Koskamo

UNPKG MCP

Provides live npm and UNPKG data for AI agents, enabling version resolution, file discovery, project audits, import-map validation, and malware/CVE checks. It supports anonymous access for general tools and optional Shield login for organization-specific domain data and edge simulation.

Visit UNPKG

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

UNPKG MCP logo, by UNPKGCommunity listingStreamable HTTPNo sign-inEndpoint checked 2026-11-07Published by UNPKG
You need:Your account must be email-verified and approved from the Shield beta waitlist
MCP endpoint (Streamable HTTP)
https://mcp.unpkg.com/mcp
Vendor documentation

What its tools do

14 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.

Read-only (14)

14 of 14 have a description · 14 of 14 declare behavior hints · 5 of 12 with parameters document them all

Checks and signals

Each line is separate evidence, not a trust score.

  • Passed Endpoint answered the live check ·
  • Availability 1 of 1 checks passed in 30 days

What you can do with it

  • Resolve exact package versions and browser entry points
  • Audit project dependencies for UNPKG conversion
  • Check packages for malware verdicts and CVEs
  • Validate and generate import maps

Source and maintenance

Community listingRegistry 1.0.0
mcp-registry: io.github.unpkg/unpkg-mcp@1.0.0Source repositoryProject website
Maintenance checked

Protocol and capabilities

Server
unpkg-mcp 1.0.0
MCP protocol negotiated in check
2025-11-25
Tools
14 advertised
Resources
2 advertised
Resource templates
0 advertised
Prompts
3 advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": true
  },
  "prompts": {
    "listChanged": true
  },
  "resources": {
    "listChanged": true
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Live npm and UNPKG data for direct file lookups (https://unpkg.com/<package>@<version>/<file>) — the original UNPKG file serving. Do not suggest esm.unpkg.com by default: it is a beta transform service, appropriate only when a package has no browser-ready file and the user opts in. Use resolve_package/list_files instead of guessing versions or paths, build_file_url for canonical URLs, Before an audit, scan the project's HTML for existing import maps and CDN URLs (unpkg.com, cdn.jsdelivr.net, esm.sh, plain script tags) and pass them as existingImports — suitability is not usage, and a project may already be converted. Lead audit summaries with current state. shield_check_packages works anonymously for package@versions the user names (malware verdicts and CVEs); only domain, watchlist, and simulation tools need Shield login. If a shield_* tool returns authorization_required, walk the user through connecting: MCP server must be https://mcp.unpkg.com/mcp, then Authenticate from the client's MCP server panel, sign in at shield.unpkg.com in the browser, Approve, retry. Never present the oauth-protected-resource URL as something the user should open. audit_dependencies and check_importmap before converting a project, and estimate_migration_impact for rough bandwidth ranges (never exact savings promises). Recommend against UNPKG when a bundler or framework already owns the dependency. Framework apps (Next, Nuxt, ...) keep framework-managed packages bundled; only standalone browser surfaces convert. Read the conversion playbook resource before a project audit.

Tools

14 advertised

resolve_package — Resolve an npm package version
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Resolve a package name plus exact version, dist-tag, or semver range to the version that exists on npm today, with its browser entry points. Use this instead of recalling versions from memory.

resolve_package input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "package"
  ],
  "properties": {
    "package": {
      "type": "string",
      "description": "npm package name, e.g. react or @scope/name"
    },
    "version": {
      "type": "string",
      "description": "Exact version, dist-tag, or semver range. Defaults to latest."
    }
  },
  "additionalProperties": false
}
resolve_package output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "name",
    "requested",
    "resolvedVersion",
    "distTags",
    "entryPoints",
    "peerDependencies"
  ],
  "properties": {
    "name": {
      "type": "string"
    },
    "distTags": {
      "type": "object",
      "additionalProperties": {
        "type": "string"
      }
    },
    "requested": {
      "type": "string"
    },
    "entryPoints": {
      "type": "object",
      "properties": {},
      "additionalProperties": true
    },
    "resolvedVersion": {
      "type": "string"
    },
    "peerDependencies": {
      "type": "object",
      "additionalProperties": {
        "type": "string"
      }
    }
  },
  "additionalProperties": false
}
resolve_package annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
list_files — List files in a package version
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

List the real files inside an exact or resolvable package version via UNPKG ?meta. Use this before choosing a file path; never guess paths.

