I treated context as an engineering budget
Every file read and shell command competes for the same finite conversation window. Full output is often the wrong first representation: it is expensive to carry, hard to scan, and likely to be replaced by the next command before the agent has extracted the useful shape. Cortex is an MCP layer that keeps the first response small without throwing away the underlying evidence.
For source files, it can return a map of the module or only its signatures. For long commands, it recognizes useful output patterns and returns a compact summary. The verbatim result stays in a bounded local cache behind an S or F reference. The agent can retrieve that exact content when a line, stack trace, or generated artifact matters.
I built the server around recoverability
Cortex is written in Rust and exposes focused tools for mapped reads, signature reads, shell execution, sandboxed scripts, compression checkpoints, and cache retrieval. A routing hook sends long-running commands such as builds, tests, and installs to the compressor. Short commands stay on the native path when routing overhead would cost more than it saves.
That distinction matters. A context optimizer that silently drops detail is a lossy filter. Cortex makes the trade visible and reversible. A response can say “98 percent smaller” because the original remains addressable, not because the system decided a summary was good enough and discarded the rest.
I measured where compression made things worse
The first live traffic review found inflation cases. Some outputs became larger after a compressor added headers and explanation, especially when the original command was already short. The follow-up pass introduced a 50-token win floor, slimmer headers, diff-aware re-reads, and a four-hour cache instead of a five-minute expiry.
The telemetry now compares savings with realistic native-tool limits rather than raw byte counts. A source file measured at 1,243 tokens returned a map or signature response of about 25 tokens, roughly a 98 percent reduction. Across a day of mixed traffic, the measured savings reached 80.1 percent. Shell commands that do not benefit remain uncompressed, which is the correct result.
I left the trust boundary explicit
Cortex is built for a trusted local operator. Its script execution and cross-project reads are convenience features, not a security sandbox. The command path has an allowlist, but the workspace boundary remains intentionally open so one agent session can inspect another project when the work requires it. That limitation belongs in the design story because the value is context control, not a claim of isolation.