@upstash/context7-mcp 3.2.1 → 3.2.3

package/dist/index.js

@@ -15,6 +15,7 @@ import { randomUUID } from "node:crypto";
 import { createSessionStore } from "./lib/sessionStore.js";
 import { SERVER_VERSION, RESOURCE_URL, AUTH_SERVER_URL, OPENAI_APPS_CHALLENGE_TOKEN, } from "./lib/constants.js";
 import { maybeElicitAuthSignIn } from "./lib/auth/auth-prompt.js";
+import { getClientIp } from "./lib/client-ip.js";
 /** Default HTTP server port */
 const DEFAULT_PORT = 3000;
 // Parse CLI arguments using commander
@@ -73,30 +74,6 @@ function getClientContext() {
         sessionId: stdioSessionId,
     };
 }
-/**
- * Extract client IP address from request headers.
- * Handles X-Forwarded-For header for proxied requests.
- */
-function getClientIp(req) {
-    const forwardedFor = req.headers["x-forwarded-for"] || req.headers["X-Forwarded-For"];
-    if (forwardedFor) {
-        const ips = Array.isArray(forwardedFor) ? forwardedFor[0] : forwardedFor;
-        const ipList = ips.split(",").map((ip) => ip.trim());
-        for (const ip of ipList) {
-            const plainIp = ip.replace(/^::ffff:/, "");
-            if (!plainIp.startsWith("10.") &&
-                !plainIp.startsWith("192.168.") &&
-                !/^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(plainIp)) {
-                return plainIp;
-            }
-        }
-        return ipList[0].replace(/^::ffff:/, "");
-    }
-    if (req.socket?.remoteAddress) {
-        return req.socket.remoteAddress.replace(/^::ffff:/, "");
-    }
-    return undefined;
-}
 function createMcpServer() {
     const server = new McpServer({
         name: "Context7",
@@ -110,7 +87,7 @@ function createMcpServer() {
             },
         ],
     }, {
-        instructions: `Use this server to fetch current documentation whenever the user asks about a library, framework, SDK, API, CLI tool, or cloud service -- even well-known ones like React, Next.js, Prisma, Express, Tailwind, Django, or Spring Boot. This includes API syntax, configuration, version migration, library-specific debugging, setup instructions, and CLI tool usage. Use even when you think you know the answer -- your training data may not reflect recent changes. Prefer this over web search for library docs.
+        instructions: `Use this server to fetch current documentation whenever the user asks about a library, framework, SDK, API, CLI tool, or cloud service — even well-known ones like React, Next.js, Prisma, Express, Tailwind, Django, or Spring Boot. This includes API syntax, configuration, version migration, library-specific debugging, setup instructions, and CLI tool usage. Use even when you think you know the answer — your training data may not reflect recent changes. Prefer this over web search for library docs.
 
 Do not use for: refactoring, writing scripts from scratch, debugging business logic, code review, or general programming concepts.`,
     });
@@ -203,7 +180,7 @@ Do not call this tool more than 3 times per question.`,
                 .describe("Exact Context7-compatible library ID (e.g., '/mongodb/docs', '/vercel/next.js', '/supabase/supabase', '/vercel/next.js/v14.3.0-canary.87') retrieved from 'resolve-library-id' or directly from user query in the format '/org/project' or '/org/project/version'."),
             query: z
                 .string()
-                .describe("The question or task you need help with. Be specific and include relevant details. Good: 'How to set up authentication with JWT in Express.js' or 'React useEffect cleanup function examples'. Bad: 'auth' or 'hooks'. The query is sent to the Context7 API for processing. Do not include any sensitive or confidential information such as API keys, passwords, credentials, personal data, or proprietary code in your query."),
+                .describe("The question or task you need help with, scoped to a single concept. Be specific and include relevant details, but keep each query to one topic — if the user's question spans multiple distinct concepts, make a separate call per concept instead of combining them, unless the question is about how the concepts interact. Good: 'How to set up authentication with JWT in Express.js' or 'React useEffect cleanup function examples'. Bad (too vague): 'auth' or 'hooks'. Bad (too broad): 'routing and auth and caching in Next.js'. The query is sent to the Context7 API for processing. Do not include any sensitive or confidential information such as API keys, passwords, credentials, personal data, or proprietary code in your query."),
         },
         annotations: {
             readOnlyHint: true,

