@upstash/context7-mcp 4.0.1 → 4.0.3

package/dist/index.js

@@ -10,7 +10,7 @@ import express from "express";
 import { Command } from "commander";
 import { AsyncLocalStorage } from "async_hooks";
 import { randomUUID } from "node:crypto";
-import { SERVER_VERSION, RESOURCE_URL, AUTH_SERVER_URL, OPENAI_APPS_CHALLENGE_TOKEN, } from "./lib/constants.js";
+import { SERVER_VERSION, RESOURCE_URL, OAUTH_AUTH_SERVER_URL, EMA_ISSUER, OPENAI_APPS_CHALLENGE_TOKEN, } from "./lib/constants.js";
 import { maybeElicitAuthSignIn } from "./lib/auth/auth-prompt.js";
 import { getClientIp } from "./lib/client-ip.js";
 /** Default HTTP server port */
@@ -282,7 +282,17 @@ async function main() {
         // no session store. The handler serves modern (2026-07-28) traffic natively
         // and 2025-era traffic through its stateless legacy fallback, which answers
         // GET/DELETE (session operations) with 405.
+        // keepAliveMs: 0 disables SSE keepalive heartbeats. Every tool here is a
+        // millisecond vector query (p100 ~28s), so no legitimate exchange needs a
+        // heartbeat to stay alive — but a hung exchange kept "alive" by heartbeats
+        // can never be reaped by the gateway's stream idle timeout. A batch
+        // carrying a request plus its own notifications/cancelled produces exactly
+        // that: per spec the cancelled request gets no response, the SDK transport
+        // then never closes the stream, and with heartbeats it survived until the
+        // gateway's 1200s hard cap (the 2026-08-11 outage). Silent hangs instead
+        // go idle and the gateway reaps them at streamIdleTimeout (300s).
         const mcpHandler = createMcpHandler(() => createMcpServer(), {
+            keepAliveMs: 0,
             onerror: (error) => console.error("MCP handler error:", error),
         });
         // Without onerror, request-conversion / handler.fetch throws are answered
@@ -362,13 +372,16 @@ async function main() {
         app.get("/.well-known/oauth-protected-resource", (_req, res) => {
             res.json({
                 resource: RESOURCE_URL,
-                authorization_servers: [AUTH_SERVER_URL],
+                // Each entry is an independent authorization server. Clerk handles
+                // regular authorization-code flows; Context7 handles only the
+                // enterprise-managed id-jag exchange.
+                authorization_servers: Array.from(new Set([OAUTH_AUTH_SERVER_URL, EMA_ISSUER])),
                 scopes_supported: ["profile", "email"],
                 bearer_methods_supported: ["header"],
             });
         });
         app.get("/.well-known/oauth-authorization-server", async (_req, res) => {
-            const authServerUrl = AUTH_SERVER_URL;
+            const authServerUrl = OAUTH_AUTH_SERVER_URL;
             try {
                 const response = await fetch(`${authServerUrl}/.well-known/oauth-authorization-server`);
                 if (!response.ok) {

package/dist/lib/api.js

@@ -3,6 +3,13 @@ import { Agent, ProxyAgent, setGlobalDispatcher } from "undici";
 import { CONTEXT7_API_BASE_URL } from "./constants.js";
 import { readFileSync } from "fs";
 import tls from "tls";
+/**
+ * Ceiling on a single Context7 API call. Without a signal a stalled backend
+ * call rides undici's ~300s default before failing. 60s is generous for these
+ * vector queries: p99.9 is ~3.2s, and no request exceeded 30s across a full
+ * day of production traffic.
+ */
+const API_TIMEOUT_MS = 60_000;
 /**
  * Parses error response from the Context7 API
  * Extracts the server's error message, falling back to status-based messages if parsing fails
@@ -99,7 +106,7 @@ export async function searchLibraries(query, libraryName, context = {}) {
         url.searchParams.set("query", query);
         url.searchParams.set("libraryName", libraryName);
         const headers = generateHeaders(context);
-        const response = await fetch(url, { headers });
+        const response = await fetch(url, { headers, signal: AbortSignal.timeout(API_TIMEOUT_MS) });
         readPromptSignal(response, context);
         if (!response.ok) {
             const errorMessage = await parseErrorResponse(response, context.apiKey);
@@ -127,7 +134,7 @@ export async function fetchLibraryContext(request, context = {}) {
         url.searchParams.set("query", request.query);
         url.searchParams.set("libraryId", request.libraryId);
         const headers = generateHeaders(context);
-        const response = await fetch(url, { headers });
+        const response = await fetch(url, { headers, signal: AbortSignal.timeout(API_TIMEOUT_MS) });
         readPromptSignal(response, context);
         if (!response.ok) {
             const errorMessage = await parseErrorResponse(response, context.apiKey);

