* feat(plugins): add Context7 plugin for OpenCode
Adds @upstash/context7-opencode, an OpenCode plugin that registers the
hosted Context7 MCP server, the context7-mcp skill, a docs-researcher
subagent, and the /context7-docs command through the config hook.
* docs(opencode): keep ctx7 setup as the primary install path
* refactor(opencode): drop the component toggles and tighten the option boundary
The skill/agent/command toggles were speculative: OpenCode dedupes skills by
name, so running ctx7 setup alongside the plugin is already safe, and a user
who wants a component gone can define it themselves, which the plugin never
overwrites. Removing them collapses resolveOptions into resolveApiKey and
deletes the duplicated defaulting between option parsing and config assembly.
Also assert the MCP endpoints as literals. The tests compared against the same
constants they exercised, so a wrong URL would have passed.
* refactor(opencode): drop tests and collapse the plugin into one file
config.ts existed to give the tests a seam. With the tests gone the split was
indirection with no consumer, so the constants, the config assembly, and the
plugin entry now live in src/index.ts and nothing but the default export is
public. Passing skillsDir through an ApplyInput object also stops being
necessary once it is a module constant.
* fix(opencode): run the MCP server over stdio and drop the slash command
Verified against a real OpenCode 1.18.11 session: the remote transport does
not work. OpenCode opens the optional GET SSE stream, mcp.context7.com answers
405, and OpenCode marks the server failed and registers no tools, so the model
never sees resolve-library-id and falls back to inventing bash calls. A control
project with a plain remote mcp block and no plugin fails the same way, so this
is not plugin-specific. Running the server over stdio connects and the model
calls the tools.
The bundled skill and the agent prompt also referenced the bare tool names.
OpenCode prefixes MCP tools with the server name, so they are now
context7_resolve-library-id and context7_query-docs.
Also removes the /context7-docs command. The skill already triggers on its own
and the subagent covers focused lookups.
* refactor(opencode): use the remote MCP server and drop the subagent
The plugin now adds two things: the hosted MCP server over the remote
transport, and the context7-mcp skill.
Known limitation: OpenCode opens the optional GET SSE stream on the endpoint
and mcp.context7.com answers 405, so OpenCode marks the server failed and
registers no tools. Reproduced on 1.18.11 and 1.18.16, and with a plain remote
mcp block and no plugin, so it is not plugin-specific. It resolves once
mcp.context7.com answers GET /mcp with a 200 SSE stream instead of 405.
* refactor(opencode): ship the canonical skill verbatim and drop the phantom peer dep
The bundled skill had been edited to hard-code OpenCode's context7_ tool
prefix. That divergence was unnecessary and counterproductive:
- It was fixing a misdiagnosis. The model only invented shell commands when
the MCP server had failed to connect and no context7 tools existed at all.
With the tools present, claude-haiku-4-5 calls context7_resolve-library-id
correctly from the bare-name canonical skill.
- It was defeated where it mattered. OpenCode dedupes skills by name and scans
~/.claude/skills first, so on any machine that ran ctx7 setup the bundled
copy is shadowed by the canonical one anyway.
- It was the only client copy to diverge in content. claude, copilot, codex
and cursor all ship skills/context7-mcp/SKILL.md verbatim, and there is no
tooling to keep copies in sync.
Also removes peerDependencies on @opencode-ai/plugin. The package is a
type-only import that the build erases, so the published dist has zero
references to it, and peerDependenciesMeta.optional made the declaration inert
anyway. The devDependency is what typechecking actually needs.
* refactor(opencode): strip commentary and inline the plugin function
Keeps only the two comments that stop someone breaking the plugin: why the
skills cast is needed, and why nothing but the default export may be exported.
Inlining the server function into the default export drops the Context7Plugin
binding and the Plugin type import, since satisfies PluginModule already types
the callback. 85 lines down to 56.
