Model Context Protocol
One MCP endpoint in front of your company, with a person behind every call
A registry tells an agent which servers exist. It does not decide whether this particular person's agent should be reading this particular record, and it has nothing to say afterwards about what happened. Contextely sits where that decision belongs: one endpoint, one identity per key, one log.
{
"mcpServers": {
"contextely": {
"url": "https://www.contextely.com/api/mcp",
"headers": { "Authorization": "Bearer ctx_sk_..." }
}
}
}Both directions
A server to your agents, a client to your systems
Most things in this space are one or the other. Being both is what lets a memory carry the address of the record it came from and then go back for it, and it is what puts your systems' own tools behind the same permission check as everything else.
Your agents connect here. 9 tools over Streamable HTTP, JSON-RPC 2.0, authenticated with a key that resolves to one person. The same catalogue generates the REST mirror, the OpenAPI document and the CLI, so the three cannot drift apart.
context_searchSearch company contextcontext_relatedWalk to neighbouring memorycontext_expandFetch the full record behind a memorymemory_getGet one memory objectsources_listList connected systems of recordworkspace_usageCheck plan and remaining quotaactions_listList the actions this workspace has enabledaction_previewPreview an action before invoking itaction_invokeInvoke an action
Contextely connects outward to your servers. A source is an endpoint plus the names of a list tool and a fetch tool, which is configuration rather than an integration somebody has to build for your logo.
It reads records to condense them, goes back to the original when a memory passes its freshness TTL, and discovers every other tool the server exposes so those become governed write actions rather than an open channel.
Saving a source lists one record and reads that same record back, asserting the reference returned is the one requested. A fetch tool called with the wrong argument name usually ignores it and returns its first record, which passes a naive check and then overwrites every memory in the source with identical content.
The rules the door keeps
Six invariants, each one asserted by a test that reads the source
These are not descriptions of intent. The tenancy, ordering and scoring guards read the implementation files as text and fail the build if the shape changes underneath them.
A key is a person, not a workspace
An agent holding a key sees exactly what that member sees. The failure where a deployed bot has broader access than whoever deployed it cannot happen here by construction.
Entitlement is inside the ranking
Not a filter afterwards. An object the asker may not see is multiplied by zero and leaves with the irrelevant ones, so no synthesis step ever receives it and there is nothing to redact.
Scoring runs before any source is touched
An asker without the scope never causes their company's database to be read on their behalf. A design that filters afterwards leaves that timing side channel open.
Absent and forbidden answer identically
Both return not_found. Answering forbidden would confirm the object exists, which is itself a disclosure, so malformed ids are rejected before they can 500 and become distinguishable from a miss.
Approval is not in the tool list
Discovering, approving and rejecting are deliberately not tools. An agent holding a key must never be able to find its own approval bypass among the things it is allowed to call.
Every refusal is a row
The log row is claimed before anything can say no, so a refused invocation is logged with the same certainty as a successful one, and the meter is charged last so refusing costs nothing.
What this is not
Three things worth knowing before you sign up
A page that only lists strengths tells you nothing, because every page lists strengths. These are the limits as they stand today.
It is not a general-purpose MCP proxy
A gateway presents the union of every upstream server's tools under their own names and routes calls through. Contextely exposes its own tool catalogue, reads through two named tools per source, and surfaces the rest as governed write actions. If you want transparent tool aggregation for reads, that is a different product and you should buy that one.
Retrieval is term overlap, not embeddings
Ranking is a deterministic term-overlap score, chosen so the whole thing self-hosts with no vector service and so a ranking can be explained rather than guessed at. The tradeoff is real: ask about a project by a name the memory does not use and the match will be weaker than a semantic system would give you.
One connector preset is verified
Postgres. Everything else in the catalogue is marked unverified until a person has watched it list a record, read that same record back and seen an object expire and re-fetch against the real service. The site will not name a system as connectable before that happens.
The current connector list is at /integrations, and it is generated from the same file the product reads, so it cannot flatter itself.
Point one agent at it and see what it is allowed to see
The free tier connects one real system of record and runs 500 retrievals a month, which is enough to watch an entitlement refusal happen and read the row it wrote. Or run the whole thing on your own hardware with no limits and no phone-home.
Machine-readable summary of this site: https://www.contextely.com/llms.txt