ctx7@0.5.4

Patch Changes

• 33229cb: Clarify the query-docs query description so it asks for a single concept per query. When a question spans multiple distinct topics, callers are now told to make a separate query per concept instead of combining them (unless the question is about how the concepts interact), which avoids diluted, shallow results. Applied consistently across the MCP server, CLI, pi, and AI SDK tools.

@upstash/context7-tools-ai-sdk@0.2.4

Patch Changes

• 33229cb: Clarify the query-docs query description so it asks for a single concept per query. When a question spans multiple distinct topics, callers are now told to make a separate query per concept instead of combining them (unless the question is about how the concepts interact), which avoids diluted, shallow results. Applied consistently across the MCP server, CLI, pi, and AI SDK tools.

@upstash/context7-pi@0.1.1

Patch Changes

• 33229cb: Clarify the query-docs query description so it asks for a single concept per query. When a question spans multiple distinct topics, callers are now told to make a separate query per concept instead of combining them (unless the question is about how the concepts interact), which avoids diluted, shallow results. Applied consistently across the MCP server, CLI, pi, and AI SDK tools.

@upstash/context7-mcp@3.2.3

Patch Changes

• 41878ec: Skip loopback (127.0.0.0/8), link-local (169.254.0.0/16), CGNAT (100.64.0.0/10), IPv6 loopback (::1), IPv6 link-local (fe80::/10), and IPv6 unique-local (fc00::/7) addresses when extracting the client IP from X-Forwarded-For, so proxy-internal hops no longer pollute the reported client IP.
• 33229cb: Clarify the query-docs query description so it asks for a single concept per query. When a question spans multiple distinct topics, callers are now told to make a separate query per concept instead of combining them (unless the question is about how the concepts interact), which avoids diluted, shallow results. Applied consistently across the MCP server, CLI, pi, and AI SDK tools.

@upstash/context7-mcp@3.2.2

Patch Changes

• 2253765: Validate Enterprise-Managed Auth (id-jag) access tokens at the MCP server, so MCP clients can authenticate to Context7 through an enterprise IdP (Okta) via the MCP Enterprise-Managed Authorization extension.

ctx7@0.5.3

Patch Changes

• acd0d46: Surface GitHub API error details when skill download fails (#2363)

  Previously, any GitHub API failure during ctx7 setup or ctx7 setup --cli produced the opaque message "GitHub API error", making it impossible to distinguish a 403 rate-limit from a 401 bad token or a 404 wrong branch.

  Changes:

  • fetchRepoTree and fetchDefaultBranch now extract the HTTP status and GitHub error body, returning descriptive strings like "HTTP 403: API rate limit exceeded"
  • listSkillsFromGitHub distinguishes a true 404 (repo not found) from other errors (rate-limit, bad credentials) that previously all collapsed into the same silent result
  • When a request fails unauthenticated with a 403/429, a hint is shown: run \gh auth login` or set the GITHUB_TOKEN env var to increase rate limits`
  • Failed skill entries in the setup results table now show a red ✖ with the error detail on its own line instead of embedding it in the status string

@upstash/context7-mcp@3.2.1

Patch Changes

• 8123b51: Restore Node 18 support by pinning undici to ^6.26.0 and commander to ^13.1.0, which dropped the Node 20+ engine requirements that caused a "File is not defined" crash on startup.

ctx7@0.5.2

Patch Changes

• cb6aee1: Bump runtime dependencies: commander 13 -> 15 and ora 9.0 -> 9.4.
• 428af3e: Recover Context7 library IDs that Git Bash mangles on Windows. Git Bash rewrites a leading-slash argument like /facebook/react into a Windows path under the Git install dir (C:/Program Files/Git/facebook/react), causing ctx7 docs to reject it as invalid; this mainly affected users running ctx7 through Claude Code. The CLI now detects and undoes the conversion before validation, accepts the //owner/repo escape, and points users at that workaround for install layouts it can't auto-detect.
• c03bc9c: Store CLI files in XDG Base Directory locations instead of ~/.context7. Credentials move to $XDG_CONFIG_HOME/context7 (default ~/.config/context7), updater state to $XDG_STATE_HOME/context7 (default ~/.local/state/context7), and generate previews to $XDG_CACHE_HOME/context7 (default ~/.cache/context7). Existing files in ~/.context7 are migrated automatically on first use; migration is best-effort and falls back to reading the legacy file if it cannot complete. The credentials file is always re-asserted to 0o600 after migration or write so it is never group/world-readable. Relative or empty XDG_* values are ignored per the spec.

@upstash/context7-sdk@0.3.1

Patch Changes

• f327589: Avoid throwing a raw SyntaxError when the server returns a non-JSON error body. HttpClient.request() now wraps the error-path res.json() in a .catch, so non-JSON responses (HTML 502s, plain-text 429s, Cloudflare challenge pages) fall back to res.statusText and always surface as a typed Context7Error.

@upstash/context7-mcp@3.2.0

Minor Changes

• c921c8b: Replace the in-result sign-in nudge with an MCP form elicitation. When the backend signals (via X-Context7-Auth-Prompt: 1) that an anonymous client has crossed the per-IP threshold, the MCP server now fires an elicitation/create request instead of appending instructions into the tool result.
  • Surfaces the npx ctx7 setup --<client> --mcp[ --stdio] -y command in a client-rendered dialog rather than as model-visible text. The previous text-injection approach was treated as untrusted instruction content by some agents; elicitations are delivered out-of-band to the user so they bypass that path entirely.
  • Gated on the client advertising the elicitation capability — clients without it see no nudge, which is a safe no-op.
  • Presents a two-option radio: "I'll run the command to sign in" or "Continue anonymously with smaller limits".
  • The server holds no suppression state: the backend emits the header at most once per MCP session, so the dialog is shown whenever the header is present. Frequency is owned entirely by the backend.
  • Fire-and-forget: the elicitation does not block or alter the surrounding tool response.

Patch Changes

• cb6aee1: Bump runtime dependencies: @modelcontextprotocol/sdk 1.25 -> 1.29, undici 6 -> 7, and zod 4.3 -> 4.4.
• fcdc36e: Advertise empty prompts and resources capabilities with no-op prompts/list, resources/list, and resources/templates/list handlers. Some MCP clients (e.g. opencode) call these unconditionally and treat -32601 Method not found as a fatal connection error rather than honoring the negotiated capabilities, which previously prevented the server from loading.