upstash/context7

[email protected] scope: ctx7 Feature

This release adds 1 notable feature for engineering teams evaluating rollout.

Published 1mo MCP Developer Tools

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

llm mcp mcp-server vibe-coding

Affected surfaces

auth

Summary

AI summary

Adds OAuth 2.0 device authorization flow for headless environments

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds OAuth 2.0 device authorization flow for ctx7 login and setup. Adds OAuth 2.0 device authorization flow for ctx7 login and setup. Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Low	Automatically selects device flow when SSH connection is detected or DISPLAY is missing on Linux. Automatically selects device flow when SSH connection is detected or DISPLAY is missing on Linux. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Feature	Low	Allows forcing device flow with `ctx7 login --device` flag. Allows forcing device flow with `ctx7 login --device` flag. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Performance	Low	Polling tolerates transient network errors and 5xx responses without ending the session. Polling tolerates transient network errors and 5xx responses without ending the session. Source: granite4.1:30b@2026-06-04-audit Confidence: low	—

Full changelog

5a180d5: Add OAuth 2.0 device authorization flow (RFC 8628) for ctx7 login and ctx7 setup. Required for headless / remote hosts (SSH, Codespaces, Docker, CI) where the existing localhost-callback flow can't work — the browser was opening on the user's laptop while the callback listener ran on the remote host.

The new flow prints a verification URL and short code, then polls a token endpoint. The user visits the URL on any device, signs in, and approves; the CLI receives the same ctx7sk-… API key it would have gotten from the legacy flow. Device flow is selected automatically when SSH_CONNECTION is set or $DISPLAY is missing on Linux, and can be forced with ctx7 login --device. Polling tolerates transient network errors and 5xx responses without ending the session.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track upstash/context7

Get notified when new releases ship.

About upstash/context7

Up-to-date code documentation for LLMs and AI code editors.

[email protected] Removes `--device` flag and localhost-callback path for `ctx7 login`.