You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Migrates the context7 library-documentation lookup skill into a repo-agnostic plugin per docs/MIGRATION-PLAYBOOK.md. Closes melodic-software/medley#1297.
What ships
One skill, /context7:context7, with three actions:
lookup (default) — two-step resolve-then-query workflow against the Context7 backend, via the ctx7 CLI or the consumer's own Context7 MCP server (graceful CLI fallback when no MCP is configured).
update — advisory drift check: installed vs latest ctx7 (npm), plus a diff of Upstash's upstream reference skills against bundled vendor/ baselines. Never auto-rewrites the skill; --refresh-baseline is maintainer-only (documented).
De-coupling from the source repo
All source-repo rule/skill citations removed (settings.local.json, .claude/rules/*, /research, /machine-health); replaced with generic consumer guidance.
scripts/update.sh resolves paths from its own location (BASH_SOURCE) — works in the installed cache and in a working clone; no git rev-parse dependency.
Preamble trimmed to one grant-covered command (ctx7 --version via frontmatter allowed-tools); the former claude mcp list | grep | sed pipeline failed per-operation permission preflight in a clean repo and was replaced by a tool-list self-check instruction.
Gate evidence (speed-adjusted per issue)
claude plugin validate ./plugins/context7 --strict — PASS; claude plugin validate --strict . (catalog) — PASS.
claude plugin details — always-on ~165 tokens, on-invoke ~2.3k.
--plugin-dir smoke test in a clean non-source scratch repo (headless claude -p): skill invoked as context7:context7, content loaded with no permission prompts, pre-computed context executed (Installed CLI version: not installed (…) — correct for that machine).
Code execution: one bundled script (scripts/update.sh), user-invoked only (no hooks). Spawns npm, curl, diff; writes only with --fix (npm global install) or --refresh-baseline (maintainer-only, writes beside itself). No eval, no curl | sh.
Remote MCP servers: none shipped (deny by default). The skill documents a consumer-side .mcp.json snippet for mcp.context7.com and degrades to the CLI when absent.
userConfig: none. CONTEXT7_API_KEY stays a consumer env var; never stored by the plugin.
Cache isolation: all references inside the plugin; no ../ reach-outs; no state writes (the skill explicitly does not cache docs).
Data egress (ACCEPT, recorded): lookup query text goes to the Context7 backend (context7.com / mcp.context7.com) — that is the plugin's purpose; skill and README both warn against secrets in queries. update reads npm registry + two public raw.githubusercontent.com files, read-only.
Third-party trust (ACCEPT, recorded): Upstash's Context7 service is the documentation backend; only user-authored queries leave the machine, authenticated by the consumer's own optional API key.
Vendor baselines vs managed lint configs
vendor/ holds byte-exact upstream snapshots (drift-diff baselines) that must not be edited to satisfy linters. Managed materializations (.markdownlint-cli2.jsonc, _typos.toml, lychee.toml, .editorconfig-checker.json) are untouched; instead:
a directory-scoped vendor/.markdownlint-cli2.jsonc (default: false) silences rules for the snapshots only (typos/editorconfig pass on them as-is);
a new root .lycheeignore excludes links resolving into plugins/*/skills/*/vendor/ (upstream files reference siblings that are deliberately not vendored).
No contract test ships: the script's behavior is network-bound (npm registry + GitHub fetch), and no existing skill-plugin script carries a *.test.sh — matching precedent rather than adding a flaky lane.
Note
Medium Risk
Lookup sends user query text to Context7; update.sh --fix runs npm install -g ctx7. No hooks or bundled MCP, but third-party network egress and global npm install warrant awareness.
Overview
Adds a new context7 marketplace plugin so consumers can resolve library names and query live Context7 documentation via /context7:context7, using either the ctx7 CLI or an optional consumer-configured Context7 MCP server (CLI fallback when MCP is absent).
