Context7 MCP

--- title: Security --- Context7 takes security and privacy seriously. This page outlines our security practices, data handling, and compliance measures. ## Highlights - Queries stay on your device; Context7 only receives derived topics for retrieval - Documentation is indexed inside SOC 2 compliant infrastructure operated by Upstash - API keys are encrypted, rate limited, and easy to rotate from your dashboard - Enterprise customers can enable SSO (SAML, OAuth, OIDC) and receive dedicated audit trails ## Privacy-First Architecture ### Query Privacy **Your queries never leave your machine.** When you use Context7 through the MCP client: 1. Your query is analyzed locally to extract topics and relevant keywords 2. Only these extracted topics are sent to the Context7 server 3. Your original query and code remain on your local machine 4. The server has no access to your actual prompts or conversations <Note> The MCP client processes your queries locally and only transmits topic information needed to retrieve relevant documentation. Your full prompts, code, and context remain private. </Note> ### Data Storage **Context7 does not store your source files.** - We only index and store **documentation** and **code examples** from public repositories - Your private code, projects, and source files are never uploaded or stored - All indexed content is stored in a secure vector database optimized for retrieval **What we store:** - Public library documentation - Public code examples from documentation - Metadata about indexed libraries **What we don't store:** - Your source code - Your queries or prompts - Your private repositories (unless explicitly authorized) - Your conversations with AI assistants ## Infrastructure Security ### SOC 2 Compliance Context7 runs on **SOC 2 compliant infrastructure** provided by Upstash. - Type II SOC 2 certified infrastructure - Regular security audits and assessments - Continuous monitoring and compliance checks - Industry-standard security controls ### Managed by Upstash Context7's infrastructure is managed by the experienced Upstash team: - 24/7 infrastructure monitoring - Automated security patching - DDoS protection and mitigation - Redundant backups and disaster recovery - Enterprise-grade reliability and uptime ### Upstash Security Practices All security practices and certificates of Upstash apply to Context7 projects: - **Data Encryption**: Encryption at rest and in transit (TLS 1.2+) - **Network Security**: VPC isolation, firewall rules, and network segmentation - **Access Control**: Role-based access control (RBAC) and least privilege principles - **Audit Logging**: Comprehensive logging of all system activities - **Incident Response**: Documented incident response procedures - **Vulnerability Management**: Regular security scanning and penetration testing Learn more about Upstash security: [upstash.com/trust](https://upstash.com/trust) ## Authentication and Access Control ### API Key Security - API keys use cryptographic random generation - Keys are hashed and encrypted in our database - Keys can be rotated at any time from your dashboard - Rate limiting prevents abuse and unauthorized access ### Enterprise SSO **Single Sign-On (SSO) is available for Enterprise plans.** Supported SSO providers: - SAML 2.0 - OAuth 2.0 - OpenID Connect (OIDC) Enterprise features include: - Centralized user management - Team access controls - Audit logs for compliance - Custom authentication policies Contact our sales team at [context7.com](https://context7.com) for Enterprise plan details. ## Data Protection ### Privacy by Design - **Data Minimization**: We only collect and store what's necessary - **Purpose Limitation**: Data is used only for documentation retrieval - **Storage Limitation**: Automated cleanup of outdated data - **Transparency**: Clear documentation of what we collect and why ### GDPR Compliance For European users, Context7 provides: - The right to access your data - The right to delete your data - Data portability options - Clear consent mechanisms - Privacy-first data processing ## Rate Limiting and Abuse Prevention - IP-based rate limiting for anonymous requests - API key-based rate limiting with tiered limits - Automatic detection and blocking of abusive patterns - Protection against DDoS and scraping attacks ## Secure Development Practices - Regular security code reviews - Automated dependency scanning - Secure CI/CD pipelines - Principle of least privilege for all systems - Security testing in development lifecycle ## Reporting Security Issues If you discover a security vulnerability: 1. **Do not** publicly disclose the issue 2. Report via [GitHub Security](https://github.com/upstash/context7/security) 3. Include detailed steps to reproduce the issue 4. Allow reasonable time for us to address the issue We take all security reports seriously and will respond promptly. ## Transparency and Compliance ### Open Source The Context7 MCP server is open source: - Code is publicly available on GitHub - Community can audit and contribute - Transparent implementation and practices Repository: [github.com/upstash/context7](https://github.com/upstash/context7) ### Compliance Certifications Context7 benefits from Upstash's compliance certifications: - SOC 2 Type II - GDPR compliant - ISO 27001 (in progress) - CCPA compliant ## Best Practices for Users ### Secure Your API Keys - Never commit API keys to version control - Use environment variables for key storage - Rotate keys regularly - Use different keys for different environments - Revoke unused or compromised keys immediately ### Private Repositories For private repository access: - Only grant minimum required permissions - Use dedicated API keys for private repos - Regularly audit access permissions - Consider using GitHub Apps with fine-grained permissions ### Network Security - Use HTTPS for all API communications (enforced) - Configure proxy settings securely if behind a firewall - Monitor API usage for unusual patterns - Implement request timeouts and retries ## Data Retention - **Library Documentation**: Retained while the library is active and public - **API Logs**: Retained for 30 days for debugging and analytics - **User Data**: Retained according to your account status - **Deleted Data**: Permanently removed within 30 days of deletion request ## Questions and Support For security-related questions: - Review our documentation at [docs.context7.com](https://docs.context7.com) - Contact us through [GitHub Issues](https://github.com/upstash/context7/issues) - Join our [Discord Community](https://upstash.com/discord) - Enterprise customers: Contact your dedicated support team For privacy policy details, visit: [context7.com/privacy](https://context7.com/privacy) --- **Last Updated**: January 2025 We continuously improve our security practices. Check this page regularly for updates.