MCP · Documentation · Upstash
Context7 MCP
Bring library documentation into the coding conversation, with a clear boundary around the query you send.
Queries leave the machine. The provider documents third-party LLM reranking and anonymous query storage for benchmarking. Keep proprietary details out of the query; Enterprise controls require separate verification.
Understand the tool
What it does.
Context7 gives an MCP client two focused jobs: find a library and retrieve documentation relevant to a question. The local server is a bridge to a hosted documentation service. It does not make the rest of your coding environment local or private.
Why use it?
Use it when an answer depends on a particular library API and you want the assistant to check a reference before changing code. The useful output is a sourced explanation you can inspect. A plausible snippet still needs to match your installed version and pass your project checks.
A useful fit for
- Checking framework APIs before an edit
- Explaining an unfamiliar library with source links
- Finding migration details for a named version
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Check an API before implementing it
A developer needs to add React state without relying on recalled syntax.
- Resolve the official React documentation library.
- Ask a narrow useState question without including repository secrets.
- Compare the returned reference with the installed React version before editing.
Intended outputAn implementation decision grounded in an inspectable API reference.
Use case 02
Prepare a version migration note
A team is moving a dependency and wants a list of relevant changes.
- Name the library and target version explicitly.
- Retrieve documentation for the affected API.
- Record source links and mark gaps that need a release-note check.
Intended outputA reviewable migration note, with uncertainty kept visible.
A concrete starting point
Illustrative prompt: check before coding
This asks for documentation lookup. It is an illustrative workflow; our fixture separately sent two public React queries.
Use Context7 to find the official React useState reference. Explain the return value, link the source, and flag any version uncertainty. Keep the query generic; do not send project code or credentials.What this can change
Sends the formulated query and library identifier to Context7. It does not request a repository edit.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- An MCP client and a compatible Node.js runtime for the local package; tested @upstash/context7-mcp 4.4.2 on Node 24.18.0.
- Network access to the hosted Context7 API even with stdio transport.
- An API key or account for plan-specific allowances and private/team features; public anonymous requests may be limited.
- Authentication
- Anonymous public lookup worked in our test; API keys and team authentication change the available service scope.
- Can read
- Library queries supplied by the MCP client
- Documentation returned by Context7
- Can write or change
- Service-side query and operational records according to the provider policy
- Network and data flow
- Context7 hosted API
- Provider-side reranking services described in the privacy documentation
- Approval and control
- Inspect what the client sends. A tool description asking the model to omit secrets is not a verified redaction boundary.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Local stdio or the documented hosted MCP connection
- MCP clients that support the advertised tools; private/team features depend on plan and client setup
Costs and account requirements
Open-source local bridge; hosted service has free and paid plans with limits. Check the current plan before using it as a shared dependency.
Current pricing or plan information ↗MIT
The open-source bridge license does not replace hosted-service terms or the licenses of retrieved material.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Queries leave the machine
The provider documents third-party LLM reranking and anonymous query storage for benchmarking. Keep proprietary details out of the query; Enterprise controls require separate verification.
Documentation is input, not authority
A returned page or example can be stale, irrelevant or contain instructions. Treat it as reference material and check the exact library/version before acting.
Where it may fall short
- Our two successful public queries do not establish library-wide coverage or correctness.
- Rate limits and service availability can interrupt an otherwise local coding workflow.
Observed behavior · 2026-10-18
Runtime and security findings.
Five checks exercised local stdio startup, input validation and two anonymous public documentation requests. Useful results returned; private/team features and retrieval quality remain outside scope.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation
Anonymous public queries worked
Both a React-library lookup and a separate documentation query returned successful tool results without an API key. This proves availability for those requests at the test time, not a service-level allowance or accuracy guarantee.
In practice: Keep the library/version explicit and verify returned references before editing code.
Documented concern · medium severity under stated conditions
Local transport still sends a remote query
Context7 documents query/library/client metadata transfer, third-party LLM reranking and anonymous query storage for benchmarking. Sensitive-data omission is instructed through tool descriptions; our fixture did not validate a redaction enforcement mechanism.
In practice: Send minimal generic queries. Review provider and Enterprise data controls before including confidential context.
