Atlas / MCP servers / upstash / Context7

Context7CAUTION

mcp/upstash/context7

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

Verdict
CAUTION
Grade
D
Trust score
68 /100
Exposed tools
3 3r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
62,510
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://cursor.com/en/install-mcp?name=context7&config=eyJ1cmwiOiJodHRwczovL21jcC5jb250ZXh0Ny5jb20vbWNwIn0%3D)

[](https://context7.com) [](https://www.npmjs.com/package/@upstash/context7-mcp) [](./LICENSE)

[](./i18n/README.zh-TW.md) [](./i18n/README.zh-CN.md) [](./i18n/README.ja.md) [](./i18n/README.ko.md) [](./i18n/README.es.md) [](./i18n/README.fr.md) [](./i18n/README.pt-BR.md) [](./i18n/README.it.md) [](./i18n/README.id-ID.md) [](./i18n/README.de.md) [](./i18n/README.ru.md) [](./i18n/README.uk.md) [](./i18n/README.tr.md) [](./i18n/READM

Read from source at commit 36213efe423cOBSERVED · 2026-09-29
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add context7-mcp --env CONTEXT7_API_KEY=${CONTEXT7_API_KEY} -- npx -y @upstash/[email protected]
03

Exposed tools (3)

3 read · 0 write · 0 destructive.

ToolRiskDescription
ReactreadA UI library
context7-mcpreaddesc
query-docsread
04

Trust audit

CAUTIONgrade D · trust 68/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (4 observation(s))
Network
declared (5 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
found

Findings (25)

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/cli/src/__tests__/setup-auth.test.ts:67
json: () => Promise.resolve({ data: { apiKey: "ctx7sk-generated-key" } }),
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/mcp/test/integration.test.ts:339
const apiKey = "ctx7sk-advertised-header-test";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/tools-ai-sdk/src/agents/context7.ts:30
*   apiKey: 'your-context7-api-key',
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
docs/enterprise/integrations/other-git.mdx:71
-----BEGIN OPENSSH PRIVATE KEY-----
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
packages/mcp/.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
packages/opencode/.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
packages/pi/.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/cli/src/__tests__/find-docs-skill-alignment.test.ts:6
const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "../../../..");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/mcp/src/lib/constants.ts:6
const pkg = JSON.parse(readFileSync(join(__dirname, "../../package.json"), "utf-8"));
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/pi/vitest.config.ts:5
config({ path: path.resolve(__dirname, "../../.env") });
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/sdk/vitest.integration.config.ts:6
dotenv.config({ path: path.resolve(__dirname, "../../.env") });
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/tools-ai-sdk/vitest.config.ts:5
config({ path: path.resolve(__dirname, "../../.env") });
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/mcp/test/integration.test.ts:135
resolve(`http://127.0.0.1:${address.port}/api`);
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/mcp/test/integration.test.ts:173
metricsUrl = `http://127.0.0.1:${metricsPort}/metrics`;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/mcp/test/integration.test.ts:496
`OpenTelemetry metrics available at http://127.0.0.1:${defaultMetricsPort}/metrics`
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/mcp/test/integration.test.ts:498
const response = await fetch(`http://127.0.0.1:${defaultMetricsPort}/metrics`);
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/mcp/test/mcp-subscription-telemetry.test.ts:193
return new Request("http://127.0.0.1/mcp", {
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@inquirer/core, @inquirer/type, @changesets/cli, @types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint, eslint-config-prettier
Why it matters. 12 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/cli/package.json
@inquirer/core, @inquirer/prompts, boxen, commander, figlet, open, ora, picocolors
Why it matters. 19 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/mcp/package.json
@opentelemetry/api, @opentelemetry/exporter-prometheus, @opentelemetry/instrumentation-runtime-node, @opentelemetry/resources, @opentelemetry/sdk-metrics, @types/express, commander, express
Why it matters. 18 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/opencode/package.json
@opencode-ai/plugin, @types/node, tsup, typescript
Why it matters. 4 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/pi/package.json
@earendil-works/pi-coding-agent, @types/node, dotenv, typebox, typescript, vitest
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
docs/enterprise/api/authentication.mdx:50
| `admin` | Full access to all endpoints including settings, user management, and delete operations |
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
docs/clients/cursor.mdx:191
If the private library can be read, the Cloud Agent is using the API key. If the agent reports **Monthly quota exceeded** even though the key has quota, the request is reaching Context7 anonymously; r
Why it matters. asks the agent to read credentials

Gates applied: no_behavioural_pass.

Audited 2026-09-29 · audit v0.4.1 · source sha 36213efe423cfull audit observations/trust-audit/mcp-server/upstash__context7.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-09-2936213efe423cCAUTIOND68first audit
06

Questions

What is the Context7 MCP server?

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

What tools does Context7 expose?

3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Context7 safe to connect to an agent?

With care. The audit graded it D (68/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Context7 need?

It reads AUTH_SERVER_URL, CONTEXT7_API_KEY, GH_TOKEN, GITHUB_TOKEN, MCP_CLIENT_IP_ASSERTION_KEY, OAUTH_AUTH_SERVER_URL, OAUTH_JWKS_URL, OPENAI_APPS_CHALLENGE_TOKEN and OPENROUTER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Context7 run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @upstash/context7-tools-ai-sdk at 1.0.2.

How current is this page?

The grade is for one exact copy of the source (36213efe423c), read on 2026-09-29. The repository is watched and re-audited when it changes.

Advertisement