list_files input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "package"
  ],
  "properties": {
    "path": {
      "type": "string",
      "description": "Directory prefix inside the package, e.g. /dist/. Defaults to /."
    },
    "limit": {
      "type": "integer",
      "maximum": 1000,
      "minimum": 1,
      "description": "Max files to return. Defaults to 200."
    },
    "package": {
      "type": "string"
    },
    "version": {
      "type": "string",
      "description": "Defaults to latest; resolved before listing."
    }
  },
  "additionalProperties": false
}
list_files output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "package",
    "version",
    "prefix",
    "totalFiles",
    "truncated",
    "files"
  ],
  "properties": {
    "files": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {},
        "additionalProperties": true
      }
    },
    "prefix": {
      "type": "string"
    },
    "package": {
      "type": "string"
    },
    "version": {
      "type": "string"
    },
    "truncated": {
      "type": "boolean"
    },
    "totalFiles": {
      "type": "number"
    }
  },
  "additionalProperties": false
}
list_files annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
build_file_url — Build a canonical UNPKG file URL
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Build a direct UNPKG file URL (the original file lookup) with a deliberate version policy, verifying the file exists when a path is given.

build_file_url input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "package"
  ],
  "properties": {
    "file": {
      "type": "string",
      "description": "File path inside the package. Defaults to the resolved entry point."
    },
    "policy": {
      "enum": [
        "preserve",
        "exact",
        "patch",
        "range"
      ],
      "type": "string",
      "description": "preserve: keep the given spec (default). exact: resolved version. patch: major.minor (bug fixes flow). range: ^major.minor.patch."
    },
    "package": {
      "type": "string"
    },
    "subpath": {
      "type": "string",
      "description": "Package subpath import, e.g. hooks for preact/hooks. Resolved through the exports map, then file discovery. Ignored when file is given."
    },
    "version": {
      "type": "string",
      "description": "Exact version, dist-tag, or range to resolve. Defaults to latest."
    }
  },
  "additionalProperties": false
}
build_file_url output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "url",
    "package",
    "specUsed",
    "resolvedVersion",
    "file",
    "verifiedFileExists"
  ],
  "properties": {
    "url": {
      "type": "string"
    },
    "file": {
      "type": "string"
    },
    "package": {
      "type": "string"
    },
    "specUsed": {
      "type": "string"
    },
    "resolvedVersion": {
      "type": "string"
    },
    "verifiedFileExists": {
      "type": [
        "boolean",
        "null"
      ]
    }
  },
  "additionalProperties": false
}
build_file_url annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
audit_dependencies — Audit dependencies for UNPKG conversion
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Classify a project's runtime dependencies for conversion to direct UNPKG file lookups, in framework context when given. Read the project's package.json yourself and pass its dependencies map; this tool checks each package against live npm/UNPKG data and returns convert_now / convert_carefully / keep_bundled / needs_review with suggested URLs and an import map for the safe conversions. IMPORTANT: suitability is not usage. Before calling, scan the project's HTML/files for an existing import map and CDN URLs and pass them as existingImports; entries already on UNPKG come back as already_on_unpkg, not conversion candidates. If you did not scan, say so — currentUsage will be absent rather than falsely 'not detected'. Only pass runtime dependencies, never devDependencies.

