Patch Changes

• ea91d7d: ctx7 login now always uses the device-code flow. The localhost-callback path is removed — every install (laptop, SSH, Codespace, Docker, CI) goes through the same boxed prompt and verification page. Drops the --device flag (it was the opt-in for what's now the default). Older CLI versions (≤ 0.5.0) continue to work against the unchanged auth endpoints, so pinned installs are unaffected.

Minor Changes

• 5a180d5: Add OAuth 2.0 device authorization flow (RFC 8628) for ctx7 login and ctx7 setup. Required for headless / remote hosts (SSH, Codespaces, Docker, CI) where the existing localhost-callback flow can't work — the browser was opening on the user's laptop while the callback listener ran on the remote host.

  The new flow prints a verification URL and short code, then polls a token endpoint. The user visits the URL on any device, signs in, and approves; the CLI receives the same ctx7sk-… API key it would have gotten from the legacy flow. Device flow is selected automatically when SSH_CONNECTION is set or $DISPLAY is missing on Linux, and can be forced with ctx7 login --device. Polling tolerates transient network errors and 5xx responses without ending the session.

Patch Changes

• 2affada: ctx7 setup now properly supports --antigravity, installing skills to .agent/skills, a GEMINI.md rule section (Antigravity reads Gemini-family config), and MCP config to Antigravity 2.0's documented global path ~/.gemini/config/mcp_config.json (with httpUrl for HTTP, matching the Gemini convention). Antigravity has no documented project-level MCP file, so setup --antigravity --project --mcp writes to the global location. Also removes the --universal flag from setup, which was advertised but silently ignored — it never propagated through agent selection, so passing it (e.g. setup --cli --universal --project) caused setup to fall back to auto-detection and write to the wrong directory.
• 268f52f: ctx7 setup --api-key <KEY> (without --cli, --mcp, or -y) now prompts to choose between MCP server and CLI + Skills modes. Previously, passing --api-key short-circuited to MCP, locking users out of the CLI + Skills option even though that mode also accepts an API key. Explicit --mcp / --cli / --stdio / --oauth / -y still skip the prompt as before.
• 2e97dae: Add deprecation warning to skill commands

Minor Changes

• 1fb2d42: Add multi-tenant Microsoft Entra ID validation for MCP tokens. The server now detects inbound Entra v2 tokens by issuer pattern, fetches per-teamspace configuration (tenantId, audience, requiredScope) from the Context7 app, and verifies the token against the matching tenant's JWKS, enforcing the required scope claim when configured. User resolution happens downstream in the Context7 app against a pre-provisioned user mapping table — the MCP server only validates. Per-tenant JWKS cache and a 5-minute in-memory config cache keyed by JWT audience reduce overhead under load.

Minor Changes

• f91b40c: Initial release. Adds an official Context7 extension for the pi coding agent — registers resolve-library-id and query-docs tools, ships the context7-docs skill, and exposes a /c7-docs slash command. Wire format, error messages, and tool descriptions are copied verbatim from @upstash/context7-mcp so pi and MCP clients give the LLM identical instructions and output. Self-contained — no Context7 runtime dependencies. Works out of the box at IP-based rate limits; set CONTEXT7_API_KEY for the higher tier. Install with pi install npm:@upstash/context7-pi.

Patch Changes

• 7cacc94: Add --json flag to ctx7 skills list for machine-parseable output. Emits { skills: [{ name, path, source }] } where path is absolute and source is the agent type (universal, claude, cursor, antigravity). Matches the existing --json pattern on ctx7 library and ctx7 docs.

Major Changes

• af6a7b5: Convert the stateless MCP implementation to a stateful one using Redis for session management.

Patch Changes

• 3d73145: Reduce Redis writes on refresh by checking the remaining TTL first and only issuing EXPIRE when the session is within one day of expiry.

Patch Changes

• dea0e43: Declare @inquirer/core as a direct dependency of the CLI. It was previously imported in selectOrInput.ts but only resolvable as a transitive of @inquirer/prompts, which caused ctx7 to fail at startup with ERR_MODULE_NOT_FOUND under pnpm's isolated node linker.
• 34fda7d: Add --stdio flag to ctx7 setup to configure Context7 as a local stdio MCP server.
• 61de754: Harden skill name handling during ctx7 skills install and ctx7 skills remove. Skill names from remote SKILL.md files are now restricted to a safe character set, and the install sinks assert the target directory is a direct child of the skills root before writing.

Minor Changes

• 34fda7d: Prompt anonymous users to sign in. After the backend signals (via the X-Context7-Auth-Prompt: 1 response header on /v2/libs/search or /v2/context) that an anonymous client has crossed the per-IP threshold, the MCP server appends a one-time sign-in invitation to the tool result.
  • Both stdio and HTTP transports surface the same nudge: a tool-result notice asking the assistant to run npx ctx7 setup --<client> --mcp -y (with --stdio appended when the MCP server is running on stdio) after explicit user confirmation. The CLI handles OAuth and writes credentials into the MCP client's config; the user restarts their MCP server / editor to pick up the new credentials.
  • Detects the calling client from X-Context7-Client-IDE / User-Agent and selects the matching CLI flag (--cursor, --claude, --codex, --opencode, --gemini); falls back to interactive setup when unknown.
  • HTTP transport remains stateless — the threshold is tracked by the backend (per-IP, 24h TTL), the MCP server only reacts to the signal.

Patch Changes

• 6c71e4d: Handle malformed MCP config files gracefully during ctx7 remove agent detection. Previously, an unparseable JSON config at any agent's well-known path (e.g. a hand-edited ~/.claude.json) would crash the command with an unhandled SyntaxError before it could do anything. The detector now skips the offending file and logs a warning naming the path and parse error so the user can fix it, while detection continues for the remaining agents.
• 4056850: Respect CLAUDE_CONFIG_DIR env var when resolving Claude Code's global config, rules, skills, and detection paths