fix(context7): use local stdio MCP and clarify operator key path by BigSimmo · Pull Request #1623 · BigSimmo/Database

BigSimmo · 2026-08-05T12:46:44Z

Summary

Switch Context7 in .cursor/mcp.json from remote HTTP (https://mcp.context7.com/mcp + headers) to pinned local stdio (npx -y @upstash/context7-mcp@3.2.5 with env.CONTEXT7_API_KEY: ${env:CONTEXT7_API_KEY}).
Document Cloud Agent Secrets vs host-injected Context7 connector: Secrets populate agent process.env and authenticate local stdio / npx ctx7, but do not authenticate the host connector (measured 2026-08-05).
Operator guidance: reload MCP after key changes (stdio captures env at spawn); keyless use expands ${env:CONTEXT7_API_KEY} to empty for anonymous/lower rate limits.
Update tooling-activation plan appendix/B1 rows from “Context7 remote” to local stdio; expand peer-library examples; thin vitest pin in tests/cursor-mcp-contract.test.ts.
Merge origin/main to clear prior DIRTY / PR-mergeability conflict (synced through outstanding-issues queue update).

Verification

npx vitest run tests/cursor-mcp-contract.test.ts — 3 passed
npm run format — committed
git merge-tree --write-tree origin/main HEAD — clean; branch current with main
Hosted CI on 88148ad8 — PR required green (mergeability, PR Policy, Secret Scan, SAST, static-pr, unit, safety/config)
Local verify:pr-local — lint/typecheck/docs gates green; unit suite 5326 passed / 1 unrelated timeout flake in design-system-adoption (re-ran green alone)
UI / provider gates not run (MCP config + docs + contract only)

Risk and rollout

Risk: Low–medium for operator tooling — functional MCP transport change (remote HTTP → local stdio). Requires npm-registry access for first npx fetch of @upstash/context7-mcp@3.2.5. No clinical/RAG/product runtime impact.
Rollback: Revert branch commits (restores remote Context7 URL entry)
Provider or production effects: None for app/worker. Local/Cloud agent Context7 sessions spawn a stdio process instead of calling the remote MCP URL.

Notes

Desktop: set CONTEXT7_API_KEY in OS/user env or Cursor Settings → MCP, then reload MCP servers.
Cloud: prefer project local stdio MCP or npx ctx7 when host-injected Context7 is quota-blocked.
This is intentionally a transport change, not “docs + contract only.”
Bugbot re-run after fixes: no remaining bugs. No unresolved GitHub review threads.

Keep the working CONTEXT7_API_KEY header form. Expand peer-library docs, document that Cloud Secrets/.env.local do not feed project MCP ${env:}, and add a thin structural vitest pin for .cursor/mcp.json.

Measured: CONTEXT7_API_KEY present in Cloud agent shell while host-injected Context7 still returns monthly quota exceeded. Clarify desktop ${env:} vs Secrets vs host connector paths.

supabase · 2026-08-05T12:46:49Z

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

coderabbitai · 2026-08-05T12:46:50Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:21 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a5a80fb3-6622-45d9-b958-e35ca55f6a4d

📥 Commits

Reviewing files that changed from the base of the PR and between 41d865c and 46fc846.

📒 Files selected for processing (9)

.cursor/mcp.json
.env.example
AGENTS.md
README.md
docs/agents-guide.md
docs/branch-review-ledger.md
docs/codex-cloud.md
docs/plans/tooling-activation-implementation-plan.md
tests/cursor-mcp-contract.test.ts

_{Comment @coderabbitai help to get the list of available commands.}

Retain this branch's host-injected vs Secrets wording; adopt main's stricter Supabase MCP URL pin and B1 follow-up done note.

Switch .cursor/mcp.json from unauthenticated remote host path to pinned @upstash/context7-mcp@3.2.5 with CONTEXT7_API_KEY from ${env:}. Cloud Secrets already populate process.env; local stdio and npx ctx7 use that key (host MCP connector may still ignore it — fall back to npx ctx7).

…MCP fix Resolve B1 follow-up footnote to local stdio + npx ctx7 fallback.

