ENFR
List your agent

UNPKG

MCP server · hosted · v1.0.0 · io.github.unpkg/unpkg-mcp
Online · tested 2h agoNEW · 3h agoSeen in the registry 2h ago

Live npm and UNPKG data for AI agents: resolution, audits, import maps, malware/CVE checks.

Website ↗Source code ↗How to connect ↓

What it does

UNPKG is an MCP server, a connector that lets an AI assistant use it as a tool. It is hosted: an assistant connects to it over the internet, nothing to install.

From the publisher's description, Electra Index matched it to one capability: security scanning. That makes it a candidate for tasks such as review pull requests or scan code for vulnerabilities.

Facts come from the Official MCP Registry, as declared by the publisher. Capabilities are matched automatically (low confidence). None of this is a test of the tool.

At a glance

Hosted (remote)YES
Local installNO
Version1.0.0
PriceNot in the registry
First seen07 Nov 2026
Last checked2h ago

How to connect

As declared in the Official MCP Registry · hosted endpoint tested by Electra Index 2h ago (live check)

Hosted endpoint

  • https://mcp.unpkg.com/mcp streamable-http

In Claude Code: claude mcp add --transport http unpkg https://mcp.unpkg.com/mcp

MCP settings (Claude Desktop, Cursor and other MCP clients)

{
  "mcpServers": {
    "unpkg": {
      "url": "https://mcp.unpkg.com/mcp"
    }
  }
}

Live check

Electra Index connected to the hosted endpoint 2h ago

ONLINE UNPKG answered an MCP connection on 07 Nov 2026 and introduced itself as unpkg-mcp 1.0.0 (MCP protocol 2025-06-18).

14 tools offered to AI assistants

  • resolve_package · Resolve a package name plus exact version, dist-tag, or semver range to the version that exists on npm today, with its browser entry points. Use this instead of recalling versions from memory.
  • list_files · List the real files inside an exact or resolvable package version via UNPKG ?meta. Use this before choosing a file path; never guess paths.
  • build_file_url · Build a direct UNPKG file URL (the original file lookup) with a deliberate version policy, verifying the file exists when a path is given.
  • audit_dependencies · Classify a project's runtime dependencies for conversion to direct UNPKG file lookups, in framework context when given. Read the project's package.json yourself and pass its dependencies map; this tool checks each package against live npm/U
  • verify_url · Check that a UNPKG file URL actually resolves (follows redirects) before you put it in a project.
  • generate_importmap · Resolve a set of bare specifiers to UNPKG file URLs and return a ready-to-paste import map. Entry files are resolved live from each package.
  • check_importmap · Validate an existing or proposed import map: every UNPKG URL resolves, files exist, versions are mutually consistent (including react/react-dom pairing and duplicate-version skew), loose specs are flagged, and framework-managed packages are
  • search_packages · Search npm for a need (e.g. 'date picker', 'markdown parser') and annotate each result with browser readiness for direct UNPKG file lookup: browser-ready ESM, CommonJS-only, or unclear, with the entry file and size when known. Ranking is np
  • estimate_migration_impact · Order-of-magnitude estimate of bandwidth offloaded (and hosting dollars, if a $/GB is given) when bytes move from first-party hosting to UNPKG. Range-based with explicit assumptions and caveats; it cannot forecast latency or Core Web Vitals
  • shield_whoami · Return the Shield account, organization, and entitlements for the OAuth login on this connection. Requires an approved Shield account; anonymous connections get an authorization_required error with reconnect instructions.
  • shield_simulate_request · Preview what Shield would do for one package@version request (optionally with referer/origin) under the logged-in user's effective pin/block rules, using the same rule-matching semantics as the edge.
  • shield_check_packages · Check exact package@version pairs against Shield intel: malware verdict (with review state) and CVEs affecting that version, including the first patched version. Works anonymously for packages you name (25 per call); Shield login raises the
Show 2 more
  • shield_domain_packages · List the caller's verified domains with package counts, or the packages Shield has observed on one domain. With includeThreats, one domain's packages come back annotated with malware verdicts and CVEs, ranked by the domain's own traffic. Re
  • shield_watchlist_status · Return the logged-in org's monitored packages, blocklist entries, and pin policies as Shield currently holds them. Requires Shield login.

