Refuted findings 13
Candidates the review stage examined and rejected, kept for transparency.
Supply chain
highRefutedlow confidenceThe Gemini extension manifest launches the MCP server via `npx -y @upstash/context7-mcp` with no version pin, so whatever is current on the registry is fetched and executed at each start, and the API key is passed on the command line.
"args": ["-y", "@upstash/context7-mcp", "--api-key", "${CONTEXT7_API_KEY}"]Why it was refuted
The unpinned npx launch is the extension's own vendor MCP server, which is its declared core capability. The API key comes from the user-configured env setting for the wrapped service, so no carve-out is exceeded.
Persistence
highRefutedlow confidenceThe `ctx7 setup` command writes Context7 rule files or appends sections to agent rule files such as AGENTS.md at dynamic paths. This is an agent control-plane write, but it matches the command's declared purpose of configuring Context7 for coding agents, so it is not concealed.
await writeFile(rulePath, ruleContent, "utf-8");
Why it was refuted
Writing the rule file is the declared purpose of `ctx7 setup`, which is explicitly documented as installing a rule for an agent. The user runs the command, and the file contents are the vendor's Context7 rule.
Persistence
highRefutedlow confidenceThe `ctx7 setup` command reads and rewrites per-agent MCP configuration files, including the user's API key, to register the Context7 server. This is an agent control-plane write, but it is the declared purpose of the setup command and the user explicitly runs it.
else await writeJsonConfig(mcpPath, config);
Why it was refuted
Registering the Context7 MCP server in the agent config is the declared core function of `ctx7 setup`. The user runs the command explicitly, and only a Context7 entry is merged in.
Code execution
highRefutedlow confidenceThe upgrade command spawns a command and arguments taken from an upgrade plan (with shell enabled on Windows), run after a confirmation prompt or --yes; the plan's origin is in another file.
const child = spawn(command, args, {Why it was refuted
The spawn is the declared core capability of the `ctx7 upgrade` subcommand, which is user-invoked and shows the exact command before running it. It runs only after a confirmation prompt or an explicit --yes. The D7 'contradiction' comes from an agent rule about question handling and has no bearing on this CLI feature. The plan's origin file was not shown, but nothing shown makes the spawn concealed or agent-directed.
Persistence
highRefutedlow confidenceThe setup CLI's patchTomlStdioApiKey edits an existing agent MCP TOML config in place and writes the user's Context7 API key into the server's args, a control-plane write that is the setup command's declared purpose and only affects a Context7 stdio entry.
await writeFile(filePath, content, "utf-8");
Why it was refuted
The function only patches the `args` of an existing Context7 stdio entry as part of the declared setup flow. It preserves every other byte and refuses to edit non-Context7 entries.
Supply chain
highRefutedlow confidenceThe rules file instructs the agent to run the CLI via `npx ctx7@latest`, which fetches and executes whatever the latest published package version is at runtime rather than a pinned version; this is the vendor's own CLI, so the risk is limited.
npx ctx7@latest library <name>
Why it was refuted
The rule invokes the vendor's own ctx7 CLI via npx, which is the declared core capability of the rule. The CLI is the product the rule exists to use.
Persistence
highRefutedlow confidenceThe documented `ctx7 setup` command writes MCP server entries, rule files, and skills into the agent's control-plane config (.mcp.json, .cursor/mcp.json, skills dirs), and `--yes` skips confirmation; this is the declared core purpose of the tool but modifies agent configuration.
MCP server entry in the agent's config file (`.mcp.json` for Claude, `.cursor/mcp.json` for Cursor, `.opencode.json` for OpenCode)
Why it was refuted
The skill openly documents `ctx7 setup` writing MCP entries as its declared core purpose of configuring Context7. The user chooses to run it.
Persistence
highRefutedlow confidencectx7 setup writes MCP config entries, a rule file that steers the agent, and skills into the agent's control-plane directories; this is the declared core purpose but is still an agent-config write.
A Context7 rule file instructing the agent to use Context7 for library docs
Why it was refuted
The rule file and skills written by setup are the documented, declared core purpose of the command. The `--yes` flag only skips setup prompts that the user opted into by running the command.
Supply chain
mediumRefutedlow confidenceGenerated stdio MCP configs run an unpinned package via `npx -y @upstash/context7-mcp`, so whatever is latest on the registry executes inside the user's agent without version pinning.
const args = ["-y", STDIO_PACKAGE];
Why it was refuted
The unpinned npx entry runs the vendor's own MCP package, which is the declared core capability of the setup tooling. setup.ts also preserves any user pin already present.
Supply chain
mediumRefutedlow confidenceThe pi package declares wildcard (`*`) peer dependency ranges for @earendil-works/pi-coding-agent and typebox, leaving host-resolved versions unpinned; this is a common peer-dependency convention for host-provided packages and is low risk.
"@earendil-works/pi-coding-agent": "*",
Why it was refuted
Wildcard peerDependencies on host-provided packages are a normal convention and do not install anything themselves. The pi package's own devDependencies are pinned by the lockfile.
Supply chain
mediumRefutedlow confidenceThe server shows an elicitation dialog telling the user to run an unpinned `npx ctx7 setup ... -y` command, which fetches and runs remote code and writes credentials into MCP client config; the server does not run it itself and the user must act.
`npx ctx7 setup ${flag} --mcp${transportFlag} -y`Why it was refuted
The command is only displayed to the human in an elicitation dialog, and the server never runs it. The code comment states this explicitly, so there is no source-to-sink chain.
Supply chain
mediumRefutedlow confidenceThe skill tells the agent to globally install the ctx7 npm package at the unpinned @latest tag before running commands, so whatever is published at that tag runs on the host.
npm install -g ctx7@latest
Why it was refuted
A fenced install of the vendor's own CLI is the skill's declared core capability and a vendor installer in install docs. The skill is the usage guide for that CLI.
Supply chain
mediumRefutedlow confidenceThe skill instructs the agent to run the CLI via `npx ctx7@latest`, which fetches and executes the newest published package on each run without a pinned version; this is the skill's declared mechanism and the vendor's own CLI.
Run commands with `npx ctx7@latest` so setup always uses the latest CLI without a global install:
Why it was refuted
The `npx ctx7@latest` invocation is the skill's declared, openly stated mechanism: the vendor's own CLI from the official npm registry. It is the core capability of a documentation-lookup skill and falls under the pinned/official-registry and vendor-installer carve-outs. Using @latest is a version-floating choice, not a concealed or contradicting behavior, and nothing in the artifact hides it.
