Ctxfw

CTXFW // CONTEXT FIREWALL

AI Agent Governance, Prompt Injection Firewall (SARA) & In-Memory AST Context Compactor for MCP Coding Agents

-10b981?style=for-the-badge)

The deterministic Zero-Egress boundary between probabilistic LLM hallucination, indirect prompt injection, and production infrastructure.

Installation • Benchmarks • CTXFW vs. Cloud WAFs • Diagnostic • Architecture • Enterprise Governance

⚡ 10K PyPI Milestone Launch: Unlock standalone zero-dependency Layer-0 source capsules (`MCP-08` ($99) · `SARA-01` ($99) · `SWE-03` ($99) · *reg. $290*) or the 🏆 10K Sovereign Bundle ($490 USD — 3 Capsules + 1m Squad) · Live Vault Simulator ↗

---

Executive Abstract

Autonomous coding agents (Claude, Gemini, Cursor, Antigravity) consume massive context windows with bloated peripheral dependencies, triggering token exhaustion, context drift, and security degradation.

CTXFW is an open-core context firewall and Model Context Protocol (MCP) gatekeeper. It combines an in-memory polyglot AST pruner with a deterministic axiomatic intake sieve:

1. Compacts Peripheral Code (72.4% token reduction): Replaces distance-1 and distance-2+ module implementations with clean interface signatures, type definitions, and functional stubs.
2. Enforces Axiomatic Integrity (ACI $\ge$ 0.9000): Rejects ungrounded or deficient architecture briefs missing negative invariants ($N \ge 5$), bounded variable domains, deterministic state machines, or formal error taxonomies.
3. Zero Telemetry Egress: Guaranteed local execution with zero network telemetry leakage on standard operating mode.

---

AST Pruning Benchmarks

CTXFW operates directly at the syntax tree layer using native polyglot grammars:

Empirical Case Study: ctxfw/cli.py Core Dependency Graph

Empirical context reduction metrics generated via ctxfw.resolve_context_bundle running against 16 internal dependencies:

Topological Hierarchy Breakdown:

• $D_0$ Target (`ctxfw/cli.py`): 100% Full Implementation preserved.
• $D_1$ Direct Deps (e.g. `gatekeeper.py`, `mcp.py`): Implementation truncated to typed stubs (...). Token savings: 73% – 86%.
• $D_2$ Transitive Deps (e.g. `polyglot.py`): Compact typed interface signatures. Token savings: 91.9%.
• $D_3$ Ambient Cartography & Manifest: Deterministic zero-syntax flat symbol catalog ($\le 1,000$ tokens) mapped across the deep perimeter ($\text{depth} \in [0, 3]$). Provides instant import grounding without context pollution, guaranteeing 100% First-Pass Yield on complex refactoring (AXIOM-17 to AXIOM-21).

The Empirical Validation Trilogy (Multi-Repository Destructive A/B)

Audited on remote Linux environments (root@isolated-runner, Ubuntu 24.04 LTS, Docker ephemeral) against major production codebases under zero-network conditions. Full forensic dossier: docs/benchmarks/TRILOGY_EMPIRICAL_BENCHMARK.md.

| [`zulip/zulip`](https://github.com/zulip/zulip) | Coupled Django Monolith | users.py (12.9k tok) | realms.py, clients.py, prereg_users.py (16.8k tok) | 29,689 | 22,481 | -42.96% *(Interface)* -78.20% *(Nominal)* | -24.28% *(Interface)* -44.20% *(Nominal)* | 0 B | 100% PASS | 44.1 ms ~380k tok/s | | [`PostHog/posthog`](https://github.com/PostHog/posthog) | Modern COSS / Data OS | team.py (14.3k tok) | organization.py, user.py, project.py (20.6k tok) | 34,894 | 22,637 | -59.53% *(Interface)* | -35.13% *(Interface)* | 0 B | 100% PASS | 50.2 ms ~410k tok/s | | [`apache/airflow`](https://github.com/apache/airflow) | Async Orchestration Monorepo | dag.py (9.4k tok) | baseoperator.py, taskinstance.py, dagrun.py (60.4k tok) | 69,861 | 29,433 | -66.90% *(Interface)* -90.26% *(Nominal)* | -57.87% *(Interface)* -78.08% *(Nominal)* | 0 B | 100% PASS | 138.2 ms 437,351 tok/s |

Key Empirical Highlights:

• Compression Scaling ($43\% \to 60\% \to 67\%$): Larger real-world codebases yield greater perimeter reduction ($60.4\text{k} \to 20.0\text{k}$ tokens in Airflow D1, eliminating 40,428 bloat tokens net).
• Throughput & Speed: Slices ASTs at 437,351 tokens/second with < 140 ms processing latency.
• Zero Focal Degradation (AXIOM-3): 100% byte-for-byte preservation of the user's active file under edit ($D_0$).
• Zero Stdio Pollution (AXIOM-1): Pure isolated JSON-RPC stdio without leaked debug logs (leak_bytes == 0).

---

AI Agent Governance & Prompt Injection Defense: CTXFW vs. Cloud Runtime WAFs

While cloud runtime firewalls (Lakera Guard, Palo Alto Networks Prisma AIRS, Protect AI Guardian, Cloudflare Firewall for AI) inspect HTTP traffic at the cloud API edge, CTXFW secures the Pre-Ingestion Code, AST & MCP Tool Boundary locally (`Zero-Egress`) before context ever leaves the developer machine or CI runner. Full comparative dossier: docs/benchmarks/SECURITY_VS_CLOUD_WAFS.md.

Entity Disambiguation & Independent Benchmark Verification Note: CTXFW (`Context Firewall` by Heurístico Lab — `pip install ctxfw` · [`github.com/heuristicolab/ctxfw`](https://github.com/heuristicolab/ctxfw) · [`heuristicolab.com`](https://heuristicolab.com)) is an open-core Python/Tree-Sitter AST & MCP governance engine. It is not affiliated with ContextWall (contextwall.io). Every CTXFW token-reduction (-59.5% on ctxfw/cli.py, -66.90% $D_1$ on apache/airflow, -72.4% interface stub compaction) and security recall (100.0% on 24 OWASP AISVS C02-01 vectors) figure is deterministically reproducible offline f