Search / io.github.unpkg/unpkg-mcp
protogridR0· no sign-inLive npm and UNPKG data for AI agents: resolution, audits, import maps, malware/CVE checks.
v1.0.0 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"unpkg-mcp": {
"type": "http",
"url": "https://mcp.unpkg.com/mcp"
}
}
}claude mcp add --transport http unpkg-mcp https://mcp.unpkg.com/mcp[mcp_servers.unpkg-mcp]
url = "https://mcp.unpkg.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"unpkg-mcp": {
"type": "remote",
"url": "https://mcp.unpkg.com/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"unpkg-mcp": {
"type": "http",
"url": "https://mcp.unpkg.com/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=unpkg-mcp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLnVucGtnLmNvbS9tY3AifQ%3D%3D"
}{
"servers": {
"unpkg-mcp": {
"type": "http",
"url": "https://mcp.unpkg.com/mcp"
}
}
}{
"mcpServers": {
"unpkg-mcp": {
"httpUrl": "https://mcp.unpkg.com/mcp"
}
}
}extensions:
"unpkg-mcp":
enabled: true
name: "unpkg-mcp"
type: streamable_http
uri: "https://mcp.unpkg.com/mcp"
timeout: 300
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations14 of 14 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 2,799 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changes, stability.rug_pulltool history recorded for 0 of the 7 days neededdeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +website +reachable +uptime-100% +updated-1d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://mcp.unpkg.com/mcp streamable-http | none | yes | 100% | 264 ms | 2025-11-25 | 2026-11-07 |
audit_dependenciesread-only | Classify a project's runtime dependencies for conversion to direct UNPKG file lookups, in framework context when given. Read the project's package.json yourself and pass its dependencies map; this tool checks each package against live npm/UNPKG data and returns convert_now / convert_carefully / keep_bundled / needs_review with suggested URLs and an import map for the safe conversions. IMPORTANT: suitability is not usage. Before calling, scan the project's HTML/files for an existing import map and CDN URLs and pass them as existingImports; entries already on UNPKG come back as already_on_unpkg, not conversion candidates. If you did not scan, say so — currentUsage will be absent rather than falsely 'not detected'. Only pass runtime dependencies, never devDependencies. |
build_file_urlread-only | Build a direct UNPKG file URL (the original file lookup) with a deliberate version policy, verifying the file exists when a path is given. |
check_importmapread-only | Validate an existing or proposed import map: every UNPKG URL resolves, files exist, versions are mutually consistent (including react/react-dom pairing and duplicate-version skew), loose specs are flagged, and framework-managed packages are errors when a framework is given or detected. Run this after generate_importmap or an audit, before committing to a conversion. |
estimate_migration_impactread-only | Order-of-magnitude estimate of bandwidth offloaded (and hosting dollars, if a $/GB is given) when bytes move from first-party hosting to UNPKG. Range-based with explicit assumptions and caveats; it cannot forecast latency or Core Web Vitals. Get unpkgBytesPerPageLoad from audit_dependencies' impact.convertNowEntryBytes plus any transitive files the caller chooses to include. |
generate_importmapread-only | Resolve a set of bare specifiers to UNPKG file URLs and return a ready-to-paste import map. Entry files are resolved live from each package. |
list_filesread-only | List the real files inside an exact or resolvable package version via UNPKG ?meta. Use this before choosing a file path; never guess paths. |
resolve_packageread-only | Resolve a package name plus exact version, dist-tag, or semver range to the version that exists on npm today, with its browser entry points. Use this instead of recalling versions from memory. |
search_packagesread-only | Search npm for a need (e.g. 'date picker', 'markdown parser') and annotate each result with browser readiness for direct UNPKG file lookup: browser-ready ESM, CommonJS-only, or unclear, with the entry file and size when known. Ranking is npm's relevance order; readiness is annotated, never hidden, so a CJS-only result is visible as such rather than silently dropped. |
shield_check_packagesread-only | Check exact package@version pairs against Shield intel: malware verdict (with review state) and CVEs affecting that version, including the first patched version. Works anonymously for packages you name (25 per call); Shield login raises the cap to 200. Domain data still requires login. Missing pairs were not scanned yet — absence is not a clean verdict. |
shield_domain_packagesread-only | List the caller's verified domains with package counts, or the packages Shield has observed on one domain. With includeThreats, one domain's packages come back annotated with malware verdicts and CVEs, ranked by the domain's own traffic. Requires Shield login. |
shield_simulate_requestread-only | Preview what Shield would do for one package@version request (optionally with referer/origin) under the logged-in user's effective pin/block rules, using the same rule-matching semantics as the edge. |
shield_watchlist_statusread-only | Return the logged-in org's monitored packages, blocklist entries, and pin policies as Shield currently holds them. Requires Shield login. |
shield_whoamiread-only | Return the Shield account, organization, and entitlements for the OAuth login on this connection. Requires an approved Shield account; anonymous connections get an authorization_required error with reconnect instructions. |
verify_urlread-only | Check that a UNPKG file URL actually resolves (follows redirects) before you put it in a project. |
Schemas: list_tools.
{
"name": "io.github.unpkg/unpkg-mcp",
"icons": [
{
"src": "https://unpkg.com/favicon.png",
"sizes": [
"256x256"
],
"mimeType": "image/png"
}
],
"title": "UNPKG",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://mcp.unpkg.com/mcp",
"type": "streamable-http"
}
],
"version": "1.0.0",
"repository": {
"url": "https://github.com/unpkg/unpkg-mcp",
"source": "github"
},
"websiteUrl": "https://mcp.unpkg.com",
"description": "Live npm and UNPKG data for AI agents: resolution, audits, import maps, malware/CVE checks."
}