* docs(opencode): use the prefixed tool names consistently in the README
The 18 links reported by `mint broken-links` were a bug in CLI 4.2.212;
4.2.762 reports zero. Those pages are auto-generated from openapi.json
and all return 200. Fixes the real issues found while checking instead:
- Swagger Petstore URL in the GitOps manifest example returned 404
- `/websites/uploadcare_com` is a stale library ID (404); it is now
`/websites/uploadcare`
- API methods table omitted the GitLab, Bitbucket, other-Git, Notion,
and metrics endpoints, and collapsed the four repo endpoints into one
`{provider}` row that does not match the spec
* fix(cli): write the API key as an Authorization header
Codex resolves a server's auth mode by checking only for
`bearer_token_env_var` or a header literally named `Authorization`
(`auth_status_before_discovery` in codex-rs/rmcp-client/src/auth_status.rs,
mirrored in `create_transport` in rmcp_client.rs). The custom
`CONTEXT7_API_KEY` header matched neither, so Codex fell through to any OAuth
credential stored for the same server name and URL and refreshed it during
startup. A dead refresh token then failed the server with `invalid_grant`
before the API key was ever sent, and re-running setup could not recover it
because setup writes config.toml and never touches the credential store.
The hosted endpoint accepts both header forms, so existing configs keep
working.
Two places keep the legacy header deliberately: the plugin .mcp.json files
default to `${CONTEXT7_API_KEY:-}`, and the server rejects `Bearer` with an
empty token while treating a missing header as anonymous; and `env` blocks in
stdio configs, where the name is an environment variable rather than a header.
* fix(plugins): send the API key via the Authorization header
The Claude and Copilot plugin configs default to `${CONTEXT7_API_KEY:-}`, and
both plugins document that an unset key still works over the anonymous tier.
The Bearer form cannot express that: the server rejects `Bearer` with an empty
token while treating an empty or missing Authorization header as anonymous.
The raw-key form satisfies both states. It is genuinely parsed rather than
ignored, verified by an invalid raw key being rejected, so a set key still
authenticates while an unset one falls back to anonymous as documented.
Once the server treats an empty-token Bearer as no header, these can move to
the `Bearer <key>` form used everywhere else.
* refactor(cli): narrow the Codex OAuth probe and trim its surface
Only `oauth` proves a stored credential exists. `not_logged_in` also covers
"no credential, server merely advertises OAuth", which is the normal state for
anyone who never logged in, so treating it as stale told most users their
config held a credential it did not.
Collapse the module to the two functions the call site needs, derive nothing
from a hand-maintained status list, and skip the subprocess entirely when the
server is not already in Codex's config. Drop the probe timeout to 1.5s and
kill with SIGKILL so it is a real ceiling rather than an intent, since the
result is only an advisory hint.
Lock the plugin manifests' raw-key form behind a test, so normalizing them to
`Bearer` for consistency with the CLI fails loudly instead of silently
breaking anonymous access.
* refactor(cli): drop the Codex OAuth cleanup note
The note existed because re-running setup could not rescue a stuck user. The
Authorization header change in this same branch makes it rescue them: Codex
never reads the stored credential once that header is present, so the
credential is inert and the hint only offered cosmetic cleanup.
Removing it drops a subprocess spawn from a user-facing path and a dependency
on the shape of `codex mcp get --json`, an external contract this repo does not
pin. The reason the header name matters moves to `withHeaders`, where the
decision is encoded.
* docs(enterprise): add multi-container scaling guide
Document running On-Premise as multiple replicas with PostgreSQL + object
storage. Add the Scaling page under Deployment and cross-reference it from the
Kubernetes single-replica notes.
* docs(enterprise): migration guide for existing deployments + docker scaling pointer
- Scaling page: step-by-step migration using the built-in migrate command
(Docker one-shot and Kubernetes Job), vector sync, encryption-key reuse
- Docker page: add a Scaling pointer
* docs(enterprise): add Settings > Scaling helper screenshots
Show the migration helper (single-container) and the multi-replica confirmation
in the migration section of the Scaling guide.
