Lean-ctx blocks AI coding agents from reading .env files

Lean-ctx is a Rust binary that gates which files an AI coding agent can read on a developer's machine, including secrets like .env, per its GitHub repo. Most agent setups ask the model nicely not to touch secrets or wander into files it shouldn't. That's a prompt, not a permission system.

The tool sits between the agent and the filesystem. It blocks reads before they happen, keeps a record of what the agent has already learned, and controls what leaves the machine at all. A system prompt can't do any of that. A permission check can.

It's a single repo, early, and unproven at scale, per its GitHub listing. But the axis it picks, enforcement instead of suggestion, is the interesting part, not the implementation.

It's not alone. graphify replaces grep-style search with graph traversal. PageIndex does reasoning-based retrieval with no vector store at all. Claude Code's own /doctor command prunes the context file you hand it. Four separate projects now sit between the agent and its context instead of living inside it.

The window was never the problem

The 2025 assumption was that bigger context windows would dissolve retrieval: dump the whole repo in and let the model sort it out. I've watched that story get retold with every new window-size release, and it keeps missing the actual constraint. The limit was attention and cost, not size. A bigger window makes picking the right files worth more, not less.

That's the environment lean-ctx and its three neighbors showed up in: the context window got bigger, but the job of deciding what the agent actually sees got more valuable, not less.