Context7 — research playbook¶
Status: 🟢 Adopted on-demand only (18 Aug 2026). Deliberately not installed as an MCP server. One-liner: third-party documentation index. Excellent for GitHub repos + non-Microsoft vendors. Never the authority for Microsoft product facts.
0. Decision (read this first)¶
| Question | Answer |
|---|---|
Is Context7 in ~/.copilot/mcp-config.json? |
No — deliberately. Do not add it without re-running the gate below. |
| How do I use it? | Plain HTTPS calls, on demand, when I judge it genuinely helps. See §3. |
| What's the authority for Microsoft product facts? | Microsoft Learn MCP (https://learn.microsoft.com/api/mcp) — already configured. |
| Does it cost anything? | No. Works unauthenticated. An API key only raises rate limits. |
1. What it is¶
Built by Upstash (third-party, US). Crawls vendor documentation sites and GitHub repositories, chunks and summarises them, then serves the chunks to AI agents — normally over MCP, so an agent can pull current docs instead of relying on stale training data. The use context7 convention in a prompt triggers it.
- Public index + search:
https://context7.com· Microsoft org view:https://context7.com/microsoft - Remote MCP endpoint:
https://mcp.context7.com/mcp(tools:resolve-library-id,query-docs) - Source:
https://github.com/upstash/context7(MIT) — but the API backend, crawler and parsing engine are closed-source - Optional CLI:
npx ctx7 setup/ctx7 library <name> <query>/ctx7 docs <libraryId> <query>— not installed here
2. 🔴 The finding that drove the decision¶
Context7 returns paraphrased summaries. Microsoft Learn MCP returns verbatim documentation text.
Verified head-to-head, 18 Aug 2026, same question ("Copilot Studio agent licensing and message capacity requirements"):
Context7 query-docs |
Microsoft Learn MCP | |
|---|---|---|
| Payload | ~2.7 KB | ~50 KB (10 chunks) |
| Nature | Context7's own summarisation of the page, with a learn.microsoft.com URL attached |
Verbatim excerpts from the pages |
| Accuracy | Correct in this test — but it is a third party's restatement | First-party text |
| Vendor's own disclaimer | "we cannot guarantee the accuracy, completeness, or security"; community-contributed; anyone can submit a library | n/a |
Why this matters here: aguidetocloud.com carries a paid practice-exam product and a public blog. A third party's paraphrase of a licensing rule, quota, or preview-status caveat is precisely the wrong input for that surface — the paraphrase can quietly drop a qualifier. Combined with the internal-first rule, the first-party tool wins for Microsoft facts every time.
3. Where it genuinely wins (the reason it wasn't dropped)¶
Learn MCP indexes learn.microsoft.com. It structurally cannot index GitHub repositories or non-Microsoft vendors. Context7 does.
Verified live: a query-docs call against /microsoft/copilotstudiosamples returned a working appsettings.json block and the PowerShell/env-var setup for the contact-centre skill-handoff sample, each with its GitHub source URL.
Good Context7 targets (all verified present, Aug 2026):
| Library ID | Snippets | Note |
|---|---|---|
/microsoftgraph/microsoft-graph-docs-contrib |
96,586 | Graph docs source repo |
/websites/learn_microsoft_en-us_graph |
99,930 | (prefer Learn MCP for these facts) |
/microsoftdocs/microsoft-365-docs |
13,700 | |
/officedev/microsoft-365-agents-toolkit |
9,170 | ATK — genuinely useful |
/microsoft/copilotstudiosamples |
1,136 | samples, contact-centre, M365 Agents SDK |
/pnp/copilot-prompts |
1,132 | community prompt collections |
/websites/learn_microsoft_en-us_microsoft-copilot-studio |
5,884 | trust 10 |
⚠️ There is no meaningful "Cowork" coverage. Searching cowork returns unrelated third-party projects (/opencoworkai/open-cowork, /accomplish-ai/coworker). For Copilot Cowork, use Learn MCP + the official Microsoft blog. Do not let a Cowork-sounding library ID fool you.
4. How to call it (no install needed)¶
Search the index:
Fetch docs for a known library ID:
$body = '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"query-docs","arguments":{"libraryId":"/microsoft/copilotstudiosamples","query":"YOUR QUESTION"}}}'
Invoke-WebRequest -Uri "https://mcp.context7.com/mcp" -Method POST -Body $body `
-ContentType "application/json" `
-Headers @{Accept="application/json, text/event-stream"} -UseBasicParsing
Response is SSE (event: message\ndata: {...}), not plain JSON — parse accordingly.
5. 🔴 Hard rules when using it¶
- Learn MCP first for any Microsoft product fact. Context7 is a fallback for what Learn cannot cover.
- Never send internal content. No MSX, WorkIQ, Teams, SharePoint, ADO, customer names, tenant IDs, opportunity detail, or internal plans — not even phrased inside a question. Query text leaves the machine to a US third party.
- Never cite Context7. Always open the original
learn.microsoft.com/github.comURL it returns, verify the claim there, and cite that. - Never use it as authority for licensing, pricing, quotas, limits, preview/GA status, compliance, or anything going into a practice-exam question.
- Verify library ownership. Anyone can submit.
/doanhidm1/copilotis a random fork;/microsoft/...is not automatically Microsoft-owned. Check the ID, not the display name. - Treat output as discovery material, not evidence.
6. Why it is NOT installed as an MCP server¶
Rule #16 Gate A was run (18 Aug 2026) with two independent, oppositely-briefed reviewers:
| Reviewer | Verdict | Decisive point |
|---|---|---|
| GPT skeptic (adversarial) | REJECT | "No unique capability + new confidentiality and supply-chain risk" |
rubber-duck (constructive) |
ADOPT-NARROWLY | "GitHub/vendor coverage Learn MCP lacks — never as a Microsoft factual authority" |
The skeptic's "no unique capability" was disproved by direct evidence (the copilotstudiosamples call), so evidence beat that argument per Rule #17 §3. Two of its risks survived verification and drove the design:
- Prompt injection / supply chain — a community-submitted index feeding text straight into an agent that holds shell and file-write access on Sush's machine.
- Compliance — Sush is a Microsoft employee. Wiring an unmanaged third-party processor into the default toolchain means work queries route there automatically. That is an approval question, not a config question.
On-demand-only resolves both, and was a third option neither reviewer proposed: it is never in the automatic tool list (no injection path, no accidental internal data in an auto-generated query) and nothing is added to mcp-config.json — while keeping 100% of the GitHub/vendor value.
Re-open the gate if: Microsoft publishes guidance approving it, OR the GitHub-repo lookups become frequent enough that manual calls are real friction. Then re-run Gate A rather than quietly adding it.
7. Provenance¶
Raised by Sush 18 Aug 2026 after Salim mentioned Context7 on a call and an internal group thread pointed at context7.com/microsoft. Investigated by live probing (endpoint, search API, two real query-docs calls, head-to-head against Learn MCP), then dual-reviewed under Rule #16. Sush chose on-demand-only.
Related: tool-integration-checklist.md · msft-gold-explore-queue.md · Rule #4 (internal-first), Rule #9 (portal-first), Rule #16 (dual-model gate), 🔒 Internal Data Classification.