* docs(enterprise): point Scaling guide at the Helm chart and turnkey compose
- Docker Compose: reference the one-command bundled stack (Postgres + MinIO + LB)
- Kubernetes: use the Helm chart (single default, scaling.enabled to scale out)
- add on-prem / S3-compatible object storage (VECTOR_STORE_ENDPOINT)
* docs(enterprise): make Scaling deployment sections self-contained
On-prem customers get the image and docs, not the source repo, so inline the
full Docker Compose stack (with nginx.conf and .env) and the scaled Kubernetes
manifests (Secret + Deployment) instead of referencing repo files. Note the Helm
chart ships with the enterprise distribution.
* docs(enterprise): pgvector default for scaling, Postgres the only dependency
Vectors go to pgvector in the same Postgres, so object storage is no longer
required. Update config, compose (pgvector image, no MinIO), k8s secret, and the
migration (copies vectors into pgvector, no bucket sync). Object storage is now
an optional escape hatch for very large indexes.
* docs(enterprise): refresh Settings > Scaling screenshot for pgvector migration command
* docs(enterprise): pgvector only, drop the object storage option from the guide
Remove the VECTOR_STORE_URI config row and the 'Vectors on object storage'
section. Multi-replica uses Postgres + pgvector with no object storage.
* docs(enterprise): detailed pgvector provisioning guide
Expand the provisioning step with per-provider instructions (RDS/Aurora, Cloud
SQL, Azure Flexible Server, self-hosted/Docker), the 0.5.0 HNSW requirement,
CREATE EXTENSION, version verification, permission notes, and references. Add a
note on how vectors are stored (HNSW cosine, dimension from the model).
* docs(enterprise): explain the scaling model in Scale out
Every replica serves traffic and indexes; adding replicas grows both. Note how to
bound parse-vs-query contention with Max concurrent parses.
* docs(enterprise): drop SESSION_SECRET; ENCRYPTION_KEY now signs sessions
* docs(enterprise): add scaling sections to docker/kubernetes, link scaling page
- kubernetes: new Scaling section (StatefulSet -> Deployment + pgvector, Helm note)
- docker: refresh Scaling section (pgvector, turnkey compose)
- drop stale object-storage wording, both link to the Scaling guide
* docs(enterprise): add architecture diagram and a Helm page
- scaling: add an Architecture section with a Mermaid multi-replica diagram
- new Helm deployment page (install, scale, ingress, migration, values)
- add Helm to deployment nav; link it from the kubernetes and scaling pages
* docs(enterprise): move Helm page to its own PR (CTX7-1846)
* docs(enterprise): describe per-run Postgres lock instead of leader election
Match the code: scheduled jobs take a short advisory lock at fire time so one
replica runs each, rather than a persistent elected leader. Drop the leader
highlight from the architecture diagram; replicas are interchangeable.
* docs(enterprise): add Vector Stores page covering LanceDB, pgvector, and Milvus
Dedicated vector-store configuration page: backend comparison, VECTOR_STORE
selection, and Milvus / Zilliz Cloud setup. Cross-link from the scaling guide.
* docs(enterprise): note library access + SSO groups carry over in migration
The migrate command now copies per-library access rules and SSO group
memberships (and session epochs) alongside the other tables, so list them
in the migration step.
- Document the By page URL mode on the Confluence integration page (with screenshot)
alongside Browse spaces, including per-page Sub-pages and cross-space support.
- Document the confluence pageUrls / includeSubPages manifest fields in GitOps.
- Correct the space picker step to the current lazy-loaded dropdown.
* docs(enterprise): add Other Git integration page (HTTPS + SSH)
Document ingesting private repos from self-managed Git hosts (Gerrit, Gitea,
self-hosted Bitbucket) over HTTPS basic auth and SSH deploy keys, with Docker
and Kubernetes mount examples. Clarifies that SSH keys are mounted into the
container and never stored by Context7.