The skill exposes three actions: lookup (default two-step resolve-then-query), configure (install, CONTEXT7_API_KEY, Windows MSYS_NO_PATHCONV=1), and update (advisory drift check). Progressive-disclosure docs live under context/*.md; scripts/update.sh compares installed vs latest ctx7, fetches Upstash reference skills, diffs against bundled vendor/ baselines, and only upgrades the CLI with --fix (never auto-merges skill content). --refresh-baseline is maintainer-only.
Catalog and docs are wired in .claude-plugin/marketplace.json and README.md. Repo hygiene adds .lycheeignore for vendor snapshot links and vendor/.markdownlint-cli2.jsonc so upstream baselines stay byte-exact for drift diffing.
Reviewed by Cursor Bugbot for commit 55ab313. Bugbot is set up for automated code reviews on this repo. Configure here.
Migrates the context7 library-documentation lookup skill into a repo-agnostic plugin: two-step resolve-then-query workflow over the ctx7 CLI or the consumer-configured Context7 MCP server, configure action (auth, Windows Git Bash gotcha), and an advisory update action that checks CLI version drift and diffs Upstash upstream reference skills against bundled vendor baselines. Ships no MCP server and no userConfig; CONTEXT7_API_KEY stays a consumer env var. Vendor baselines are byte-exact upstream snapshots — rules off via a directory-scoped markdownlint config and a root .lycheeignore vendor pattern.
Co-Authored-By: Claude <noreply@anthropic.com>
Review plugin manifest and marketplace registration
Review skill files (SKILL.md, context files)
Review update script (scripts/update.sh)
Review security posture
Review alignment with CLAUDE.md / MIGRATION-PLAYBOOK.md rules
Post comprehensive findings
Overall: This is a well-crafted migration. The plugin structure is clean, the security posture is solid, and the layered progressive-disclosure pattern (SKILL.md + context/*.md) is the right design for a skill this wide. The playbook gate evidence is thorough. A few minor items below.
Findings
1. update.sh — diff truncation gives no truncation signal (Low)
When upstream content has changed substantially, the head -60 silently drops everything past line 60. A maintainer running --refresh-baseline after a major upstream rewrite would see a partial diff with no signal that content was cut. A simple count-and-warn would help:
local diff_output
diff_output=$(diff -u "$baseline_lf""$tmpfile_lf")local total_lines
total_lines=$(printf '%s\n'"$diff_output"| wc -l | tr -d '')printf'%s\n'"$diff_output"| head -60
if(( total_lines >60));thenecho" ↳ (diff truncated — $total_lines total lines; run diff manually for full output)"fi
If a required tool (npm, curl, diff) is missing and the script exits 1, the vendor subdirectories are left created empty. Functionally harmless (they're directories with no files), but running the mkdir -p after the prereq check is the logical ordering.
3. context/mcp.md — empirical MCP serialization claim is unverified (Low)
Claude Code serializes MCP tool calls to the same server unless the tool declares readOnlyHint: true.
The readOnlyHint mechanism is documented in the MCP spec, but the claim that Claude Code specifically serializes same-server calls unless this hint is set reads as an empirical inference rather than a documented guarantee. The CLAUDE.md fresh-docs mandate applies to context files too — if this claim isn't confirmed from a fetched page this session, it should be marked as observed behavior or removed. An incorrect model of tool call scheduling could lead to wrong guidance when users are debugging latency.
4. context/cli.md — pinned version string will age (Nitpick)
The update action handles drift detection, so a user who runs it will get a fresh version. But a user who reads cli.md directly (e.g., via /context7:context7 configure) sees a hardcoded minimum that will drift behind reality. Consider wording it as a minimum floor (0.3.13 or later) rather than a benchmark, or omitting the version entirely and deferring to ctx7 --version output shown in the pre-computed context.
What's solid
Security gate: No eval, no curl | sh, no unquoted user-controlled variables, no ../ escapes. The --fix/--refresh-baseline privilege separation is correct design — consumers get report + CLI upgrade; only maintainers in a working clone touch baselines.
allowed-tools is minimal: Only Bash(ctx7 --version*) for the pre-computed context. The update script still prompts (intentional — explicit user approval before a global npm install or baseline write).