audit_dependencies input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "dependencies"
  ],
  "properties": {
    "framework": {
      "enum": [
        "next",
        "nuxt",
        "sveltekit",
        "remix",
        "astro",
        "gatsby"
      ],
      "type": "string",
      "description": "The project's framework, if any. Framework-managed packages (react/react-dom in Next, vue in Nuxt, ...) are classified keep_bundled in context. Auto-detected from the dependency map when omitted."
    },
    "dependencies": {
      "type": "object",
      "description": "Map of package name to the version spec from package.json, e.g. { \"preact\": \"^10.25.4\" }",
      "additionalProperties": {
        "type": "string"
      }
    },
    "existingImports": {
      "type": "object",
      "description": "Existing imports found in the project: bare specifier to current URL, typically an import map extracted from HTML (include subpath keys like preact/hooks). Pass {} if you scanned and found none. Omit only if you did not scan; the result then reports current usage as unknown instead of not detected.",
      "additionalProperties": {
        "type": "string"
      }
    }
  },
  "additionalProperties": false
}
audit_dependencies output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "framework",
    "frameworkNote",
    "scopeNote",
    "currentStateSummary",
    "shieldVerdicts",
    "shieldNote",
    "summary",
    "dependencies",
    "importmap",
    "importmapScope",
    "peerImportsAdded",
    "peerNotes",
    "mapValidation",
    "impact",
    "nextSteps"
  ],
  "properties": {
    "impact": {
      "type": "object",
      "properties": {},
      "additionalProperties": true
    },
    "summary": {
      "type": "object",
      "properties": {},
      "additionalProperties": true
    },
    "framework": {
      "type": [
        "string",
        "null"
      ]
    },
    "importmap": {
      "type": "object",
      "properties": {},
      "additionalProperties": true
    },
    "nextSteps": {
      "type": "string"
    },
    "peerNotes": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "scopeNote": {
      "type": "string"
    },
    "shieldNote": {
      "type": [
        "string",
        "null"
      ]
    },
    "dependencies": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {},
        "additionalProperties": true
      }
    },
    "frameworkNote": {
      "type": [
        "string",
        "null"
      ]
    },
    "mapValidation": {
      "anyOf": [
        {
          "type": "object",
          "properties": {},
          "additionalProperties": true
        },
        {
          "type": "null"
        }
      ]
    },
    "importmapScope": {
      "type": "string"
    },
    "shieldVerdicts": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {},
            "additionalProperties": true
          }
        },
        {
          "type": "null"
        }
      ]
    },
    "peerImportsAdded": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "currentStateSummary": {
      "type": "object",
      "properties": {},
      "additionalProperties": true
    }
  },
  "additionalProperties": false
}
audit_dependencies annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
verify_url — Verify a UNPKG URL resolves
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Check that a UNPKG file URL actually resolves (follows redirects) before you put it in a project.

verify_url input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "format": "uri",
      "description": "A full https://unpkg.com/... file URL."
    }
  },
  "additionalProperties": false
}
verify_url output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "ok",
    "status",
    "finalUrl",
    "contentType"
  ],
  "properties": {
    "ok": {
      "type": "boolean"
    },
    "status": {
      "type": "number"
    },
    "finalUrl": {
      "type": "string"
    },
    "contentType": {
      "type": [
        "string",
        "null"
      ]
    }
  },
  "additionalProperties": false
}
verify_url annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
generate_importmap — Generate an import map for UNPKG packages
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Resolve a set of bare specifiers to UNPKG file URLs and return a ready-to-paste import map. Entry files are resolved live from each package.

generate_importmap input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "entries"
  ],
  "properties": {
    "entries": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "specifier",
          "package"
        ],
        "properties": {
          "file": {
            "type": "string",
            "description": "Explicit file; defaults to the package entry point."
          },
          "package": {
            "type": "string"
          },
          "version": {
            "type": "string"
          },
          "specifier": {
            "type": "string",
            "description": "Bare specifier used in imports, e.g. preact or preact/hooks"
          }
        },
        "additionalProperties": false
      }
    }
  },
  "additionalProperties": false
}
generate_importmap output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "importmap",
    "resolved"
  ],
  "properties": {
    "resolved": {
      "type": "object",
      "additionalProperties": {
        "type": "string"
      }
    },
    "importmap": {
      "type": "object",
      "properties": {},
      "additionalProperties": true
    }
  },
  "additionalProperties": false
}
generate_importmap annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_importmap — Validate an import map as a system
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Validate an existing or proposed import map: every UNPKG URL resolves, files exist, versions are mutually consistent (including react/react-dom pairing and duplicate-version skew), loose specs are flagged, and framework-managed packages are errors when a framework is given or detected. Run this after generate_importmap or an audit, before committing to a conversion.

check_importmap input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "imports"
  ],
  "properties": {
    "imports": {
      "type": "object",
      "description": "The import map's imports object: bare specifier to URL.",
      "additionalProperties": {
        "type": "string"
      }
    },
    "framework": {
      "enum": [
        "next",
        "nuxt",
        "sveltekit",
        "remix",
        "astro",
        "gatsby"
      ],
      "type": "string"
    }
  },
  "additionalProperties": false
}
check_importmap output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "ok",
    "framework",
    "entries",
    "globalIssues"
  ],
  "properties": {
    "ok": {
      "type": "boolean"
    },
    "entries": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {},
        "additionalProperties": true
      }
    },
    "framework": {
      "type": [
        "string",
        "null"
      ]
    },
    "globalIssues": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {},
        "additionalProperties": true
      }
    }
  },
  "additionalProperties": false
}
check_importmap annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
search_packages — Search npm for browser-suitable packages
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Search npm for a need (e.g. 'date picker', 'markdown parser') and annotate each result with browser readiness for direct UNPKG file lookup: browser-ready ESM, CommonJS-only, or unclear, with the entry file and size when known. Ranking is npm's relevance order; readiness is annotated, never hidden, so a CJS-only result is visible as such rather than silently dropped.

