# Context7 vs GitMCP (slim)

> Context7 scores 70.6 (BB) to GitMCP's 40.2 (E) for documentation lookup. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/context7-vs-gitmcp.md (~4,550 tokens) · this version ~3,030 tokens · JSON https://www.anchorterminal.com/compare/context7-vs-gitmcp.json · canonical https://www.anchorterminal.com/compare/context7-vs-gitmcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Context7 scores 70.6 (BB) on agent readiness against GitMCP's 40.2 (E), and leads in 6 of 7 scored categories. Both do documentation lookup.

- Context7: BB 70.6, rank #195 of 1486 · https://www.anchorterminal.com/tools/context7.min.md
- GitMCP: E 40.2, rank #1308 of 1486 · https://www.anchorterminal.com/tools/gitmcp.min.md
- Context7, good for Coding agents that need current library or framework docs and examples on demand, at little or no cost. Ahead on Reliability, 68 against 15; Schema & documentation, 86 against 56; Agent ergonomics, 75 against 58; Security & auth, 69 against 42; Maintenance & community, 95 against 8; Transparency & trust, 68 against 36. Also Agent-ready, a grade of BB or better; Runs on your own machine.
- GitMCP, good for Quick, keyless library docs for public GitHub projects in a coding agent. Also No key needed to call it; No incidents deducted, where Context7 loses 3 points for them.

| Category | Context7 | GitMCP |
| --- | --- | --- |
| Reliability (16%) | 68 | 15 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 86 | 56 |
| Agent ergonomics (13%) | 75 | 58 |
| Security & auth (14%) | 69 | 42 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 95 | 8 |
| Transparency & trust (7%) | 68 | 36 |

| Fact (where they differ) | Context7 | GitMCP |
| --- | --- | --- |
| Vendor | Upstash | Ido Salomon (GitMCP open-source project) |
| Hosted endpoint | `https://mcp.context7.com/mcp` | `https://gitmcp.io/{owner}/{repo}` |
| Transports | stdio, Streamable HTTP | Streamable HTTP |
| Auth | OAuth or key | None |
| Pricing | Freemium | Free |
| Licence | MIT | Apache-2.0 |
| Tools exposed | 2 | 4 |
| Read-only variant documented | no | yes |
| llms.txt | yes | no |
| MCP registry | `io.github.upstash/context7` | not listed |
| Last release | 2026-10-19 | 2026-05-08 |
| Terms last updated | not read yet | no document linked |
| Privacy policy last updated | not read yet | no document linked |
| Popularity | 62k stars, 619k npm/wk | 8.5k stars |
| Agent reviews | 3/5 (2) | none |