package/dist/lib/client-ip.js

@@ -0,0 +1,60 @@
+function stripIpv4MappedPrefix(ip) {
+    return ip.replace(/^::ffff:/i, "");
+}
+/**
+ * Returns true for RFC1918, CGNAT, loopback, link-local, and IPv6 private ranges.
+ */
+export function isPrivateOrLocalIp(ip) {
+    const plainIp = stripIpv4MappedPrefix(ip).toLowerCase();
+    if (plainIp.includes(".")) {
+        return (plainIp.startsWith("10.") ||
+            plainIp.startsWith("192.168.") ||
+            /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(plainIp) ||
+            /^100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\./.test(plainIp) ||
+            plainIp.startsWith("127.") ||
+            plainIp.startsWith("169.254."));
+    }
+    // ::1 loopback in any textual form (e.g. "0::1", "0:0:0:0:0:0:0:1")
+    if (/^[0:]+1$/.test(plainIp)) {
+        return true;
+    }
+    // First hextets in fe80::/10 and fc00::/7 start with a non-zero digit, so a
+    // valid textual form always spells out all 4 digits.
+    // fe80::/10 link-local
+    if (/^fe[89ab][0-9a-f]:/.test(plainIp)) {
+        return true;
+    }
+    // fc00::/7 unique local
+    if (/^f[cd][0-9a-f]{2}:/.test(plainIp)) {
+        return true;
+    }
+    return false;
+}
+function pickClientIpFromForwardedList(ipList) {
+    for (const ip of ipList) {
+        const plainIp = stripIpv4MappedPrefix(ip);
+        if (!isPrivateOrLocalIp(plainIp)) {
+            return plainIp;
+        }
+    }
+    if (ipList.length === 0) {
+        return undefined;
+    }
+    return stripIpv4MappedPrefix(ipList[0]);
+}
+/**
+ * Extract client IP address from request headers.
+ * Handles X-Forwarded-For header for proxied requests.
+ */
+export function getClientIp(req) {
+    const forwardedFor = req.headers["x-forwarded-for"] || req.headers["X-Forwarded-For"];
+    if (forwardedFor) {
+        const ips = Array.isArray(forwardedFor) ? forwardedFor[0] : forwardedFor;
+        const ipList = ips.split(",").map((ip) => ip.trim());
+        return pickClientIpFromForwardedList(ipList);
+    }
+    if (req.socket?.remoteAddress) {
+        return stripIpv4MappedPrefix(req.socket.remoteAddress);
+    }
+    return undefined;
+}

package/dist/lib/constants.js

@@ -10,4 +10,8 @@ export const CLERK_DOMAIN = "clerk.context7.com";
 export const CONTEXT7_API_BASE_URL = process.env.CONTEXT7_API_URL || `${CONTEXT7_BASE_URL}/api`;
 export const RESOURCE_URL = process.env.RESOURCE_URL || MCP_RESOURCE_URL;
 export const AUTH_SERVER_URL = process.env.AUTH_SERVER_URL || CONTEXT7_BASE_URL;
+// Enterprise-Managed Auth (id-jag): access tokens minted by the Context7
+// authorization server, validated against its public JWKS.
+export const EMA_ISSUER = AUTH_SERVER_URL;
+export const EMA_JWKS_URL = process.env.EMA_JWKS_URL || `${CONTEXT7_API_BASE_URL}/oauth/ema-jwks`;
 export const OPENAI_APPS_CHALLENGE_TOKEN = process.env.OPENAI_APPS_CHALLENGE_TOKEN;

package/dist/lib/jwt.js

@@ -1,7 +1,8 @@
 import * as jose from "jose";
-import { CLERK_DOMAIN, CONTEXT7_API_BASE_URL } from "./constants.js";
+import { CLERK_DOMAIN, CONTEXT7_API_BASE_URL, EMA_ISSUER, EMA_JWKS_URL, RESOURCE_URL, } from "./constants.js";
 const CLERK_ISSUER = `https://${CLERK_DOMAIN}`;
 const clerkJwks = jose.createRemoteJWKSet(new URL(`https://${CLERK_DOMAIN}/.well-known/jwks.json`));
+const emaJwks = jose.createRemoteJWKSet(new URL(EMA_JWKS_URL));
 const ENTRA_V2_ISSUER_RE = /^https:\/\/login\.microsoftonline\.com\/[0-9a-f-]{36}\/v2\.0$/;
 const jwksByTenant = new Map();
 function entraJwks(tenantId) {
@@ -65,6 +66,10 @@ export async function validateJWT(token) {
             }
             return { valid: true };
         }
+        if (iss === EMA_ISSUER) {
+            await jose.jwtVerify(token, emaJwks, { issuer: EMA_ISSUER, audience: RESOURCE_URL });
+            return { valid: true };
+        }
         await jose.jwtVerify(token, clerkJwks, { issuer: CLERK_ISSUER });
         return { valid: true };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upstash/context7-mcp",
-  "version": "3.2.1",
+  "version": "3.2.3",
   "mcpName": "io.github.upstash/context7",
   "description": "MCP server for Context7",
   "repository": {