MCP graceful degradation: No MCP server shipped; consumer opts in via their own .mcp.json. The skill's CLI fallback is complete and correct.
set -uo pipefail without -e and the CLI_DRIFT unset-variable pattern (${CLI_DRIFT:-0}) is correct — the -u flag is respected by using the :- default wherever the variable may be unset.
Line-ending normalization in check_skill_drift (the tr -d '\r' before diff) prevents false-positive drift on Windows checkouts.
vendor/.markdownlint-cli2.jsonc + .lycheeignore correctly scopes linting exclusions to the vendor snapshots without polluting root config.
plugin.json is minimal and correct; skills are auto-discovered; validation passes.
SKILL.md frontmatterdisable-model-invocation: false with a well-scoped description trigger is the right call for a lookup skill that should activate automatically on library questions.
None of the findings above block the merge. Items 1 and 3 are the most worth addressing before the plugin sees significant consumer use.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving because the Cursor Bugbot check skipped (usage limit reached), so automated review did not complete. Human review is needed before merge; requested reviewers.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Prereq checks before mkdir, diff-truncation warning, serialization claim reworded as observed behavior, CLI version floor wording.
Co-Authored-By: Claude <noreply@anthropic.com>
The snippet unconditionally includes ${CONTEXT7_API_KEY} in headers. Claude Code expands ${VAR} in MCP config at load time — if the variable is unset, the config fails to parse and the server never starts. That silently breaks the MCP path for anonymous users (who the plugin README and cli.md both say are supported at low rates).
The clearest fix is two configs — one anonymous, one authenticated:
With a note that CONTEXT7_API_KEY must be set in the environment before the authenticated snippet will parse. If Claude Code allows empty-string expansion (vs. treating the variable as missing) the behavior may differ, but the explicit two-config pattern is the safe path regardless.
The update script is correct: set -uo pipefail (no -e) is intentional and documented; the diff exit-code-1-on-differ is handled cleanly without -e; the diff_output capture is correct; arithmetic ((diff_lines > 60)) is safe. The RETURN trap for temp-file cleanup, the line-ending normalization, and the ${CLI_DRIFT:-0} unset-variable guard all remain solid. Security posture (no eval, no curl | sh, correct privilege separation on --fix/--refresh-baseline) is unchanged.
Bottom line: Four findings from the initial review are resolved cleanly. The one item remaining is the Codex-flagged anonymous MCP config — worth a small doc fix before merge, but doesn't affect the CLI path (which all consumers get by default).
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: Cursor Bugbot completed with a skipped status (usage limit reached) and did not produce a clean review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Unset ${CONTEXT7_API_KEY} in headers fails .mcp.json parsing (per MCP docs), which would break the documented anonymous path. Addresses Codex P2 review finding.
Co-Authored-By: Claude <noreply@anthropic.com>
Commit dd8af33 directly addresses the last open item flagged by both the previous Claude review and the Codex P2 finding: the anonymous MCP config being broken for consumers who haven't set CONTEXT7_API_KEY.
The single config block with unconditional headers was replaced with two separate blocks:
Anonymous (no headers) — safe for all consumers regardless of whether CONTEXT7_API_KEY is set
Authenticated — with an explicit inline warning that Claude Code fails to parse the config if the env var is unset, so consumers must have the key in their environment before switching to this form
The warning text accurately reflects the documented MCP behavior and is the correct signal for consumers to act on. The two-config pattern matches what the previous review recommended. Minimal, targeted, correct.
All findings across three review rounds — resolved
No new issues introduced in dd8af33 — the change is a two-block doc addition touching only mcp.md, with no script, manifest, or vendor changes.
