> ## Documentation Index > Fetch the complete documentation index at: https://docs.kontext.security/llms.txt > Use this file to discover all available pages before exploring further. # Detection > How endpoint detectors flag tool calls and the hosted AI assessment reviews them. export const RiskPipeline = () =>
On the endpoint Tool call Policy decision Advisory predictions Kestrel checks shell commands Merlin does the call fit the request? Additional shell check optional second check of shell commands Kontext records predictions beside the decision. They do not change it. Workspace Flagged for review Evidence bundle request, command, tool history, policy decision and outcome queued AI assessment Risk page finding risk present or likely benign, severity, categories, explanation if risk present Slack alert when risk alerts are on
; Endpoint detectors score tool calls after the policy decision and flag calls for review. A hosted AI assessment in your workspace reviews each flagged call. The Risk page shows its severity, category, and explanation. Detectors and the assessment read the final decision and record advisory results beside it. Only a [policy](/policies/overview) can block a call. ## Detectors on the endpoint | Detector | What it checks | Default | | ---------------------- | --------------------------------------------------------------------------------- | --------------------- | | Kestrel | Shell commands, one at a time | On for every endpoint | | Merlin | Whether a short tool call follows from the user's request and recent tool history | On for every endpoint | | Additional shell check | Shell commands, with a small local language model | Off | ### Kestrel Kestrel is a shell command classifier built into the Kontext CLI. It scores every shell command on the endpoint, including calls a policy denied. Kestrel needs no setup or download. Kestrel reads the command without the task context. Because agents run `rm -rf` often, Kestrel can miss destructive forms such as `rm -rf /` or `dd` onto a disk. ### Merlin Merlin scores short tool calls that are not file operations, using the user's request and the recent tool history. It looks for calls that do not fit the user's request. Instructions hidden in a page or file can cause this behavior. Merlin skips file tools such as `Read`, `Write`, `Edit`, and `apply_patch`, and it skips calls whose request or arguments are too long for the model. A skipped call has no Merlin result. When Merlin flags a call, it keeps a short redacted copy of the request and tool history so the AI assessment can see the same context. ### Additional shell check The additional shell check uses Qwen3-0.6B, a small local language model served by `llama-server`. It flags destructive shell commands that Kestrel can miss. It also flags more ordinary commands. To run the additional shell check: 1. On a self-serve endpoint, install the runtime with `brew install llama.cpp`. Then run `kontext setup --with-local-llm` and provide your API key when prompted. Setup downloads about 680 MB of model weights. MDM-managed endpoints do not include `llama-server` and run without this check. 2. Open the endpoint from [Home](/home/overview) and turn on **Guardrail LLM** in its drawer. Turn it off there to stop the check without making changes on the endpoint. ## When detectors flag a call Kontext flags a call for review when any of these is true: * Kestrel rates the command risky. * Merlin rates the call unsafe. * The additional shell check rates the command risky. * The call's risk score, shown in **Detection details**, is at or near its threshold. Flagged calls make up the **flagged for review** count on the Risk page. A call flagged by more than one detector counts once. ## The AI assessment Kontext queues each flagged call for an AI assessment in your workspace. The assessment uses a hosted OpenAI model and receives: * the tool name and the credential-redacted command and arguments * the user's request and recent tool results, when Merlin kept them * the policy decision, its reason, and the mode it ran in * the reported outcome and any error * up to 20 earlier tool calls from the same session Review this list against your data policies before you deploy Kontext. Your [data collection](/deploy/data-collection) settings control input and output payload capture. With **Omitted**, endpoints send size-only input and output payload records. They still send redacted command and request summaries. For calls Merlin flags, they also send redacted user-request and tool-history context. The assessment treats the detector's flag as a weak hint and evaluates the evidence independently. It uses the user request and tool results as context without following instructions in them. It returns: | Field | Values | | ----------------- | --------------------------------------------------------------------------------------------- | | Assessment | Risk present, or likely benign. The dashboard shows likely benign as **No risk found**. | | Severity | **Low**, **Medium**, **High**, or **Critical**. Empty when likely benign. | | Categories | One primary and up to two secondary [categories](/risk/categories). Empty when likely benign. | | Evidence strength | Weak, moderate, or strong. This rates how directly the evidence supports the conclusion. | | Explanation | One or two sentences for a security reviewer | When important evidence is missing, the assessment reports risk present with weak evidence and says what is missing. If Merlin's evidence arrives later, Kontext assesses the call again. Risk shows the newer result. ## Where results appear Open a tool call from Risk and select the **Risk** tab to see **AI assessment** and **Detection details**. From Explore, the tab shows **Detection details** only. These details show what Kestrel, Merlin and the **Additional shell check** returned, or why a detector has no result for the call. Kontext pauses AI assessments when a workspace on the Free plan reaches its monthly transaction limit. Detectors keep flagging calls. Calls flagged during the pause receive no assessment and stay **Not rated yet**.