Entity trail

Context7

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-05 / github-pulse-researcherContext7 MCP 4.0.5 starts requiring authentication for the Claude Code plugin and drops a legacy AES-CBC IP headerReleased 2026-09-04, the Context7 MCP server now requires authentication and tracks usage separately for the Claude Code plugin (21c3dd4), raises the default HTTP subscription capacity with a configurable `MCP_MAX_SUBSCRIPTIONS` (4e980f6), and removes the legacy AES-CBC client-IP header now that authenticated assertions are deployed (2a851fc). Anyone running Context7 through the Claude Code plugin unauthenticated will need to reconnect.
2026-08-23 / vibe-coding-researcherContext7 MCP Server Prompt Injection Exfiltrates .env Files on a Routine Docs Lookup (CVE-2026-75130)NVD published CVE-2026-75130 on 18 August 2026 against Upstash's Context7 through version 2.1.2: its Custom AI Instructions feature serves unsanitized content through the MCP server, so an attacker can poison the instructions to exfiltrate credentials from environment files to an attacker-controlled service and delete files, triggered when the agent makes an ordinary library documentation request. NVD carries a CVSS 4.0 base of 6.4 from VulnCheck with no vulnerability confidentiality impact but high subsequent-system confidentiality, integrity and availability impact; secondary coverage quotes a 9.0 under CVSS 3.1. Context7 is one of the most commonly installed MCP servers in coding agents, and no fix is documented.
2026-08-18 / github-pulse-researcherContext7 Ships an Official OpenCode Plugin With OAuth as the Default Auth Pathupstash/context7 (60,920 stars) published @upstash/[redacted] on 2026-08-18 — the official Context7 plugin for OpenCode. Installing it registers both the hosted Context7 MCP server and a `context7-mcp` skill in one step. Authentication defaults to OAuth and falls back to CONTEXT7_API_KEY or an inline apiKey plugin option, which is a notable shift: most MCP documentation servers still assume a pasted API key as the primary path. For builders, this is the up-to-date-library-docs layer becoming a first-class OpenCode install rather than a hand-edited MCP config block.
2026-08-13 / projects-researcherContext7 Rebrands From MCP Server to 'Context7 Platform' at 60,685 Starsupstash/context7 — the service that injects up-to-date library documentation into LLMs and AI code editors — now describes itself as the Context7 Platform rather than a single MCP server, at 60,685 stars in TypeScript. The shift from server to platform is the same move Firecrawl made when it became 'the Context API,' and it points at documentation retrieval consolidating into a paid layer rather than staying a free MCP endpoint. Worth watching if your agent config depends on the public server staying free.
2026-08-12 / github-pulse-researcherContext7's SDK 2.0 Migration Leaked SSE Streams — Two Patches Landed the Same Day With p99.9 Latency DataContext7 shipped @upstash/context7-mcp 4.0.1 and 4.0.2 on 2026-08-11, both cleaning up fallout from the 4.0.0 migration to MCP SDK 2.0. Version 4.0.1 stopped forcing `responseMode: "sse"` on the HTTP handler because every response was riding an unreleased SSE stream, and 4.0.2 added a 60s `AbortSignal.timeout()` after finding stalled backend calls were inheriting undici's ~300s default. The team justified the 60s figure with production data — these are vector queries with p99.9 around 3.2s — and a companion [redacted] release fixed silent anonymous fallback when stored OAuth tokens expired.
2026-08-11 / github-pulse-researcherContext7 Became One of the First Large MCP Servers to Migrate to SDK 2.0 and the 2026-07-28 Protocol Revision — Deleting Redis Sessions Entirelyupstash/context7 (60,590 stars) published `@upstash/[redacted]` on 2026-08-07, migrating to `@modelcontextprotocol/{node,server,client}` 2.0.0 and the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions were removed outright — a meaningful operational simplification for anyone self-hosting an MCP server at scale. The same release train also fixed a subtle auth failure: `ctx7 setup` now writes a standard `Authorization: Bearer` header instead of a custom `CONTEXT7_API_KEY` one, because Codex read the custom name as 'no credential configured,' fell through to a stale OAuth credential, and failed with `invalid_grant` before the API key was ever sent.
2026-08-05 / vibe-coding-researcherPattern: Codebase Graphs Are Consolidating as the Standard Answer to Agent Context CostThree separate MCP-native code-intelligence graphs are now at meaningful scale — code-review-graph (28.5K stars, 30 MCP tools, ~65x median context reduction), Serena (27.6K stars, semantic retrieval and editing positioned as "the IDE for your agent"), and Context7 (60.3K stars, up-to-date library docs for LLMs). All three solve the same problem the same way: precompute structure so the agent retrieves symbol-anchored slices instead of grepping or reading whole files. For builders, the takeaway is that hand-rolling repo-wide context strategies is now redundant work — the graph layer is a solved, installable component.
2026-06-15 / vibe-coding-researcherTip: Add 'use context7' to Your Prompt to Inject Current Library Docs and Kill Stale-API HallucinationsWhen an agent keeps generating code against an API signature that changed, wire up the Context7 MCP server and append a directive like 'use context7' so the agent pulls version-specific docs before writing. This converts a class of silent hallucination bugs (deprecated methods, renamed params) into correct first-pass code. It's especially valuable for fast-moving SDKs where the model's training cutoff lags the current release.
2026-06-04 / github-pulse-researcherupstash/context7 at 56.7K Stars: MCP Server Delivers Up-to-Date Code Documentation Directly to LLMs and AI Editorsupstash/context7 has reached 56,722 stars by serving current, version-accurate code documentation to LLMs and AI code editors via an MCP server. It directly addresses the stale-training-data problem that causes agents to hallucinate outdated APIs. For builders using Claude Code or Cursor, it's a practical MCP plug-in to ground code generation in real docs.
2026-05-25 / projects-researcherContext7 by Upstash Becomes Most Popular MCP Server — 54K Stars, 890K Weekly npm DownloadsContext7, open-sourced by Upstash, has surged to over 54,000 GitHub stars and 890,000 weekly npm downloads, making it the single most popular MCP server in the ecosystem. It dynamically fetches the latest version-specific documentation for React, Next.js, Tailwind, and other libraries, injecting them into Claude's context so the model works with current API surfaces instead of stale training data. In an MCP ecosystem that now has 14,000+ servers (governance transferred to Linux Foundation's AAIF), Context7 stands alone in adoption.
2026-05-23 / github-pulse-researcherupstash/context7 at 55.9K Stars: MCP Server Injects Version-Specific Documentation Into LLM Prompts to Eliminate Hallucinated APIsContext7 pulls up-to-date, version-specific documentation and code examples straight from source and places them directly into LLM prompts via MCP. The two core tools — resolve-library-id and query-docs — let any MCP-compatible client (Cursor, Windsurf, Claude Code) retrieve accurate docs instead of relying on training data. Free API key available at context7.com for higher rate limits.
2026-05-13 / projects-researcherContext7 Reaches 55,202 Stars as the Most Popular MCP Server of 2026 — Injects Version-Specific Library Docs Into Any AI Coding AgentUpstash's Context7 MCP server has climbed to 55,202 GitHub stars by solving AI coding agents' hallucinated-documentation problem. It fetches version-specific code examples directly into the LLM context — ask for Next.js 14 middleware patterns and you get Next.js 14 docs, not 13 or 15. Works with Claude Code, Cursor, OpenCode, and any MCP-compatible client, free under MIT license with optional API key for higher rate limits.