What's solid (unchanged from prior review)
The full plugin holds up across all review dimensions:
Security: No eval, no curl | sh, no ../ escapes; --fix/--refresh-baseline privilege separation is correct; allowed-tools is minimal (ctx7 --version only)
MCP graceful degradation: No MCP server shipped; CLI fallback is complete; the mcp.md two-config pattern now covers both anonymous and authenticated paths safely
update.sh: set -uo pipefail (no -e) is intentional; diff truncation warning, line-ending normalization, ${CLI_DRIFT:-0} guard, and RETURN trap for temp-file cleanup are all correct
Plugin structure: plugin.json minimal and correct; skills auto-discovered; catalog and README updated; .lycheeignore and vendor/.markdownlint-cli2.jsonc correctly scope linting exclusions
No PII / secrets / hardcoded paths: Consumer context flows through ${CLAUDE_PROJECT_DIR} and userConfig; CONTEXT7_API_KEY is a consumer env var, never stored
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Wrap both .mcp.json snippets in the top-level mcpServers object Claude Code
requires (per code.claude.com/docs/en/mcp), and send the API key in the
CONTEXT7_API_KEY request header Context7's server expects (per
github.com/upstash/context7 README) instead of x-api-key. Addresses the two
Codex P2 review findings on dd8af33.
Latest commit (169ce85) — Both Codex P2 findings addressed
Commit 169ce85 ("fix: correct Context7 MCP snippet nesting and API-key header name") is a targeted, correct fix for the two Codex P2 findings raised against dd8af33. Only context/mcp.md changed (18 insertions / 10 deletions).
Both the anonymous and authenticated config snippets are now correctly wrapped in the top-level mcpServers object Claude Code requires. A consumer can copy either block verbatim into .mcp.json.
Finding 2 — Wrong API-key header name (x-api-key): ✅ Fixed
Changed to CONTEXT7_API_KEY per the upstream Upstash Context7 README (cited in the commit message). The header key in the authenticated snippet now matches what Context7's MCP server expects:
The commit message includes the source references (code.claude.com/docs/en/mcp for the mcpServers shape; github.com/upstash/context7 README for the header name), satisfying the repo's fresh-docs mandate.
All findings across all four review rounds — resolved
Round
Finding
Commit
1
head -60 silent truncation with no signal in update.sh
No new issues introduced in 169ce85. The change is minimal and exclusively targets the Codex findings.
What's solid (unchanged)
All prior green-flags from earlier review rounds remain intact:
Security: No eval, no curl | sh, no ../ escapes; --fix/--refresh-baseline privilege separation correct; allowed-tools scoped to ctx7 --version only.
update.sh: set -uo pipefail (no -e) is intentional; diff truncation warning, RETURN trap for temp cleanup, line-ending normalization (tr -d '\r'), and ${CLI_DRIFT:-0} unset-var guard all correct.
MCP graceful degradation: No MCP server shipped; CLI fallback is complete; mcp.md two-config pattern now covers both anonymous and authenticated paths safely and correctly.
Plugin structure: plugin.json minimal and valid; skills auto-discovered; catalog, README, .lycheeignore, and vendor/.markdownlint-cli2.jsonc all correctly structured.
Repo-agnostic design: No hardcoded paths; consumer context flows through ${CLAUDE_PROJECT_DIR}; CONTEXT7_API_KEY is a consumer env var, never stored.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
lookup.md told the model to use the user's full question/intent as the
Context7 query, which would forward pasted stack traces, proprietary code,
and internal endpoints/identifiers to Context7's backend when only a
distilled library/topic query is needed. Rework the query guidance to
build a minimal query and broaden the do-not-send list beyond credentials.
Addresses Codex P2 review finding on 169ce85.
Latest commit (f4068d2) — Final Codex P2 finding addressed
Commit f4068d2 ("docs: distill Context7 queries instead of forwarding raw user prompts") is a minimal, targeted fix for the last open Codex P2 finding raised against 169ce85: lookup.md was instructing the model to use "the user's full question as the query when possible", which would forward pasted stack traces, proprietary code, and internal identifiers to Context7's backend.