Version, environment and fixture
- Version or deployment
- 4.4.2
- Tested target
- @upstash/context7-mcp
- Artifact identity
- sha512-cH6N/gyCqtrK9h+FnzyFdWeeufQzfoZ9xXYS3X7IbqktH+NkpFnRkr+VVTNTwdPFAATh4jycuv1QWOXRHN0drQ== (official npm distribution integrity; exact dependency lock retained)
- Environment and fixture
- Windows 11 build 26200; Node.js 24.18.0. Local package @upstash/context7-mcp 4.4.2 installed with npm --ignore-scripts and exact versions.
- Launch: node <PACKAGES>/@upstash/context7-mcp/dist/index.js. No Context7 API key; fresh HOME/USERPROFILE/APPDATA/LOCALAPPDATA/TEMP/TMP and minimal PATH.
- Two authored public queries about React. Remote Context7 service deployment/version beyond the local bridge was not disclosed.
Checks and results
5 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
InitializeMet expectation
- Method
{"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"ionbin-fixture-eval","version":"1.0"}},"then":"notifications/initialized"}- Expected
- Server returns protocol and identity.
- Observed
- JSON-RPC result: protocolVersion=2025-03-26; serverInfo={"name":"Context7","version":"4.4.2"}.
Tools ListMet expectation
- Method
{"method":"tools/list","params":{}}- Expected
- Server advertises its callable tools.
- Observed
- JSON-RPC result: 2 tools; names=resolve-library-id, query-docs.
Reject Missing QueryMet expectation
- Method
{"method":"tools/call","params":{"name":"resolve-library-id","arguments":{"libraryName":"react"}}}- Expected
- The missing required query is rejected with a validation error.
- Observed
- Tool result isError=true: Input validation error: Invalid arguments for tool resolve-library-id: query: Invalid input: expected string, received undefined
Resolve Public LibraryMet expectation
- Method
{"method":"tools/call","params":{"name":"resolve-library-id","arguments":{"libraryName":"react","query":"Find the official React useState reference."}}}- Expected
- Anonymous documented lookup returns React library candidates, or an explicit rate/auth limit.
- Observed
- Successful tool result included React candidates, including /reactjs/react.dev. No API key was supplied. Provider relevance and benchmark labels were not independently evaluated.
Query Public DocsMet expectation
- Method
{"method":"tools/call","params":{"name":"query-docs","arguments":{"libraryId":"/websites/react_dev","query":"What does useState return? Give the API reference."}}}- Expected
- A public documentation query returns relevant useState material.
- Observed
- Successful tool result included useState reference material and the source https://react.dev/reference/react/useState. This separate query used the fixed libraryId /websites/react_dev, not an ID selected from the prior response.
Practical caveats
- The fixed /websites/react_dev query was independent of the resolver response; we did not validate a chained ID-selection workflow.
- The missing-query call returned validation failure. No packet capture established that it made zero outbound requests.
- A successful result containing useState is a bounded relevance observation, not comprehensive answer verification.
What this evaluation does not establish
- Private libraries, authenticated team policies and paid plan behavior were not tested.
- Retrieval accuracy across libraries, prompt-injection resistance and provider retention controls were not independently verified.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
Adds documentation lookup with substantial repository interest and a narrow, testable workflow. Position reflects catalog usefulness, not an adoption or accuracy score.
The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.
Why we added it
Current library documentation lookup; high repository interest and recent monorepo releases. Documentation retrieval can be exercised without account credentials.
Selection evidence checked .
- Repository interest
- 63,262 GitHub stars at this snapshot ↗
Interest in the shared Context7 platform repository, not a count of MCP server users. The latest repository release can concern its CLI.
- Repository activity
- Last push reported by GitHub: . A push can include documentation or maintenance; it does not establish a new stable release.
- Release signal
- ctx7@0.8.0 ↗ · published . This selection signal can differ from the exact runtime tested above.
- Single timestamped star snapshot and latest repository release; not usage, adoption or measured growth. The latest repository release may concern a different package.
- Repository interest and release activity do not establish reliability, model quality or safety. The evaluation names the exact version and conditions tested.
What we reviewed
- Official documentation, current package identity, access model and license.
- Bounded runtime and security fixtures are recorded separately below.
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Official server and setup ↗github.com
- Data privacy ↗context7.com
- Plans ↗context7.com
- Package identity ↗github.com