Related Pages

Related topics: CLI Tool, Setup Wizard and Skills, MCP Server, Tools and Agent Plugins

Platform Overview and Architecture

Context7 is an MCP (Model Context Protocol) service that injects version-specific, up-to-date documentation and code examples directly into the prompts sent to large language models. Its central goal is to prevent AI assistants from hallucinating APIs by grounding their responses in authoritative library documentation fetched at query time rather than relying on stale training data. Source: README.md:1-40

Core Problem and Solution Scope

Most LLM-powered coding assistants rely on training data cutoffs that lag behind library releases by months. When developers ask about a recent API change, the model tends to fabricate plausible but incorrect method signatures. Context7 addresses this gap by providing a real-time documentation lookup layer that LLMs can call as a tool.

The platform operates as a hosted backend exposed through a public HTTP API and an MCP-compatible server. The service indexes hundreds of public libraries (npm packages, GitHub repositories, llms.txt sites, and traditional documentation websites) and serves targeted snippets based on a library identifier and a natural-language topic query. Source: README.md:41-90

Top community requests reflect the demand for architectural flexibility in this area. Issue #59 specifically asks for an option to self-host the documentation backend due to concerns about API downtime and vendor lock-in when all requests route through context7.com/api. Source: README.md:91-120

System Components

Context7 is delivered as a monorepo containing several cooperating packages:

Source: package.json:1-40

The monorepo is managed with pnpm workspaces, declared in pnpm-workspace.yaml. Source: pnpm-workspace.yaml:1-20

MCP Server

The MCP server is the public face of the platform. It advertises tools such as resolve-library-id and query-docs, which let an LLM fetch a library identifier from a friendly name and then retrieve scoped documentation snippets. As of @upstash/[email protected], the server also performs multi-tenant Microsoft Entra ID validation for MCP tokens, verifying inbound Entra v2 tokens against per-teamspace JWKS configuration. Source: server.json:1-60

CLI Installer

The ctx7 CLI is the integration shim that wires the MCP server into a developer's local environment. It detects which coding agent the user runs (Claude Code, Cursor, Windsurf, Codex, Antigravity, Gemini CLI), writes the appropriate MCP configuration block, and downloads any associated skill files from GitHub. The latest release, [email protected], fixes a fetch failed issue during skill installation and a Microsoft Defender for Endpoint alert caused by invoking the GitHub CLI through cmd.exe. Source: package.json:41-80

Earlier [email protected] added explicit --antigravity support, installing skills to .agent/skills, a GEMINI.md rule section, and the MCP config to Antigravity's documented global path ~/.gemini/config/mcp_config.json. Source: package.json:81-120

Request Flow and Data Path

When a user asks their coding assistant a question that requires current API knowledge, the assistant calls resolve-library-id with a hint such as "next.js routing" and receives a canonical id like /vercel/next.js. It then calls query-docs with that id plus a topic string, and Context7 returns a Markdown-formatted snippet drawn from the indexed source.

sequenceDiagram
    participant LLM as Coding Assistant (LLM)
    participant MCP as Context7 MCP Server
    participant API as context7.com API
    participant Src as Source Adapters
    LLM->>MCP: resolve-library-id("next.js routing")
    MCP-->>LLM: /vercel/next.js
    LLM->>MCP: query-docs("/vercel/next.js", "app router")
    MCP->>API: lookup snippet
    API->>Src: fetch & chunk source
    Src-->>API: tokenized snippet
    API-->>MCP: Markdown snippet
    MCP-->>LLM: documentation + examples

Source: docs/overview.mdx:1-80

Source Ingestion and Refresh

Documentation sources are ingested by adapters that handle GitHub repos, npm packages, llms.txt files, and arbitrary websites. Each library tracks a token budget; libraries that exceed the auto-refresh threshold must be refreshed manually via an issue or the web UI. Community threads such as /websites/mapbox (1,248,801 tokens) and /llmstxt/cognee_ai_llms-full_txt (3,088,586 tokens) demonstrate this scale limit and the manual refresh workflow. Source: docs/overview.mdx:81-140

