Positioning: add two vs-context7 advantages — local-by-construction (no vendor server) + fully free (no metering/seats)

[kiki830621]

Problem / Request

Original text (verbatim, from the maintainer):
「我覺得我還可以家上兩個優點，就是完全布簾server是完全安全的：…（貼上 Context7 Enterprise 頁）… 第二個是完全免費：…（貼上 Context7 Pricing 頁）」
(≈「我覺得我還可以加上兩個優點：就是完全不連 server → 完全安全；第二個是完全免費」)

Interpretation: extend the LiveDocs vs-context7 positioning (currently the freshness axis, #50) with two more advantages, each backed by Context7's own public marketing as evidence:

1. Local by construction → no vendor server in the path. LiveDocs' MCP server runs on the user's machine and fetches primary sources directly (registries, llms.txt, repos). There is no LiveDocs SaaS — nothing in the middle to trust, breach, log, or rate-limit.
2. Fully free — no metering, no seats, no paid tiers. LiveDocs is a free, open-source Claude Code plugin. Private repos "just work" because it reads your sources locally at no cost.

Type

feature (positioning / messaging — sibling of #50; touches README top + docs/positioning.md)

Evidence (Context7's own pages — public marketing, quoted verbatim)

Enterprise page — Context7's default is a hosted SaaS ("Built by Upstash", "Cloud (SaaS) — Managed by Upstash with a dedicated private database per organization"), with Self-Hosted / On-Premise offered as a deployment option. It claims "Privacy-First Architecture: Queries are processed locally—prompts, code, and conversations never leave your device", and lists SOC 2 Type II / GDPR / CCPA / ISO 27001 (in progress).

Pricing page — Free = $0, 1,000 API calls/mo, public repos only. Pro = $10 per seat / month, 5,000 calls/seat, additional "Unlimited ($10 / 1,000)", Private Repo Parsing $25 / 1M tokens. Enterprise = Custom (SSO, self-hosted).

⚠ Honesty guardrails (iron rule #27/#29 — measured, never asserted)

The diagnose/implement phase MUST frame both advantages as fair, citable, conceded-where-due, not spin:

• Security advantage is architectural, NOT "they're insecure." Context7 also claims local processing and is SOC-2 certified, and offers self-hosted. The honest differentiator: LiveDocs has no vendor server at all, by construction (local MCP reading primary sources) → there is no SaaS in the path to trust or breach; Context7's default routes through their cloud, and vendor-free operation requires a paid self-hosted/Enterprise tier. Concede: Context7's certs + self-host option are real.
• Cost advantage is factual + citable, NOT "they're paywalled." Context7 has a real free tier (1,000 calls, public repos). The honest differentiator: LiveDocs is unmetered, seatless, private-repos-included because it never calls a metered API. Concede: Context7's free tier exists; LiveDocs is narrower in scope (freshness + primary-source fetch, not a broad hosted doc index).
• No hardcoded competitor numbers rot-checked. If pricing/claims are cited, mark them as a dated capture ("Context7 pricing as of 2026-07-05") the way evals/look-up treats the freshness snapshot — their marketing can change. Prefer citing the structural fact (SaaS-default vs local-only; metered vs unmetered) over volatile dollar figures.

Expected

• Two new advantages added to the positioning surface (README top near the README vs-context7 chart: replace the ASCII block with a per-library matplotlib SVG (revises #46) #50 chart, and/or docs/positioning.md), each: honestly framed, evidence-cited, concessions inline, dated where a competitor number is used.
• No claim that Context7 is "insecure" or "paid-only" — the differentiators are no-vendor-by-construction and unmetered/free.

Actual

• Positioning currently covers only the freshness axis (the vs-context7 chart from README vs-context7 chart: replace the ASCII block with a per-library matplotlib SVG (revises #46) #50 + docs/positioning.md). Security posture (local-only, no SaaS) and cost (free/unmetered) are not stated, even though they're strong, defensible, structural differentiators.

Impact

• Sharper, multi-axis positioning: freshness (README vs-context7 chart: replace the ASCII block with a per-library matplotlib SVG (revises #46) #50) + privacy/security-by-construction + cost. All three are structural, not marketing puff.
• Risk to manage: competitive security/cost claims are the easiest place to over-assert — hence the honesty guardrails above are load-bearing.

Related

Sibling of #50 (vs-context7 freshness chart, in verify). Deeper positioning doc: docs/positioning.md. Follow-ups #48 / #49 still apply to the freshness snapshot.