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

Resolve agents-guide and codex-cloud conflicts by keeping local Context7 stdio MCP guidance while adopting main's Railway/Codex Desktop MCP wording. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Document MCP reload after key changes, keyless empty-expansion behaviour, and update the tooling plan appendix/B1 rows from remote URL to local stdio. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

cursoragent added 2 commits August 4, 2026 13:00

docs(context7): clarify operator key path and pin Cursor MCP contract
a31ed09
Keep the working CONTEXT7_API_KEY header form. Expand peer-library docs, document that Cloud Secrets/.env.local do not feed project MCP ${env:}, and add a thin structural vitest pin for .cursor/mcp.json.

docs(context7): Secrets put key in process.env but not host MCP auth
dfafca1
Measured: CONTEXT7_API_KEY present in Cloud agent shell while host-injected Context7 still returns monthly quota exceeded. Clarify desktop ${env:} vs Secrets vs host connector paths.

cursoragent added 4 commits August 5, 2026 13:16

merge origin/main: keep Context7 Cloud Secrets clarification
011fd24
Retain this branch's host-injected vs Secrets wording; adopt main's stricter Supabase MCP URL pin and B1 follow-up done note.

merge: sync origin/cursor/context7-refresh-22b5; keep local Context7 …
9735777
…MCP fix Resolve B1 follow-up footnote to local stdio + npx ctx7 fallback.

docs(context7): drop merge conflict markers from B1 follow-up footnote
f83874b

BigSimmo marked this pull request as ready for review August 5, 2026 15:20

devin-ai-integrationBot reviewed Aug 5, 2026
View reviewed changes

cursoragentand others added 3 commits August 5, 2026 16:25

merge origin/main into cursor/context7-refresh-22b5
f495941
Resolve agents-guide and codex-cloud conflicts by keeping local Context7 stdio MCP guidance while adopting main's Railway/Codex Desktop MCP wording. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

docs(context7): address Bugbot findings on stdio MCP operator path
2cd4e3b
Document MCP reload after key changes, keyless empty-expansion behaviour, and update the tooling plan appendix/B1 rows from remote URL to local stdio. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

style: prettier-format Context7 docs tables after merge
88148ad
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

cursorBot changed the title ~~docs(context7): clarify operator key path and pin Cursor MCP contract~~fix(context7): use local stdio MCP and clarify operator key pathAug 5, 2026

cursoragentand others added 6 commits August 5, 2026 16:35

merge origin/main: pick up outstanding-issues queue update
26b4618
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Merge branch 'main' into cursor/context7-refresh-22b5
3ba9f19

Merge branch 'main' into cursor/context7-refresh-22b5
08c98aa

Merge branch 'main' into cursor/context7-refresh-22b5
8cc2344

Merge branch 'main' into cursor/context7-refresh-22b5
4ea41c9

Merge branch 'main' into cursor/context7-refresh-22b5
9479401

BigSimmo enabled auto-merge (squash) August 5, 2026 20:17

chore(ledger): record PR#1623babysit (main sync)
46fc846

BigSimmo merged commit 88b098b into mainAug 5, 2026
24 checks passed

BigSimmo deleted the cursor/context7-refresh-22b5 branch August 5, 2026 20:24

BigSimmo mentioned this pull request Aug 6, 2026
docs(ledger): record post-merge audit of PR #1614 (RAG index restore) #1636
Merged
4 tasks

Navigation Menu

fix(context7): use local stdio MCP and clarify operator key path - #1623

fix(context7): use local stdio MCP and clarify operator key path#1623
BigSimmo merged 16 commits into
mainfrom
cursor/context7-refresh-22b5

BigSimmo commented Aug 5, 2026•
edited by cursor Bot
Loading

Uh oh!

supabaseBot commented Aug 5, 2026

Uh oh!

coderabbitaiBot commented Aug 5, 2026•
edited
Loading

Review limit reached

Uh oh!

devin-ai-integrationBot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

BigSimmo commented Aug 5, 2026• edited by cursor BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Risk and rollout

Notes

Uh oh!

supabaseBot commented Aug 5, 2026

Uh oh!

coderabbitaiBot commented Aug 5, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

devin-ai-integrationBot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

BigSimmo commented Aug 5, 2026•
edited by cursor Bot
Loading

coderabbitaiBot commented Aug 5, 2026•
edited
Loading