Categories › Data & Databases › Files, spreadsheets, CSV & PDFs
Live npm and UNPKG data for AI agents: resolution, audits, import maps, malware/CVE checks.
Remote server: your requests and data go to mcp.unpkg.com. Claude Code: claude mcp add --transport http unpkg https://mcp.unpkg.com/mcp · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
resolve_package — Resolve a package name plus exact version, dist-tag, or semver range to the version that exists on npm today, with its browser entry points.list_files — List the real files inside an exact or resolvable package version via UNPKG ?meta. Use this before choosing a file path; never guess paths.build_file_url — Build a direct UNPKG file URL (the original file lookup) with a deliberate version policy, verifying the file exists when a path is given.audit_dependencies — Classify a project's runtime dependencies for conversion to direct UNPKG file lookups, in framework context when given. Read the project's pverify_url — Check that a UNPKG file URL actually resolves (follows redirects) before you put it in a project.generate_importmap — Resolve a set of bare specifiers to UNPKG file URLs and return a ready-to-paste import map. Entry files are resolved live from each package.check_importmap — Validate an existing or proposed import map: every UNPKG URL resolves, files exist, versions are mutually consistent (including react/react-search_packages — Search npm for a need (e.g. 'date picker', 'markdown parser') and annotate each result with browser readiness for direct UNPKG file lookup: estimate_migration_impact — Order-of-magnitude estimate of bandwidth offloaded (and hosting dollars, if a $/GB is given) when bytes move from first-party hosting to UNPshield_whoami — Return the Shield account, organization, and entitlements for the OAuth login on this connection. Requires an approved Shield account; anonyshield_simulate_request — Preview what Shield would do for one package@version request (optionally with referer/origin) under the logged-in user's effective pin/blockshield_check_packages — Check exact package@version pairs against Shield intel: malware verdict (with review state) and CVEs affecting that version, including the fshield_domain_packages — List the caller's verified domains with package counts, or the packages Shield has observed on one domain. With includeThreats, one domain'sshield_watchlist_status — Return the logged-in org's monitored packages, blocklist entries, and pin policies as Shield currently holds them. Requires Shield login.Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.