search_packages input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "query"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "maximum": 10,
      "minimum": 1,
      "description": "Results to annotate. Defaults to 5."
    },
    "query": {
      "type": "string",
      "description": "What the package should do, e.g. 'confetti', 'sanitize html', 'date picker'."
    }
  },
  "additionalProperties": false
}
search_packages output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "query",
    "results",
    "note"
  ],
  "properties": {
    "note": {
      "type": "string"
    },
    "query": {
      "type": "string"
    },
    "results": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {},
        "additionalProperties": true
      }
    }
  },
  "additionalProperties": false
}
search_packages annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
estimate_migration_impact — Rough bandwidth/cost impact of a conversion
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Order-of-magnitude estimate of bandwidth offloaded (and hosting dollars, if a $/GB is given) when bytes move from first-party hosting to UNPKG. Range-based with explicit assumptions and caveats; it cannot forecast latency or Core Web Vitals. Get unpkgBytesPerPageLoad from audit_dependencies' impact.convertNowEntryBytes plus any transitive files the caller chooses to include.

estimate_migration_impact input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "monthlyPageViews",
    "unpkgBytesPerPageLoad"
  ],
  "properties": {
    "browserCacheRate": {
      "type": "number",
      "maximum": 0.95,
      "minimum": 0,
      "description": "Share of loads served from browser cache. Default 0.5."
    },
    "monthlyPageViews": {
      "type": "number",
      "exclusiveMinimum": 0
    },
    "bandwidthCostPerGbUsd": {
      "type": "number",
      "description": "Current hosting $/GB, if known. Omit to skip dollars.",
      "exclusiveMinimum": 0
    },
    "unpkgBytesPerPageLoad": {
      "type": "number",
      "description": "Raw bytes per page load moving to UNPKG.",
      "exclusiveMinimum": 0
    }
  },
  "additionalProperties": false
}
estimate_migration_impact output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "monthlyGbOffloaded",
    "monthlySavingsUsd",
    "perLoadWireBytes",
    "transferTimeEquivalentMs",
    "assumptions",
    "caveats",
    "betterMetrics"
  ],
  "properties": {
    "caveats": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "assumptions": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "betterMetrics": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "perLoadWireBytes": {
      "$ref": "#/properties/monthlyGbOffloaded"
    },
    "monthlySavingsUsd": {
      "anyOf": [
        {
          "$ref": "#/properties/monthlyGbOffloaded"
        },
        {
          "type": "null"
        }
      ]
    },
    "monthlyGbOffloaded": {
      "type": "object",
      "required": [
        "low",
        "high"
      ],
      "properties": {
        "low": {
          "type": "number"
        },
        "high": {
          "type": "number"
        }
      },
      "additionalProperties": false
    },
    "transferTimeEquivalentMs": {
      "type": "object",
      "properties": {},
      "additionalProperties": true
    }
  },
  "additionalProperties": false
}
estimate_migration_impact annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
shield_whoami — Shield account for the logged-in user
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Return the Shield account, organization, and entitlements for the OAuth login on this connection. Requires an approved Shield account; anonymous connections get an authorization_required error with reconnect instructions.

shield_whoami input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {}
}
shield_whoami annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
shield_simulate_request — Simulate a Shield edge decision
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Preview what Shield would do for one package@version request (optionally with referer/origin) under the logged-in user's effective pin/block rules, using the same rule-matching semantics as the edge.

