@upstash/context7-mcp 3.1.0 → 3.2.0

package/README.md

@@ -52,7 +52,7 @@ Check out our [project addition guide](https://context7.com/docs/adding-librarie
 ### Requirements
 
 - Node.js >= v18.0.0
-- Cursor, Claude Code, VSCode, Windsurf or another MCP Client
+- Cursor, Claude Code, VSCode, Devin Desktop or another MCP Client
 - Context7 API Key (Optional) for higher rate limits and private repositories (Get yours by creating an account at [context7.com/dashboard](https://context7.com/dashboard))
 
 > [!TIP]
@@ -60,7 +60,7 @@ Check out our [project addition guide](https://context7.com/docs/adding-librarie
 >
 > After installing Context7 (see instructions below), enhance your workflow by adding a rule so you don't have to type `use context7` in every prompt. Define a simple rule in your MCP client's rule section to automatically invoke Context7 on any code question:
 >
-> - For Windsurf, in `.windsurfrules` file
+> - For Devin Desktop, in `.devin/rules/` directory
 > - For Cursor, from `Cursor Settings > Rules` section
 > - For Claude Code, in `CLAUDE.md` file
 > - Or the equivalent in your MCP client
@@ -172,11 +172,11 @@ amp mcp add context7 --header "CONTEXT7_API_KEY=YOUR_API_KEY" https://mcp.contex
 </details>
 
 <details>
-<summary><b>Install in Windsurf</b></summary>
+<summary><b>Install in Devin Desktop</b></summary>
 
-Add this to your Windsurf MCP config file. See [Windsurf MCP docs](https://docs.windsurf.com/windsurf/cascade/mcp) for more info.
+Add this to your Devin Desktop MCP config file. See [Devin Desktop MCP docs](https://docs.devin.ai/desktop/cascade/mcp) for more info.
 
-#### Windsurf Remote Server Connection
+#### Devin Desktop Remote Server Connection
 
 ```json
 {
@@ -191,7 +191,7 @@ Add this to your Windsurf MCP config file. See [Windsurf MCP docs](https://docs.
 }
 ```
 