---

Do NOT add a close trailer — /idd-close after merge. Verbatim quotes are Context7 public marketing (no private data).

Current Status

Phase: implemented (PR #53; verify pending)

[kiki830621]

Diagnosis

Type

feature (positioning / external-messaging — docs only, no code)

Analysis

The two requested advantages are already present but understated in docs/positioning.md, and not evidence-cited against Context7's own marketing:

• Differentiator Proactive language-runtime version detection (esp. pinned Python versions) #2 "Private, no key. Queries never leave your machine. No account, no API key, no hosted quota." (line 40)
• Head-to-head rows: Architecture: local tool, no backend | centralized hosted service; Privacy: queries stay on your machine | queries hit their servers; Access: no account, no API key | hosted (quota / keys) (lines 51-53)

So this is sharpen + evidence-cite + honesty-correct, not net-new prose.

Honesty finding (load-bearing — #27/#29)

positioning.md:52 currently asserts "queries hit their servers" for context7. Context7's Enterprise page contests this: it claims "Privacy-First Architecture: Queries are processed locally—prompts, code, and conversations never leave your device", is SOC-2 Type II certified, and offers Self-Hosted / On-Premise. So the bare "hits their servers" line is only true of the default cloud SaaS and is over-asserted as written. The honest, defensible differentiators:

• Security = architectural absence, not comparative weakness. context7's default is a hosted SaaS ("Built by Upstash / Cloud (SaaS) — dedicated private DB per org"); vendor-free operation needs a paid Self-Hosted/Enterprise tier. LiveDocs has no vendor server at all, by construction — nothing to trust, breach, or self-deploy. Concede: context7's SOC-2 + self-host + local-processing claims are real.
• Cost = unmetered by construction, not "they're paywalled." context7 Pricing (dated capture 2026-07-05): Free = 1,000 calls/mo, public repos only; Pro = $10/seat/mo + $25/1M tokens private-repo parsing; Enterprise = custom. LiveDocs is unmetered, seatless, private-repos-included (it reads your sources locally, never a metered API). Concede: context7's free tier is real; LiveDocs is narrower in scope.

Strategy

• docs/positioning.md: correct the over-asserted "hits their servers" row → honest SaaS-default framing + concessions; sharpen Architecture/Privacy/Access with context7's own evidence; add an explicit Cost dimension (dated pricing capture, structural framing).
• Wiki Home.md + Home-zh-TW.md ## vs context7 section: mirror the security/cost axes (bilingual pair — edit both).
• README blurb below README vs-context7 chart: replace the ASCII block with a per-library matplotlib SVG (revises #46) #50's <!-- BEGIN vs-context7 --> sentinel block (conflict-safe region): optional one-line "local-only, unmetered" touch.

Conflict Class

C_shared_module_coord — shared resource: README.md (with in-flight #50, which owns the sentinel block). Mitigated: #52's primary work is docs/positioning.md + wiki (zero #50 overlap); any README touch stays below #50's sentinel region so both merge in either order.

Complexity

Plan — decision-heavy competitive framing on a public-facing surface, squarely in the #27/#29 measured-not-asserted risk zone. Docs-only (no Spectra spec change).

Residue (honest limitation)

Unlike freshness (harness-measured, drift-guarded via #27/#46/#50), the security and cost axes are structural + citable, not numerically measured — so their honesty mechanism is dated citation + inline concession, not a drift-guarded number. Competitor pricing/claims can change; prose must cite the structural fact (SaaS-default vs local-only; metered vs unmetered) and date any figure, accepting it may rot. No automated guard is added (there's no metric to measure).

Risks

Over-asserting security/cost is the easiest failure here. The verify pass (opus ensemble) will re-attack exactly the honesty framing + concession fairness.

[kiki830621]

Implementation Plan

Scope narrowed to docs/positioning.md only (from the 3-item strategy) — deliberate, with rationale:

• positioning.md is the declared "External-messaging source of truth" (its own header) → the user's "add two advantages to the positioning" lands here fully.
• Zero README vs-context7 chart: replace the ASCII block with a per-library matplotlib SVG (revises #46) #50 conflict: README vs-context7 chart: replace the ASCII block with a per-library matplotlib SVG (revises #46) #50 never touches positioning.md. Dropping the README/wiki items removes all overlap with README vs-context7 chart: replace the ASCII block with a per-library matplotlib SVG (revises #46) #50's in-flight sentinel-block work — both merge in any order.
• README blurb + wiki Home ## vs context7 mirror = downstream expressions, deferred as a follow-up (they're README vs-context7 chart: replace the ASCII block with a per-library matplotlib SVG (revises #46) #50-adjacent + syncable separately). Keeps Positioning: add two vs-context7 advantages — local-by-construction (no vendor server) + fully free (no metering/seats) #52 focused + reviewable.

