Skip to main content
Kontext posts a Slack alert when the AI assessment rates a flagged tool call as risky. Your team can open Risk from the alert to investigate.

​
Set up alerts

You need an admin role in the Kontext workspace.
  1. Open Settings → Notifications.
  2. Under Slack risk alerts, select Connect Slack and approve the connection in Slack.
  3. Choose an Alert channel.
  4. Turn on Send confirmed risk findings.
You can only turn alerts on after you choose a channel. If your deployment has no Slack connection configured, the card says so. Choose a channel whose members have permission to see the evidence. The redacted request can still name repositories, hosts, and resources.

​
What gets sent

Kontext sends an alert when both of these are true:
  • Kestrel, Merlin, or the additional shell check flagged the call. See detection.
  • The AI assessment rated the call risky.
Kontext sends alerts for every severity, from Low to Critical. It skips likely benign calls and calls flagged only by their risk score. Blocked calls also trigger alerts because the assessment rates the requested action. Kontext sends one alert per call per assessment. If Merlin’s evidence arrives later, Kontext reassesses the call and may send a second alert.

​
What the message contains

The alert heading names the severity and primary category, for example “High risk finding · External service or resource change”. Kontext includes these fields below the heading: The Open Risk in Kontext link opens the Risk page. Find the call in Flagged tool calls and follow the steps in investigate a finding.

​
When alerts pause

Kontext pauses AI assessments and Slack alerts for the rest of the billing cycle when a Free workspace reaches its monthly transaction limit. The channel receives one “Kontext risk alerts paused” message with the date alerts resume. You can also resume alerts by upgrading. Policies keep running on your endpoints during the pause.

​
If no alert arrives

  • Check that the call appears in Flagged tool calls on the Risk page.
  • Check its Severity column. Pending means the assessment has not finished. No risk means Kontext sends no alert for the call.
  • Check that Send confirmed risk findings is on and an Alert channel is set.
  • Check that the Kontext Slack app can post to that channel.
To stop alerts, turn off Send confirmed risk findings. To remove the connection, select Disconnect Slack. Neither changes your policies.