Week 45, updated 2 Nov 2026

Agent skills & MCP Context7

Is Context7 safe?

Short answer: Caution. StackGrade's weekly scan of upstash/context7 gives it a Caution label for 2 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 35 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Context7 is exploitable in your setup. Automated scan of commit 7836c58 on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

Serves up-to-date library documentation to LLMs and AI code editors via MCP.

  • 64,060 stars
  • pushed 1 Nov
  • MIT
  • TypeScript

github.com/upstash/context7 · context7.com

57score out of 100

#19of 52 overall#2in Agent skills & MCP▲ 5 vs Week 44

  • Maintenance 30%67
  • Adoption 30%39
  • Docs 20%69
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 58, 52, 52, 57.

Caution

2 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 1 Nov 2026. Last 10 GitHub releases within 8 days (about 35 per 30 days), latest release 23 Oct 2026. Median 13.3 h to close an issue (19 closed issues).
  • Adoption: 64,060 stars (70%), 3,198 forks (30%).
  • Docs: README 12,843 characters, 17 headings, 7 code blocks, install section: yes.

Methodology

#2 of 9 in Agent skills & MCP

Ranked by score. The yellow row is this tool.

Agent skills & MCP, Week 45score 0–100, safety
  1. 1Superpowers#13 overall62No dependencies scanned
  2. 2Context7#19 overall57Caution
  3. 3Agent Skills#25 overall53No issues found
  4. 4MCP reference servers#29 overall48No issues found
  5. 5awesome-mcp-servers#30 overall47No dependencies scanned
  6. 6Playwright MCP#32 overall45No issues found
Show the other 3
  1. 7wshobson/agents#38 overall42No issues found
  2. 8GitHub MCP Server#40 overall41No issues found
  3. 9skill-recorder#52 overall22No issues found

Safety scan, 2 Nov 2026

Automated scan of commit 7836c58, 308 files. Not a manual audit.

Caution

  • 2Critical dependency advisories35 high, 53 medium, 8 low. OSV, runtime dependencies only.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 34Agent files checked0 phrases flagged for review.
  • 0curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 2 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 2 critical, 35 high, 53 medium, 8 low

  • proxy-addr@2.0.7 (GHSA-jqcg-44mw-7w3h) in pnpm-lock.yaml
  • shell-quote@1.10.0 (GHSA-pqg4-j6r4-53mv) in pnpm-lock.yaml

Also found (informational, does not change the label):

  • 35 high-severity known vulnerabilities in runtime dependencies (OSV)

Notes:

  • Telemetry/analytics references in code: telemetry

Automated scan of commit 7836c58 on 2 Nov 2026, not a manual audit. 308 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 10+Releases, 90 daysLatest @upstash/context7-sdk@0…, 23 Oct
  • 13hMedian issue closeOver 19 closed issues
  • 64.1kStars+370 since 26 Oct
  • 3.2kForks50 open issues
  • 2025Repo created26 Mar 2025
30 days ago2 Nov
10 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

10 releases in the last 30 days (GitHub releases feed, last 10 entries):

Questions about Context7

Answers use this week's StackGrade data.

Is Context7 safe to use?

Caution. StackGrade's weekly scan of upstash/context7 gives it a Caution label for 2 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 35 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Context7 is exploitable in your setup. Automated scan of commit 7836c58 on 2 Nov 2026, not a manual audit.

How does StackGrade score Context7?

Context7 scores 57 out of 100 in Week 45: #19 of 52 tracked tools overall and #2 in Agent skills & MCP. The score combines maintenance (67), adoption (39) and docs (69) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to Context7?

The highest-scored other tools in Agent skills & MCP this week: Superpowers (62, No dependencies scanned), Agent Skills (53, No issues found), MCP reference servers (48, No issues found), awesome-mcp-servers (47, No dependencies scanned). StackGrade has not tested them hands-on.

What licence does Context7 use?

The licence listed for upstash/context7 is MIT. Read the licence text before commercial use.

Compare and use it

All facts and sources
Type
MCP server
License
MIT
Language
TypeScript
Created
26 Mar 2025
Owner
upstash (Organization)
Forks
3,198
Homepage
context7.com

GitHub description: “Context7 Platform -- Up-to-date docs for AI agents”

Sources: github.com/upstash/context7, api.github.com/repos/upstash/context7, raw.githubusercontent.com/upstash/context7/master/README.md. Fetched 2 Nov 2026.

Know when Context7 changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.