LeanCTX sits between the agent and your repository
LeanCTX combines several context-management jobs in one Rust binary. Its MCP server supplies file reads, search, memory, graph queries, shell execution, handoffs, and recovery tools. Shell hooks compress familiar command output. An optional local proxy can rewrite full requests before they reach OpenAI, Anthropic, or Gemini, while a browser dashboard tracks context use and cost.
The project says eligible content can use 50 to 80 percent fewer tokens and that cached rereads can cost about 13 tokens. Those are LeanCTX's published figures, not results from our sandbox. Its design is more important than the headline percentage: compressed material moves to a content-addressed store, and the model receives handles that can retrieve original bytes through several paths.
That recovery contract is the feature to test first. Context reduction is useful only when an agent can reliably request the exact omitted code before editing or making a claim. LeanCTX offers ctx_expand, ctx_retrieve, reference URLs, and explicit read modes for that purpose. A current issue shows the contract is not dependable in every path.
Full and raw reads are not always verbatim
Issue 1543 reproduces an undocumented "triage level 2" filter in LeanCTX 3.9.19. Structured Markdown and HTML files were replaced with outline-like output even when the caller requested mode=full, mode=raw, zero aggressiveness, or a fresh read. The reporter found no documented switch that restored the original through ctx_read.
This defect cuts directly against edit safety. An agent may believe it has received full source when a structural filter has removed bodies, tables, or repeated selectors. It can retry several modes and still spend extra calls without recovering the content. Until the behavior is fixed, compare important reads with the editor's native file tool or shell and reserve LeanCTX compression for material where omission is acceptable.
The README itself shows documentation drift. One section labels the full list as 83 MCP tools, while later compatibility text and scenario copy refer to 79. Tool count is not a quality metric, but a changing surface needs generated reference material that agrees with the shipped binary.
What happened when we ran it
Our Rust sandbox installed 492 packages in 27 seconds. The project lives under ./rust/ inside a 48.9 MB checkout containing 3,589 files and roughly 755,534 lines of source. A full build succeeded in 402 seconds at commit 2a4a663.
Tests ran for 223 seconds and exited 101. The supplied log tail shows a long Rust linker invocation, says the lean-ctx library generated 3 warnings, and ends with warning: build failed, waiting for other jobs to finish. It does not include the original error or a test summary, so we cannot identify what failed or how many tests ran.
The repository has 14 CI workflow files and a tests directory, which is better evidence of intended coverage than a token-saving GIF. Our failed run still blocks a clean bill of health. Source adopters should capture the complete first error on their platform rather than guessing from the truncated tail.
Plan mode does not enforce read-only behavior
Issue 1500 says ctx_shell, ctx_execute, and ctx_patch remain available when an IDE is in plan or readonly mode. According to the report, MCP interaction metadata is not used to populate the server's existing access fields, so a denial guard never fires. The issue even demonstrates an arbitrary shell command arriving with plan metadata.
That means an interface label cannot be treated as a permission boundary. LeanCTX's shell tool is powerful enough to run development commands, and scripts can write outside a project when the process account allows it. Evaluate with operating-system isolation, a disposable repository, and an MCP allowlist that omits write or shell tools. Do not assume the agent client's mode protects the host.
The project provides useful escape controls: agent-only shell activation, a raw-command bypass, a current-shell off switch, doctor --json, and an unwrap command. Those make a trial reversible. They do not repair enforcement inside a running MCP session, so policy must live outside the tool until issue 1500 closes and is verified.
Packaging and indexing need their own trial
The README advertises shell, Homebrew, npm, and Cargo installation. Open issue 1508 reports that cargo install lean-ctx is broken for every version from 3.9.14 through current release 3.9.19. The report identifies stale published helper crates and capability manifests referenced outside the packaged crate. Prefer a prebuilt route only after verifying its provenance, or wait for a fresh-install CI fix.
Large trees have another reported failure. Issue 1494 describes a roughly 7,300-file, 211 MB repository where initial indexing completed file I/O and then spun CPU without returning. An undocumented LEAN_CTX_NO_INDEX=1 switch allowed calls to proceed but removed graph edges. Our checkout had 3,589 files, so our successful 402-second build does not test that runtime case.
LeanCTX is most interesting when a coding agent repeatedly burns context on the same large codebase. It is also least safe to adopt casually because it can read, compress, remember, proxy, and execute. Repomix is a smaller choice for preparing a static repository bundle; Serena is a narrower route to symbol-aware MCP navigation. LeanCTX deserves a controlled trial after its current safety and packaging bugs are fixed, with savings measured against your own accepted work rather than its headline percentage.