ContextSentry: Repository Context Firewall

AI coding agents need broad repository context to be useful, but that context is not necessarily trustworthy. A README, source comment, dependency script, or tool result can contain prompt injection, secret-access requests, exfiltration instructions, or destructive commands. Traditional agent workflows rely on the model to recognize and resist these attacks, leaving a gap between repository evidence and machine authority. ContextSentry is a local-first repository context firewall for IBM Bob. It treats repository content as data, never as instructions. A bounded scanner identifies prompt-injection phrases, secret access, external exfiltration, risky lifecycle scripts, and destructive actions. A deterministic policy engine then evaluates every lifecycle event and tool request before execution. It canonicalizes paths, protects control files, restricts commands, allows only approved MCP servers and tools, and propagates taint when suspicious content is observed. The primary users are developers, security engineers, and teams deploying coding agents in real repositories. In the dashboard, a user runs a staged attack simulation or connects the local MCP server to Bob. The agent can still read and reason over the repository, but high-impact actions pass through policy. Safe workspace reads remain available; secret paths, shell composition, unapproved tools, untrusted MCP operations, and control-plane changes are denied. Every decision is appended to an HMAC-SHA256 chained audit log with a policy version, reason code, taint state, finding IDs, and checkpoint, making the run reviewable and tamper-evident. The project is differentiated by enforcing the trust boundary outside the model while preserving a useful developer workflow. It demonstrates the complete loop: detect untrusted context, constrain the action, record the evidence, and export a replayable report. The included poisoned and safe fixtures provide a reproducible benchmark: all five seeded attack signals are detected and the safe control fixture produces zero findings. The system runs locally without external AI APIs, making it portable and suitable for security-conscious teams. Demo: https://ibm-bob-contextsentry.onrender.com Repository: https://github.com/Weejay13/IBM-Bob-ContextSentry