shield_simulate_request input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "package",
    "version"
  ],
  "properties": {
    "path": {
      "type": "string"
    },
    "origin": {
      "type": "string"
    },
    "package": {
      "type": "string"
    },
    "referer": {
      "type": "string"
    },
    "version": {
      "type": "string"
    }
  },
  "additionalProperties": false
}
shield_simulate_request annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
shield_check_packages — Malware verdicts and CVEs for package versions
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Check exact package@version pairs against Shield intel: malware verdict (with review state) and CVEs affecting that version, including the first patched version. Works anonymously for packages you name (25 per call); Shield login raises the cap to 200. Domain data still requires login. Missing pairs were not scanned yet — absence is not a clean verdict.

shield_check_packages input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "packages"
  ],
  "properties": {
    "packages": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "version"
        ],
        "properties": {
          "name": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "additionalProperties": false
      },
      "maxItems": 200,
      "minItems": 1
    }
  },
  "additionalProperties": false
}
shield_check_packages annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
shield_domain_packages — Shield-observed packages on your domains
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

List the caller's verified domains with package counts, or the packages Shield has observed on one domain. With includeThreats, one domain's packages come back annotated with malware verdicts and CVEs, ranked by the domain's own traffic. Requires Shield login.

shield_domain_packages input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {
    "days": {
      "type": "integer",
      "maximum": 365,
      "minimum": 0,
      "description": "Lookback window for threats mode. Default 30; 0 = all-time."
    },
    "domain": {
      "type": "string",
      "description": "One verified domain. Omit to list domains with package counts."
    },
    "includeThreats": {
      "type": "boolean",
      "description": "Annotate one domain's packages with verdicts and CVEs. Requires domain."
    }
  },
  "additionalProperties": false
}
shield_domain_packages annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
shield_watchlist_status — Your Shield watchlist, pins, and blocks
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Return the logged-in org's monitored packages, blocklist entries, and pin policies as Shield currently holds them. Requires Shield login.

shield_watchlist_status input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {}
}
shield_watchlist_status annotations
{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

Prompts

3 advertised

audit_project_for_unpkg — Audit this project for UNPKG conversion

Advertised by the server during the last successful anonymous check.

Guided workflow: audit the current project's dependencies and convert the ones that make sense.

apply
Set to "yes" to apply conversions after the audit; otherwise propose first.
convert_this_page — Convert this page to UNPKG imports

Advertised by the server during the last successful anonymous check.

Wire a single no-build HTML page's bare imports to UNPKG, with validation and browser proof.

page
Path to the HTML file. Defaults to index.html.
find_browser_package — Find an npm package that works as a browser import

Advertised by the server during the last successful anonymous check.

Search npm for a need and shortlist packages by browser readiness for direct UNPKG lookup.

need
What the package should do, e.g. 'a small markdown parser'. (required)

Resources

2 advertised

conversion-playbook — UNPKG conversion playbook

Advertised by the server during the last successful anonymous check.

How to audit and convert a project to UNPKG file lookups.

conversion-playbook URI
unpkg://guidance/conversion-playbook

MIME type: text/markdown

version-policy — UNPKG version specifier policy

Advertised by the server during the last successful anonymous check.

Exact vs patch-level vs range specifiers and when to use each.

version-policy URI
unpkg://guidance/version-policy

MIME type: text/markdown

90-day uptime

A lightweight connection check about every six hours, sampled on hosts with many listings. It shows the server answered, not that its tools work.

Too few checks for a percentage yet (1 of 1 answered).

  1. 2026-11-07: 1 of 1 checks answered

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
410 ms
95th percentile latency
410 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 410 ms · metadata changed · 14 tool(s), 2 resource(s), 0 resource template(s), 3 prompt(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http unpkg-mcp https://mcp.unpkg.com/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add unpkg-mcp --url https://mcp.unpkg.com/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable unpkg-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "unpkg-mcp": {
      "url": "https://mcp.unpkg.com/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "unpkg-mcp": {
      "type": "streamableHttp",
      "url": "https://mcp.unpkg.com/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start unpkg-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "unpkg-mcp": {
      "type": "http",
      "url": "https://mcp.unpkg.com/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http unpkg-mcp https://mcp.unpkg.com/mcp

Claude Desktop

Open Claude Settings > Connectors > Add custom connector, enter this server URL and enable it for the conversation. This is a manual remote-connector handoff, not a desktop JSON configuration.
Claude Desktop configuration
https://mcp.unpkg.com/mcp

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "unpkg-mcp": {
      "serverUrl": "https://mcp.unpkg.com/mcp"
    }
  }
}

Let your agent find its tools

Find servers like UNPKG MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 9,322