Build my server

Guides

Context7 MCP Server: Setup, API Key and Security (Oct 2026)

By Team TrustedMCP

On this page
Context7 MCP Server: Setup, API Key and Security (Oct 2026)

Context7 MCP is Upstash's server that pulls current, version-specific library docs into the model's context. That stops the agent from guessing at old APIs. TrustedMCP grades it A. One caution: the docs it returns are outside text, so treat them as untrusted input.

The server code is open source at upstash/context7. The backend, parser and crawler behind it are private. It sits in our docs and knowledge category.

What it connects

  • Two tools. resolve-library-id turns a name like "next.js" into a Context7 ID. query-docs fetches docs and code examples for that ID. (It was called get-library-docs before, so update old allowlists.)
  • Read-only. It looks up docs. It cannot touch your repos, files or accounts.
  • Hosted or local. Use the hosted server at https://mcp.context7.com/mcp, or run the npm package @upstash/context7-mcp with npx. Local needs Node.js 20.18.1 or newer.

Add use context7 to a prompt to call it, or add a rule (for example in CLAUDE.md) so the agent uses it on its own.

Setup

These snippets come from the Context7 MCP README. YOUR_API_KEY is a placeholder. The key is optional, so you can drop the header or the --api-key part to start without one.

Claude Code, hosted server:

claude mcp add --scope user --header "Authorization: Bearer YOUR_API_KEY" --transport http context7 https://mcp.context7.com/mcp

Claude Code, local server:

claude mcp add --scope user context7 -- npx -y @upstash/context7-mcp --api-key YOUR_API_KEY

Cursor (~/.cursor/mcp.json), hosted:

{ "mcpServers": { "context7": { "url": "https://mcp.context7.com/mcp",
  "headers": { "Authorization": "Bearer YOUR_API_KEY" } } } }

Cursor, local:

{ "mcpServers": { "context7": { "command": "npx",
  "args": ["-y", "@upstash/context7-mcp", "--api-key", "YOUR_API_KEY"] } } }

VS Code, hosted:

"mcp": { "servers": { "context7": { "type": "http", "url": "https://mcp.context7.com/mcp",
  "headers": { "Authorization": "Bearer YOUR_API_KEY" } } } }

For a local server in VS Code, use "type": "stdio" with the same npx command and args as Cursor. Claude Desktop takes the hosted URL as a custom connector (Settings > Connectors > Add Custom Connector). The README also covers Codex, Gemini CLI, Zed, JetBrains and more. See also the VS Code MCP guide.

Free or paid, and do you need a key?

You do not need a key. Context7 works without one. A key gives higher rate limits and private repos. The keyless limit is not published.

You get a key by making a free account at context7.com. At the time of writing, the plans page lists the free plan at 1,000 API calls a month. After that, free users are blocked except for 20 bonus calls a day until the month resets. Pro is $10 per seat a month with 2,000 calls per seat.

Where to put the API key

  • In a header or an environment variable. Never in the URL. URLs end up in logs and history. The README only ever sends the key as Authorization: Bearer on the hosted server.
  • For the local server, use the env var. The README supports CONTEXT7_API_KEY instead of --api-key, so the key stays out of the command args:
{ "mcpServers": { "context7": { "command": "npx", "args": ["-y", "@upstash/context7-mcp"],
  "env": { "CONTEXT7_API_KEY": "YOUR_API_KEY" } } } }
  • Keep it out of committed files. Use user-level config, not a project file in your repo. In Claude Code, --scope user does that. In Cursor, use ~/.cursor/mcp.json, not the project's .cursor/mcp.json. If you keep the key in a .env file, add that file to .gitignore.
  • Or skip the key with OAuth. The README says clients that support MCP OAuth can use https://mcp.context7.com/mcp/oauth instead. OAuth does not work with the local stdio server.
  • Don't tick "management access" when you create a docs key. Per Context7's API key docs, only the admin tools need it. Revoking a key stops it at once.

Security notes

The past CVE. CVE-2026-75130, nicknamed "ContextCrush", was a prompt injection bug. Library owners could add "Custom AI Instructions" to their library. Context7 served that text to every agent that asked for those docs, with no filtering. A poisoned rule could tell the agent to read secrets from .env files, send them out, and delete files. Noma Security reported it on 18 February 2026. Upstash deployed a fix to production on 23 February, five days later, with rule sanitization and guardrails. Noma published on 5 March. The NVD entry lists Context7 through 2.1.2 and a CVSS 4.0 score of 6.4 (medium).

The lesson still applies. Context7's own disclaimer says the libraries are community-contributed and it cannot guarantee their security. So treat what it returns like any web page. Keep approval on for shell commands, file deletes and network calls the agent proposes after reading docs. More in MCP security best practices and is it safe to install an MCP server.

Low blast radius. The server only reads docs. The risk is what your agent does with that text.

Why it grades A

  • Maintenance, 25 of 25. Commits most days and frequent releases.
  • Known CVEs, 25 of 25. One past CVE, fixed in production five days after the report. Nothing is open.
  • Transport, 20 of 20. The hosted server runs over HTTPS. Local runs over stdio on your machine.
  • Authentication, 18 of 30. This is the only deduction. It works with no key by default, and the API key or OAuth is optional. ContextCrush showed that the docs it returns can carry instructions into your agent.

Full breakdown on the Context7 MCP listing. The method is in how TrustedMCP scores servers.

FAQs

What is Context7? A docs lookup service from Upstash. Its MCP server fetches current docs and code examples for the library version you use.

Is Context7 free? Yes. It works with no key. A free account adds a key with 1,000 calls a month. Paid plans add more calls.

Do I need an API key? No. Add one for higher limits or private repos.

How do I install Context7 in Claude Code or Cursor? Use the snippets above. In Claude Code, run claude mcp list afterwards to check it shows up. In Cursor, restart after editing mcp.json.

Is Context7 safe? For a read-only docs server, yes, with one habit: treat returned docs as untrusted text. The ContextCrush bug was fixed in February 2026 and nothing is open.

Does it use a lot of context? Its tool list is small, only two tools. The docs it returns do use context, so ask focused questions. Naming the library ID in your prompt (for example /supabase/supabase) skips the lookup step. See why MCP servers eat your context window.