npm JavaScript analyzed 4.0.3

@upstash/context7-mcp

v4.0.3

MCP server for Context7

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 2 tools

transport stdio · http verified reported listed in the official MCP registry counts 2 tools · 0 res · 0 prompts permission surface via code analysis

code evidence v4.0.3 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 9

net package/dist/index.js :386 const response = await fetch(`${authServerUrl}/.well-known/oauth-authorization-server`);
net package/dist/lib/api.js :2 import { Agent, ProxyAgent, setGlobalDispatcher } from "undici";
net package/dist/lib/jwt.js :23 const res = await fetch(`${CONTEXT7_API_BASE_URL}/v2/entra/config/${encodeURIComponent(audience)}`);

secrets package/dist/index.js :441 stdioApiKey = cliOptions.apiKey || process.env.CONTEXT7_API_KEY;
secrets package/dist/lib/constants.js :25 export const OPENAI_APPS_CHALLENGE_TOKEN = process.env.OPENAI_APPS_CHALLENGE_TOKEN;
secrets package/dist/lib/encryption.js :4 const ENCRYPTION_KEY = process.env.CLIENT_IP_ENCRYPTION_KEY || DEFAULT_ENCRYPTION_KEY;