UNPKG

AI agents often recall npm details incorrectly — versions that don't exist, file paths that were never published, Node entry points offered as browser modules. UNPKG MCP gives agents live data instead: it resolves exact versions, tags, and ranges against the npm registry, lists the real files in a package, and builds canonical UNPKG file URLs (https://unpkg.com/<package>@<version>/<file>).

For projects, it audits a dependency list for no-build conversion: which packages can load directly from UNPKG, which need an import map, and which must stay bundled because a framework or bundler owns them. It generates and validates import maps and estimates migration impact as ranges with stated assumptions, never exact promises.

Every package can be checked for known malware and CVEs before adoption — anonymously, no account needed. Users with an approved UNPKG Shield account can optionally sign in to see packages observed on their own verified domains, with threat matches, watchlist status, and edge decision simulation, all scoped to their own organization.

Anonymous by default: no install, no API key. Optional Shield sign-in only unlocks the account tools.