-#### Windsurf Local Server Connection
+#### Devin Desktop Local Server Connection
 
 ```json
 {
@@ -863,7 +863,7 @@ If you prefer to run the MCP server in a Docker container:
    # EXPOSE 3000
 
    # Default command to run the server
-   CMD ["context7-mcp"]
+   CMD ["context7-mcp", "--transport", "stdio"]
    ```
 
    </details>
@@ -897,6 +897,37 @@ If you prefer to run the MCP server in a Docker container:
 
    _Note: This is an example configuration. Please refer to the specific examples for your MCP client (like Cursor, VS Code, etc.) earlier in this README to adapt the structure (e.g., `mcpServers` vs `servers`). Also, ensure the image name in `args` matches the tag used during the `docker build` command._
 
+   If you use the Docker MCP Toolkit image (`mcp/context7`) with a stdio-based client,
+   set `MCP_TRANSPORT=stdio` so the container starts with stdio transport instead of its
+   HTTP default. For Cline, Roo Code, and Claude Desktop, use:
+
+   ```json
+   {
+     "mcpServers": {
+       "context7": {
+         "command": "docker",
+         "args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT=stdio", "mcp/context7"]
+       }
+     }
+   }
+   ```
+
+   For VS Code, use the same Docker command in the `servers` format:
+
+   ```json
+   {
+     "servers": {
+       "context7": {
+         "type": "stdio",
+         "command": "docker",
+         "args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT=stdio", "mcp/context7"]
+       }
+     }
+   }
+   ```
+
+   Keep using the remote server URL for HTTP-based clients.
+
 </details>
 
 <details>

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 import { searchLibraries, fetchLibraryContext } from "./lib/api.js";
 import { formatSearchResults, extractClientInfoFromUserAgent } from "./lib/utils.js";
@@ -13,7 +14,7 @@ import { AsyncLocalStorage } from "async_hooks";
 import { randomUUID } from "node:crypto";
 import { createSessionStore } from "./lib/sessionStore.js";
 import { SERVER_VERSION, RESOURCE_URL, AUTH_SERVER_URL, OPENAI_APPS_CHALLENGE_TOKEN, } from "./lib/constants.js";
-import { appendAuthPrompt } from "./lib/auth/auth-prompt.js";
+import { maybeElicitAuthSignIn } from "./lib/auth/auth-prompt.js";
 /** Default HTTP server port */
 const DEFAULT_PORT = 3000;
 // Parse CLI arguments using commander
@@ -167,22 +168,24 @@ IMPORTANT: Do not call this tool more than 3 times per question. If you cannot f
         const searchResponse = await searchLibraries(query, libraryName, ctx);
         if (!searchResponse.results || searchResponse.results.length === 0) {
             const text = searchResponse.error ?? "No libraries found matching the provided name.";
+            maybeElicitAuthSignIn(server, ctx);
             return {
                 content: [
                     {
                         type: "text",
-                        text: appendAuthPrompt(text, ctx),
+                        text,
                     },
                 ],
             };
         }
         const resultsText = formatSearchResults(searchResponse);
         const responseText = `Available Libraries:\n\n${resultsText}`;
+        maybeElicitAuthSignIn(server, ctx);
         return {
             content: [
                 {
                     type: "text",
-                    text: appendAuthPrompt(responseText, ctx),
+                    text: responseText,
                 },
             ],
         };
@@ -211,15 +214,24 @@ Do not call this tool more than 3 times per question.`,
     }, async ({ query, libraryId }) => {
         const ctx = getClientContext();
         const response = await fetchLibraryContext({ query, libraryId }, ctx);
+        maybeElicitAuthSignIn(server, ctx);
         return {
             content: [
                 {
                     type: "text",
-                    text: appendAuthPrompt(response.data, ctx),
+                    text: response.data,
                 },
             ],
         };
     });
+    server.server.registerCapabilities({ prompts: {}, resources: {} });
+    server.server.setRequestHandler(ListPromptsRequestSchema, async () => ({ prompts: [] }));
+    server.server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+        resources: [],
+    }));
+    server.server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({
+        resourceTemplates: [],
+    }));
     return server;
 }
 const GLOBAL_ALIASES = {

package/dist/lib/auth/auth-prompt.js

@@ -14,38 +14,72 @@ function clientFlagForCli(ide) {
         return "--gemini";
     return "";
 }
-/**
- * Appends a sign-in nudge to `text` when the backend has signaled (via
- * `X-Context7-Auth-Prompt: 1`, captured on `ctx.shouldPrompt` in api.ts)
- * that the anonymous caller should be prompted to authenticate. No-op for
- * authenticated callers or when the signal wasn't set.
- */
-export function appendAuthPrompt(text, ctx) {
-    if (ctx.apiKey || !ctx.shouldPrompt)
-        return text;
-    return `${text}\n\n${buildAuthPrompt({
-        clientIde: ctx.clientInfo?.ide,
-        transport: ctx.transport,
-    })}`;
-}
-export function buildAuthPrompt(opts) {
-    const flag = clientFlagForCli(opts.clientIde);
-    const transportFlag = opts.transport === "stdio" ? " --stdio" : "";
-    const command = flag
+function buildAuthCommand(clientIde, transport) {
+    const flag = clientFlagForCli(clientIde);
+    const transportFlag = transport === "stdio" ? " --stdio" : "";
+    return flag
         ? `npx ctx7 setup ${flag} --mcp${transportFlag} -y`
         : `npx ctx7 setup --mcp${transportFlag}`;
+}
+function buildElicitMessage(clientIde, transport) {
+    const command = buildAuthCommand(clientIde, transport);
     return [
-        "---",
-        `**[Heads up] Notice for the user — please relay the following section to them and offer to run the command for them after their confirmation:**`,
+        "You're using Context7 anonymously. To unlock free higher rate limits, run this in your terminal:",
         "",
-        "> You're using Context7 anonymously. To sign in for **free** higher rate limits, run this in your terminal:",
-        ">",
-        "> ```",
-        `> ${command}`,
-        "> ```",
-        ">",
-        "> It opens the browser, completes sign-in, and writes credentials into your MCP client config. After it finishes, disable + re-enable the Context7 MCP server in your editor so the new credentials take effect.",
+        `    ${command}`,
         "",
-        `(Background for the assistant: this user is using Context7 anonymously. Surface the notice above to the user; with their permission, you may run \`${command}\` for them via your shell tool.)`,
+        "It opens your browser, signs you in, and writes credentials into your MCP client config.",
+        "After it finishes, disable then re-enable the Context7 MCP server in your editor so the new credentials take effect.",
     ].join("\n");
 }
+// User-facing strings double as enum const values: keeps the schema in the
+// simpler `enum: [...]` shape, which clients render more reliably than
+// `oneOf` with separate `const`/`title`.
+const CHOICE_RUN_SETUP = "I'll run the command to sign in";
+const CHOICE_STAY_ANON = "Continue anonymously with smaller limits";
+/**
+ * Fires a form-mode elicitation that surfaces a sign-in nudge in the client UI
+ * when the backend has signaled (via `X-Context7-Auth-Prompt: 1`, captured on
+ * `ctx.shouldPrompt` in api.ts) that the anonymous caller should be prompted
+ * to authenticate.
+ *
+ * The message is delivered out-of-band to the human via the client, not into
+ * the tool result the LLM reads, so it does not trip prompt-injection guards.
+ *
+ * The backend owns how often this fires: it sets the header at most once per
+ * MCP session, so the server holds no suppression state — it simply shows the
+ * dialog whenever the header is present. The command itself is shown in the
+ * dialog message for the user to copy; the server does not attempt to drive
+ * the client to run it.
+ *
+ * No-op for authenticated callers, when the signal wasn't set, or when the
+ * client did not advertise the `elicitation` capability. Fire-and-forget:
+ * never blocks or fails the surrounding tool response.
+ */
+export function maybeElicitAuthSignIn(server, ctx) {
+    if (ctx.apiKey || !ctx.shouldPrompt)
+        return;
+    if (!server.server.getClientCapabilities()?.elicitation)
+        return;
+    void server.server
+        .elicitInput({
+        message: buildElicitMessage(ctx.clientInfo?.ide, ctx.transport),
+        requestedSchema: {
+            type: "object",
+            properties: {
+                choice: {
+                    type: "string",
+                    title: "How would you like to continue?",
+                    enum: [CHOICE_RUN_SETUP, CHOICE_STAY_ANON],
+                    default: CHOICE_RUN_SETUP,
+                },
+            },
+            required: ["choice"],
+        },
+    })
+        .catch(() => {
+        // Client may not support elicitation despite the capability flag, or
+        // the session may have closed before the user responded. Either way,
+        // a missed nudge should never affect the tool result.
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upstash/context7-mcp",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "mcpName": "io.github.upstash/context7",
   "description": "MCP server for Context7",
   "repository": {
@@ -33,14 +33,14 @@
   },
   "homepage": "https://github.com/upstash/context7#readme",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.25.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@types/express": "^5.0.4",
     "@upstash/redis": "^1.38.0",
     "commander": "^14.0.0",
     "express": "^5.1.0",
     "jose": "^6.1.3",
-    "undici": "^6.6.3",
-    "zod": "^4.3.4"
+    "undici": "^7.27.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",