Skip to main content
Endpoint detectors score tool calls after the policy decision and flag calls for review. A hosted AI assessment in your workspace reviews each flagged call. The Risk page shows its severity, category, and explanation. Detectors and the assessment read the final decision and record advisory results beside it. Only a policy can block a call.

Detectors on the endpoint flag candidates. The hosted AI assessment reviews flagged calls afterwards, with more context.

​
Detectors on the endpoint

​
Kestrel

Kestrel is a shell command classifier built into the Kontext CLI. It scores every shell command on the endpoint, including calls a policy denied. Kestrel needs no setup or download. Kestrel reads the command without the task context. Because agents run rm -rf often, Kestrel can miss destructive forms such as rm -rf / or dd onto a disk.

​
Merlin

Merlin scores short tool calls that are not file operations, using the user’s request and the recent tool history. It looks for calls that do not fit the user’s request. Instructions hidden in a page or file can cause this behavior. Merlin skips file tools such as Read, Write, Edit, and apply_patch, and it skips calls whose request or arguments are too long for the model. A skipped call has no Merlin result. When Merlin flags a call, it keeps a short redacted copy of the request and tool history so the AI assessment can see the same context.

​
Additional shell check

The additional shell check uses Qwen3-0.6B, a small local language model served by llama-server. It flags destructive shell commands that Kestrel can miss. It also flags more ordinary commands. To run the additional shell check:
  1. On a self-serve endpoint, install the runtime with brew install llama.cpp. Then run kontext setup --with-local-llm and provide your API key when prompted. Setup downloads about 680 MB of model weights. MDM-managed endpoints do not include llama-server and run without this check.
  2. Open the endpoint from Home and turn on Guardrail LLM in its drawer. Turn it off there to stop the check without making changes on the endpoint.

​
When detectors flag a call

Kontext flags a call for review when any of these is true:
  • Kestrel rates the command risky.
  • Merlin rates the call unsafe.
  • The additional shell check rates the command risky.
  • The call’s risk score, shown in Detection details, is at or near its threshold.
Flagged calls make up the flagged for review count on the Risk page. A call flagged by more than one detector counts once.

​
The AI assessment

Kontext queues each flagged call for an AI assessment in your workspace. The assessment uses a hosted OpenAI model and receives:
  • the tool name and the credential-redacted command and arguments
  • the user’s request and recent tool results, when Merlin kept them
  • the policy decision, its reason, and the mode it ran in
  • the reported outcome and any error
  • up to 20 earlier tool calls from the same session
Review this list against your data policies before you deploy Kontext. Your data collection settings control input and output payload capture. With Omitted, endpoints send size-only input and output payload records. They still send redacted command and request summaries. For calls Merlin flags, they also send redacted user-request and tool-history context. The assessment treats the detector’s flag as a weak hint and evaluates the evidence independently. It uses the user request and tool results as context without following instructions in them. It returns: When important evidence is missing, the assessment reports risk present with weak evidence and says what is missing. If Merlin’s evidence arrives later, Kontext assesses the call again. Risk shows the newer result.

​
Where results appear

Open a tool call from Risk and select the Risk tab to see AI assessment and Detection details. From Explore, the tab shows Detection details only. These details show what Kestrel, Merlin and the Additional shell check returned, or why a detector has no result for the call. Kontext pauses AI assessments when a workspace on the Free plan reaches its monthly transaction limit. Detectors keep flagging calls. Calls flagged during the pause receive no assessment and stay Not rated yet.