audit_dependencies

Classify a project's runtime dependencies for conversion to direct UNPKG file lookups, in framework context when given. Read the project's package.json yourself and pass its dependencies map; this tool checks each package against live npm/UNPKG data and returns convert_now / convert_carefully / keep_bundled / needs_review with suggested URLs and an import map for the safe conversions. IMPORTANT: suitability is not usage. Before calling, scan the project's HTML/files for an existing import map and CDN URLs and pass them as existingImports; entries already on UNPKG come back as already_on_unpkg, not conversion candidates. If you did not scan, say so — currentUsage will be absent rather than falsely 'not detected'. Only pass runtime dependencies, never devDependencies.

read-only

Argument	Type	Description
framework	string	The project's framework, if any. Framework-managed packages (react/react-dom in Next, vue in Nuxt, ...) are classified keep_bundled in context. Auto-detected from the dependency map when omitted.
dependencies*	object	Map of package name to the version spec from package.json, e.g. { "preact": "^10.25.4" }
existingImports	object	Existing imports found in the project: bare specifier to current URL, typically an import map extracted from HTML (include subpath keys like preact/hooks). Pass {} if you scanned and found none. Omit only if you did not scan; the result then reports current usage as unknown instead of not detected.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "dependencies"
  ],
  "properties": {
    "framework": {
      "enum": [
        "next",
        "nuxt",
        "sveltekit",
        "remix",
        "astro",
        "gatsby"
      ],
      "type": "string",
      "description": "The project's framework, if any. Framework-managed packages (react/react-dom in Next, vue in Nuxt, ...) are classified keep_bundled in context. Auto-detected from the dependency map when omitted."
    },
    "dependencies": {
      "type": "object",
      "description": "Map of package name to the version spec from package.json, e.g. { \"preact\": \"^10.25.4\" }",
      "additionalProperties": {
        "type": "string"
      }
    },
    "existingImports": {
      "type": "object",
      "description": "Existing imports found in the project: bare specifier to current URL, typically an import map extracted from HTML (include subpath keys like preact/hooks). Pass {} if you scanned and found none. Omit only if you did not scan; the result then reports current usage as unknown instead of not detected.",
      "additionalProperties": {
        "type": "string"
      }
    }
  },
  "additionalProperties": false
}

build_file_url

Build a direct UNPKG file URL (the original file lookup) with a deliberate version policy, verifying the file exists when a path is given.

read-only

Argument	Type	Description
file	string	File path inside the package. Defaults to the resolved entry point.
policy	string	preserve: keep the given spec (default). exact: resolved version. patch: major.minor (bug fixes flow). range: ^major.minor.patch.
package*	string
subpath	string	Package subpath import, e.g. hooks for preact/hooks. Resolved through the exports map, then file discovery. Ignored when file is given.
version	string	Exact version, dist-tag, or range to resolve. Defaults to latest.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "package"
  ],
  "properties": {
    "file": {
      "type": "string",
      "description": "File path inside the package. Defaults to the resolved entry point."
    },
    "policy": {
      "enum": [
        "preserve",
        "exact",
        "patch",
        "range"
      ],
      "type": "string",
      "description": "preserve: keep the given spec (default). exact: resolved version. patch: major.minor (bug fixes flow). range: ^major.minor.patch."
    },
    "package": {
      "type": "string"
    },
    "subpath": {
      "type": "string",
      "description": "Package subpath import, e.g. hooks for preact/hooks. Resolved through the exports map, then file discovery. Ignored when file is given."
    },
    "version": {
      "type": "string",
      "description": "Exact version, dist-tag, or range to resolve. Defaults to latest."
    }
  },
  "additionalProperties": false
}

check_importmap

Validate an existing or proposed import map: every UNPKG URL resolves, files exist, versions are mutually consistent (including react/react-dom pairing and duplicate-version skew), loose specs are flagged, and framework-managed packages are errors when a framework is given or detected. Run this after generate_importmap or an audit, before committing to a conversion.

