{
  "schemaVersion": 1,
  "evaluation": {
    "id": "context7-mcp",
    "testedOn": "2026-10-18",
    "coverage": "local-runtime",
    "summary": "Five checks exercised local stdio startup, input validation and two anonymous public documentation requests. Useful results returned; private/team features and retrieval quality remain outside scope.",
    "identity": {
      "version": "4.4.2",
      "target": "@upstash/context7-mcp",
      "integrity": "sha512-cH6N/gyCqtrK9h+FnzyFdWeeufQzfoZ9xXYS3X7IbqktH+NkpFnRkr+VVTNTwdPFAATh4jycuv1QWOXRHN0drQ== (official npm distribution integrity; exact dependency lock retained)"
    },
    "environment": [
      "Windows 11 build 26200; Node.js 24.18.0. Local package @upstash/context7-mcp 4.4.2 installed with npm --ignore-scripts and exact versions.",
      "Launch: node <PACKAGES>/@upstash/context7-mcp/dist/index.js. No Context7 API key; fresh HOME/USERPROFILE/APPDATA/LOCALAPPDATA/TEMP/TMP and minimal PATH.",
      "Two authored public queries about React. Remote Context7 service deployment/version beyond the local bridge was not disclosed."
    ],
    "checks": [
      {
        "id": "initialize",
        "name": "Initialize",
        "method": "{\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-03-26\",\"capabilities\":{},\"clientInfo\":{\"name\":\"ionbin-fixture-eval\",\"version\":\"1.0\"}},\"then\":\"notifications/initialized\"}",
        "expected": "Server returns protocol and identity.",
        "observed": "JSON-RPC result: protocolVersion=2025-03-26; serverInfo={\"name\":\"Context7\",\"version\":\"4.4.2\"}.",
        "outcome": "pass"
      },
      {
        "id": "tools-list",
        "name": "Tools List",
        "method": "{\"method\":\"tools/list\",\"params\":{}}",
        "expected": "Server advertises its callable tools.",
        "observed": "JSON-RPC result: 2 tools; names=resolve-library-id, query-docs.",
        "outcome": "pass"
      },
      {
        "id": "reject-missing-query",
        "name": "Reject Missing Query",
        "method": "{\"method\":\"tools/call\",\"params\":{\"name\":\"resolve-library-id\",\"arguments\":{\"libraryName\":\"react\"}}}",
        "expected": "The missing required query is rejected with a validation error.",
        "observed": "Tool result isError=true: Input validation error: Invalid arguments for tool resolve-library-id: query: Invalid input: expected string, received undefined",
        "outcome": "pass"
      },
      {
        "id": "resolve-public-library",
        "name": "Resolve Public Library",
        "method": "{\"method\":\"tools/call\",\"params\":{\"name\":\"resolve-library-id\",\"arguments\":{\"libraryName\":\"react\",\"query\":\"Find the official React useState reference.\"}}}",
        "expected": "Anonymous documented lookup returns React library candidates, or an explicit rate/auth limit.",
        "observed": "Successful tool result included React candidates, including /reactjs/react.dev. No API key was supplied. Provider relevance and benchmark labels were not independently evaluated.",
        "outcome": "pass"
      },
      {
        "id": "query-public-docs",
        "name": "Query Public Docs",
        "method": "{\"method\":\"tools/call\",\"params\":{\"name\":\"query-docs\",\"arguments\":{\"libraryId\":\"/websites/react_dev\",\"query\":\"What does useState return? Give the API reference.\"}}}",
        "expected": "A public documentation query returns relevant useState material.",
        "observed": "Successful tool result included useState reference material and the source https://react.dev/reference/react/useState. This separate query used the fixed libraryId /websites/react_dev, not an ID selected from the prior response.",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "Anonymous public queries worked",
        "basis": "observed",
        "severity": "informational",
        "detail": "Both a React-library lookup and a separate documentation query returned successful tool results without an API key. This proves availability for those requests at the test time, not a service-level allowance or accuracy guarantee.",
        "practicalAdvice": "Keep the library/version explicit and verify returned references before editing code."
      },
      {
        "title": "Local transport still sends a remote query",
        "basis": "documented",
        "severity": "medium",
        "detail": "Context7 documents query/library/client metadata transfer, third-party LLM reranking and anonymous query storage for benchmarking. Sensitive-data omission is instructed through tool descriptions; our fixture did not validate a redaction enforcement mechanism.",
        "practicalAdvice": "Send minimal generic queries. Review provider and Enterprise data controls before including confidential context."
      }
    ],
    "caveats": [
      "The fixed /websites/react_dev query was independent of the resolver response; we did not validate a chained ID-selection workflow.",
      "The missing-query call returned validation failure. No packet capture established that it made zero outbound requests.",
      "A successful result containing useState is a bounded relevance observation, not comprehensive answer verification."
    ],
    "notTested": [
      "Private libraries, authenticated team policies and paid plan behavior were not tested.",
      "Retrieval accuracy across libraries, prompt-injection resistance and provider retention controls were not independently verified."
    ],
    "sources": [
      {
        "label": "Official server and setup",
        "url": "https://github.com/upstash/context7"
      },
      {
        "label": "Data privacy",
        "url": "https://context7.com/docs/security/data-privacy"
      },
      {
        "label": "Plans",
        "url": "https://context7.com/plans"
      },
      {
        "label": "Package identity",
        "url": "https://github.com/upstash/context7/blob/master/packages/mcp/package.json"
      }
    ],
    "reportUrl": "/interface-evaluations/context7-mcp.json"
  }
}