Live npm and UNPKG data for direct file lookups —
https://unpkg.com/<package>@<version>/<file> — so agents resolve
real versions and files instead of guessing from memory, audit projects for conversion,
and validate import maps before they land.
Pick your client. The general tools need no account and no login.
Two tiers, same server. Anonymous is the default and never requires an account. Shield login is optional and only adds your own account's data.
shield_* toolsLogin is OAuth, run by your MCP client — there is no token to copy and paste. Your account must be email-verified and approved from the Shield beta waitlist.
https://mcp.unpkg.com/mcp (see Connect above). Logins cannot complete against a localhost server, because tokens are issued for the production address.shield.unpkg.com. Sign in and review the consent screen — client name, scopes in plain language, redirect host — then Approve.shield_whoami to confirm. To disconnect later, use the logout for this server shown above; revoking there ends the grant.Discovery for client software: protected-resource metadata · server card · health
Paste these into your agent once connected. Start with your project; add Shield login only when you want your own domains in the picture.
“Check my current project and audit what makes sense to convert to UNPKG.”
Classifies every runtime dependency, separates what already loads from UNPKG from candidates, and refuses framework-managed packages.
“Convert this page to load its imports from UNPKG and prove it runs.”
Generates and validates the import map, then verifies execution — not just HTTP 200s.
“Find me a small date-picker package that actually works as a browser import.”
Search results annotated with browser readiness, with CJS-only results rejected openly.
“If I move these packages to UNPKG, roughly what bandwidth do I offload at my traffic level?”
A range with stated assumptions. It will not invent a latency or dollar figure.
“Is lodash@4.17.20 safe to load? Check it for malware and CVEs, and tell me what to upgrade to.”
Exact-version verdict with review state, affecting CVEs, and the first patched version. Provisional verdicts are labelled, never overstated.
“Check the packages in this audit for known compromises or CVEs before we convert anything.”
Audits are enriched with Shield intel for the resolved versions, so a flagged package changes the recommendation before it ships.
“Connect to my Shield account and tell me what Shield would do for react@18.3.1 on my domains.”
Simulates the edge pin/block decision under your rules before you ship anything.
“Show my verified domains and tell me which packages on them have CVEs or malware verdicts, worst first.”
Your domain inventory annotated server-side: exact-version verdicts and CVEs ranked by your own traffic, so a clean result never comes from the wrong version.
“Show my Shield watchlist, pins, and blocks.”
Your monitored packages and edge policies as Shield currently holds them.
| Tool | Access | Purpose |
|---|---|---|
| resolve_package | Anonymous | Resolve exact, tag, or range specs to a real version with browser entry points |
| search_packages | Anonymous | Search npm for a need, annotated with browser readiness |
| list_files | Anonymous | Real file listing for a package version — never guess paths |
| build_file_url | Anonymous | Canonical UNPKG file URL with a deliberate version policy |
| audit_dependencies | Anonymous | Classify a project's dependencies, separating what already loads from UNPKG from what could convert |
| verify_url | Anonymous | Confirm a UNPKG URL resolves before it lands in a project |
| generate_importmap | Anonymous | Ready-to-paste import map from bare specifiers, subpaths resolved |
| check_importmap | Anonymous | Validate a whole import map: resolution, peers, version skew, CJS entries |
| estimate_migration_impact | Anonymous | Range-based bandwidth estimate with explicit assumptions — never a single savings figure |
| shield_whoami | Shield login | Your Shield account, organization, and entitlements |
| shield_simulate_request | Shield login | Preview Shield's pin/block decision for one package@version under your rules |
| shield_check_packages | Anonymous | Malware verdicts and CVEs for exact package versions you name (login raises the per-call cap) |
| shield_domain_packages | Shield login | Packages observed on your verified domains, optionally annotated with malware verdicts and CVEs |
| shield_watchlist_status | Shield login | Your monitored packages, blocklist, and pin policies |
Plus three guided prompts (audit_project_for_unpkg, convert_this_page,
find_browser_package) and the conversion playbook resource.
