Product · contextecfMCP
Stop giving AI direct database access.
Empower your agents with verifiable, policy-governed memory.
Most enterprise AI deployments face the same dilemma: giving AI access to internal systems risks data leakage and unmonitored actions, but air-gapping AI guarantees hallucinations and poor ROI.
contextecfMCP solves this with the Enterprise Context Fabric. Connect your favorite AI agents to internal knowledge through a strict, cryptographic gateway — no raw database credentials required.
A secure gateway for AI memory
A private Context Fabric runtime sits safely inside your firewall, fronted by an open-source adapter called contextecf-mcp.
For your users
They bring any AI tool they want — Claude, Dify, n8n, or Open WebUI. Nothing about their workflow changes.
For your systems
External tools only communicate via the standardized Model Context Protocol (MCP), through a single unified context_assemble tool.
The result
The AI receives a surgically precise, governed ContextPackage containing only the evidence it is authorized to see.
Built for the CISO
We treat AI as an untrusted client. The infrastructure is built on a fail-closed governance model and a strict read-before-write progression.
Zero IP leakage
Internal proprietary data — T3-classified scoring factors, learning-rate formulas, sufficiency computation internals — is stripped before context ever leaves the private Fabric.
Cryptographic provenance
Every response returned to an agent carries a verified receipt signature. A tampered receipt is rejected as a hard failure, not a warning.
Stop at recommend
The public endpoint is explicitly read-only during Phase 1. It structurally rejects any Command Capsule payload, so external agents cannot execute internal actions.
Architecture for the CTO
You do not need to rebuild your infrastructure. contextecf-mcp acts as a thin translation layer.
- 01
Ingest & govern
The private Enterprise Fabric connects internally to Jira, Gmail, ServiceNow, and source code through secure connectors.
- 02
Translate & protect
The public contextecf-mcp facade intercepts tool calls from your agents and translates them into calls against your private HTTP endpoints.
- 03
Deliver
The agent receives a schema-valid package with sufficiency_score, evidence_refs, and reason codes for any excluded_sources.
What it looks like in use
Both walkthroughs below use synthetic data. The support walkthrough mirrors the current shipped demo identifiers and values; nothing shown is a live customer system.
Exact synthetic support scenario output
SyntheticA severe support ticket needs immediate triage. The public, no-login demo requests governed context through MCP using the synthetic demo tenant.
[Synthetic Support Demo Output]> Initiating context_assemble...> tenant_id: synthetic-demo-tenant> Demo mode: no-login synthetic--------------------------------------------------RECEIPT: synthetic-receipt-supportSIGNATURE: synthetic-sha256-demo CONTEXT PACKAGE ASSEMBLED:- Sufficiency Score: 0.92- Evidence Refs: * synthetic:evidence:support-ticket-summary- Excluded Sources: * synthetic:pagerduty:private-note:exec-only > System Prompt Augmented. Generating compliant briefing...
Notice how the private PagerDuty note is excluded before the model can use it.
Developer repository context (CodeLedger)
SyntheticA developer uses an AI coding assistant. The assistant needs to know why an architecture decision was made before suggesting new code.
User: Why did we deprecate the DyadHash module in the user service? AI Assistant: Let me check the enterprise context fabric.> Calling tool: context_assemble> Fetching from CodeLedger... AI Assistant: Based on the verified context package retrieved fromCodeLedger, the DyadHash module was deprecated due to a T3-classifiedvulnerability flag raised last quarter.Verified Sources: PR #274 (merged by @sec-team) Architecture Decision Record 042
Ready to test it safely?
You don’t need to wire up live enterprise data to see the governance in action. Developers can run the synthetic local demo mode today — entirely on their own machine, zero network calls, with visibly labeled synthetic data proving the MCP contract works.
$ npx @intelligentcontext/contextecf-mcp --demo