Is Context7 MCP server safe?
What Context7 MCP server does
Context7 MCP pulls up-to-date, version-specific documentation and code examples for libraries into the model's prompt, using a resolve-library-id tool to find a library and get-library-docs to fetch its docs. The npm package is published under the @upstash scope from the upstash/context7 repository. It sends library queries to the Context7 service over the network; an optional API key raises rate limits and enables private repositories. Before installing, pin a package version instead of the @latest tag shown in many examples, and keep any API key in your client's private configuration rather than in a shared project file.
- Node.js network egress
- MCP tool surface detected
What to do: Nothing here argues against installing it. Grant the capabilities it lists only if you expect the tool to need them.
Context7 MCP server is an MCP server analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators. It can: mcp tools detected and network egress — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).
@upstash/
Get notified when this component changes
Change alerts aren't live yet. Leave your email and we'll let you know when they launch. We use it only for this and delete it on request.
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Context7 MCP server's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (2)
The component makes outbound network requests.
const upstream = await observeUpstreamRequest("oauth_metadata", () => fetch(`${authServerUrl}/.well-known/oauth-authorization-server`, {return await observeUpstreamRequest("search_libraries", () => fetch(url, { headers, signal: abortSignal }), async (response) => {return await observeUpstreamRequest("submit_feedback", () => fetch(url, {return await observeUpstreamRequest("fetch_code", () => fetch(url, { headers, signal: abortSignal }), async (response) => {return await observeUpstreamRequest("fetch_upgrade_guide", () => fetch(url, { headers, signal: abortSignal }), async (response) => {return await observeUpstreamRequest("fetch_context", () => fetch(url, { headers, signal: abortSignal }), async (response) => {const res = await fetch(`${CONTEXT7_API_BASE_URL}/v2/entra/config/${encodeURIComponent(audience)}`);return handler.fetch(request, options);
const response = await operation.run(() => handler.fetch(request, options));
return await observeUpstreamRequest("auth_check", () => fetch(`${CONTEXT7_API_BASE_URL}${AUTH_CHECK_PATH}`, {Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
An MCP tool surface (manifest or tool definitions) was found.
: new McpServer(serverInfo, serverOptions);
server.registerTool(RESOLVE_LIBRARY_ID_TOOL, {server.registerTool(QUERY_DOCS_TOOL, {const rawStdioTransport = new StdioServerTransport();
server.registerTool(QUERY_CODE_TOOL, {server.registerTool(SUBMIT_DOCS_FEEDBACK_TOOL, {server.registerTool(GET_UPGRADE_GUIDE_TOOL, {Why it matters: Just context — review which tools it offers and their permissions.
Fix: Review the declared MCP tools and their permissions.
Maintain Context7 MCP server?
The free Claude Code plugin scans each npm, PyPI or MCP package with this report's open-source engine before the install command runs. It runs on your machine and needs no account.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →