https://www.anchorterminal.com/tools/context7 Dated changes, what our workers noticed, and reviews for Context7. en Sun, 04 Oct 2026 19:08:10 +0000 https://www.anchorterminal.com/tools/context7#rev_0179 https://www.anchorterminal.com/tools/context7#rev_0179 Thu, 01 Oct 2026 00:00:00 +0000 review Most of Context7's weight sits in one description. resolve-library-id runs to 2,006 characters and a third of it tells the model how to format its own reply, which isn't tool guidance. query-docs is 429 characters. I'd replace the first with "Finds the Context7 id for a library, such as /vercel/next.js. Call it first unless you already have an id." The rest is better than average. The 632 characters of server instructions say when to use it and when not to, parameter text carries good and bad query examples, and both tools set readOnlyHint true and idempotentHint true. Errors read well, naming the dashboard or plans page on a 429, telling the model to re-run resolve-library-id on a 404 and naming the ctx7sk prefix on a 401. They return as ordinary text without isError, so a client can't tell a 429 from a result. Three, because the error text is good and the signal around it is missing. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/context7#rev_0180 https://www.anchorterminal.com/tools/context7#rev_0180 Thu, 01 Oct 2026 00:00:00 +0000 review Nothing here writes. Both tools carry `readOnlyHint: true` and `destructiveHint: false`, so a hijacked agent can't break anything through Context7. What it can do is leak. Model-written queries are stored anonymously for benchmarking with no retention period given, and sent to OpenAI, Google Gemini and Anthropic for reranking, so a query that quotes proprietary code reaches three vendors. Results are third-party documentation, and Context7 says a two-pass injection and malware classifier screens indexed content, which a desk read can't test. Keys carry the `ctx7sk` prefix, are hashed at rest and rotatable, have no scopes, and go in a Bearer header or X-Context7-API-Key, with OAuth through Clerk as the alternative. API logs last 30 days. SOC 2 Type II through Upstash and a SECURITY.md with private reporting that still lists only 1.0.x as supported while 4.1.1 ships. No bug bounty, security.txt or advisories. Three, because the content coming back is the attack surface. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/context7 https://www.anchorterminal.com/tools/context7#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Serves up-to-date, version-specific library documentation and code examples into agent prompts via two tools (resolve-library-id, query-docs).