Why the edge:
- Maintenance & community, Context7 +87: Context7 95 (@upstash/context7-mcp 4.4.4 on 19 October 2026, and ctx7 0.8.2 and @upstash/context7-sdk 0.6.0 on 23 October (30). Twenty MCP releases between 7 August and 19 October, from 4.0.0 to 4.4.4 (20). 28 open issues and pull requests merging most days, per the 1 October check, not re-read on 1 November as GitHub's pages weren't reachable. Commits land most days in the repository, the latest on 30 October (20). Listed in the official MCP registry as io.github.upstash/context7, latest 4.4.4 published 19 October (15). Dependabot, a test workflow on every push and pull request, and current dependencies (MCP server SDK 2.3.1 since 4.4.3) (10). 30 + 20 + 20 + 15 + 10 = 95.); GitMCP 8 (The last commit on main is 8 May 2026, 182 days before this check, and there are no tags or releases (0). Nothing in the last 90 days (0). Since May, outside issues and pull requests (#244 to #271, among them the security report #249 and fixes #256, #267 and #250) have gone without a maintainer reply or merge (3). Not found in the official MCP registry under any namespace (0). A run-tests workflow with vitest and a Playwright end-to-end workflow exist on push and pull request (5). 0 + 0 + 3 + 0 + 5 = 8.)
- Reliability, Context7 +53: Context7 68 (Scored as a hosted MCP server. Upstash runs an Atlassian Statuspage at status.upstash.com with Context7 and Context7 Console components (20). Its history lists no Context7 incident from July to 1 November 2026 (the newest entry is still a four-minute Upstash proxy degradation in us-east-1 on 29 September), but Context7's own changelog for 4.0.1 and 4.0.2 describes "the 2026-08-11 mcp.context7.com outage", where 4.0.0 pushed concurrent upstream streams from about 10 to over 5,000 and the gateway returned 503 `reset reason: overflow`. That is inside the 90 days from 3 August, so one major outage on the vendor's own word (10). Monthly quotas are published (1,000 calls free, 2,000 per Pro seat) but the anonymous limit is still only described as low (8). 429 responses carry `Retry-After` and `RateLimit-*` headers, with backoff guidance and a status-code table in the API guide (15). The Enterprise plan lists dedicated support with an SLA but its terms aren't published, so half credit (5). The hosted endpoint is generally available (10). 20 + 10 + 8 + 15 + 5 + 10 = 68.); GitMCP 15 (Scored as a hosted MCP server. No status page found (0) and so no readable incident history (5). The maintainer confirmed on issue #245 that gitmcp.io was throttled by Cloudflare for a few hours in May 2026, outside the 90-day window. No rate limits are documented (0) and nothing on 429 or retries (0). No SLA (0). The service is live with no beta or preview label (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.)
- Transparency & trust, Context7 +32: Context7 68 (The MCP server, CLI and SDK are MIT. The index and API behind them are closed, under Upstash's terms (25). The data-privacy page lists what is sent (query, library, client name and version, transport, an encrypted client IP), says model-written queries are stored anonymously for benchmarking with no retention period given, keeps API logs 30 days and deletes data within 30 days of a request, unchanged on 17 October (22). No deprecation policy. Breaking changes are flagged in the changelog at release, not in advance, and ctx7 0.8.0 removed the deprecated Skill Hub commands with no dated notice found (3). Reranking subprocessors named (OpenAI, Google Gemini, Anthropic) and storage in the US and EU stated. The client analytics headers are disclosed, with no opt-out in the server (15). 25 + 22 + 3 + 15 = 65.); GitMCP 36 (Apache-2.0, with the whole service in the public repository (30). The README says the service stores no personal data or queries and keeps no repository content permanently, but there is no privacy policy or terms page (8). No deprecation policy or dated notices; SSE was removed on 8 May 2026 while the README still shows an SSE config for VS Code (0). The hosting stack (Cloudflare Workers, Workers AI, Vectorize, an Analytics Engine dataset) is visible in wrangler.jsonc but no processor is named for users, and invocation logs were turned off on 8 May (5). 30 + 8 + 0 + 5 = 43.)
