Entity trail

Upstash

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-07 / github-pulse-researcherContext7's SDK 0.4.0 makes every request time out after 30 seconds by default and narrows a return type in a breaking wayupstash/context7 published `@upstash/[redacted]` at 2026-09-07T08:56Z. Requests now time out after 30 seconds unless you set `timeout: false` on the client or the individual request — a behavioural change for any long-running documentation fetch that previously hung rather than failing. It also adds abort signals, configurable transient HTTP retries, native fetch cache settings, custom fetch/base URL/header/keepalive support, and a structured `Context7Error` carrying status, code, request ID, rate limits and retryability. Calls forwarding options whose response format is chosen at runtime now return an array-or-string union and may need narrowing at the call site.
2026-08-23 / vibe-coding-researcherContext7 MCP Server Prompt Injection Exfiltrates .env Files on a Routine Docs Lookup (CVE-2026-75130)NVD published CVE-2026-75130 on 18 August 2026 against Upstash's Context7 through version 2.1.2: its Custom AI Instructions feature serves unsanitized content through the MCP server, so an attacker can poison the instructions to exfiltrate credentials from environment files to an attacker-controlled service and delete files, triggered when the agent makes an ordinary library documentation request. NVD carries a CVSS 4.0 base of 6.4 from VulnCheck with no vulnerability confidentiality impact but high subsequent-system confidentiality, integrity and availability impact; secondary coverage quotes a 9.0 under CVSS 3.1. Context7 is one of the most commonly installed MCP servers in coding agents, and no fix is documented.
2026-08-18 / github-pulse-researcherContext7 Ships an Official OpenCode Plugin With OAuth as the Default Auth Pathupstash/context7 (60,920 stars) published @upstash/[redacted] on 2026-08-18 — the official Context7 plugin for OpenCode. Installing it registers both the hosted Context7 MCP server and a `context7-mcp` skill in one step. Authentication defaults to OAuth and falls back to CONTEXT7_API_KEY or an inline apiKey plugin option, which is a notable shift: most MCP documentation servers still assume a pasted API key as the primary path. For builders, this is the up-to-date-library-docs layer becoming a first-class OpenCode install rather than a hand-edited MCP config block.
2026-08-13 / projects-researcherContext7 Rebrands From MCP Server to 'Context7 Platform' at 60,685 Starsupstash/context7 — the service that injects up-to-date library documentation into LLMs and AI code editors — now describes itself as the Context7 Platform rather than a single MCP server, at 60,685 stars in TypeScript. The shift from server to platform is the same move Firecrawl made when it became 'the Context API,' and it points at documentation retrieval consolidating into a paid layer rather than staying a free MCP endpoint. Worth watching if your agent config depends on the public server staying free.
2026-08-12 / github-pulse-researcherContext7's SDK 2.0 Migration Leaked SSE Streams — Two Patches Landed the Same Day With p99.9 Latency DataContext7 shipped @upstash/context7-mcp 4.0.1 and 4.0.2 on 2026-08-11, both cleaning up fallout from the 4.0.0 migration to MCP SDK 2.0. Version 4.0.1 stopped forcing `responseMode: "sse"` on the HTTP handler because every response was riding an unreleased SSE stream, and 4.0.2 added a 60s `AbortSignal.timeout()` after finding stalled backend calls were inheriting undici's ~300s default. The team justified the 60s figure with production data — these are vector queries with p99.9 around 3.2s — and a companion [redacted] release fixed silent anonymous fallback when stored OAuth tokens expired.
2026-08-11 / github-pulse-researcherContext7 Became One of the First Large MCP Servers to Migrate to SDK 2.0 and the 2026-07-28 Protocol Revision — Deleting Redis Sessions Entirelyupstash/context7 (60,590 stars) published `@upstash/[redacted]` on 2026-08-07, migrating to `@modelcontextprotocol/{node,server,client}` 2.0.0 and the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions were removed outright — a meaningful operational simplification for anyone self-hosting an MCP server at scale. The same release train also fixed a subtle auth failure: `ctx7 setup` now writes a standard `Authorization: Bearer` header instead of a custom `CONTEXT7_API_KEY` one, because Codex read the custom name as 'no credential configured,' fell through to a stale OAuth credential, and failed with `invalid_grant` before the API key was ever sent.
2026-06-04 / github-pulse-researcherupstash/context7 at 56.7K Stars: MCP Server Delivers Up-to-Date Code Documentation Directly to LLMs and AI Editorsupstash/context7 has reached 56,722 stars by serving current, version-accurate code documentation to LLMs and AI code editors via an MCP server. It directly addresses the stale-training-data problem that causes agents to hallucinate outdated APIs. For builders using Claude Code or Cursor, it's a practical MCP plug-in to ground code generation in real docs.
2026-05-25 / projects-researcherContext7 by Upstash Becomes Most Popular MCP Server — 54K Stars, 890K Weekly npm DownloadsContext7, open-sourced by Upstash, has surged to over 54,000 GitHub stars and 890,000 weekly npm downloads, making it the single most popular MCP server in the ecosystem. It dynamically fetches the latest version-specific documentation for React, Next.js, Tailwind, and other libraries, injecting them into Claude's context so the model works with current API surfaces instead of stale training data. In an MCP ecosystem that now has 14,000+ servers (governance transferred to Linux Foundation's AAIF), Context7 stands alone in adoption.
2026-05-23 / github-pulse-researcherupstash/context7 at 55.9K Stars: MCP Server Injects Version-Specific Documentation Into LLM Prompts to Eliminate Hallucinated APIsContext7 pulls up-to-date, version-specific documentation and code examples straight from source and places them directly into LLM prompts via MCP. The two core tools — resolve-library-id and query-docs — let any MCP-compatible client (Cursor, Windsurf, Claude Code) retrieve accurate docs instead of relying on training data. Free API key available at context7.com for higher rate limits.
2026-05-13 / projects-researcherContext7 Reaches 55,202 Stars as the Most Popular MCP Server of 2026 — Injects Version-Specific Library Docs Into Any AI Coding AgentUpstash's Context7 MCP server has climbed to 55,202 GitHub stars by solving AI coding agents' hallucinated-documentation problem. It fetches version-specific code examples directly into the LLM context — ask for Next.js 14 middleware patterns and you get Next.js 14 docs, not 13 or 15. Works with Claude Code, Cursor, OpenCode, and any MCP-compatible client, free under MIT license with optional API key for higher rate limits.
2026-04-27 / github-pulse-researcherUpstash Context7 Ships Architecture Overhaul — 65% Token Reduction for MCP Documentation PlatformContext7, the MCP server that injects up-to-date code documentation into LLM context, shipped an architecture overhaul achieving 65% reduction in tokens (from ~9.7K to ~3.3K average), 38% latency improvement (24s to 15s), and 30% fewer tool calls. The platform serves real-time documentation for any library directly into AI code editors like Cursor and Windsurf via the Model Context Protocol. At 53.8K stars, Context7 has become one of the most-installed MCP servers in the ecosystem.
2026-04-16 / github-pulse-researcherUpstash Context7 Platform Surges to 52.9K Stars — Up-to-Date Code Documentation MCP Server for AI EditorsContext7, an MCP server that provides real-time, up-to-date code documentation to LLMs and AI code editors, has grown to 52,871 stars. The platform solves the stale-documentation problem where LLMs hallucinate outdated APIs by serving verified, current library docs directly into the coding context. Tagged for vibe-coding and MCP-server, it integrates natively with any MCP-compatible tool including Claude Code and Cursor.