Only lookup.md changed (4 insertions / 4 deletions). Three locations updated:
Step 1 resolve bullet — changed from forwarding to distilling:
-`query` argument is **required** ... Use the user's full intent as the query-Do NOT include sensitive information (API keys, passwords, credentials, personal data) in queries+`query` argument is **required** ... Distill the user's intent into a focused library/topic query+Queries are sent to Context7's backend. Never include secrets (API keys, passwords, credentials),+personal data, proprietary code, pasted stack traces, or internal endpoints/identifiers —+send distilled library/topic terms only
"Writing good queries" section — replaced the permissive forwarding instruction with an explicit distillation example:
-Use the user's full question as the query when possible. Vague one-word queries return generic results.+Distill the user's question into a focused query: keep the details that describe the library+problem, drop everything else. When the question includes a pasted stack trace, code snippet,+or internal endpoint/identifier, extract only the library and topic terms — never forward the+raw content (e.g. a `NullReferenceException` trace from change-tracking code becomes+`"EF Core DbContext change tracking null reference"`). Vague one-word queries return generic results.
"Common mistakes" section — broadened the ban list to match the step-1 bullet:
-Do not include sensitive information in queries+Do not include secrets, personal data, proprietary code, stack traces, or internal identifiers+in queries — send distilled library/topic terms only
The fix is correct and complete: the do-not-send list is now consistent across all three enforcement points (Step 1 guidance, query-writing section, common mistakes). The concrete example (NullReferenceException trace → "EF Core DbContext change tracking null reference") makes the distillation expectation unambiguous for the model.
All findings across all review rounds — resolved
Round
Finding
Commit
1
head -60 silent truncation with no signal in update.sh
No new issues introduced in f4068d2. The change is minimal and exclusively targets the Codex P2 query-distillation finding.
What's solid (unchanged from prior reviews)
All prior green-flags remain intact:
Security: No eval, no curl | sh, no ../ escapes; --fix/--refresh-baseline privilege separation correct; allowed-tools scoped to ctx7 --version only
Data minimization: Query guidance now consistently instructs the model to distill — secrets, stack traces, proprietary code, and internal identifiers are explicitly excluded at three points in lookup.md
update.sh: set -uo pipefail (no -e) intentional; diff truncation warning, RETURN trap, line-ending normalization, and ${CLI_DRIFT:-0} guard all correct
MCP graceful degradation: No MCP server shipped; CLI fallback complete; mcp.md covers both anonymous and authenticated paths safely with correct mcpServers wrapping and header name
Plugin structure: plugin.json minimal and valid; catalog, README, .lycheeignore, and vendor/.markdownlint-cli2.jsonc all correctly structured
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
cli.md claimed the CLI reads no env vars beyond CONTEXT7_API_KEY, but
Context7's CLI docs (context7.com/docs/clients/cli, Telemetry section)
document CTX7_TELEMETRY_DISABLED=1 as the opt-out for the CLI's anonymous
usage telemetry. List it in the env-var table, state the on-by-default
behavior, and surface it in the README data-egress note.
Lookup guidance let independent topics share one query; per the ctx7@0.5.4
release notes (github.com/upstash/context7/releases/tag/ctx7@0.5.4),
query-docs wants a single concept per query, with distinct topics split
into separate queries unless the question is about how they interact. Add
the split rule to SKILL.md and lookup.md, and scope the 3-lookup cap per
topic so it does not contradict splitting. Addresses the two Codex P2
review findings on f4068d2.
Latest commit (55ab313) — Both remaining Codex P2 findings addressed
Commit 55ab313 ("docs: document telemetry opt-out and one-concept-per-query guidance") is a clean, targeted fix for the two Codex P2 findings raised against f4068d2. Four files changed (12 insertions / 6 deletions): README.md, SKILL.md, context/cli.md, context/lookup.md.