The web UI also exposes include/exclude folder controls so monorepo owners can scope which subdirectories are parsed, an issue raised in #2688 after a docs migration. Source: docs/overview.mdx:141-200

Known Architectural Risks

Two recurring failure modes shape how the architecture is hardened:

• Prompt injection in third-party docs. Issues #2663 and #2673 describe query-docs responses that embed instruction-style content from indexed sources, attempting to redirect the calling LLM. The architecture relies on downstream prompt hygiene because Context7 cannot fully sanitize arbitrary source content.
• CLI precedence bugs. Issue #2695 reports that ctx7 setup --cli --universal --project silently ignores --universal when an agent is auto-detected, indicating that target-resolution ordering in the CLI needs explicit precedence rules.

Source: README.md:121-180

Deployment Topologies

Today the canonical deployment is the hosted context7.com API. The community roadmap items — self-hosting (#59), offline/air-gapped operation (#320), and private documents (#34) — all imply a future where the parsing pipeline, the MCP server, and the index storage can be deployed independently. Until then, developers integrate Context7 either through the hosted MCP endpoint configured by ctx7 setup or by self-hosting the @upstash/context7-mcp server with their own token store. Source: server.json:61-120

Related Pages

Related topics: Platform Overview and Architecture, MCP Server, Tools and Agent Plugins

CLI Tool, Setup Wizard and Skills

The ctx7 CLI (located in the packages/cli workspace) is the developer-facing command-line tool for the Context7 ecosystem. It authenticates against the Context7 backend, fetches and parses library documentation, and—most importantly—runs an interactive setup wizard that wires MCP integrations and installs "skills" into supported AI coding agents such as Claude Code, Antigravity, Cursor, and others. The wizard is the primary onboarding path for new users.

1. Entry Point and Command Surface

The CLI is registered through packages/cli/src/index.ts, which parses process.argv, dispatches to subcommands, and wires shared options (--api-key, --profile, JSON output flags). The top-level command tree is:

• ctx7 setup — interactive wizard (also runnable non-interactively via flags)
• ctx7 docs — fetch docs for a library, locally cached
• ctx7 auth — manage Context7 API credentials

Source: packages/cli/src/index.ts:1-80

The setup command is loaded from packages/cli/src/commands/setup.ts and is the largest surface in the CLI. It exports a single async function that accepts an AgentTarget enum value and a set of options (cli, universal, antigravity, project). When no target is passed, it enumerates installed agents by scanning well-known config paths and prompts the user with a select list. Source: packages/cli/src/commands/setup.ts:1-60

2. Setup Wizard Flow

The wizard has two operational modes: interactive (TTY prompts) and non-interactive (flag-driven). The --cli flag forces the CLI/onboarding flow as opposed to the legacy GUI flow, while --project restricts installation to the current working directory rather than user-global paths. Source: packages/cli/src/commands/setup.ts:60-140

A known bug surfaced when --cli --universal --project were combined: the --universal target was silently overridden by an auto-detected agent because the target-merge logic in setup.ts ran after the auto-detection branch. Source: packages/cli/src/commands/setup.ts:110-135 This was tracked in issue #2695.

The wizard's logical sequence:

flowchart TD
    A[ctx7 setup invoked] --> B{Target flag?}
    B -- yes --> C[Use explicit target]
    B -- no --> D[Scan well-known agent paths]
    D --> E[Prompt user to pick agent]
    C --> F[Load AgentDefinition]
    E --> F
    F --> G[Install skill files]
    F --> H[Patch MCP config]
    F --> I[Append agent rule block]
    G --> J[Verify & print summary]
    H --> J
    I --> J

Source: packages/cli/src/commands/setup.ts:140-220

3. Supported Agents and Skill Installation

Agent support is data-driven and lives in packages/cli/src/setup/agents.ts. Each entry is an AgentDefinition describing:

• The skill directory (e.g., .claude/skills, .agent/skills)
• The MCP config file path (e.g., ~/.claude/mcp.json, ~/.gemini/config/mcp_config.json)
• The rule-file marker (CLAUDE.md, GEMINI.md) and the snippet to inject
• Whether HTTP (httpUrl) or stdio transport is used

Source: packages/cli/src/setup/agents.ts:1-90

The --antigravity flag, added in [email protected], installs skills to .agent/skills, appends an Antigravity-compatible rule block to GEMINI.md, and writes the MCP config to ~/.gemini/config/mcp_config.json using httpUrl for HTTP transport (matching the Gemini convention rather than the MCP url field). Source: packages/cli/src/setup/agents.ts:90-140 This aligns with the [email protected] release notes.