* docs(enterprise): SSH deploy key is configurable in the UI (mount is the alternative)
* docs(enterprise): add Other Git screenshots + Add a repository steps
- HTTPS and SSH tab screenshots
- 'Add a repository' Steps showing the clone-URL scheme selects auth
- ssh-keyscan snippet for known_hosts
* docs(enterprise): remove em dashes from Other Git page
- Document the manifest 'type' field routing entries to Confluence, website,
llms.txt, and OpenAPI parsers (bare entries stay git)
- Add the per-type field table and the no-secrets/strict-validation notes
- Confluence: document the space URL field, 'index entire space' scope, and
paginated page browsing; cross-link GitOps confluence entries
* docs(enterprise): document programmatic library import/export API
- Add POST /import-libraries endpoint reference (openapi-enterprise.json + page)
- Register it under API Reference → Parse in the nav
- Add an Automating with the API section to the Library Import feature doc,
covering the cloud license-key export and the on-prem JSON import
* docs: update export endpoint to /api/v1/enterprise/export, plain language
Match the renamed cloud export path, move the license key into the request
body, and reword the automation section without em dashes.
* docs(enterprise): export uses Authorization header; import requires an API key
* docs(enterprise): document the force query param on import
* docs(enterprise): add Confluence integration page
Document connecting Confluence (Cloud and self-hosted Data Center) and
indexing a space from Add. Includes screenshots and a nav entry under
Enterprise > Integrations.
* docs(enterprise): wider Confluence settings screenshot with mock site URL
Document setting the GitHub Enterprise host before creating the App or token, so the App flow targets the on-prem server instead of github.com. Note the GITHUB_URL env var as a deploy-time alternative.
* CTX7-1760: document GitOps for on-premise
Add the GitOps page under the On-Premise docs: how reconciliation works, the
manifest format and fields, dashboard configuration, webhooks, disaster
recovery, and the REST API. Includes a dashboard screenshot.
* CTX7-1760: clarify GitOps webhook requirements (reachable host, push subscription)
* CTX7-1760: call out webhook caveat for pre-existing GitHub Apps
* CTX7-1760: add a Before you start prerequisites section to GitOps docs
* CTX7-1760: add GitHub Integration page; trim GitOps prerequisites to reference it
* CTX7-1760: group on-prem feature pages under a Features nav section
* CTX7-1760: move GitHub docs under an Integrations group, add setup screenshots
* Remove accidentally-staged docs/enterprise/integrations/github-actions.mdx
* CTX7-1760: use an admin API key example for the reconcile endpoint instead of a session cookie
* CTX7-1760: use connected-state GitHub App screenshot; split setup into create + install steps
* CTX7-1760: add Verify the App configuration section with permissions and webhook screenshots
Documents generic OIDC SSO setup for Context7 On-Premise, with dashboard
screenshots and a troubleshooting section. Adds the page to the On-Premise
Security nav group.
Adds Part 4 Step 3 covering Microsoft Graph permissions (GroupMember.Read.All
+ User.ReadBasic.All), the WIF federated credential setup (issuer, subject,
audience values copied from the dashboard), group creation, dashboard config,
and "Sync now" verification. Updates the Step 2 roadmap note and adds a
troubleshooting entry for the most common pitfall: missing User.ReadBasic.All
returns 0 members synced even when the group has members.
Document the offline library transfer flow: export libraries from Context7
Cloud, import the bundle into an airgapped on-premise install (snippets are
re-embedded locally). Adds the page under Enterprise > On-Premise.
Adds the redirect URI registration step that VS Code with GitHub Copilot
requires, plus troubleshooting entries for AADSTS500113 and AADSTS50011.
Also notes the CLI alternative when the Manifest UI silently fails to
persist requestedAccessTokenVersion.
* docs: backup and restore guide for on-premise
* docs: add dashboard restore flow and Keep all retention
* docs: use ctx7:restore in the local restore command
* docs: use consistent library/index vocabulary in backup-restore
Add the page files for the Policies and Rules dashboard tabs, which the
nav (docs.json) already references. Policies covers source-type access
and library filters; Rules covers global and library-specific teamspace
rules.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fahreddin Özcan