context7

upstash/context7

Context7 is a documentation lookup MCP server, CLI, SDK, and set of agent plugins by Upstash that fetches version-specific library documentation and code examples for AI coding agents. The main risks are that its CLI skill templates instruct Codex to run unpinned npx commands outside the default sandbox, and local HTTP mode binds to all network interfaces by default.

What it can reach

Network

Connects to https://context7.com/api (or a user-configured base URL), https://mcp.context7.com, https://clerk.context7.com, https://login.microsoftonline.com, https://integrations.vercel.com, https://raw.githubusercontent.com, and https://registry.npmjs.org; can also listen on local TCP ports for HTTP MCP serving and Prometheus metrics.

Files

Reads and writes CLI credentials and state under ~/.config/context7 and ~/.local/state/context7, reads custom CA certificates from NODE_EXTRA_CA_CERTS, and modifies AI agent configuration, rule, and skill files (such as .mcp.json, .cursor/mcp.json, AGENTS.md, GEMINI.md, and .agents/skills) during setup or removal.

Secrets

Reads CONTEXT7_API_KEY and OAuth tokens from environment variables, CLI flags, HTTP headers, or local credential files, and writes API keys into agent configuration files during setup.

Shell commands

Spawns package manager commands (npm, pnpm, bun) when the user runs ctx7 upgrade.

Browser

Opens the system default browser to complete OAuth device authorization during ctx7 login and ctx7 setup.

Findings

1. MediumCLI setup injects instructions telling Codex to bypass its default sandbox

   packages/cli/src/setup/templates.ts:38

   When setting up CLI mode for OpenAI Codex, ctx7 appends guidance to AGENTS.md and the find-docs skill instructing the agent to run Context7 CLI commands outside Codex's default sandbox. Encouraging an AI agent to request unsandboxed execution weakens isolation for command execution.

   Fix: Remove the instruction to run commands outside the sandbox and instead advise the user how to allowlist the required domain in their sandbox network configuration.

2. LowSkills and rules instruct the agent to execute unpinned npm packages at runtime

   skills/find-docs/SKILL.md:24

   The find-docs and context7-cli skills and rule files instruct the coding agent to run npx ctx7@latest on each documentation lookup. Because @latest is not pinned to a specific version, any compromise of the npm package would immediately execute untrusted code on the user's machine when the agent looks up documentation.

   Fix: Recommend installing a pinned version of ctx7 or invoking the local binary rather than fetching @latest on every command.

3. LowMCP HTTP server listens on all network interfaces by default

   packages/mcp/src/index.ts:804

   When started with --transport http, app.listen(port) is called without specifying a bind address. Node.js therefore binds to 0.0.0.0 / :: (all network interfaces) even though the startup log prints http://localhost:<port>/mcp, exposing the server on the local network if run outside a container.

   Fix: Bind to 127.0.0.1 by default (matching the Prometheus exporter in telemetry-provider.ts) and provide a --host flag or environment variable for container deployments that need 0.0.0.0.

4. LowOAuth JWT audience check defaults to observe mode

   packages/mcp/src/lib/oauth-audience.ts:86

   When validating Clerk OAuth JWT access tokens on the HTTP transport, MCP_OAUTH_AUDIENCE_ENFORCEMENT defaults to observe. In this mode, tokens with a missing or foreign aud claim are logged but still accepted unless the operator explicitly sets the environment variable to foreign or required.

   Fix: Change the default enforcement mode to required (or foreign during migration) so tokens issued for other resource servers are rejected by default.

5. LowDevice login passes unvalidated server URI to the OS opener

   packages/cli/src/commands/auth.ts:135

   During ctx7 login and ctx7 setup, the verification_uri_complete or verification_uri returned by the server is passed directly to open() without verifying that its protocol is https: or http:. If a user passes a malicious --base-url, the server could return a non-HTTP URI scheme (such as file: or a custom application protocol) that the OS opener will execute.

   Fix: Parse the verification URI with new URL() and verify that its protocol is https: (or http: for localhost) before calling open().