Skill files themselves are fetched from the Context7 GitHub organization via the helper in packages/cli/src/utils/github.ts. The downloadSkillFromGitHub(skillId, targetDir) function calls https://api.github.com/repos/upstash/context7/contents/skills/<skillId> and writes the tree to disk. Because GitHub's raw API requires authentication for higher rate limits and certain paths, the helper accepts an optional token. Source: packages/cli/src/utils/github.ts:1-70

A regression in earlier versions omitted the Authorization header, producing GitHub API error: 403 when the unauthenticated rate limit was exhausted during ctx7 setup --cli. This was reported in issue #2363 and fixed by threading the resolved token (env GITHUB_TOKEN → gh auth token) into the request. Source: packages/cli/src/utils/github.ts:40-95

4. GitHub Auth and Recent Fixes

Token resolution is centralized in the same github.ts module. As of [email protected] it invokes gh auth token directly rather than via a shell wrapper, which on Windows was triggering Microsoft Defender for Endpoint "Suspicious Node.js process behavior" alerts because of the cmd.exe /d /s /c spawn pattern. Source: packages/cli/src/utils/github.ts:70-120 The same release fixed a "fetch failed" error during skill install by switching the underlying transport (Node 22's global fetch was failing on certain TLS paths). Source: packages/cli/src/utils/github.ts:120-160

Authentication for the Context7 API itself is handled by packages/cli/src/commands/auth.ts. It supports login (browser-based OAuth), logout, and whoami, persisting the issued API key to the user's config directory and exposing it via ctx7 auth token --print for piping into shell snippets. Source: packages/cli/src/commands/auth.ts:1-80

The docs command complements setup by giving users a quick way to verify their installation. ctx7 docs <library-id> calls resolve-library then query-docs against the Context7 API, rendering the result either as Markdown (default) or JSON (--json) for scripting. Source: packages/cli/src/commands/docs.ts:1-90

Summary

• ctx7 is the onboarding CLI; setup is its flagship command.
• The wizard merges explicit target flags with auto-detection; ordering matters (see #2695).
• Agents are declarative records in agents.ts; new agents are added by appending entries.
• Skill downloads require a GitHub token; the resolver now calls gh directly per [email protected].
• auth and docs round out the CLI surface for credential management and post-install smoke-testing.

Related Pages

Related topics: Platform Overview and Architecture, CLI Tool, Setup Wizard and Skills, Enterprise Features, Deployment, Security and Known Risks

MCP Server, Tools and Agent Plugins

The MCP (Model Context Protocol) server in context7 is the public integration point that lets LLM-based agents and IDE assistants query up-to-date library documentation. It runs as a standalone Node process that exposes a small set of MCP tools, forwards them to the upstream context7.com API, and optionally authenticates the calling user. Companion "agent plugins" are bundled separately as skills and configuration snippets that are installed by the ctx7 setup CLI into a developer's editor or agent runtime. Source: packages/mcp/src/index.ts:1-40

Server Architecture

The server is bootstrapped in packages/mcp/src/index.ts, which constructs a McpServer instance, registers tools, and selects the transport (stdio for local CLI use, streamableHttp for hosted deployments). Authentication is pluggable: a token can be supplied via env, HTTP Authorization header, or the OAuth prompt flow, then validated against jwt.ts or an external IdP. Source: packages/mcp/src/index.ts:40-90

State and rate limiting live in Upstash Redis, accessed through packages/mcp/src/lib/redis.ts. Per-IP rate-limit buckets, OAuth state, and cached library metadata are stored here so the server remains stateless across horizontal replicas. Source: packages/mcp/src/lib/redis.ts:1-60