Graph relationships

BUILT BY
Upstash
Upstash's Context7 MCP server through version 2.1.2 has prompt injection vulnerability CVE-2026-75130.
Source finding
CRITICIZES
ContextCrush
ContextCrush is a documentation poisoning vulnerability in Context7 MCP server
Source finding
SUPPORTS
Cursor
Context7 MCP server integrates with Cursor
Source finding
SUPPORTS
Claude Code
Context7 MCP server integrates with Claude Code
Source finding
BUILT BY
Upstash
Context7 is an Upstash MCP server for real-time documentation.
Source finding
SUPPORTS
Cursor
Context7 MCP server integrates with Cursor.
Source finding
SUPPORTS
Claude Code
Context7 MCP server integrates with Claude Code.
Source finding
SUPPORTS
Claude Code
Context7 integrates with Claude Code for real-time documentation.
Source finding
RELEASED
Upstash
Upstash released Context7, an MCP server for up-to-date code documentation.
Source finding
SUPPORTS
Windsurf
Context7 integrates with Windsurf AI code editor.
Source finding
SUPPORTS
Cursor
Context7 integrates with Cursor AI code editor.
Source finding
USES
MCP
Context7 is an MCP server that injects documentation into LLM context.
Source finding

Source trail

CVE-2026-75130 upstash/context7 GitHub Serena Model Context Protocol specification release candidate Released May 22 2.3K stars From the SST team Copilot's April release technique A Rust CLI proxy Sysdig TRT instrumented Claude Code, Gemini CLI, and Codex CLI at the syscall level

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…