Edits (all in docs/positioning.md):

• Differentiator Proactive language-runtime version detection (esp. pinned Python versions) #2 → "Private and free, by construction" — sharpen both axes + inline concession (context7 SOC-2 + self-host).
• Head-to-head table → honest Architecture ("hosted SaaS by default") + Privacy ("default routes through their cloud") rows; replace Access with a Cost row (unmetered vs metered+paid).
• Add a prose paragraph after the "Freshness row is measured" note → context7-cited evidence + concessions + dated pricing capture (2026-07-05) + the "cite the structure, not the rotting figure" caveat.

No code / no tests (prose positioning; the honesty mechanism is dated-citation + concession, per the diagnosis Residue — these axes aren't harness-measured).

[kiki830621]

Implementation Complete

Checklist

• Differentiator Proactive language-runtime version detection (esp. pinned Python versions) #2 → "Private and free, by construction" + inline concession → 6a33467
• Head-to-head: honest Architecture / Privacy rows + Access → Cost row → 6a33467
• Prose: context7-cited evidence + concessions + dated pricing capture (2026-07-05) + "cite the structure" caveat → 6a33467
• Self-caught honesty refinement: "queries never leave your machine" over-claimed (LiveDocs fetches from origin hosts) → "no third-party index sees your query" (context7's exact role) + local-reconciliation-offline → follow-up commit

Changes (docs/positioning.md only)

• 6a33467 feat: sharpen the two axes + honesty-correct the over-asserted "hits their servers" row
• (follow-up) refine: precise privacy claim — no middleman, not "never leaves machine"

Design note

Caught the "queries never leave your machine" over-assertion before verify: LiveDocs still makes network requests to the authoritative source (npm/PyPI/docs host) — the defensible privacy claim is "no third-party index/vendor in between," which is precisely context7's role, plus offline local-install reconciliation. That is the measured-not-asserted discipline applied to my own prose.

Sister Bugs Filed

(none) — docs-only; the README blurb + wiki Home ## vs context7 mirror are deferred follow-ups (noted in the plan, #50-adjacent).

PR

#53 (Refs #52). Next: /idd-verify #52 (opus ensemble — honesty framing). Stop at verified.

[kiki830621]

Verify: #52 — Round 1 (opus ensemble)

Verdict: FINDINGS · dispatch=opus (confirmed) · 4 lenses + devil's-advocate ran (Codex disabled — API session limit, non-blocking). Delivery confirmed (INFO): both advantages present + sharpened, the old queries hit their servers / queries stay on your machine over-assertions removed, every context7 figure matches the pasted evidence, and the self-caught privacy refinement is literally accurate. The findings are all "be more honest," not "you got it wrong" — and they cluster around one theme the DA named: the doc counts what LiveDocs removes but never what it adds.

#	Sev	Lens	Finding	Action
1	MED	DA	"nothing to deploy, trust, or breach" is a literal over-claim — trust doesn't vanish, it moves to the local signed binary + its GitHub-Release/--self-update distribution (per this project's own model); a compromised release/key is arguably a larger blast radius	FIX
2	MED	honesty	Privacy row leaves context7's own "queries processed locally" claim unreconciled — a reader could take it at face value and the contrast collapses; the honest reconciliation (client-side processing ≠ the index lookup still hits their hosted per-org DB) strengthens the true edge	FIX
3	MED	DA	"no third-party index sees your query" — the word index carries load-bearing scope the reader misses: the origin host (npm/PyPI/docs) + DNS/proxy/ISP still see it; the privacy win is narrow (removes one observer), not "nobody sees it"	FIX
4	LOW	DA	"unmetered / at no cost" hides transferred cost (you bear origin-host rate-limits + bandwidth); "private repos included" is a different mechanism (local installed copy vs cloud parse), not a free superset	FIX
5	LOW	DA	Framing asymmetry — only removals tallied → skimmer concludes "LiveDocs is more secure"; honest conclusion is "different trust surface, not smaller"	FIX (ties 1/3/4)
6-9	LOW	mixed	1,000 calls/mo adds an unverified period (drop /mo); SOC-2 "claimed" vs "certified" inconsistency; "hosted" silently swapped for source's "private" DB; "self-host is a paid tier" is an inference → anchor to the (custom-priced) Enterprise tier	FIX
—	LOW	consistency	one-liner/wedge/taglines looser than sharpened #2	won't-fix — each has a local "straight from the source" concession; the one literal over-claim was already fixed; non-blocking per reviewer

Fix plan

A focused honesty-symmetry revision of positioning.md: acknowledge the trust surface that LiveDocs adds (signed binary + distribution, origin-host visibility, self-borne rate-limits), reconcile context7's local-processing claim (their hosted index is what LiveDocs structurally lacks), and apply the accuracy nits (drop /mo, SOC-2 Type II uniformly, source's "private", self-host = Enterprise tier). Then re-verify (Round 2).

