Skip to main content

​
What is a context?

A context is a security knowledge bundle the agent loads before starting an engagement. It gives the agent domain expertise: methodology, techniques, tools, and reporting guidance for a specific type of security work. Contexts are served via the rifteo-context-mcp MCP server and retrieved on demand through natural language. Unlike skills (which define a specific technique), contexts define the full engagement methodology: the phases to follow, what to test, how to validate findings, and how to report.

​
Install the MCP server

git clone https://github.com/Rifteo/context-mcp
cd context-mcp
pip install -e .
Register with all detected agents at once: 
rifteo-context install
Or register with a specific agent: 
rifteo-context install --agent claude-code
rifteo-context install --agent cursor
rifteo-context install --agent gemini-cli
Supports 15 agents: Claude Code, Cursor, Windsurf, Gemini CLI, Cline, Kiro, Codex, OpenCode, Amp, Continue, GitHub Copilot, Aider Desk, Roo Code, OpenHands, Goose.

​
Using a context

Once the MCP server is registered, ask your agent in plain language: 
list all available security contexts

get the web-app-pentest context
The agent automatically loads the right level (L1 for an overview, L2 when it needs deep methodology detail).

​
Available contexts

ContextWhat it covers
Web App PentestFull web app pentest methodology: recon, auth, injection, business logic
Cloud AuditAWS/Azure/GCP: IAM, storage exposure, networking, logging, secrets
Code AuditSource code security review: secrets, auth logic, injection sinks, crypto, dependencies
AD Pentest (Unauthenticated)Unauthenticated infra pentest with AD focus: host discovery, SMB null sessions, AS-REP roasting, Kerberoasting

​
Context anatomy

Every context lives in its own directory with a single required file: 
contexts/
└── web-app-pentest/
  └── CONTEXT.md

​
CONTEXT.md

The core of every context. It has a frontmatter block and a body structured in three levels: 
---
name: my-context
l0: One sentence describing what this context covers.
---

## L1 Overview

When to use this context and what it covers at a high level.

---

## L2 Full Methodology

Complete detailed content the agent uses during the engagement.
See CONTEXT_GUIDE.md for the full format reference including optional fields.

​
The 3-tier loading system

Each context has three levels of detail. The MCP server loads the right level based on what the agent needs, keeping token usage low.
LevelWhat it containsWhen used
L0One sentence from the l0 frontmatter fieldListings, quick discovery
L1Overview: when to use, key focus areas, high-level scopeDefault load at session start
L2Full methodology: phases, techniques, tools, commands, reportingLoaded when the agent needs deep detail

​
Context vs skill

ContextSkill
ScopeFull engagement methodologySingle technique or workflow
When loadedAt session startWhen the user’s request matches a trigger
ContentPhases, tools, reporting guidanceStep-by-step instructions, output format, rules
Exampleweb-app-pentestxss-hunter, jwt-cracker
Contexts and skills work together: a context defines the engagement methodology and references relevant skills at each phase.

​
Naming conventions

RuleGoodAvoid
Use kebab-caseweb-app-pentest, cloud-auditWebAppPentest, cloud_audit
Name by engagement type, not toolapi-security-reviewburp-scan
Keep names under 40 charactersmobile-pentestandroid-and-ios-mobile-pentest-full

​
Next step

Ready to write a context? Follow the CONTEXT_GUIDE.md in the community repo.