What "online" means: the server answered an MCP connection at the time of the check. It is not a guarantee of security, quality or continuous uptime. How we test: we open an MCP session and ask for the tool list, as an AI assistant would. We never run a tool and never send a key. Checked every few days. Method

Is this your server? Monitoring Pro: a check every 30 minutes and an email within the hour when it stops answering. Launch offer: $39.99 once, for life.

Tasks it helps with

Share of each task's required capabilities it covers
Review pull requests
Security Scanning
50%
Scan code for vulnerabilities
Security Scanning
50%

Similar tools

Listed for the same task: review pull requests
  • diffpilotREMOTELOCAL
    MCP server for PR code review, commit messages, changelogs, and secret detection
  • MCP Code Review ServerREMOTELOCAL
    Code review as an MCP server — structured reviews with OWASP security scanning
  • StrixREMOTELOCAL
    AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets
  • ELYREON Workflow RescueREMOTELOCAL
    Offline static analysis of n8n workflow exports: dead ends, cycles, missing triggers, secrets
  • DraugrREMOTELOCAL
    Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk
  • BlackDome Threat IntelREMOTELOCAL
    Honeypot threat intel: IOCs, sample comparisons, evidence clusters and ThreatDrop case status

Ready-made AI agents

An MCP server is a connector you add to your own assistant. These are finished products that do the same job for you:
All AI agents to review pull requests, ranked →

Facts & evidence

Each fact shows where it was seen and when.
FactValueEvidenceSourceLast confirmed
Hosted endpointhttps://mcp.unpkg.com/mcpDECLAREDSRC-001 Official MCP Registry2h ago
Local install (package)noDECLAREDSRC-001 Official MCP Registry2h ago
Remote access (hosted)yesDECLAREDSRC-001 Official MCP Registry2h ago
Websitehttps://mcp.unpkg.comDECLAREDSRC-001 Official MCP Registry2h ago
Repositoryhttps://github.com/unpkg/unpkg-mcpDECLAREDSRC-001 Official MCP Registry2h ago
Registry statusactiveDECLAREDSRC-001 Official MCP Registry2h ago
Version1.0.0DECLAREDSRC-001 Official MCP Registry2h ago
MCP serveryesDECLAREDSRC-001 Official MCP Registry2h ago

Change history

  • NEW07 Nov 2026
    first seen in the index

Is this page accurate?

Flag it and our robot re-checks the official source. Reports never change a score.

Do you run UNPKG? Know when it stops answering

For publishers · optional

Its hosted endpoint can be monitored. Monitoring Pro connects every 30 minutes like an AI assistant, emails you within the hour when it stops answering, keeps a 90-day availability history and adds your answer rate to your badge.

Monitor UNPKGLaunch offer $39.99 once, for life instead of $9.99/month · All plans

Monitoring never changes a score or a rank.

Are you the publisher of UNPKG?

Free · show your listing

An independent listing builds trust with your buyers. Announce it, and add the badge to your website or README.

Announce it on LinkedInListed on Electra Index
<a href="https://electraindex.com/mcp/unpkg?utm_source=badge&utm_medium=share&utm_campaign=listing"><img src="https://electraindex.com/api/badge/unpkg" alt="Listed on Electra Index"></a>

Questions about UNPKG

How do I connect UNPKG?

Use the hosted endpoint https://mcp.unpkg.com/mcp in your assistant's MCP settings. The exact settings are in "How to connect" above, as declared in the Official MCP Registry.

What tools does UNPKG offer?

When Electra Index connected on 07 Nov 2026, it listed 14 tools: resolve_package, list_files, build_file_url, audit_dependencies, verify_url, generate_importmap, check_importmap, search_packages and more. The full list is in "Live check" above.

Is UNPKG online?

Yes. Its hosted endpoint answered an MCP connection from Electra Index 2h ago.

What can I use UNPKG for?

Based on its description, it is most relevant to: review pull requests, scan code for vulnerabilities.