context7-mcp
An agent skill by upstash, from upstash/context7. Tags: api, development, documentation, mcp, setup.
What it does
This skill should be used when the user asks about libraries, frameworks, API references, or needs code examples. Activates for setup questions, code generation involving libraries, or mentions of specific frameworks like React, Vue, Next.js, Prisma, Supabase, etc.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add upstash/context7 --skill context7-mcpOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/upstash/context7
cp -r context7/packages/opencode/skills/context7-mcp ~/.claude/skills/context7-mcpSafety box score
Grade A, minimal risk: 4 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a documentation lookup helper: it tells the agent to query Context7 for library IDs and docs instead of relying on training data. The main risk is outbound network use to a third-party docs service; there is no local code execution, filesystem access, or secret handling in the skill text.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | `SKILL.md` contains no shell commands, scripts, or code evaluation instructions; it only describes how to query docs. |
| Network access | 1 (low) | It explicitly calls remote services via `resolve-library-id` and `query-docs`, which sends the user’s library name/query text off-machine, but only for documentation lookup. |
| Filesystem reach | 0 (none) | The skill does not read, write, or delete files outside the project, and mentions no paths or file operations. |
| Secrets & credentials | 0 (none) | There is no request to access tokens, keys, passwords, `.env` files, or browser/CLI sessions. |
| Privilege & persistence | 0 (none) | No sudo, service registration, global install, or OS/shell configuration changes are described. |
| Instruction hijack surface | 0 (none) | The text does not ask the agent to ignore instructions, hide behavior, or follow untrusted remote content beyond normal documentation lookup. |
| Irreversible actions | 0 (none) | It does not push, deploy, post, pay, book, or otherwise take external actions; it only fetches documentation. |
| Transparency | 0 (none) | There are no binaries, base64 blobs, or downloaded installers; the skill content is plain markdown. |
Before installing
- Confirm you’re okay with library names and query text being sent to Context7.
- Check whether your MCP/runtime routes requests through any third-party proxy or logging layer.
Rated 2026-10-16 by an automated review of 1 file from the skill's repository.
Source
- Repository
- upstash/context7 (all skills from this repository)
- Path
- packages/opencode/skills/context7-mcp/SKILL.md
- Branch
- master
- Updated
- 2026-09-23
Related skills
- context7-docs — Fetch up-to-date documentation and code examples for any library, framework, SDK, CLI tool, or cloud service.
- X MCP guide — ALWAYS read this when a user connects the X plugin or any X MCP, before using any X connection, and again on any X error.
- atlassian-mcp — Integrates with Atlassian products to manage project tracking and documentation via MCP protocol.
- agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
- cursor-sdk — Guide users building apps, scripts, CI pipelines, or automations on top of the Cursor TypeScript SDK (`@cursor/sdk`).
- devcontainers — Set up local development environments with production parity for DigitalOcean App Platform.