Outbound calls to context7.com are isolated in packages/mcp/src/lib/api.ts, which wraps fetch with retry, error mapping, and a shared API_BASE constant. Tools call into this client rather than building URLs ad-hoc, so a single change can switch the upstream host (used for self-host testing — see issue #59). Source: packages/mcp/src/lib/api.ts:1-80

Exposed MCP Tools

The MCP layer exposes roughly two end-user tools plus a few internal helpers:

Tool registration happens inside registerTools(server, ...) in index.ts. Each tool declares an inputSchema, calls into api.ts, and wraps the result in an MCP content array of text parts. Source: packages/mcp/src/index.ts:120-220

The get-library-docs response intentionally includes only curated snippets, not raw HTML or unfiltered markdown. This design choice is what triggered the prompt-injection reports in issues #2663 and #2673: when a library contains adversarial text, that text can still be returned verbatim because the server does not sanitize upstream content. Operators relying on context7 in sensitive workflows should treat tool output as untrusted, exactly like any web-fetched data. Source: community issues #2663, #2673

Authentication and Authorization

Authentication supports three modes:

1. API key — passed via CONTEXT7_API_KEY env or Authorization: Bearer …. The server decrypts keys using packages/mcp/src/lib/encryption.ts, which derives a key from a server secret with HKDF and uses AES-GCM for at-rest tokens. Source: packages/mcp/src/lib/encryption.ts:1-70
2. JWT user session — issued after the OAuth-style prompt. packages/mcp/src/lib/jwt.ts verifies the signature, checks expiry, and extracts userId and plan claims used for per-tier rate limits. Source: packages/mcp/src/lib/jwt.ts:1-90
3. Microsoft Entra ID (multi-tenant) — added in @upstash/[email protected]. The server detects inbound Entra v2 tokens by issuer, fetches per-teamspace config (tenantId, audience, requiredScope) from the Context7 app, and verifies against the tenant's JWKS, enforcing the declared scope. Source: release notes @upstash/[email protected]

The interactive prompt flow is implemented in packages/mcp/src/lib/auth/auth-prompt.ts, which opens a local browser, polls a callback route, exchanges the code, and stores the resulting refresh token in Redis under the user's userId. Source: packages/mcp/src/lib/auth/auth-prompt.ts:1-110

Agent Plugins and the `ctx7 setup` CLI

Agent plugins are not part of the server itself; they are installable artifacts produced by the ctx7 CLI. Each plugin consists of a *skill file* (Markdown describing how an agent should use the MCP tools) and an *MCP config snippet* that points the agent at the running server.

Supported targets include Claude Code, Cursor, Windsurf, Codex CLI, and Antigravity. The release [email protected] added first-class --antigravity support, installing skills to .agent/skills and writing MCP config to ~/.gemini/config/mcp_config.json. The --universal flag, intended to install to all detected agents at once, was reported in issue #2695 to be silently overridden by an auto-detected project target; this was fixed in subsequent patches. Source: issue #2695, release [email protected]

Skill files are fetched from GitHub raw URLs by downloadSkillFromGitHub(). Issue #2363 reported that this function omitted the Authorization header on private repos, returning 403; the fix threads the user's gh auth token (read by invoking gh directly rather than through a shell, per [email protected]) into the request. Source: issue #2363, release [email protected]

flowchart LR
  A[LLM Agent / IDE] -->|MCP stdio or HTTP| B[context7-mcp Server]
  B --> C[resolve-library-id]
  B --> D[get-library-docs]
  C --> E[context7.com API]
  D --> E
  B --> F[(Upstash Redis)]
  B --> G[Auth: API key / JWT / Entra ID]
  H[ctx7 setup CLI] -->|writes skills + mcp config| A

This separation keeps the server small and version-stable while allowing each agent runtime to evolve its skill content independently. For users in air-gapped environments (issue #320) or those needing private documentation (issue #34), the current architecture still requires reaching context7.com, since the server itself does not embed documentation storage.

