Check text before it reaches the agent.

Enable filters in a policy pack

These filters are off unless an active policy pack enables them. They run on supported MCP result text before the archive/compression step. They inspect the result text at that stage, not necessarily every byte of an original source.

An example project policy at .lean-ctx/policy.toml:

name = "project-context"
version = "1.0.0"
description = "Check supported context text before delivery"

[filters]
pii = "redact"
classification = "block"
injection = "warn"
blocked_labels = ["CONFIDENTIAL", "SECRET"]

Validate and inspect it from the project root:

lean-ctx policy validate
lean-ctx policy show

Test the effective policy with a non-sensitive fixture through the same tool path your agent uses. Merely placing a configuration fragment in another file does not demonstrate active enforcement.

Choose the response

Action	Result
off	Detector does not run
warn	Text can pass through with a warning
redact	Detected spans are replaced before delivery
block	The result is replaced with a refusal

Classification is a whole-content gate: classification redact is treated as block. Checks run in classification → injection → PII order; a block stops subsequent processing.

Understand the detectors

PII checks include email, payment cards, IBAN and Swiss AHV patterns, with checksum validation where implemented. Classification checks look for configured markings. Injection detection recognizes known patterns; it cannot establish that arbitrary content is safe.

Custom policy [redaction] patterns are a separate mechanism for text substitutions. Secret detection also has its own configuration.

Read the evidence correctly

Filter outcome metadata contains category/count pairs rather than the sensitive matched values. The persisted policy audit path does not guarantee that all those pairs are retained for every outcome. Inspect the actual event fields your workflow consumes.

A warning means content may still reach the agent. A clean result means no configured detector fired, not that a full security review passed.

Coverage has a boundary

The reviewed MCP pipeline returns image/binary blocks before these text post-processors. It does not establish equivalent filtering for every SDK call, proxy request or native host operation.

Validate each integration separately, including raw reads, error paths and recovery. For filesystem scope and shell controls, see security.

Sources & versions6 references · Reviewed 17 Sept 2026

• mod.rsrust/src/core/input_filters/mod.rsGitHub
• pii.rsrust/src/core/input_filters/pii.rsReviewed checkout
• mod.rsrust/src/core/policy/mod.rsGitHub
• policy_cmd.rsrust/src/cli/policy_cmd.rsGitHub
• pipeline.rsrust/src/server/call_tool/pipeline.rsReviewed checkout
• policy_guard.rsrust/src/server/policy_guard.rsGitHub

Core checkout

0ce2207ee4

Installed runtime

3.10.2

SDK release

1.1.0

Separate baselines for source, CLI/configuration and SDK contracts. Review does not certify every platform or integration.

Versions & compatibility