* fix(cli): write the API key as an Authorization header
Codex resolves a server's auth mode by checking only for
`bearer_token_env_var` or a header literally named `Authorization`
(`auth_status_before_discovery` in codex-rs/rmcp-client/src/auth_status.rs,
mirrored in `create_transport` in rmcp_client.rs). The custom
`CONTEXT7_API_KEY` header matched neither, so Codex fell through to any OAuth
credential stored for the same server name and URL and refreshed it during
startup. A dead refresh token then failed the server with `invalid_grant`
before the API key was ever sent, and re-running setup could not recover it
because setup writes config.toml and never touches the credential store.
The hosted endpoint accepts both header forms, so existing configs keep
working.
Two places keep the legacy header deliberately: the plugin .mcp.json files
default to `${CONTEXT7_API_KEY:-}`, and the server rejects `Bearer` with an
empty token while treating a missing header as anonymous; and `env` blocks in
stdio configs, where the name is an environment variable rather than a header.
* fix(plugins): send the API key via the Authorization header
The Claude and Copilot plugin configs default to `${CONTEXT7_API_KEY:-}`, and
both plugins document that an unset key still works over the anonymous tier.
The Bearer form cannot express that: the server rejects `Bearer` with an empty
token while treating an empty or missing Authorization header as anonymous.
The raw-key form satisfies both states. It is genuinely parsed rather than
ignored, verified by an invalid raw key being rejected, so a set key still
authenticates while an unset one falls back to anonymous as documented.
Once the server treats an empty-token Bearer as no header, these can move to
the `Bearer <key>` form used everywhere else.
* refactor(cli): narrow the Codex OAuth probe and trim its surface
Only `oauth` proves a stored credential exists. `not_logged_in` also covers
"no credential, server merely advertises OAuth", which is the normal state for
anyone who never logged in, so treating it as stale told most users their
config held a credential it did not.
Collapse the module to the two functions the call site needs, derive nothing
from a hand-maintained status list, and skip the subprocess entirely when the
server is not already in Codex's config. Drop the probe timeout to 1.5s and
kill with SIGKILL so it is a real ceiling rather than an intent, since the
result is only an advisory hint.
Lock the plugin manifests' raw-key form behind a test, so normalizing them to
`Bearer` for consistency with the CLI fails loudly instead of silently
breaking anonymous access.
* refactor(cli): drop the Codex OAuth cleanup note
The note existed because re-running setup could not rescue a stuck user. The
Authorization header change in this same branch makes it rescue them: Codex
never reads the stored credential once that header is present, so the
credential is inert and the hint only offered cosmetic cleanup.
Removing it drops a subprocess spawn from a user-facing path and a dependency
on the shape of `codex mcp get --json`, an external contract this repo does not
pin. The reason the header name matters moves to `withHeaders`, where the
decision is encoded.
* focus Context7 documentation queries
* narrow documentation query prompt changes
* remove focused from query prompts
* use lookup wording in query prompts
* distinguish documentation lookup from task
* allow live Pi test more time
* add prompt guidance changeset
* refactor(skills): consolidate skills under /skills with canonical sources
- Rename skills/docs → skills/find-docs (name: find-docs)
- Rename skills/ctx7-cli → skills/context7-cli (name: context7-cli)
- Add skills/context7-mcp as canonical MCP skill source
- Rename plugin skill folders to context7-mcp and unify name to context7-mcp
- MCP setup now downloads context7-mcp skill from GitHub instead of using hardcoded SKILL_CONTENT
- Remove SKILL_CONTENT from templates.ts — skills/context7-mcp/SKILL.md is the single source of truth
- Add Error Handling section to find-docs skill for quota errors
- Update agents.ts skill name: documentation-lookup → context7-mcp
- Update docs/clients/cli.mdx and setup references accordingly
* chore: add changeset for skills consolidation
* fix(skills): update plugin skill frontmatter name and setup docs to context7-mcp
* feat: add Context7 plugin for Cursor marketplace
Adds a Cursor plugin with MCP server (OAuth), rules, skills, and agent
for up-to-date library documentation lookup via Context7.
* chore: update Cursor plugin author to Context7
* fix: claude code plugin name and details image
* fix: claude code plugin name and details image
* update skill prompt
* fix: update plugin.json name and improve agent/skill instructions
* fix: update plugin README with correct install commands
* fix: remove max 3 calls warning
Fahreddin Özcan