* Add JSON output for skills list
* test(cli): resolve tempDir via realpath for macOS compatibility
On macOS, os.tmpdir() returns /var/folders/... but process.cwd()
reports the symlink-resolved /private/var/folders/... after chdir.
The JSON output uses the resolved cwd, so the test assertion mismatched
the unresolved tempDir on macOS.
* chore: add changeset for skills list --json
---------
Co-authored-by: Fahreddin Özcan <ozcanfahrettinn@gmail.com>
* fix(cli): declare @inquirer/core as direct dependency
selectOrInput.ts imports from @inquirer/core directly, but the package
was only resolvable as a transitive of @inquirer/prompts. Under pnpm's
isolated linker this fails with ERR_MODULE_NOT_FOUND at startup.
Fixes#2651
* chore: add changeset
* docs(enterprise): add Azure APIM deployment guide
Step-by-step guide for deploying Context7 behind Azure API Management
with Microsoft Entra ID per-user authentication via On-Behalf-Of (OBO)
token exchange. Covers APIM provisioning, Entra app registrations,
policy wiring, OAuth discovery surfaces, and connecting MCP clients
(VS Code Copilot, Cursor) through the gateway.
* docs(azure-apim): cover user pre-provisioning + fix variable typo
- Restructure Part 4 into two steps: tenant config + pre-provisioning
users via the new dashboard card. Calls out that Context7 rejects
unmapped oids — there is no auto-provisioning.
- Add troubleshooting entry for the unmapped-user 401 (most common
failure once tenant config is correct).
- Fix \$APIM_NAME → \$APIM typo in the OAuth proxy provisioning
commands; the rest of the doc uses \$APIM so the OAuth proxy
commands would have failed as written.
* fix(cli): validate skill names to prevent path traversal on install
Adds boundary validation and containment checks so a remote SKILL.md
with a malicious name field (e.g. `name: ..`) cannot escape the skills
root during `ctx7 skills install`. Previously, the value flowed from
parseSkillFrontmatter to installSkillFiles unchecked, and the existing
traversal guard only verified files stayed inside the attacker-chosen
directory rather than the real skills root, enabling arbitrary file
writes outside `.claude/skills` (e.g. `.claude/settings.json` for
hook-driven RCE). symlinkSkill had the same trust issue and could
`rm(recursive: true)` arbitrary directories.
* chore: add changeset for skill name validation
* chore: soften changeset wording
Configures pnpm's minimumReleaseAge to 10080 minutes (7 days) so newly
published package versions can't be installed until they've existed on
the registry long enough for short-lived supply-chain compromises (e.g.
hijacked publish tokens, typosquats) to be detected and yanked. 7 days
is the post-Shai-Hulud/tj-actions community baseline.
Critical hotfixes can still be installed by adding entries to
minimumReleaseAgeExclude.
Ref: https://pnpm.io/blog/2025/12/05/newsroom-npm-supply-chain-security
Some LLM clients send `context7CompatibleLibraryID`/`userQuery` instead of
the canonical `libraryId`/`query` — likely echoing phrasing from the tool
descriptions — and trip Zod validation before the tool ever runs.
Hook `Transport.onmessage` (set before `server.connect()` so the SDK chains
its dispatch over it) and rewrite those two keys in place on `tools/call`
requests where the canonical key is absent. Published `tools/list` schemas
are unchanged; the rewrite is a server-side compatibility shim.
Listen for stdin end/close and SIGHUP and exit with code 0. Without these,
an idle undici keep-alive socket left over from a recent fetch keeps
libuv's event loop alive past stdin EOF, leaving an orphan node process
when the parent (e.g. Claude Code) is force-killed.
Fixes#2542
readJsonConfig only caught file-read errors, not JSON.parse errors.
During `ctx7 remove`, the detector iterates every agent's well-known
config path; an unparseable JSON file at any of them (e.g. a
hand-edited ~/.claude.json) crashed the command with an unhandled
SyntaxError before it could do anything.
Wrap the readJsonConfig call in hasMcpConfig with a try/catch that
logs a warning naming the path and parse error and skips that agent.
Keep readJsonConfig itself strict so write paths in setup and
uninstallMcp continue to surface failures via their existing handling.
* fix(mcp): stream tool-call responses so headers flush before 60s
The remote MCP server's StreamableHTTPServerTransport runs in JSON mode
(`enableJsonResponse: true`), which buffers the entire response and writes
status + headers + body together at the end of the tool call. Long-running
tools — notably `query-docs` with `researchMode: true` — routinely take
60–250s, during which no bytes are written to the wire.
MCP HTTP clients cap the underlying `fetch()` waiting for headers
(Claude Code: 60s, hardcoded in @modelcontextprotocol/sdk consumers),
independent of the higher-level per-tool timeout. Production curl with
`-w time_starttransfer` shows `start_transfer ≈ total ≈ 125s` for a
research call — the connection sits silent for the full duration before
flushing in one burst, well past any reasonable client `fetch` timeout.
Switch to SSE responses for POST tool calls. The SDK then returns the
HTTP response synchronously after parsing the request, headers flush in
ms, and the body streams while the tool runs. Same total wall time, but
clients see headers immediately and don't time out.
The existing NGINX-timeout comment above (about rejecting GETs) is about
the standalone GET SSE channel for server-initiated notifications and
still applies — GETs remain rejected. Per-request POST SSE responses are
bounded by the tool call and work fine on the existing ingress
(`proxy-buffering: off`, `proxy-read-timeout: 3600`).
