Context7 MCP
v2026.6Upstash
Upstash's documentation-retrieval MCP server. Two tools (resolve-library-id, get-library-docs) inject up-to-date, version-specific library documentation into the agent's context to prevent hallucinated APIs. The most-starred MCP server repo (57.1k), but with a notable security history: the ContextCrush content-injection vulnerability (disclosed Feb 2026, patched within days).
Trust Vector Analysis
Dimension Breakdown
🚀Performance & Reliability+
Spot-check of returned documentation against official library docs across popular frameworks
Relevance assessment of topic-filtered retrievals across common and long-tail queries
Availability monitoring of the hosted API endpoint over the evaluation period
Coverage sampling across mainstream and long-tail open-source libraries
Error-path testing with unknown libraries, rate limits, and offline backend
🛡️Security+
Review of the ContextCrush vulnerability, its patch, and the residual risk of doc-content prompt injection
Analysis of the open library-submission pipeline as an attack surface for agent contexts
Assessment of disclosure-to-patch timeline and vendor cooperation
Analysis of indirect credential-theft pathways via injected instructions in a multi-tool agent
Review of API-key handling for the hosted endpoint and local server
🔒Privacy & Compliance+
Data flow analysis of outbound query content to the hosted backend
Assessment of direct and indirect sensitive-data pathways
Review of request payloads and tool surface area
Data sharing pathway analysis across Upstash and LLM provider
👁️Trust & Transparency+
Documentation completeness and accuracy review
Source availability review of client/server versus hosted backend
Review of vendor communication during and after the ContextCrush incident
Logging and traceability assessment of tool calls and returned content
⚙️Operational Excellence+
Setup complexity assessment across remote and local installation paths
Latency measurement of resolve and retrieval calls
Feature scope assessment relative to documentation-retrieval needs
Adoption metrics and ecosystem-integration analysis
Commit frequency, release cadence, and patch-responsiveness analysis
- +Directly addresses hallucinated/outdated APIs with version-specific, current documentation
- +Largest MCP server community on GitHub (57.1k stars) with broad client integration
- +Minimal tool surface: two read-only tools with a small, predictable data footprint
- +Zero-friction setup — remote endpoint works with just a URL, no API key required
- +Fast vendor response to the ContextCrush vulnerability (patched in 5 days)
- +Configurable token budget keeps documentation injection cost-controlled
- !ContextCrush (Feb 2026) proved the library index is an exploitable injection channel into agent contexts; retrieved third-party content remains untrusted by design
- !Open publishing model means doc quality and integrity vary across the index
- !Backend indexing/retrieval pipeline is proprietary and unauditable
- !Dependent on Upstash's hosted service — no fully offline operation
- !Queries reveal a team's technology stack to a third party
- !Narrow scope: documentation retrieval only, no private-docs support in the open tier
Use Case Ratings
code generation
Core use case — current, version-specific docs measurably reduce hallucinated APIs and deprecated patterns
research assistant
Excellent for researching library capabilities and APIs; limited to indexed open-source documentation
education
Strong for learning frameworks with accurate, up-to-date examples instead of stale training data
content creation
Useful for writing accurate technical tutorials and documentation-backed articles
data analysis
Indirectly helpful (correct API usage for analysis libraries) but not an analysis tool itself