Coding agents write code against the API they remember, and they remember last year's. Context7 exists to close that gap: it keeps an index of library documentation and hands the relevant pieces to the agent at the moment it needs them. With 64,773 stars, upstash/context7 is one of the most installed MCP servers there is.
It has also changed shape several times. The tool most guides describe, get-library-docs, no longer exists; there is now a free quota with a key; and the answers you get depend on which version of a library you ask for, in ways that are easy to miss. We ran @upstash/context7-mcp 4.7.0, published on 12 November 2026, through MCP Inspector's CLI on 14 November 2026, without an API key, and looked at what came back.
Install it
Context7 runs two ways. Both talk to the same hosted Context7 API.
| Remote | Local | |
|---|---|---|
| Address or command | https://mcp.context7.com/mcp |
npx -y @upstash/context7-mcp |
| Key | Authorization: Bearer header, or OAuth at /mcp/oauth |
--api-key flag or CONTEXT7_API_KEY |
| Needs Node.js | No | 20.18.1 or newer |
| Works offline | No | No: it still calls the hosted API |
Pick remote unless your client cannot do HTTP servers. The local package is a thin client; Context7's README is clear that only the MCP server is open source and the index, parser and crawler are private.
Get a free key at context7.com first. Keys start with ctx7sk- and are shown once.
Claude Code, remote:
claude mcp add --scope user --header "Authorization: Bearer YOUR_API_KEY" --transport http context7 https://mcp.context7.com/mcp
Or the plugin, which uses OAuth through /mcp instead of a key:
/plugin marketplace add upstash/context7
/plugin install context7@context7-marketplace
Cursor, in ~/.cursor/mcp.json:
{
"mcpServers": {
"context7": {
"url": "https://mcp.context7.com/mcp",
"headers": { "Authorization": "Bearer YOUR_API_KEY" }
}
}
}
VS Code uses servers instead of mcpServers, in .vscode/mcp.json:
{
"servers": {
"context7": {
"type": "http",
"url": "https://mcp.context7.com/mcp",
"headers": { "Authorization": "Bearer YOUR_API_KEY" }
}
}
}
Codex:
codex mcp add context7 -- npx -y @upstash/context7-mcp --api-key YOUR_API_KEY
If Codex times out on start, raise startup_timeout_sec to 40 in its config, as Context7's Codex page suggests. Claude Desktop adds it as a custom connector: Settings, Connectors, Add Custom Connector, URL https://mcp.context7.com/mcp.
Context7 also offers npx ctx7 setup, which signs you in, creates a key and installs either the MCP entry or a skill for Claude Code, Cursor, Codex or OpenCode. npx ctx7 remove undoes it. Our config builder writes the plain entries if you prefer to see what goes where.
The two tools
tools/list on 4.7.0 returned two tools, both marked read-only and idempotent:
| Tool | Parameters | What it does |
|---|---|---|
resolve-library-id |
libraryName, query |
Finds the Context7 ID for a library, ranked against your question |
query-docs |
libraryId, query, optional language |
Returns documentation sections and code examples for that library |
The descriptions tell the agent to resolve first unless the user already gave an ID like /vercel/next.js, and to make no more than three calls of each per question. Both query fields carry the same warning: do not include API keys, passwords, personal data or proprietary code, because the query is sent to Context7's API.
If you are following an older tutorial: get-library-docs was replaced by query-docs in version 2.0.0, and its tokens, topic, page and mode parameters are gone. Since 2.2.5 the server quietly fixes some argument names agents invent, such as question for query.
What we got back
We asked resolve-library-id for "next.js" with the question "app router middleware". The reply was 2,175 bytes. The top hit was /vercel/next.js: 7,338 code snippets, source reputation High, benchmark score 79.96, with versions from v12.3.7 to v16.4.5 plus canary branches. Next came /websites/nextjs, the docs website indexed separately, with 9,524 snippets and a score of 76.15. Two IDs for one framework is normal in Context7; the repository and the website are indexed as separate libraries.
Then we called query-docs three times:
| Library ID | Question | Reply | Code blocks |
|---|---|---|---|
/vercel/next.js |
proxy that redirects unauthenticated users | 8,422 bytes | 5 |
/vercel/next.js |
server actions revalidatePath | 4,304 bytes | 8 |
/vercel/next.js/v16.2.9 |
proxy that redirects unauthenticated users | 5,512 bytes | not counted |
The replies are compact: a few sections, each with a heading, a source link and a code example, small enough that an agent can call it several times in a session without filling its context. The anonymous calls worked without a key and without errors.
Pin the version
The detail that matters most was in the source links. The unpinned answers pointed to files on the canary branch of the Next.js repository: documentation for code that has not been released yet. For a fast-moving framework, canary docs can describe APIs, names or defaults that your installed version does not have.
Pinning fixes it. Add the version to the ID, /vercel/next.js/v16.2.9, and the reply comes from that release; ours was a different and shorter answer to the same question. The versions Context7 holds are listed in the resolve-library-id output, and you can also name the version in plain words in your prompt.
