- Document the manifest 'type' field routing entries to Confluence, website,
llms.txt, and OpenAPI parsers (bare entries stay git)
- Add the per-type field table and the no-secrets/strict-validation notes
- Confluence: document the space URL field, 'index entire space' scope, and
paginated page browsing; cross-link GitOps confluence entries
* docs(enterprise): document programmatic library import/export API
- Add POST /import-libraries endpoint reference (openapi-enterprise.json + page)
- Register it under API Reference → Parse in the nav
- Add an Automating with the API section to the Library Import feature doc,
covering the cloud license-key export and the on-prem JSON import
* docs: update export endpoint to /api/v1/enterprise/export, plain language
Match the renamed cloud export path, move the license key into the request
body, and reword the automation section without em dashes.
* docs(enterprise): export uses Authorization header; import requires an API key
* docs(enterprise): document the force query param on import
On issues.opened for 'Library Report' titles, forward the issue number to the
triage service (context7app), which runs the read-only agent and comments its
findings. Requires repo secrets TRIAGE_WEBHOOK_URL and TRIAGE_WEBHOOK_SECRET.
* docs(enterprise): add Confluence integration page
Document connecting Confluence (Cloud and self-hosted Data Center) and
indexing a space from Add. Includes screenshots and a nav entry under
Enterprise > Integrations.
* docs(enterprise): wider Confluence settings screenshot with mock site URL
* fix(mcp): skip loopback and IPv6 private IPs in getClientIp
Extract getClientIp into lib/client-ip.ts and extend the private/local
IP filter to cover 127.0.0.0/8, 169.254.0.0/16, ::1, fe80::/10, and
fc00::/7 when walking X-Forwarded-For. Proxies that prepend loopback or
health-check addresses no longer pollute mcp-client-ip analytics.
Fixes#2874
* fix(mcp): tighten private IP detection and add changeset
Anchor the fe80::/10 and fc00::/7 regexes to full 4-digit first hextets
so abbreviated hextets like fe8::1 or fc::1 are no longer misclassified
as private. Match IPv6 loopback in any textual form (0::1,
0:0:0:0:0:0:0:1), add CGNAT (100.64.0.0/10) to the skip list, and add a
patch changeset.
---------
Co-authored-by: syf2211 <syf2211@users.noreply.github.com>
Co-authored-by: Fahreddin Özcan <ozcanfahrettinn@gmail.com>
Fixes#2860
- Use npx ctx7@latest as the canonical CLI invocation in find-docs SKILL.md
- Add official library naming guidance matching rules/context7-cli.md
- De-emphasize global npm install as the primary workflow
- Add regression tests to keep skill and rule guidance aligned
Co-authored-by: syf2211 <syf2211@users.noreply.github.com>
Document setting the GitHub Enterprise host before creating the App or token, so the App flow targets the on-prem server instead of github.com. Note the GITHUB_URL env var as a deploy-time alternative.
* CTX7-1760: document GitOps for on-premise
Add the GitOps page under the On-Premise docs: how reconciliation works, the
manifest format and fields, dashboard configuration, webhooks, disaster
recovery, and the REST API. Includes a dashboard screenshot.
* CTX7-1760: clarify GitOps webhook requirements (reachable host, push subscription)
* CTX7-1760: call out webhook caveat for pre-existing GitHub Apps
* CTX7-1760: add a Before you start prerequisites section to GitOps docs
* CTX7-1760: add GitHub Integration page; trim GitOps prerequisites to reference it
* CTX7-1760: group on-prem feature pages under a Features nav section
* CTX7-1760: move GitHub docs under an Integrations group, add setup screenshots
* Remove accidentally-staged docs/enterprise/integrations/github-actions.mdx
* CTX7-1760: use an admin API key example for the reconcile endpoint instead of a session cookie
* CTX7-1760: use connected-state GitHub App screenshot; split setup into create + install steps
* CTX7-1760: add Verify the App configuration section with permissions and webhook screenshots
Documents generic OIDC SSO setup for Context7 On-Premise, with dashboard
screenshots and a troubleshooting section. Adds the page to the On-Premise
Security nav group.
