The pitch is "governed execution" for AI agents — which makes the outside view interesting, because right now the page itself is ungoverned. Quick passive check (headers + served HTML only, what any visitor's browser sees):
No Content-Security-Policy at all, no HSTS, no X-Frame-Options/frame-ancestors, no Permissions-Policy. nosniff and Referrer-Policy are set, so someone has touched the headers — the four that matter most just never landed. For a tool asking devs to trust it inside their agent workflows, CSP + HSTS are the two I'd close first; since it's Next.js behind Cloudflare, both are config, not code (middleware header block, or a Cloudflare Transform Rule).
www.kontexta.dev has no DNS record at all — not a broken page, the name simply doesn't resolve. A slice of people type www out of habit and will assume the product is down. One CNAME + a redirect rule at Cloudflare fixes it in minutes.
Small alongside: access-control-allow-origin: * rides on the homepage (harmless on a static page, but worth tightening), and no security.txt — for a security-adjacent dev tool, that file is a cheap trust signal.
robots.txt and sitemap.xml are clean, http 301s to https correctly, and the meta description is actually written. The base is fine — it's the trust surface that needs one config pass to match the pitch.
Hello Amit, Thanks for your valuable feedback. Kontexta.dev is advertisement page of the app itself. The main app can be pulled from npm or docker or github.