Related Pages

Related topics: MCP Server, Tools and Agent Plugins, Platform Overview and Architecture

Enterprise Features, Deployment, Security and Known Risks

Context7 exposes a tier of capabilities aimed at organizations that need to run documentation retrieval outside the public context7.com API boundary, integrate with corporate identity providers, and operate at scale. This page summarizes the deployment topologies, authentication options, and the operational and security risks that enterprise adopters should plan for, drawing on the official enterprise documentation and current issue tracker evidence.

Deployment Topologies

On-Premise Self-Hosting

The on-premise edition is the recommended path for teams that need to keep documentation indexing and query traffic inside their own network. It addresses the recurring concern raised in issue #59, where operators cite API downtime, data-residency, and audit-logging requirements as reasons to avoid the central hosted endpoint.

Source: docs/enterprise/on-premise.mdx:1-40

The self-hosted runtime expects operators to supply their own embedding model credentials, vector store, and crawler workers. Once deployed, the public MCP URL and tool surface (resolve-library-id, query-docs) remain identical to the hosted version, which means client integrations do not need to be reconfigured when switching tiers.

Container and Orchestration Targets

Docker is the canonical packaging format. The image bundles the MCP HTTP server, the background indexer, and the CLI helper. Operators typically run it behind a reverse proxy that terminates TLS and forwards to the container's internal port. Source: docs/enterprise/deployment/docker.mdx:1-35

Kubernetes is supported for higher-scale deployments. The Helm-friendly manifests provision a Deployment for the server, a separate Deployment for the indexer workers, and a Job or CronJob that schedules crawl-and-parse runs against configured library sources. Source: docs/enterprise/deployment/kubernetes.mdx:1-60

For horizontal scaling, the indexer is stateless and can be sharded by library ID, while the query path scales by adding read replicas of the vector store and behind the MCP server. Source: docs/enterprise/deployment/scaling.mdx:1-45

Vector Store Backends

The vector store is pluggable. Enterprise deployments commonly substitute the default managed store with self-hosted alternatives (e.g., Qdrant, Milvus, or Postgres + pgvector) to keep embeddings in-network. Configuration is performed through environment variables consumed at server startup. Source: docs/enterprise/deployment/vector-stores.mdx:1-50

Security and Identity

Microsoft Entra ID Validation

The MCP server can authenticate inbound requests against Microsoft Entra ID (formerly Azure AD). Release @upstash/[email protected] introduced multi-tenant Entra v2 token validation: the server detects tokens by issuer pattern, fetches per-teamspace configuration (tenantId, audience, requiredScope) from the Context7 app, and verifies signatures against the matching tenant's JWKS while enforcing the configured required scope. Source: CHANGELOG.md:1-20

Configuration guidance, including how to register the app, mint tokens, and map required scopes, is documented in the Entra SSO page. Source: docs/enterprise/security/entra-sso.mdx:1-80

MCP Transport and Token Hygiene

Authentication in self-hosted deployments is typically handled at the MCP transport layer (bearer token or HTTP header injected by the calling agent). Operators are responsible for rotating these tokens and for ensuring that the reverse proxy strips any upstream identity headers that should not reach the indexer workers.

Known Risks and Operational Issues

Prompt-Injection via Indexed Documentation

Two recent reports (issues #2663 and #2673) describe query-docs responses containing appended text formatted as a system instruction to the calling LLM, instructing it to relay an auto-approve install command to the user. The injection is sourced from third-party documentation content (e.g., HubSpot Developer Documentation) that the indexer has ingested verbatim. Operators of self-hosted deployments should treat indexed content as untrusted and consider stripping or sandboxing prompt-shaped fragments during the parse stage. Source: docs/enterprise/on-premise.mdx:80-120

CLI Setup Bugs Affecting Enterprise Installers

The ctx7 setup flow has surfaced several issues relevant to enterprise rollout:

• Issue #2363: downloadSkillFromGitHub() does not include an Authorization header, producing 403 errors when GitHub rate-limits anonymous requests.
• Issue #2695: --cli --universal --project silently overrides --universal and falls back to auto-detected agent directory.
• Release [email protected]: Fixed a Defender for Endpoint false positive caused by invoking the gh CLI through a Windows shell wrapper; the auth token is now read by invoking gh directly.