A standing rule saves typing. Context7's own tip is a line in CLAUDE.md or your Cursor rules telling the agent to use Context7 for library documentation, setup and configuration without being asked. We would add one clause: "and use the version in package.json".
Plans and limits
| Free | Pro | Enterprise | |
|---|---|---|---|
| Price | $0 | $10 per seat a month | Custom |
| Calls included | 1,000 a month | 2,000 per seat a month | 2,000 per seat a month |
| After that | 20 bonus calls a day until the month resets | $5 per 1,000, never blocked | $5 per 1,000 |
| Private repositories | No | Yes, $5 per million parsed tokens | Yes |
| Team members | Just you | Up to 30 | Unlimited, with SSO and self-hosting |
A call is one search or one docs request, through the MCP server, the CLI or the REST API. Without a key you get what Context7 calls "low rate limits", with no number published. A limited request returns HTTP 429 with Retry-After and RateLimit-* headers.
In practice, each question an agent answers with Context7 costs two calls: one resolve and one query, or more if it retries. Naming the ID in your prompt, or in a rule, skips the resolve step and halves the cost.
How docs get into Context7
Anyone can add a public library at context7.com/add-library by pasting a GitHub URL, whether they own the project or not. Context7 also takes websites, llms.txt files and OpenAPI specs. It indexes Markdown, MDX, reStructuredText, notebooks and similar text, converts PDF and DOCX, and skips pages that are mainly not in English. When a repository has little documentation, Context7 generates examples from the source.
Libraries refresh when someone asks for them and the copy is stale. How stale depends on popularity: one day for the top 100, 15 days for the top 1,000, 30 for the top 5,000, and 45 for everything else, with websites and llms.txt sources waiting ten days longer. A less popular library can be six weeks behind its own docs.
If you maintain a library, a context7.json file in the repository root controls what gets indexed: which folders, which branch, which older versions, and rules that get prepended to answers. "disallow": true removes the library. Claiming it gives you an admin panel and a path to the verified badge.
Safety
Everything Context7 returns was written by someone else, and some of it was submitted by people who do not own the project. That makes it the same kind of input as a web page: data for the model to read, not instructions to follow.
Context7 says it runs every submitted repository and site through a two-pass prompt-injection classifier and skips flagged chunks. It scores libraries on trust, from signals such as the account's age, stars and activity, and on a benchmark of generated developer questions; the score of 79.96 above is that benchmark. Upstash's blog says the verified badge is only a visual indicator so far.
One incident is worth knowing about. In May 2026, users reported that query-docs replies ended with a "system notice" asking the assistant to offer to run npx ctx7 setup -y (issues 2663 and 2673). The maintainers explained that it was their own test of a sign-in prompt for anonymous users, added in 2.3.0, and switched it off after objections. It came from Context7's server rather than a library's docs, but it shows how easily text in a tool result can ask an agent to run a command. Approve shell commands yourself.
The practical rules: keep secrets out of questions, prefer verified or well-known libraries, and on Pro or Enterprise use a teamspace policy to restrict which libraries can be used. More on this class of risk in MCP security.
Alternatives
| Server | What it does | Key | Notes |
|---|---|---|---|
| Context7 | Pre-built index of library docs with versions and scores | Free key | 64,773 stars, MIT server, private index |
| DeepWiki MCP | Questions about any public GitHub repository, answered from an AI-written wiki | None | Hosted by Cognition at mcp.deepwiki.com/mcp, free |
| GitMCP | Turns one repository's llms.txt or README into a docs endpoint |
None | 8,515 stars, Apache-2.0, last push May 2026 |
| Ref | Searches documentation and reads pages | Required | 1,186 stars, MIT; pricing not stated on its site |
Context7 is the better fit when you want the same library at a known version every time. DeepWiki is good for understanding an unfamiliar repository as a whole. GitMCP is the lightest option for one project that publishes a good llms.txt. For framework-specific work, the framework's own server can beat all of them; Next.js 16 ships version-matched docs to agents through next-devtools-mcp, covered in our Next.js MCP guide.
When it does not work
| What you see | Cause | Fix |
|---|---|---|
| HTTP 429 | Free or anonymous limit reached | Add a key, wait for the daily bonus or upgrade; check usage with the API's usage endpoint |
| Code uses an API your version lacks | Unpinned query answered from newer or canary docs | Pin /org/project/vX or name the version in the prompt |
| Agent never calls Context7 | No "use context7" and no standing rule | Add the rule to CLAUDE.md or Cursor rules |
Tutorial calls get-library-docs |
Written before 2.0.0 | Use resolve-library-id and query-docs |
| Codex fails on start | Startup timeout | Set startup_timeout_sec to 40 |
| A library is out of date | Refresh is on demand, up to 45 days | Refresh it on its Context7 page, or ask the maintainer to add the GitHub Action |
| The wrong project comes back | Several IDs for one name | Read the resolve list and choose by snippets, reputation and score; then name the ID |
The Context7 entries in our catalog, with checks scores and install commands, are at the top of this page.