read-only

Argument	Type	Description
imports*	object	The import map's imports object: bare specifier to URL.
framework	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "imports"
  ],
  "properties": {
    "imports": {
      "type": "object",
      "description": "The import map's imports object: bare specifier to URL.",
      "additionalProperties": {
        "type": "string"
      }
    },
    "framework": {
      "enum": [
        "next",
        "nuxt",
        "sveltekit",
        "remix",
        "astro",
        "gatsby"
      ],
      "type": "string"
    }
  },
  "additionalProperties": false
}

estimate_migration_impact

Order-of-magnitude estimate of bandwidth offloaded (and hosting dollars, if a $/GB is given) when bytes move from first-party hosting to UNPKG. Range-based with explicit assumptions and caveats; it cannot forecast latency or Core Web Vitals. Get unpkgBytesPerPageLoad from audit_dependencies' impact.convertNowEntryBytes plus any transitive files the caller chooses to include.

read-only

Argument	Type	Description
browserCacheRate	number	Share of loads served from browser cache. Default 0.5.
monthlyPageViews*	number
bandwidthCostPerGbUsd	number	Current hosting $/GB, if known. Omit to skip dollars.
unpkgBytesPerPageLoad*	number	Raw bytes per page load moving to UNPKG.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "monthlyPageViews",
    "unpkgBytesPerPageLoad"
  ],
  "properties": {
    "browserCacheRate": {
      "type": "number",
      "maximum": 0.95,
      "minimum": 0,
      "description": "Share of loads served from browser cache. Default 0.5."
    },
    "monthlyPageViews": {
      "type": "number",
      "exclusiveMinimum": 0
    },
    "bandwidthCostPerGbUsd": {
      "type": "number",
      "description": "Current hosting $/GB, if known. Omit to skip dollars.",
      "exclusiveMinimum": 0
    },
    "unpkgBytesPerPageLoad": {
      "type": "number",
      "description": "Raw bytes per page load moving to UNPKG.",
      "exclusiveMinimum": 0
    }
  },
  "additionalProperties": false
}

generate_importmap

Resolve a set of bare specifiers to UNPKG file URLs and return a ready-to-paste import map. Entry files are resolved live from each package.

read-only

Argument	Type	Description
entries*	array

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "entries"
  ],
  "properties": {
    "entries": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "specifier",
          "package"
        ],
        "properties": {
          "file": {
            "type": "string",
            "description": "Explicit file; defaults to the package entry point."
          },
          "package": {
            "type": "string"
          },
          "version": {
            "type": "string"
          },
          "specifier": {
            "type": "string",
            "description": "Bare specifier used in imports, e.g. preact or preact/hooks"
          }
        },
        "additionalProperties": false
      }
    }
  },
  "additionalProperties": false
}

list_files

List the real files inside an exact or resolvable package version via UNPKG ?meta. Use this before choosing a file path; never guess paths.

read-only

Argument	Type	Description
path	string	Directory prefix inside the package, e.g. /dist/. Defaults to /.
limit	integer	Max files to return. Defaults to 200.
package*	string
version	string	Defaults to latest; resolved before listing.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "package"
  ],
  "properties": {
    "path": {
      "type": "string",
      "description": "Directory prefix inside the package, e.g. /dist/. Defaults to /."
    },
    "limit": {
      "type": "integer",
      "maximum": 1000,
      "minimum": 1,
      "description": "Max files to return. Defaults to 200."
    },
    "package": {
      "type": "string"
    },
    "version": {
      "type": "string",
      "description": "Defaults to latest; resolved before listing."
    }
  },
  "additionalProperties": false
}

resolve_package

Resolve a package name plus exact version, dist-tag, or semver range to the version that exists on npm today, with its browser entry points. Use this instead of recalling versions from memory.

