Installation Guide
Get Contexa AI Native Zero Trust Platform running in your Spring project. Choose between automatic CLI setup or manual configuration.
Quick Install (Recommended)
Install the Contexa CLI and set up everything automatically with a single command.
Step 1 - Install CLI
curl -fsSL https://install.ctxa.ai | sh
Windows — The install script is a POSIX shell script. On Windows, run it from Git Bash or WSL:
curl -fsSL https://install.ctxa.ai | sh
Alternatively, download the CLI release directly from contexa-security/contexa-cli and place the contexa binary on your PATH.
Step 2 - Initialize your project
cd your-spring-project
contexa init
The CLI will guide you through an interactive setup:
- Project type - New project (FULL) or legacy system (SANDBOX)
- AI security mode - Monitor only or block threats immediately
- AI / LLM Model - Ollama (local), OpenAI, or Anthropic
- Infrastructure - Standard (PostgreSQL + Ollama) or Distributed (+ Redis + Kafka)
The CLI automatically:
- Adds
spring-boot-starter-contexadependency to your build file - Configures
application.ymlwith the correct settings - Generates
docker-compose.ymlfor infrastructure - Starts Docker containers and pulls AI models
Step 3 - Add annotations
@EnableAISecurity
@SpringBootApplication
public class MyApplication {
public static void main(String[] args) {
SpringApplication.run(MyApplication.class, args);
}
}
// Protect any endpoint with AI Zero Trust
@Protectable
@GetMapping("/api/customers")
public List<Customer> getCustomers() { ... }
Step 4 - Start your application
./gradlew bootRun
That's it. Contexa is now active in your application. Request-time enforcement and asynchronous analysis work together around @Protectable endpoints.
Legacy System Integration (SANDBOX Mode)
If your project already has its own authentication system, use SANDBOX mode. Contexa adds AI security on top of your existing login — without modifying it.
@EnableAISecurity(
mode = SecurityMode.SANDBOX,
authObjectLocation = AuthObjectLocation.SESSION,
authObjectAttribute = "loginUser" // your legacy session attribute name
)
@SpringBootApplication
public class LegacyApplication { }
Zero side effects —SANDBOX mode does not interfere with your existing security. Your login pages, session management, and access control remain untouched. Contexa only activates on @Protectable endpoints.
Prerequisites
Required for both CLI and manual installation:
| Requirement | Version | Purpose |
|---|---|---|
| Java | 21+ | Runtime (configured via Gradle toolchain) |
| Spring Boot | 3.x | Application framework |
| Docker | Latest | Infrastructure services (PostgreSQL, Ollama) |
Distributed mode only —If you plan to use Distributed mode, you will also need Redis (for session store and distributed locks) and Kafka (for event streaming).
Manual Installation
If you prefer not to use the CLI, follow these steps manually.
1. Add Dependency
dependencies {
implementation 'ai.ctxa:spring-boot-starter-contexa:0.1.0'
}
<dependency>
<groupId>ai.ctxa</groupId>
<artifactId>spring-boot-starter-contexa</artifactId>
<version>0.1.0</version>
</dependency>
2. Start Infrastructure
# Standard mode (PostgreSQL + Ollama)
docker compose up -d
# Distributed mode (+ Redis + Kafka)
docker compose --profile distributed up -d
# Pull AI models
docker exec contexa-ollama ollama pull qwen3.5:9b
docker exec contexa-ollama ollama pull mxbai-embed-large
3. Infrastructure Services
| Service | Image | Port | Mode |
|---|---|---|---|
| PostgreSQL | pgvector/pgvector:pg16 | 5432 | Standard |
| Ollama | ollama/ollama:latest | 11434 | Standard |
| Redis | redis:7.2-alpine | 6379 | Distributed |
| Kafka | cp-kafka:7.4.0 | 9092 | Distributed |
Troubleshooting
| Problem | Solution |
|---|---|
| PostgreSQL connection refused | Check Docker is running: docker ps. Verify port 5432 is not in use. |
| Ollama connection refused | Check container: docker logs contexa-ollama. Verify port 11434. |
| AI model not found | Pull models: docker exec contexa-ollama ollama pull qwen3.5:9b |
| Port conflicts | Default ports: PostgreSQL 5432, Ollama 11434, Redis 6379, Kafka 9092 |
contexa init —arrow keys not working |
Windows: use winpty contexa init in Git Bash, or run in Windows Terminal |
Need more help? —Check the Configuration Reference or visit GitHub Discussions.