Finding 1 — Telemetry opt-out not documented in cli.md: ✅ Fixed
The old claim "The CLI reads no other env vars (no CTX7_* prefix detected in the compiled binary)" was factually wrong and would prevent privacy-sensitive users from knowing they can suppress telemetry. The fix:
Adds CTX7_TELEMETRY_DISABLED to the env-var table with a clear description
Replaces the no-env-vars claim with an accurate statement that anonymous telemetry is on by default, citing context7.com/docs/clients/cli
Provides both the per-invocation (CTX7_TELEMETRY_DISABLED=1 ctx7 docs ...) and permanent shell-profile forms
Surfaces the same fact in README.md's data-egress note so consumers see it at the plugin level
Finding 2 — Independent topics should split into separate queries: ✅ Fixed
The guidance is now consistent at three enforcement points:
"One concept per query — when a question spans several independent topics, run a separate lookup per topic." + cap changed from "per question" → "per topic"
New paragraph in "Writing good queries": single-concept rule, example of when to combine (interaction questions: "Next.js middleware with NextAuth session validation") vs. split
New "Common mistakes" bullet: "Do not combine independent topics into one query — one concept per lookup" + cap bullet changed to "per topic"
The interaction-vs-independent distinction in lookup.md ("Combine concepts in one query only when the question is about how they interact") is exactly the right nuance — it prevents both the anti-pattern (combined query diluting ranking) and over-splitting (a question about how two things interact genuinely needs both terms in scope).
All findings across all five review rounds — resolved
Round
Finding
Commit
1
head -60 silent truncation with no signal in update.sh
No new issues introduced in 55ab313. The change is minimal and exclusively targets the Codex P2 findings.
What's solid (unchanged from prior reviews)
All prior green-flags remain intact. The full security, MCP, and script posture is unchanged from the prior review sign-off. The query guidance is now complete: distillation (no secrets/code/traces), one-concept-per-query (split independent topics), and the 3-lookup cap is correctly scoped to "per topic" at all three enforcement points.
The reason will be displayed to describe this comment to others. Learn more.
Risk: medium. Not approving because Cursor Bugbot skipped (usage limit reached) and did not provide a clean automated review signal. Human review is needed; no reviewers were assigned because no suitable non-author maintainers were identified in this repository.
Sent by Cursor Approval Agent: Pull Request Router and Approver
… machinery
The cross-vendor review's fourth gap: the gate re-asked the proportionality
question of the catalog and never of the run contract after the payload shrank
to one detector. Applied per mechanism rather than to the contract as a whole,
because an aggregate verdict can only come back "necessary" — the same
unfalsifiable shape the blind pass already recorded against this gate's
escalation clause.
The test fired on two of four. The state key's repo-identity half is legibility
standing in a correctness slot; the worktree hash alone carries every property.
Per-lane input digests are deferred with a Phase 10 trigger, because a single
tree-wide refuse-to-resume check closes the P1 hole completely and partial
resume is an unmeasured ergonomic gain on top. The advisory lock and the
versioned anchor survive on reasons that do not depend on solo-machine scope.
Three consistency defects found by re-grepping with multiline enabled — these
documents hard-wrap near 100 characters, so every prior multi-word grep was
unreliable:
- The report's finding sections were still named for the superseded two-tier
vocabulary, so a consumer would have diffed a section no property mentions.
- Shadowed-definition findings were filed in the host catalog's "mechanical"
tier rather than the sweep's derived tier. The two vocabularies measure
different axes and are now stated as such.
- T2's suppression blast-radius bullet cited the replaced identity tuple and
claimed a bound of one excerpt in one file. Under a sorted sites set a
pairwise suppression spans two surfaces — one site wider than advertised,
for exactly the finding class D1 exists to produce.