Streamable HTTP requires clients to accept both `application/json` and
`text/event-stream` (SDK enforces 406 otherwise), so this is transparent
to compliant clients including Claude Code.
* remove comment
* chore: add changeset
* fix(mcp): emit progress notifications during researchMode query-docs
The SSE-streaming change in the previous commit only addresses clients
whose timeout fires when response *headers* don't arrive (e.g. Claude
Code's `wrapFetchWithTimeout`). Clients using the MCP SDK's default
`Protocol.request()` timer (`DEFAULT_REQUEST_TIMEOUT_MSEC = 60000`) hit
a wall-clock timeout that bytes flowing don't reset.
Emit `notifications/progress` every 20s while the upstream fetch is in
flight, gated on `researchMode: true` and the client supplying a
`progressToken` in `_meta`. Clients that pass an `onprogress` handler
have the SDK include `progressToken` automatically; on each notification
the SDK resets their JSON-RPC request timer (when they also opted into
`resetTimeoutOnProgress: true`), keeping 60–250s research runs alive.
Clients that don't include a `progressToken` see no notifications and no
behavior change. Fast `query-docs` calls are unaffected — the interval
only arms when `researchMode` is true.
* Merge branch 'master' of https://github.com/upstash/context7 into fix/mcp-stream-tool-responses
# Conflicts:
# packages/mcp/src/index.ts
* fix(mcp): restore researchMode and progress notifications on query-docs
Re-add the researchMode parameter to the query-docs input schema and
re-emit periodic notifications/progress while the upstream call is in
flight. Clients that opt into resetTimeoutOnProgress (e.g. opencode)
reset their per-request timer on each notification, which keeps the
long-running researchMode call alive past the SDK's default 60s
wall-clock timeout.
* fix(mcp): create a fresh McpServer per HTTP request
The HTTP transport is stateless (sessionIdGenerator: undefined), but the
handler shared one global McpServer across requests. McpServer extends
Protocol, which has a single _transport field. Each server.connect()
overwrites it, and any transport.close on any request fires the shared
Protocol's onclose, leaving _transport undefined for everyone else.
That meant a long-running researchMode call lost its transport every
time an unrelated short request (tool list refresh, init confirmation,
etc.) closed in the background, surfacing as "Not connected" on every
subsequent sendNotification and ultimately a -32001 timeout on the
client.
Switch to the per-request pattern from the SDK's
simpleStatelessStreamableHttp example: a createMcpServer factory builds
a fresh server, registers tools, and is closed alongside the transport
on res.on('close'). stdio mode keeps a single server, since stdio has
exactly one transport for the process lifetime.
* Merge remote-tracking branch 'origin/master' into fix/mcp-stream-tool-responses
# Conflicts:
# packages/mcp/src/index.ts
* chore(mcp): minimize PR diff against master
Drop the now-redundant changeset that duplicated the SSE-streaming note
already released in 2.2.3, restore comments inadvertently dropped during
the createMcpServer refactor, and rename the changeset file to reflect
what this PR actually changes.
Net diff vs master is now wrapping the existing setup in a
createMcpServer factory, calling it per HTTP request, and closing the
server alongside the transport (12 logical lines added, ignoring
indentation introduced by Prettier).
* fix(mcp): move client info capture to MCP server initialization for stdio mode
Hide the `researchMode` parameter from the MCP tool's input schema so
agents stop invoking it. The upstream `/api/v2/context` route still
accepts and serves the parameter; only the MCP-layer surface is
removed. Reasoning: several MCP clients hit per-request timeouts (60s
defaults in the SDK and in fetch-wrappers) on long-running research
calls in ways that can't all be solved server-side. Until the timeout
story is reliable across clients, agents shouldn't be able to call it
via MCP.
Updates:
- Drop the `researchMode` field from the `query-docs` input schema.
- Drop the workflow line in the tool description that referenced it.
- Stop forwarding `researchMode` to fetchLibraryContext; the field is
optional on ContextRequest, so omitting it is equivalent to false.
* fix(cli): support Windows backslash in skill installation path check
* chore(cli): add changeset for Windows path check fix
* style(cli): format Windows path guard
---------
Co-authored-by: Fahreddin Özcan <ozcanfahrettinn@gmail.com>
* fix(mcp): support NODE_EXTRA_CA_CERTS for enterprise MITM proxies
When NODE_EXTRA_CA_CERTS is set, reads the CA certificate file and
injects it into undici's global dispatcher. This fixes fetch failures
behind enterprise transparent SSL intercept proxies (Zscaler, etc.)
where the default TLS context does not trust the corporate CA.
The CA certs are also passed through when an explicit HTTPS_PROXY is
configured, so both proxy modes work with custom certificates.
Fixes#2268
This contribution was developed with AI assistance (Claude Code).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add changeset for NODE_EXTRA_CA_CERTS support
* fix(mcp): preserve default CAs with NODE_EXTRA_CA_CERTS
* chore: add changeset for CA trust fix
* chore: remove superseded changeset
* fix(mcp): lint test files with test tsconfig
* fix(mcp): use explicit test file path
* fix(mcp): support older Node TLS CA APIs
* test(mcp): run certificate test with vitest
---------
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
github-actions[bot]