package/dist/lib/constants.js

@@ -6,12 +6,20 @@ const pkg = JSON.parse(readFileSync(join(__dirname, "../../package.json"), "utf-
 export const SERVER_VERSION = pkg.version;
 const CONTEXT7_BASE_URL = "https://context7.com";
 const MCP_RESOURCE_URL = "https://mcp.context7.com";
-export const CLERK_DOMAIN = "clerk.context7.com";
+const DEFAULT_OAUTH_AUTH_SERVER_URL = "https://clerk.context7.com";
 export const CONTEXT7_API_BASE_URL = process.env.CONTEXT7_API_URL || `${CONTEXT7_BASE_URL}/api`;
 export const RESOURCE_URL = process.env.RESOURCE_URL || MCP_RESOURCE_URL;
-export const AUTH_SERVER_URL = process.env.AUTH_SERVER_URL || CONTEXT7_BASE_URL;
+// Clerk owns the interactive OAuth flow and is the issuer returned in the
+// authorization response. Advertising Clerk directly keeps RFC 8414 discovery
+// and RFC 9207 response-issuer validation on the same authorization-server
+// identity.
+export const OAUTH_AUTH_SERVER_URL = (process.env.OAUTH_AUTH_SERVER_URL || DEFAULT_OAUTH_AUTH_SERVER_URL).replace(/\/+$/, "");
+export const OAUTH_JWKS_URL = process.env.OAUTH_JWKS_URL || `${OAUTH_AUTH_SERVER_URL}/.well-known/jwks.json`;
 // Enterprise-Managed Auth (id-jag): access tokens minted by the Context7
 // authorization server, validated against its public JWKS.
-export const EMA_ISSUER = AUTH_SERVER_URL;
+// AUTH_SERVER_URL remains a backwards-compatible alias for local EMA setups;
+// it does not move interactive user OAuth. Local end-to-end OAuth environments
+// must set OAUTH_AUTH_SERVER_URL separately when Clerk is not the intended issuer.
+export const EMA_ISSUER = process.env.EMA_ISSUER || process.env.AUTH_SERVER_URL || CONTEXT7_BASE_URL;
 export const EMA_JWKS_URL = process.env.EMA_JWKS_URL || `${CONTEXT7_API_BASE_URL}/oauth/ema-jwks`;
 export const OPENAI_APPS_CHALLENGE_TOKEN = process.env.OPENAI_APPS_CHALLENGE_TOKEN;

package/dist/lib/jwt.js

@@ -1,7 +1,6 @@
 import * as jose from "jose";
-import { CLERK_DOMAIN, CONTEXT7_API_BASE_URL, EMA_ISSUER, EMA_JWKS_URL, RESOURCE_URL, } from "./constants.js";
-const CLERK_ISSUER = `https://${CLERK_DOMAIN}`;
-const clerkJwks = jose.createRemoteJWKSet(new URL(`https://${CLERK_DOMAIN}/.well-known/jwks.json`));
+import { CONTEXT7_API_BASE_URL, EMA_ISSUER, EMA_JWKS_URL, OAUTH_AUTH_SERVER_URL, OAUTH_JWKS_URL, RESOURCE_URL, } from "./constants.js";
+const oauthJwks = jose.createRemoteJWKSet(new URL(OAUTH_JWKS_URL));
 const emaJwks = jose.createRemoteJWKSet(new URL(EMA_JWKS_URL));
 const ENTRA_V2_ISSUER_RE = /^https:\/\/login\.microsoftonline\.com\/[0-9a-f-]{36}\/v2\.0$/;
 const jwksByTenant = new Map();
@@ -70,7 +69,7 @@ export async function validateJWT(token) {
             await jose.jwtVerify(token, emaJwks, { issuer: EMA_ISSUER, audience: RESOURCE_URL });
             return { valid: true };
         }
-        await jose.jwtVerify(token, clerkJwks, { issuer: CLERK_ISSUER });
+        await jose.jwtVerify(token, oauthJwks, { issuer: OAUTH_AUTH_SERVER_URL });
         return { valid: true };
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upstash/context7-mcp",
-  "version": "4.0.1",
+  "version": "4.0.3",
   "mcpName": "io.github.upstash/context7",
   "description": "MCP server for Context7",
   "repository": {