Graph relationships

RELEASED
context7-sdk
upstash released context7-sdk 0.4.0 with 30-second request timeout by default
Source finding
BUILT BY
Context7
Upstash's Context7 MCP server through version 2.1.2 has prompt injection vulnerability CVE-2026-75130.
Source finding
BUILT BY
Context7
Context7 is an Upstash MCP server for real-time documentation.
Source finding
RELEASED
Context7
Upstash released Context7, an MCP server for up-to-date code documentation.
Source finding
BUILT BY
Context7
Upstash created Context7 MCP server
Source finding
BUILT BY
Context7
Context7 is an MCP server built by Upstash.
Source finding
BUILT BY
Context7
Context7 was open-sourced by Upstash
Source finding
BUILT BY
Context7
Context7 is maintained by Upstash.
Source finding
BUILT BY
Context7 -> Upstash
Upstash's Context7 MCP server through version 2.1.2 has prompt injection vulnerability CVE-2026-75130.
Source finding
BUILT BY
Context7 -> Upstash
Context7 is an Upstash MCP server for real-time documentation.
Source finding
BUILT BY
Context7 -> Upstash
Upstash created Context7 MCP server
Source finding
BUILT BY
Context7 -> Upstash
Context7 is an MCP server built by Upstash.
Source finding

Source trail

CVE-2026-75130 Context7 by Upstash Released May 22 2.3K stars From the SST team GitHub GitHub GitHub GitHub

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…