Adds Part 4 Step 3 covering Microsoft Graph permissions (GroupMember.Read.All
+ User.ReadBasic.All), the WIF federated credential setup (issuer, subject,
audience values copied from the dashboard), group creation, dashboard config,
and "Sync now" verification. Updates the Step 2 roadmap note and adds a
troubleshooting entry for the most common pitfall: missing User.ReadBasic.All
returns 0 members synced even when the group has members.
Document the offline library transfer flow: export libraries from Context7
Cloud, import the bundle into an airgapped on-premise install (snippets are
re-embedded locally). Adds the page under Enterprise > On-Premise.
Adds the redirect URI registration step that VS Code with GitHub Copilot
requires, plus troubleshooting entries for AADSTS500113 and AADSTS50011.
Also notes the CLI alternative when the Manifest UI silently fails to
persist requestedAccessTokenVersion.
* docs: backup and restore guide for on-premise
* docs: add dashboard restore flow and Keep all retention
* docs: use ctx7:restore in the local restore command
* docs: use consistent library/index vocabulary in backup-restore
* feat(mcp): switch anonymous sign-in nudge to elicitation
Replace the in-result markdown nudge with an MCP `elicitation/create`
form request. The previous text-injection approach instructed the
assistant to relay the message to the user, which some agents flagged
as prompt injection. Elicitations are delivered out-of-band to the
client UI, bypassing that surface entirely.
- `maybeElicitAuthSignIn` fires after each tool response when the
backend has set `ctx.shouldPrompt` (via `X-Context7-Auth-Prompt: 1`)
and the caller is anonymous.
- Gated on the client advertising the `elicitation` capability;
no-op otherwise.
- Includes a "Don't show this again" checkbox; opting out suppresses
further nudges for the lifetime of the MCP process, keyed per
session id / client IP.
- Fire-and-forget: the elicitation never blocks or fails the
surrounding tool response.
* feat(mcp): two-option choice in sign-in elicitation
Replace the "Don't show this again" checkbox with a single-select
radio between "I'll run the command to sign in" and "Continue
anonymously with smaller limits". The radio makes the user's intent
explicit and softens the protocol-fixed Accept/Decline labels —
Accept now just submits the choice.
Picking "Continue anonymously" (or declining/cancelling outright)
suppresses further nudges for the lifetime of the MCP process.
The command itself stays in the dialog message for the user to
copy; the server does not attempt to drive the client to execute it.
* fix(mcp): use plain enum schema for choice radio
Switch the elicitation's choice field from `oneOf` with separate
`const`/`title` entries to the simpler `enum: [...]` shape. Cursor's
elicitation UI does not render the `oneOf`-with-titles pattern
correctly — it falls back to a plain text input with the const string
as the default value. The flat enum form is rendered as a proper
dropdown / radio across the clients we tested.
The user-facing strings are now also the enum const values, so the
elicitation response surfaces the chosen label directly. Suppression
logic compares against the same string constants.
* refactor(mcp): drop in-memory suppression, let backend own prompt frequency
The MCP server no longer keeps a per-session suppression set. It fires the
elicitation whenever X-Context7-Auth-Prompt is present; the backend now emits
that header at most once per MCP session.
* chore(deps): bump dependencies (combined dependabot updates)
Combines the safe dependabot dependency bumps into a single change:
- @modelcontextprotocol/sdk 1.25.2 -> 1.29.0 (mcp)
- undici 6.26.0 -> 8.3.0 (mcp)
- zod 4.3.5 -> 4.4.3 (mcp, tools-ai-sdk)
- commander 13.1.0 -> 15.0.0 (cli)
- ora 9.0.0 -> 9.4.0 (cli)
- dotenv 17.2.3 -> 17.4.2 (sdk, tools-ai-sdk, pi)
- @earendil-works/pi-coding-agent 0.75.5 -> 0.78.0 (pi)
eslint 9 -> 10 (#2703) is excluded: it is incompatible with the
pinned typescript-eslint v8 and breaks lint.
Verified: build, typecheck, lint, and tests pass.
* chore: add changesets for runtime dependency bumps
* fix(deps): pin undici to 7.x for Node 20 compatibility
undici 8 requires Node >=22.19.0 (it calls worker_threads.markAsUncloneable
unconditionally at module load), but CI and the release pipeline run Node 20,
which crashed the mcp test suite with 'markAsUncloneable is not a function'.
undici 7.27.0 guards that call and supports Node >=20.18.1.
github-actions[bot]