context

ingrain context runs a semantic search against your organization’s recorded security rules. Queries are matched on meaning, not keywords, so phrase them as questions.

ingrain context security_rules <query> [--assessment <path>] [--limit N] [--json]

security_rules

ingrain context security_rules "how do we authenticate service-to-service calls"

One query per distinct question — run several rather than combining topics into one long query.

Scoping a search to your change

Passing --assessment narrows the search to the rules that govern the code you are about to touch, instead of every rule your organization has.

ingrain context security_rules "input validation" --assessment "$ASSESSMENT_ABS"

The paths come from the assessment file’s ## Affected paths section, where the security review declares the folders the change is expected to land in. They are a prediction: a design review runs before the code exists, so there is no diff to read, and what the review states is the only description of where the change is going. The repository is read from the git remote of the checkout that owns the assessment file.

Scoping is best-effort and never fails a query. An unwritten section, a file that cannot be read, a checkout with no remote — each falls back to an org-wide search, the same result you get without the flag.

The one case that behaves differently is worth knowing: if the repository is not registered in your organization, a scoped search matches nothing rather than falling back. That is deliberate — registering a repository is how an organization says which rules govern it — and the command tells you when it happens.

Flags

Flag	Description
--assessment <path>	Assessment file whose ## Affected paths narrows the search to the code this change touches. Omit to search org-wide.
--limit <N>	Maximum results to return, 1–50. Defaults to 10.
--json	Emit raw JSON results to stdout, in place of the human-readable list.

Results go to stdout; every diagnostic — including the empty-result hint — goes to stderr, so --json output can be piped cleanly.

If nothing matches, the command prints a short hint saying why: whether your organization has any security rules ingested yet, or whether the search was narrowed and found nothing inside that narrowing.

Configuration

context talks to the platform over a sync URL and an API token. Provide them via either:

• the INGRAIN_SYNC_URL and INGRAIN_API_TOKEN environment variables, or
• a [context] section in your user-level conf.toml with syncUrl and ingrainApiToken fields.

Run config to find your conf.toml. Set both values before running a search. See the [context] configuration page for the full key reference and validation rules.