read-only

Argument	Type	Description
package*	string	npm package name, e.g. react or @scope/name
version	string	Exact version, dist-tag, or semver range. Defaults to latest.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "package"
  ],
  "properties": {
    "package": {
      "type": "string",
      "description": "npm package name, e.g. react or @scope/name"
    },
    "version": {
      "type": "string",
      "description": "Exact version, dist-tag, or semver range. Defaults to latest."
    }
  },
  "additionalProperties": false
}

search_packages

Search npm for a need (e.g. 'date picker', 'markdown parser') and annotate each result with browser readiness for direct UNPKG file lookup: browser-ready ESM, CommonJS-only, or unclear, with the entry file and size when known. Ranking is npm's relevance order; readiness is annotated, never hidden, so a CJS-only result is visible as such rather than silently dropped.

read-only

Argument	Type	Description
limit	integer	Results to annotate. Defaults to 5.
query*	string	What the package should do, e.g. 'confetti', 'sanitize html', 'date picker'.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "query"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "maximum": 10,
      "minimum": 1,
      "description": "Results to annotate. Defaults to 5."
    },
    "query": {
      "type": "string",
      "description": "What the package should do, e.g. 'confetti', 'sanitize html', 'date picker'."
    }
  },
  "additionalProperties": false
}

shield_check_packages

Check exact package@version pairs against Shield intel: malware verdict (with review state) and CVEs affecting that version, including the first patched version. Works anonymously for packages you name (25 per call); Shield login raises the cap to 200. Domain data still requires login. Missing pairs were not scanned yet — absence is not a clean verdict.

read-only

Argument	Type	Description
packages*	array

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "packages"
  ],
  "properties": {
    "packages": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "version"
        ],
        "properties": {
          "name": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "additionalProperties": false
      },
      "maxItems": 200,
      "minItems": 1
    }
  },
  "additionalProperties": false
}

shield_domain_packages

List the caller's verified domains with package counts, or the packages Shield has observed on one domain. With includeThreats, one domain's packages come back annotated with malware verdicts and CVEs, ranked by the domain's own traffic. Requires Shield login.

read-only

Argument	Type	Description
days	integer	Lookback window for threats mode. Default 30; 0 = all-time.
domain	string	One verified domain. Omit to list domains with package counts.
includeThreats	boolean	Annotate one domain's packages with verdicts and CVEs. Requires domain.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {
    "days": {
      "type": "integer",
      "maximum": 365,
      "minimum": 0,
      "description": "Lookback window for threats mode. Default 30; 0 = all-time."
    },
    "domain": {
      "type": "string",
      "description": "One verified domain. Omit to list domains with package counts."
    },
    "includeThreats": {
      "type": "boolean",
      "description": "Annotate one domain's packages with verdicts and CVEs. Requires domain."
    }
  },
  "additionalProperties": false
}

shield_simulate_request

Preview what Shield would do for one package@version request (optionally with referer/origin) under the logged-in user's effective pin/block rules, using the same rule-matching semantics as the edge.

read-only

Argument	Type	Description
path	string
origin	string
package*	string
referer	string
version*	string

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "package",
    "version"
  ],
  "properties": {
    "path": {
      "type": "string"
    },
    "origin": {
      "type": "string"
    },
    "package": {
      "type": "string"
    },
    "referer": {
      "type": "string"
    },
    "version": {
      "type": "string"
    }
  },
  "additionalProperties": false
}

shield_watchlist_status

Return the logged-in org's monitored packages, blocklist entries, and pin policies as Shield currently holds them. Requires Shield login.

read-only

No arguments.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {}
}

shield_whoami

Return the Shield account, organization, and entitlements for the OAuth login on this connection. Requires an approved Shield account; anonymous connections get an authorization_required error with reconnect instructions.

read-only

No arguments.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {}
}

verify_url

Check that a UNPKG file URL actually resolves (follows redirects) before you put it in a project.

read-only

Argument	Type	Description
url*	string	A full https://unpkg.com/... file URL.

Input schema (JSON)

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "format": "uri",
      "description": "A full https://unpkg.com/... file URL."
    }
  },
  "additionalProperties": false
}

UNPKG

Registry entry

Try it

audit_dependencies Read-only

UNPKG

Registry entry

Try it

audit_dependencies Read-only

Install

Tools (14)

Security checkA100/100