Context7 MCP

Context7 MCP - Intelligent documentation search and context for any library

Security Scan

The skill's code and instructions require a CONTEXT7_API_KEY and npm dependencies but the registry metadata doesn't declare any required credentials or an install spec, and there are other small inconsistencies that make the package look sloppy or misconfigured.

Purpose & Capability

The skill's name/description (documentation search/context) matches the implemented behavior: query.ts calls https://context7.com APIs. Requested binary 'node' is appropriate. However, the registry metadata claims no required env vars or primary credential, while the code and README require a CONTEXT7_API_KEY — this mismatch is unexpected.

Instruction Scope

SKILL.md and query.ts confine actions to calling Context7 REST APIs (GET requests) and printing results. That's within scope. Concerns: SKILL.md tells users to copy a .env.example to .env, but no .env.example file is included in the package; query.ts also attempts to read a local .env file in addition to process.env. The instructions are otherwise explicit and do not reference unrelated system files or external endpoints beyond context7.com.

Install Mechanism

There is no automated install spec in the registry (instruction-only), which is lower risk, but package.json + package-lock.json are included and SKILL.md tells users to run npm install. That is reasonable, but the package declares dependencies (mcp-client, zod) even though query.ts does not import them. The lockfile is large with many dev/optional esbuild binaries — not malicious but unnecessary and worth auditing.

Credentials

The runtime requires CONTEXT7_API_KEY (read from process.env or a local .env) to function, but the skill's declared requirements list zero env vars and no primary credential. Requiring an API key for the 3rd-party service itself is proportionate to the stated purpose, but the omission from metadata is an incoherence that could mislead users. No other secrets are requested.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system config, and does not claim persistent/background privileges. It simply expects to be run with node when invoked.

What to consider before installing

This skill appears to be what it says (a Context7 documentation query tool) but has configuration/metadata inconsistencies you should resolve before installing or running it. Specifically: - The code requires CONTEXT7_API_KEY (via environment or a local .env), but the registry metadata does not declare this — expect to provide your API key. - SKILL.md tells you to copy .env.example, but no .env.example is bundled; ensure you get the API key from the official Context7 dashboard (https://context7.com) rather than an untrusted source. - package.json lists dependencies (mcp-client, zod) not used by query.ts and a large package-lock.json is included; consider running a dependency audit (npm audit) and inspect third-party packages for unexpected network behavior before running npm install. - The CLI only contacts context7.com in the code. If you plan to grant this skill an API key, be comfortable that the key will be sent to that domain. If you don't have a Context7 account or don't trust the publisher, do not provide credentials. If you want to proceed, ask the publisher to update the registry metadata to declare CONTEXT7_API_KEY as a required credential, remove or explain unused dependencies, and include the missing .env.example or clearer setup instructions. If you are unsure, treat this package as untrusted and avoid running npm install / executing the script until those issues are addressed.

Context7 provides intelligent documentation search and context for any library, powered by LLMs.

Setup

1. Copy .env.example to .env and add your Context7 API key:

   cp .env.example .env
   

   Add your API key to .env:

   CONTEXT7_API_KEY=your-api-key-here
   

   Get your key from context7.com/dashboard

2. Install dependencies:

   npm install
   

Usage

Context7 provides two main commands:

Search Command

Search for libraries by name with intelligent LLM-powered ranking:

npx tsx query.ts search <library_name> <query>

# Examples:
npx tsx query.ts search "nextjs" "setup ssr"
npx tsx query.ts search "react" "useEffect cleanup"
npx tsx query.ts search "better-auth" "authentication flow"

This calls the Context7 Search API:

GET https://context7.com/api/v2/libs/search?libraryName=<name>&query=<query>

Response includes:

• id: Library ID (e.g., /vercel/next.js)
• name: Display name
• trustScore: Source reputation (0-100)
• benchmarkScore: Quality indicator (0-100)
• versions: Available version tags

Context Command

Retrieve intelligent, LLM-reranked documentation context:

npx tsx query.ts context <owner/repo> <query>

# Examples:
npx tsx query.ts context "vercel/next.js" "setup ssr"
npx tsx query.ts context "facebook/react" "useState hook"

This calls the Context7 Context API:

GET https://context7.com/api/v2/context?libraryId=<repo>&query=<query>&type=txt

Response includes:

• title: Documentation section title
• content: Documentation text/snippet
• source: URL to source page

Quick Reference

# Search for documentation
npx tsx query.ts search "library-name" "your search query"

# Get context from a specific repo
npx tsx query.ts context "owner/repo" "your question"

Best Practices

Get the most out of the Context7 API with these best practices:

Optimize Search Relevance

When using the /libs/search endpoint, always include the user's original question in the query parameter. This allows the API to use LLM-powered ranking to find the most relevant library for the specific task, rather than relying on a simple name match.

Example: If a user asks about SSR in Next.js, search with:

• libraryName=nextjs
• query=setup+ssr

This ensures the best ranking for the specific task.

Use Specific Library IDs

For the fastest and most accurate results with the /context endpoint, provide the full libraryId (e.g., /vercel/next.js). If you already know the library the user is asking about, skipping the search step and calling the context endpoint directly reduces latency.

Leverage Versioning

To ensure documentation accuracy for older or specific project requirements, include the version in the libraryId using the /owner/repo/version format. You can find available version tags in the response from the search endpoint.

Choose the Right Response Type

Tailor the /context response to your needs using the type parameter:

• Use type=json when you need to programmatically handle titles, content snippets, and source URLs (ideal for UI display).
• Use type=txt when you want to pipe the documentation directly into an LLM prompt as plain text.

Filter by Quality Scores

When programmatically selecting a library from search results, use the trustScore and benchmarkScore to prioritize high-quality, reputable documentation sources for your users.

Find Navigation Pages

Find navigation and other pages in this documentation by fetching the llms.txt file at:

https://context7.com/docs/llms.txt

API Reference

Context7 REST API

Search Endpoint:

GET https://context7.com/api/v2/libs/search
  ?libraryName=<library_name>
  &query=<user_query>

Context Endpoint:

GET https://context7.com/api/v2/context
  ?libraryId=<owner/repo>
  &query=<user_query>
  &type=txt|json

Troubleshooting

No results found?

• Check your API key is valid
• Verify the library name is correct (e.g., 'react' not 'React')

Authentication errors?

• Ensure CONTEXT7_API_KEY is set in .env
• Check your key hasn't expired at context7.com/dashboard

License

MIT