[kiki830621]

Verify: #52 — Round 2 (opus ensemble, partial) + fix

Verdict: FINDINGS (partial — the devil's-advocate lens hit the API session limit; 3 review lenses completed). The completed lenses confirmed the R1 honesty fixes are sound ("R1 closed, no self-defeating over-correction"; the trust-shift is grounded in LiveDocs' actual release model; the context7 local-processing reconciliation is fair). One real straggler:

Sev	Finding	Fix
HIGH	I sharpened #2 / table / bullets to "origin host still sees it / different trust surface", but the wedge (the lead section) still asserted flat "private" — a direct contradiction	FIX (0fc653f)
MED	wedge "context7 can't become local, private, keyless" clashes with the sharpened concession that context7 offers self-host	FIX
LOW	"index lookup still sent to context7's DB" states an inference as fact	FIX — hedged to "a hosted SaaS ... must still route the index lookup"
LOW	one-liner / tagline "on your machine"	keep — house-style; describes where the tool runs (the wording-guidance endorses it); not the deleted "queries never leave" over-claim

Fix (0fc653f)

Propagated the verified register to the lead: wedge "it is private" → "no third-party doc index in the query path"; lead outcome "(latest, private, keyless)" → "(latest, keyless, no index in the middle)"; "context7 can't become local … without giving up its model" → states the reconciliation (centralized SaaS by default; local+keyless = its Enterprise self-host tier). Left the anti-positioning "lost privacy" as-is (it refers to the third-party index a central cache would add — the one privacy LiveDocs retains).

66 Python + 144 Swift green (docs-only; no code). Final confirmation round not run — bounded by the API session limit, not an open finding.

[kiki830621]

Closing Summary

Problem. Add two vs-context7 advantages to the positioning: (1) security = local-by-construction / no vendor server; (2) cost = fully free / unmetered — using Context7's own marketing (Enterprise + Pricing pages) as the evidence base.

Root cause / reframe. Diagnosis found both advantages already present but understated in docs/positioning.md, and one line (queries hit their servers) over-asserted — contradicted by Context7's own Enterprise page (local-processing claim + SOC-2 + self-host). So the work was sharpen + evidence-cite + honesty-correct, not net-new prose.

Solution. docs/positioning.md only (the external-messaging source of truth; zero overlap with #50): differentiator #2 → "Private and free, by construction"; head-to-head Architecture / Privacy / Cost rows; a prose block citing Context7's pages with concessions inline + a dated pricing capture (2026-07-05) + "cite the structure, not the rotting figure".

Verification — 2 opus ensemble rounds:

• Self-caught before verify: "queries never leave your machine" over-claimed (LiveDocs fetches from npm/PyPI/docs hosts) → "no third-party index sees your query".
• R1: the framing counted what LiveDocs removes (vendor/index/meter) but not what it adds → fixed: trust shifts to the local signed binary + distribution; reconcile Context7's "processed locally" claim (index lookup still hits their hosted per-org DB); "unmetered ≠ costless" (rate limits/bandwidth); "private repos" = a different mechanism; symmetric "different trust surface, not smaller".
• R2: confirmed the body honest, found a HIGH wedge straggler (the lead still asserted flat "private" that the body walked back) → aligned the lead ("no index in the middle"); hedged the context7-internals inference; SOC-2 Type II / source's "private" DB / self-host = Enterprise tier.

Changes. PR #53 (feat + 3 fix commits, positioning.md only), merged 7f9692b. Docs-only; 210 tests still green.

Residue (honest). Unlike freshness (harness-measured, drift-guarded), the security/cost axes are structural + citable, not numerically measured — so their honesty mechanism is dated citation + concession, not a drift-guarded number; competitor pricing can rot (dated + "cite the structure"). The R2 devil's-advocate + a confirmation R3 were bounded by an Anthropic API session limit, not an open finding.

Follow-ups (deferred, not in scope). README blurb + wiki Home ## vs context7 mirror of the security/cost axes.