Source-cited context packs for AI coding agents
ContextAtlas installs as a skill for your coding agent, then turns a plain-English question into compact, current evidence from trusted docs, source, tests, examples, changelogs, repository examples, and API references. Every snippet is cited, freshness-aware, and scanned so third-party text stays evidence instead of becoming instructions.
Basic setup
Setup auto detects Codex, Claude Code, Cursor, Windsurf, Gemini CLI, GitHub Copilot CLI, Cline, Roo Code, Kilo Code, Continue, Zed, OpenCode, Amp, Antigravity, Universal skills, and Generic MCP.
npx contextatlasdev setupPublic catalog packs work from the hosted API.
Self-serve setup never writes secrets into committable config.
Enterprise can point the same skill at a private deployment.
The problem
Fast-moving libraries outrun training data. Your agent suggests a deprecated call, a renamed option, or a removed API, then you find out only after the edit breaks.
Public APIs want docs. Setup wants examples. Edge cases live in tests. Migrations live in changelogs. Repeated searching flattens those roles into noise and burns the same context tokens your agent needs for the actual fix.
Agents read third-party docs with file, terminal, and network tools nearby. Retrieved text should arrive framed as evidence, not as commands to obey.
How it works
Four deterministic stages turn a vague question into context an agent can use and a human can verify.
Map the question to the right library, ecosystem, and version using names, aliases, packages, and version clues from the project.
Pull from curated source roles with role-aware ranking and deliberate diversity.
Attach citations and freshness signals, flag conflicts, and check whether the pack can answer the question.
Scan third-party text for prompt-injection patterns and return it with provenance.
One API, many agents
The hosted API returns compact public-catalog packs with citations, freshness, conflicts, answerability, and prompt-injection scan signals in the same response.
# one call, source-backed answer
curl https://api.contextatlas.dev/v1/context-pack \
-H "Authorization: Bearer ca-demo_not-a-real-key" \
-d '{ "query": "FastAPI lifespan cleanup", "profile": "standard" }'
# returns answerability, citations, warnings, and billable statusThe difference
EVIDENCE NOT INSTRUCTIONS
ContextAtlas assumes retrieved docs, examples, comments, and tests can be stale, wrong, or adversarial. Packs carry provenance, citation checks, freshness/conflict warnings, and prompt-injection scan signals before your agent uses them.
Account, tenant, session, usage, billing, support, and audit routes are scoped by tenant membership and role checks.
API keys are hashed server side, displayed once at creation, and never stored in browser local storage by the account shell.
Browser telemetry is disabled in the web shell. Raw query text is not allowed in browser analytics or route registry telemetry fields.
Hosted public evidence fails closed unless source-rights review, publication, takedown, cache, and attribution checks allow serving.
Security reports route through the contact form or security sender and are handled without attachments until scanning policy is approved.
Compliance evidence, customer review packets, and formal assessments are roadmap items. This page does not claim completed certification.
ContextAtlas catalog curation and context-pack design are shaped by prompt-injection research. Supply-chain incidents such as Shai-Hulud are one reason source text is treated as hostile evidence: cited, scanned, bounded, and never agent instructions.
This is risk reduction, not a replacement for dependency scanning, sandboxing, credential hygiene, code review, incident response, or a public status process.