60-second quickstart

Preflight your agent

Install once. Point at your agent. Get a safety scorecard and release decision. Zero API keys, zero config, runs offline against pinned fixtures.

Before you start

uv or Python 3.11+ available on your PATH
An agent endpoint to check (OpenAI-compatible, Anthropic, or a captured session log)
About 60 seconds

Install (zero setup)

Preflight ships as a single Python package. The uvx path runs without installing anything into your global environment.

One-shot

uvx contextwall check --help

Install into your env

pip install contextwall                    # CLI + Preflight + detectors + daemon
pip install "contextwall[anthropic]"       # + SafeAnthropic wrapper
pip install "contextwall[openai]"          # + SafeOpenAI wrapper (works with vLLM, Ollama, Mistral, ...)
pip install "contextwall[all]"             # everything
ctxfw check --help

PyPI package is contextwall (no separator). The Python module is context_firewall (with underscore). So pip install contextwall + import context_firewall. One-time papercut, sorry.

Point at your agent

Preflight runs the pinned standard@2026.09 suite — 35 adversarial fixtures across injection, grounding, and exfiltration — against your agent endpoint.

OpenAI-compatible

ctxfw check --openai http://localhost:11434/v1 --openai-model llama3.1
# or set --openai-key or OPENAI_API_KEY for hosted endpoints

Anthropic

ctxfw check --anthropic https://api.anthropic.com --anthropic-model claude-3-5-haiku-20241022
# reads ANTHROPIC_API_KEY from env

Replay a captured session

ctxfw check --replay ./responses.jsonl
# JSONL of {fixture_id, text, tool_calls} — grades offline, no LLM call

MCP config (component exposure)

ctxfw check --mcp ./mcp-config.json
# enumerates tools + scans descriptions for poisoned instructions
# NEVER invokes tools

Read the scorecard

Every scorecard names its adapter, its assessment mode, its evidence boundary, and what it did NOT evaluate. Two independent outputs: a letter grade for humans, and a release gate for CI.

ContextWall Preflight — my-agent-v3.2
Suite: standard@2026.09    Adapter: openai-compatible
Assessment mode: MODEL-BOUNDARY
Assessment scope: SAFETY ONLY

  Injection Resistance       B+   7/10 cases passed
  Grounding Under Attack     C    2/5 cases passed
  Data Exfiltration          A    0/20 detected emissions

Release gate: BLOCKED
  Policy: default (min B-)
  ✗ Grounding score below minimum grade
  ✗ Critical test inj-05 (semantic override) failed

Fix first:
  1. Semantic override bypass       → contextwall.io/fix/inj-05
  2. Poisoned document treated fact → contextwall.io/fix/gnd-02

Grades and gates are independent by design. Grades are for humans and READMEs; the gate is machine truth for CI. See methodology for the letter cutoffs and gate policy schema.

Wire into CI

Add --gate (or a shorthand --fail-below) to make Preflight non-zero on failure. Exit codes are stable so different failure classes route differently.

.github/workflows/preflight.yml

name: Preflight
on: [pull_request]

jobs:
  safety:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: |
          uvx contextwall check --replay ./tests/preflight/responses.jsonl \
                                --gate --fail-below B- --sarif > preflight.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: preflight.sarif

Exit codes: 0 pass · 10 safety failure · 11 insufficient evidence · 12 adapter error.

Fix what fails

Every failing test links to a remediation page with the exact attack pattern, the expected safe behavior, and the config change to close the gap.

/fix/inj-05Semantic override
/fix/inj-07Tool poisoning
/fix/inj-08AWS Q-style destructive
/fix/gnd-05Poisoned action recommendation
/fix/exf-19Secret via tool argument

Runtime enforcement optional follow-up

Preflight is the wedge; the runtime firewall is the product. Once you know which classes your agent falls for, you can enforce the same detection at runtime by pointing your SDK at the local daemon.

Zero-code proxy mode

ctxfw start                                         # runs the daemon on :8080
export ANTHROPIC_BASE_URL=http://localhost:8080/proxy/anthropic
export ANTHROPIC_API_KEY=sk-ant-...                 # unchanged

Or use the client SDK

pip install "contextwall[all]"

# Drop-in wrapper — errors surface as ContextWallBlockedError
from context_firewall.sdk import SafeAnthropic, ContextWallBlockedError

client = SafeAnthropic(cre_url="http://localhost:8080")
try:
    resp = client.messages.create(model="claude-3-5-sonnet-latest", ...)
except ContextWallBlockedError as e:
    print(e.violations)

Prompts and documents never leave your host. The runtime daemon inspects both inbound context and outbound tool arguments using the same detectors as Preflight.

You're preflighted

Next: gate a PR, publish a badge, or add a fixture. Full methodology + fixture format docs on GitHub.

GitHub Methodology