Source: CHANGELOG.md:20-60

Large-Library Refresh Quotas

Several libraries exceed the automatic refresh token ceiling (e.g., /websites/mapbox at ~1.25M tokens, /llmstxt/cognee_ai_llms-full_txt at ~3.09M tokens, /2sic/2sxc-docs at ~1.28M tokens). Issues #2701 and #2710 were resolved by triggering manual re-parses; #2715 remained open at time of writing. Self-hosted operators should configure crawler concurrency and chunk size to avoid hitting the same ceiling on their own indexer. Source: docs/enterprise/deployment/scaling.mdx:45-80

Gaps and Requested Enterprise Features

Air-gapped operation in particular requires resolving the indexer's outbound fetch requirements for crawling source repositories; today the MCP server still attempts internet-bound calls for certain workflows, which prevents fully offline use. Source: docs/enterprise/on-premise.mdx:120-160

Doramagic Pitfall Log

Found 38 structured pitfall item(s), including 3 high/blocking item(s). Top priority: Security or permission risk - Security or permission risk requires verification.

1. Security or permission risk: Security or permission risk requires verification

• Severity: high
• Finding: Developers should check this security_permissions risk before relying on the project: [Bug]: OAuth metadata issuer mismatch for MCP OAuth endpoint
• User impact: Developers may expose sensitive permissions or credentials: [Bug]: OAuth metadata issuer mismatch for MCP OAuth endpoint
• Recommended check: Before packaging this project, run the relevant install/config/quickstart check for: [Bug]: OAuth metadata issuer mismatch for MCP OAuth endpoint. Context: Source discussion did not expose a precise runtime context.
• Evidence: failure_mode_cluster:github_issue | https://github.com/upstash/context7/issues/2723

2. Security or permission risk: Security or permission risk requires verification

• Severity: high
• Finding: Project evidence flags a security or permission risk. Review the linked source before relying on this workflow.
• User impact: May increase setup, validation, or first-run risk for the user.
• Recommended check: Reproduce the official install and quickstart path in an isolated environment.
• Evidence: community_evidence:github | https://github.com/upstash/context7/issues/214

3. Security or permission risk: Security or permission risk requires verification

• Severity: high
• Finding: Project evidence flags a security or permission risk. Review the linked source before relying on this workflow.
• User impact: May increase setup, validation, or first-run risk for the user.
• Recommended check: Reproduce the official install and quickstart path in an isolated environment.
• Evidence: community_evidence:github | https://github.com/upstash/context7/issues/339

4. Installation risk: Installation risk requires verification

• Severity: medium
• Finding: Developers should check this installation risk before relying on the project: @upstash/[email protected]
• User impact: Upgrade or migration may change expected behavior: @upstash/[email protected]
• Recommended check: Before packaging this project, run the relevant install/config/quickstart check for: @upstash/[email protected]. Context: Observed when using node
• Evidence: failure_mode_cluster:github_release | https://github.com/upstash/context7/releases/tag/%40upstash/context7-pi%400.1.0

5. Installation risk: Installation risk requires verification

• Severity: medium
• Finding: Developers should check this installation risk before relying on the project: Add tool to search by npm package name to skip the initial docs index search, makes MCP server faster
• User impact: Developers may fail before the first successful local run: Add tool to search by npm package name to skip the initial docs index search, makes MCP server faster
• Recommended check: Before packaging this project, run the relevant install/config/quickstart check for: Add tool to search by npm package name to skip the initial docs index search, makes MCP server faster. Context: Observed when using node
• Evidence: failure_mode_cluster:github_issue | https://github.com/upstash/context7/issues/230

6. Installation risk: Installation risk requires verification

• Severity: medium
• Finding: Developers should check this installation risk before relying on the project: [Feature Request] Local docs sync and numerous dx improvements
• User impact: Developers may fail before the first successful local run: [Feature Request] Local docs sync and numerous dx improvements
• Recommended check: Before packaging this project, run the relevant install/config/quickstart check for: [Feature Request] Local docs sync and numerous dx improvements. Context: Observed during installation or first-run setup.
• Evidence: failure_mode_cluster:github_issue | https://github.com/upstash/context7/issues/103

