Context7 - Up-to-date Docs for AI AgentsCAUTION

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: context7-cli
description: Use the ctx7 CLI to fetch library documentation and configure Context7 MCP. Activate when the user mentions "ctx7" or "context7", needs current docs for any library, or needs to set up Context7 for their AI coding agent.
---

# ctx7 CLI

The Context7 CLI does two things: fetches up-to-date library documentation and sets up Context7 MCP for your editor.

Make sure the CLI is up to date before running commands:

```bash
npm install -g ctx7@latest
```

Or run directly without installing:

```bash
npx ctx7@latest <command>
```

## What this skill covers

- **[Documentation](references/docs.md)** — Fetch current docs for any library. Use when writing code, verifying API signatures, or when training data may be outdated.
- **[Setup](references/setup.md)** — Configure Context7 MCP for Claude Code / Cursor / OpenCode.

## Quick Reference

```bash
# Documentation
ctx7 library <name> <query>           # Step 1: resolve library ID
ctx7 docs <libraryId> <query>         # Step 2: fetch docs

# Setup
ctx7 setup                            # Configure Context7 MCP (interactive)
ctx7 login                            # Log in for higher rate limits
ctx7 whoami                           # Check current login status
```

## Authentication

```bash
ctx7 login               # Opens browser for OAuth
ctx7 login --no-browser  # Prints URL instead of opening browser
ctx7 logout              # Clear stored tokens
ctx7 whoami              # Show current login status (name + email)
```

Most commands work without login. Exception: `ctx7 setup` requires it unless `--api-key` or `--oauth` is passed. Login also unlocks higher rate limits on docs commands.

Set an API key via environment variable to skip interactive login entirely:

```bash
export CONTEXT7_API_KEY=your_key
```

## Common Mistakes

- Library IDs require a `/` prefix — `/facebook/react` not `facebook/react`
- Always run `ctx7 library` first — `ctx7 docs react "hooks"` will fail without a valid ID

CAUTIONgrade C · trust 72/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (4 observation(s))

Network

declared (5 observation(s))

Shell

none-observed

Dependencies

not all pinned

Secrets in source

found

Findings (25)

json: () => Promise.resolve({ data: { apiKey: "ctx7sk-generated-key" } }),

const apiKey = "ctx7sk-advertised-header-test";

*   apiKey: 'your-context7-api-key',

-----BEGIN OPENSSH PRIVATE KEY-----

.prettierignore

.prettierignore

.prettierignore

.prettierignore

.prettierignore

const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "../../../..");

const pkg = JSON.parse(readFileSync(join(__dirname, "../../package.json"), "utf-8"));

config({ path: path.resolve(__dirname, "../../.env") });

dotenv.config({ path: path.resolve(__dirname, "../../.env") });

config({ path: path.resolve(__dirname, "../../.env") });

resolve(`http://127.0.0.1:${address.port}/api`);

metricsUrl = `http://127.0.0.1:${metricsPort}/metrics`;

`OpenTelemetry metrics available at http://127.0.0.1:${defaultMetricsPort}/metrics`

const response = await fetch(`http://127.0.0.1:${defaultMetricsPort}/metrics`);

return new Request("http://127.0.0.1/mcp", {

@inquirer/core, @inquirer/type, @changesets/cli, eslint-config-prettier

zod

@inquirer/prompts, boxen, commander, figlet, jsonc-parser, open, ora, picocolors

@opentelemetry/api, @opentelemetry/exporter-prometheus, @opentelemetry/instrumentation-runtime-node, @opentelemetry/resources, @opentelemetry/sdk-metrics, @types/express, commander, express

@opencode-ai/plugin, @opencode/plugin

Confirm that the custom server URL is `https://mcp.context7.com/mcp`, the header is named `Context7-API-Key`, and the saved value is the current API key. Then enable the server and start a new Cloud A

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Context7 - Up-to-date Docs for AI Agents](https://modelsatlas.com/skills/upstash/documentation-lookup/badge.svg)](https://modelsatlas.com/skills/upstash/documentation-lookup/)

Not your listing, or something out of date? Claim or update your listing.