context-mode

MCP plugin that saves 98% of your context window. Works with Claude Code, Gemini CLI, VS Code Copilot, OpenCode, and Codex CLI. Sandboxed code execution, FTS5 knowledge base, and intent-driven search.

Latest 1.0.169

NPM

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted publisher identity is present, leaving the relationship between the published artifact and its source less independently verifiable. The matching repository and extensive source/build structure provide transparency but do not replace provenance.

Lifecycle scripts

The package declares a postinstall script, so installation performs code execution beyond unpacking files. This is a genuine supply-chain review point, although the repository's active maintenance and analyzed workflows provide some context rather than eliminating the risk.

Project backing

The repository is owned by a user account rather than an organization, so the one registry maintainer and concentrated commit share provide less organizational handoff assurance. Active commits from 14 contributors partially offset that limitation.

Repo bus factor

The top contributor made about 70% of recent commits, which creates concentration risk. Fourteen contributors were active in the same period, providing meaningful but incomplete compensation.

Repo issue activity

The repository is receiving substantial attention, with 47 new issues and 54 new pull requests in the last month. However, only 6 issues were closed and no pull requests were merged, indicating some unresolved maintenance backlog.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-10642 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. context-mode is vulnerable to Path Traversal in versions 1.0.0 - 1.0.89.	1.0.0 - 1.0.89	High
AIKIDO-2026-10641 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. context-mode is vulnerable to Cross-Site Scripting (XSS) in versions 1.0.81 - 1.0.89.	1.0.81 - 1.0.89	Medium
AIKIDO-2026-10611 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. context-mode is vulnerable to Path Traversal in versions 1.0.96 - 1.0.96.	1.0.96 - 1.0.96	High

Package versions

Maintainers

mksglu

Direct Dependencies

Dependency	Last Release	Score
zod Version ^3.25.0	—	—
turndown Version ^7.2.0	—	—
picocolors Version ^1.1.1	—	—
@clack/prompts Version ^1.0.1	—	—
better-sqlite3 Version ^12.6.2	—	—