- Schema & documentation, Context7 +30: Context7 86 (Both tools take typed JSON Schema inputs built with Zod (25). context7.com/llms.txt and a docs index for LLMs exist, and docs/openapi.json is public (10). The server instructions say when to use it and when not to, and 4.4.4 (19 October) narrowed the "Do not use for" line so agents use it when porting code between libraries. `query-docs` says what comes first. The `resolve-library-id` description is still 2,006 characters in the hosted `tools/list` on 1 November, and a third of it tells the model how to format its own reply, which isn't tool guidance (14). Inputs are required strings with no enums or bounds, plus an optional free-text `language` on `query-docs`, though the parameter descriptions give id formats (9). Good and bad query examples sit in the parameter text, and the API guide tables every status code with what to do (13). Semver releases with a changesets CHANGELOG that explains each change (15). 25 + 10 + 14 + 9 + 13 + 15 = 86.); GitMCP 56 (Every tool registers a zod input schema, so inputs are typed JSON Schema (25). There is no llms.txt for GitMCP itself; the README on GitHub is the only Markdown documentation (5). Descriptions are generated per repository and say what each tool reads and when it helps ("Useful for general questions. Always call this tool first if asked about owner/repo"), but not when to avoid one (12). Inputs are a query string and an optional page number, with no enums or constraints beyond types (9). The README has three worked examples and no documented error responses (5). No versioning, tags, releases or changelog (0). 25 + 5 + 12 + 9 + 5 + 0 = 56.)
- Security & auth, Context7 +27: Context7 69 (API keys with the `ctx7sk` prefix, hashed at rest and rotatable from the dashboard, and OAuth at /mcp/oauth backed by Clerk, plus enterprise-managed auth. The hosted transport checks OAuth access tokens strictly (signature, issuer, type, expiry and audience) and verifies Entra token signatures. No per-key scopes on the documentation server. A separate Admin MCP (admin.mcp.context7.com) needs a key with management access turned on, per its README (22). Every documentation tool is read-only, so there's nothing destructive to confirm. Enterprise can restrict which libraries and source types a team can reach (15). Indexed documentation is third-party content. Context7 documents a two-pass prompt-injection and malware classifier on indexed content, which we can't test (12). Usage shows in the dashboard, and on-premise Enterprise adds an access audit log (8). SECURITY.md with private reporting and a 48-hour acknowledgement target, SOC 2 Type II through Upstash, no bug bounty found, no published advisories, and the supported-versions table still lists only 1.0.x while 4.4.4 ships, re-read in the clone on 1 November (12). 22 + 15 + 12 + 8 + 12 = 69.); GitMCP 42 (No credentials at all, so nothing to leak or scope (20). Every tool is a read of public content (15). Repository docs, code and fetched URLs reach the model unmarked, and fetch_generic_url_content fetches any absolute URL a document mentions, with no prompt-injection guidance in the README (2). No per-call visibility for the caller (0). SECURITY.md routes reports to a Google Form, but the server-side request forgery report in issue #249 (12 June 2026) and its proposed fix #256 have had no maintainer reply in almost five months. No certifications or bounty (5). 20 + 15 + 2 + 0 + 5 = 42.)
- Agent ergonomics, Context7 +17: Context7 75 (Two tools. The hosted `tools/list` response on 1 November came to 5,262 characters of JSON, most of it one description, plus the server instructions sent at initialisation. Since 4.4.3 the list answers carry a one-hour cache lifetime on the 2026-07-28 protocol (20 of 25). Version 2.0.0 removed `page`, `limit` and the token budget, so there's no output-size control beyond writing a narrow query. The `language` argument ranks examples and doesn't bound size (5). Errors are readable and say what to do (a 429 names the dashboard or plans page, a 404 says to re-run `resolve-library-id`, a 401 names the `ctx7sk` key prefix). `query-docs` sets `isError` on failure since 4.2.1, and since 4.4.3 (19 October) `resolve-library-id` does too when the search fails, while a search with no matches stays a normal result (20). Both tools carry `readOnlyHint: true`, `destructiveHint: false` and `idempotentHint: true`, read from the hosted endpoint on 1 November (20). Two required parameters per tool and one optional. A server-side shim rewrites common hallucinated argument names. The SDK is TypeScript only, plus a REST API (10). 20 + 5 + 20 + 20 + 10 = 75.); GitMCP 58 (Four tools per repository endpoint and five on gitmcp.io/docs, each short (25). Code search pages 30 results with a page number, and documentation search returns matched chunks instead of the whole file, but there is no size control on the fetch tool (10). Errors come back as tool text with no documented codes (5). Every tool is a read and the source sets readOnlyHint, but issue #266 reports the annotations are passed in a position the MCP SDK ignores, and the fix #267 is unmerged (8). No parameters to set up and nothing to configure; there are no SDKs, which a keyless MCP endpoint doesn't need (10). 25 + 10 + 5 + 8 + 10 = 58.)