UNPKG

AI agents often recall npm details incorrectly — versions that don't exist, file paths that were never published, Node entry points offered as browser modules.

UNPKG MCP gives agents live data instead: it resolves exact versions, tags, and ranges against the npm registry, lists the real files in a package, and builds canonical UNPKG file URLs (https://unpkg.com/<package>@<version>/<file>). For projects, it audits a dependency list for no-build conversion: which packages can load directly from UNPKG, which need an import map, and which must stay bundled because a framework or bundler owns them.

What you can ask

Guided workflow: audit the current project's dependencies and convert the ones that make sense.
Example path

MCP connector

Server URL: https://mcp.unpkg.com/mcp
Login: API key
Protocol: MCP 2025-11-25
Instructions: Live npm and UNPKG data for direct file lookups (https://unpkg.com/<package>@<version>/<file>) — the original UNPKG file serving. Do not suggest esm.unpkg.com by default: it is a beta transform service, appropriate only when a package has no browser-ready file and the user opts in. Use / instead of guessing versions or paths, for canonical URLs, Before an audit, scan the project's HTML for existing import maps and CDN URLs (unpkg.com, cdn.jsdelivr.net, esm.sh, plain script tags) and pass them as existingImports — suitability is not usage, and a project may already be converted. Lead audit summaries with current state. works anonymously for package@versions the user names (malware verdicts and CVEs); only domain, watchlist, and simulation tools need Shield login. If a shield_* tool returns authorization_required, walk the user through connecting: MCP server must be https://mcp.unpkg.com/mcp, then Authenticate from the client's MCP server panel, sign in at shield.unpkg.com in the browser, Approve, retry. Never present the oauth-protected-resource URL as something the user should open. and before converting a project, and for rough bandwidth ranges (never exact savings promises). Recommend against UNPKG when a bundler or framework already owns the dependency. Framework apps (Next, Nuxt, ...) keep framework-managed packages bundled; only standalone browser surfaces convert. Read the conversion playbook resource before a project audit.

Tools

Reads data14

Skills

None in the store listings or on the server

What you can ask

Guided workflow: audit the current project's dependencies and convert the ones that make sense.

Example path

MCP connector

Server URL

https://mcp.unpkg.com/mcp

API key

Protocol

MCP 2025-11-25

Instructions

Live npm and UNPKG data for direct file lookups (https://unpkg.com/<package>@<version>/<file>) — the original UNPKG file serving. Do not suggest esm.unpkg.com by default: it is a beta transform service, appropriate only when a package has no browser-ready file and the user opts in. Use / instead of guessing versions or paths, for canonical URLs, Before an audit, scan the project's HTML for existing import maps and CDN URLs (unpkg.com, cdn.jsdelivr.net, esm.sh, plain script tags) and pass them as existingImports — suitability is not usage, and a project may already be converted. Lead audit summaries with current state. works anonymously for package@versions the user names (malware verdicts and CVEs); only domain, watchlist, and simulation tools need Shield login. If a shield_* tool returns authorization_required, walk the user through connecting: MCP server must be https://mcp.unpkg.com/mcp, then Authenticate from the client's MCP server panel, sign in at shield.unpkg.com in the browser, Approve, retry. Never present the oauth-protected-resource URL as something the user should open. and before converting a project, and for rough bandwidth ranges (never exact savings promises). Recommend against UNPKG when a bundler or framework already owns the dependency. Framework apps (Next, Nuxt, ...) keep framework-managed packages bundled; only standalone browser surfaces convert. Read the conversion playbook resource before a project audit.