Also from task #54's empirical record: liveness is three-valued, because a
one-shot run observes the launch set only and a nested CLAUDE.md fired no event
at session start. Classifying a conditionally-live surface as dead yields a
finding that is perfectly deterministic and perfectly wrong. Ground truth must
be both InstructionsLoaded and /context — the hook sees only CLAUDE.md and
rules files, which is most of D1's comparison set missing. The suppression
record stores identity constituents rather than a bare hash, or versioned-anchor
matching has nothing to recompute from and cancels itself out. And the /doctor
TTY claim is falsified as written rather than merely unverified: slash commands
resolve headlessly by counter-example on 2.1.220.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
Migrates the
context7library-documentation lookup skill into a repo-agnostic plugin perdocs/MIGRATION-PLAYBOOK.md. Closes melodic-software/medley#1297.What ships
One skill,
/context7:context7, with three actions:ctx7CLI or the consumer's own Context7 MCP server (graceful CLI fallback when no MCP is configured).CONTEXT7_API_KEYenv-var auth, Windows Git BashMSYS_NO_PATHCONV=1gotcha.ctx7(npm), plus a diff of Upstash's upstream reference skills against bundledvendor/baselines. Never auto-rewrites the skill;--refresh-baselineis maintainer-only (documented).De-coupling from the source repo
settings.local.json,.claude/rules/*,/research,/machine-health); replaced with generic consumer guidance.scripts/update.shresolves paths from its own location (BASH_SOURCE) — works in the installed cache and in a working clone; nogit rev-parsedependency.ctx7 --versionvia frontmatterallowed-tools); the formerclaude mcp list | grep | sedpipeline failed per-operation permission preflight in a clean repo and was replaced by a tool-list self-check instruction.Gate evidence (speed-adjusted per issue)
claude plugin validate ./plugins/context7 --strict— PASS;claude plugin validate --strict .(catalog) — PASS.claude plugin details— always-on ~165 tokens, on-invoke ~2.3k.--plugin-dirsmoke test in a clean non-source scratch repo (headlessclaude -p): skill invoked ascontext7:context7, content loaded with no permission prompts, pre-computed context executed (Installed CLI version: not installed (…)— correct for that machine).lychee --offline0 errors.Security review (playbook plugin-acceptance)
scripts/update.sh), user-invoked only (no hooks). Spawnsnpm,curl,diff; writes only with--fix(npm global install) or--refresh-baseline(maintainer-only, writes beside itself). Noeval, nocurl | sh..mcp.jsonsnippet formcp.context7.comand degrades to the CLI when absent.CONTEXT7_API_KEYstays a consumer env var; never stored by the plugin.../reach-outs; no state writes (the skill explicitly does not cache docs).context7.com/mcp.context7.com) — that is the plugin's purpose; skill and README both warn against secrets in queries.updatereads npm registry + two public raw.githubusercontent.com files, read-only.Vendor baselines vs managed lint configs
vendor/holds byte-exact upstream snapshots (drift-diff baselines) that must not be edited to satisfy linters. Managed materializations (.markdownlint-cli2.jsonc,_typos.toml,lychee.toml,.editorconfig-checker.json) are untouched; instead:vendor/.markdownlint-cli2.jsonc(default: false) silences rules for the snapshots only (typos/editorconfig pass on them as-is);.lycheeignoreexcludes links resolving intoplugins/*/skills/*/vendor/(upstream files reference siblings that are deliberately not vendored).No contract test ships: the script's behavior is network-bound (npm registry + GitHub fetch), and no existing skill-plugin script carries a
*.test.sh— matching precedent rather than adding a flaky lane.Note
Medium Risk
Lookup sends user query text to Context7;
update.sh --fixrunsnpm install -g ctx7. No hooks or bundled MCP, but third-party network egress and global npm install warrant awareness.Overview
Adds a new
context7marketplace plugin so consumers can resolve library names and query live Context7 documentation via/context7:context7, using either thectx7CLI or an optional consumer-configured Context7 MCP server (CLI fallback when MCP is absent).The skill exposes three actions: lookup (default two-step resolve-then-query), configure (install,
CONTEXT7_API_KEY, WindowsMSYS_NO_PATHCONV=1), and update (advisory drift check). Progressive-disclosure docs live undercontext/*.md;scripts/update.shcompares installed vs latestctx7, fetches Upstash reference skills, diffs against bundledvendor/baselines, and only upgrades the CLI with--fix(never auto-merges skill content).--refresh-baselineis maintainer-only.Catalog and docs are wired in
.claude-plugin/marketplace.jsonandREADME.md. Repo hygiene adds.lycheeignorefor vendor snapshot links andvendor/.markdownlint-cli2.jsoncso upstream baselines stay byte-exact for drift diffing.Reviewed by Cursor Bugbot for commit 55ab313. Bugbot is set up for automated code reviews on this repo. Configure here.