Model Context Protocol
One MCP endpoint in front of your company, with a person behind every call
A registry tells an agent which servers exist. It does not decide whether this person's agent should be reading this record, and has nothing to say afterwards about what happened.
{
"mcpServers": {
"contextely": {
"url": "https://www.contextely.com/api/mcp",
"headers": { "Authorization": "Bearer ctx_sk_..." }
}
}
}Both directions
A server to your agents, a client to your systems
Most things here are one or the other. Being both is what lets a memory carry the address of its record and go back for it.
Your agents connect here. 18 tools over Streamable HTTP, on a key that resolves to one person. The same catalogue generates the REST mirror, the OpenAPI document and the CLI.
context_searchSearch company contextcontext_relatedWalk to neighbouring memorycontext_expandFetch the full record behind a memorymemory_getGet one memory objectsources_listList connected systems of recordmemory_addStore something worth rememberingsource_tools_listList the source tools you may call directlysource_tool_callCall one source tool directlyworkspace_usageCheck plan and remaining quotaactions_listList the actions this workspace has enabledaction_previewPreview an action before invoking itaction_invokeInvoke an actiongraph_searchFollow the relationships around an answergraph_neighboursWhat is connected to thismemory_historyWhat this used to saymemory_forgetRemove a memory, or just its relationshipssession_recordSay what you just did, so the memory can learn from itsession_feedbackSay whether an answer was any good
Contextely connects outward. A source is an endpoint plus the names of a list tool and a fetch tool, which is configuration rather than an integration built for your logo.
It discovers every other tool the server exposes, and an administrator turns those on one at a time rather than as an open channel.
Saving a source reads one record back and asserts the reference returned is the one requested. A fetch tool called with the wrong argument name returns its first record instead, which passes a naive check.
Two ways in
Ranked memory, and a narrower live door beside it
Both go through the same key, the same person and the same log. They do not carry the same guarantee.
| Condensed memory | Passthrough read | |
|---|---|---|
| What comes back | Condensed memory objects, each with a citation, a freshness label and a score. | The system's own answer, exactly as it gave it. |
| Where entitlement applies | Inside the ranking, per object. Anything the asker may not see is multiplied by zero. | On the call. Contextely decides whether it happens, not what is inside the reply. |
| What is exposed by default | The sources an administrator connected, scoped as they scoped them. | Nothing. Each tool is enabled by hand, with the scope it requires. |
| What is written down | Every retrieval, including how many candidates were refused on entitlement grounds. | Every call and every refusal, in a separate log, with the size of what left the building. |
| When to reach for it | Almost always. It is cheaper, it is ranked, and it is the stronger guarantee. | When you need something live and specific that condensed memory does not hold. |
The rules the door keeps
Six invariants, each asserted by a test that reads the source
Not descriptions of intent. The guards read the implementation files as text and fail the build if the shape changes underneath them.
A key is a person, not a workspace
An agent holding a key sees exactly what that member sees, never more than whoever deployed it.
Entitlement is inside the ranking
Not a filter afterwards. An object the asker may not see is multiplied by zero, so nothing downstream receives it.
Scoring runs before any source is touched
An asker without the scope never causes their company's database to be read on their behalf. Filtering afterwards leaves that timing side channel open.
Absent and forbidden answer identically
Both return not_found. Answering forbidden would confirm the object exists, so a malformed id is rejected before it can 500 and become distinguishable.
Approval is not in the tool list
Discovering, approving and rejecting are deliberately not tools. An agent must never find its own approval bypass in its own tool list.
Every refusal is a row
The log row is claimed before anything can say no, so a refusal is logged as certainly as a success. Charging is last, so refusing is free.
When a server goes quiet
Every connected server is checked, and you hear about it once
A server that stopped answering looks exactly like one that is fine. Contextely probes each one on a schedule, records the latency, and tells your admins on the second consecutive failure.
A dead sign-in is its own state
A refused refresh is not a timeout. It needs a person, so it is announced at once and the Reconnect button appears beside it.
Expiry only where it is real
A token backed by a refresh token renews itself, and warning about that weekly is how a person learns to filter you. Only deadlines nothing can renew are announced.
Your memory keeps its age
While a source is down its memory is still served and still labelled with how old it is. What stops is the refresh, not the answer.
What is checked, and exactly which conditions send mail, is on /mcp-health.
What this is not
Four things worth knowing before you sign up
A page that only lists strengths tells you nothing. These are the limits as they stand today.
It is not a transparent MCP proxy
A gateway exposes upstream tools under their own names the moment you point it at a server. Here a tool is reachable only once an administrator enables it and names the scope it requires. That is more setup, and it is the point.
A passthrough answer is not ranked
On a live tool call, entitlement gates whether the call happens rather than scoring what comes back. Contextely logs it either way, but the reply is exactly as that system gave it, and the agent is told so on every reply.
Retrieval is term overlap by default
A deterministic score, so it self-hosts with no vector service and a ranking can be explained. Ask by a name the memory does not use and the match is weaker. Name an embedding model for hybrid ranking instead; nothing is installed by default.
Two connector presets are verified
Postgres and GitHub. Everything else stays unverified until somebody has watched it list a record, read that record back, and let an object expire and re-fetch against the real service.
The current connector list is at /integrations, generated from the same file the product reads, so it cannot flatter itself.
Point one agent at it and see what it is allowed to see
The free tier connects one real system and runs 500 retrievals a month. Enough to watch an entitlement refusal happen and read the row it wrote.
Machine-readable summary of this site: https://www.contextely.com/llms.txt