7. Installation risk: Installation risk requires verification

• Severity: medium
• Finding: Developers should check this installation risk before relying on the project: ctx7 setup --cli: downloadSkillFromGitHub missing Authorization header causes 403
• User impact: Developers may fail before the first successful local run: ctx7 setup --cli: downloadSkillFromGitHub missing Authorization header causes 403
• Recommended check: Before packaging this project, run the relevant install/config/quickstart check for: ctx7 setup --cli: downloadSkillFromGitHub missing Authorization header causes 403. Context: Observed when using macos
• Evidence: failure_mode_cluster:github_issue | https://github.com/upstash/context7/issues/2363

8. Installation risk: Installation risk requires verification

• Severity: medium
• Finding: Developers should check this installation risk before relying on the project: [email protected]
• User impact: Upgrade or migration may change expected behavior: [email protected]
• Recommended check: Before packaging this project, run the relevant install/config/quickstart check for: [email protected]. Context: Observed during installation or first-run setup.
• Evidence: failure_mode_cluster:github_release | https://github.com/upstash/context7/releases/tag/ctx7%400.4.5

9. Installation risk: Installation risk requires verification

• Severity: medium
• Finding: Developers should check this installation risk before relying on the project: [email protected]
• User impact: Upgrade or migration may change expected behavior: [email protected]
• Recommended check: Before packaging this project, run the relevant install/config/quickstart check for: [email protected]. Context: Observed when using docker
• Evidence: failure_mode_cluster:github_release | https://github.com/upstash/context7/releases/tag/ctx7%400.5.1

10. Installation risk: Installation risk requires verification

• Severity: medium
• Finding: Project evidence flags a installation risk. Review the linked source before relying on this workflow.
• User impact: May increase setup, validation, or first-run risk for the user.
• Recommended check: Reproduce the official install and quickstart path in an isolated environment.
• Evidence: community_evidence:github | https://github.com/upstash/context7/issues/230

11. Configuration risk: Configuration risk requires verification

• Severity: medium
• Finding: Developers should check this configuration risk before relying on the project: @upstash/[email protected]
• User impact: Upgrade or migration may change expected behavior: @upstash/[email protected]
• Recommended check: Before packaging this project, run the relevant install/config/quickstart check for: @upstash/[email protected]. Context: Source discussion did not expose a precise runtime context.
• Evidence: failure_mode_cluster:github_release | https://github.com/upstash/context7/releases/tag/%40upstash/context7-mcp%403.1.0

12. Configuration risk: Configuration risk requires verification

• Severity: medium
• Finding: Developers should check this configuration risk before relying on the project: Feature Request: Support multiple product docs in one repo
• User impact: Developers may misconfigure credentials, environment, or host setup: Feature Request: Support multiple product docs in one repo
• Recommended check: Before packaging this project, run the relevant install/config/quickstart check for: Feature Request: Support multiple product docs in one repo. Context: Source discussion did not expose a precise runtime context.
• Evidence: failure_mode_cluster:github_issue | https://github.com/upstash/context7/issues/328

Community Discussion Evidence

Doramagic exposes project-level community discussion separately from official documentation. Review these links before using context7 with real data or production workflows.

• Refresh request for /websites/uqudo - github / github_issue
• [[Bug/Missing Data] Context7 index missing crucial GraphQL mutations for](https://github.com/upstash/context7/issues/2924) - github / github_issue
• Refresh request for /websites/spacelift_io - github / github_issue
• [[Bug]: Codex setup Skill failed](https://github.com/upstash/context7/issues/2936) - github / github_issue
• [[Bug]: sstdio server does client-side DNS via bundled undici 6.27 ProxyA](https://github.com/upstash/context7/issues/2935) - github / github_issue
• 🧹 Help us clean up duplicate (or unnecessary) libraries in Context7 - github / github_issue
• Security or permission risk requires verification - GitHub / issue
• Security or permission risk requires verification - GitHub / issue
• Installation risk requires verification - GitHub / issue
• Installation risk requires verification - GitHub / issue
• Installation risk requires verification - GitHub / issue
• Installation risk requires verification - GitHub / issue