unpkg MCP (remote)

90/100
Last tested 2026-11-06 (Fresh: tested within 30 days) Working (tool call tested 2026-11-06) No key needed for the tools we called

Advisories: not checked (remote-only)

Security review: not tested

Score = points from our five tests (install, handshake, maintenance, docs, license). Not a quality or security rating. Methodology

  • Install20/20
  • Handshake30/30
  • Maintenance25/25
  • Docs15/15
  • License0/10

Vendor-hosted
UNPKG's hosted endpoint https://mcp.unpkg.com/mcp (server unpkg-mcp 0.6.2) completed initialize and tools/list with no sign-in and listed 14 tools. Responses include an optional WWW-Authenticate for Shield OAuth, but anonymous calls succeed. Real calls (no LLM, no credentials): resolve_package resolved lodash, search_packages returned npm hits for 'react', and verify_url confirmed an unpkg.com URL. The five shield_* tools need optional Shield OAuth and were not called. Server source is not public, so license scores 0.
Tool-call test (2026-11-06, direct MCP stdio client, no LLM): pass. 3 of 3 anonymous read-only calls passed. Shield OAuth tools not called. Evidence: live endpoint probe, Nov 6, 2026.
UNPKG-hosted endpoint. Nine general tools work with no account; five shield_* tools need optional Shield OAuth. The server source isn't public, so license scores 0. Listed as a hosted remote (Our review, Nov 5, 2026).
Sources: https://mcp.unpkg.com · https://unpkg.com/llms.txt · https://mcp.unpkg.com/.well-known/mcp.json · https://x.com/unpkg/status/2118159852698792106

Transport (tested 2026-11-06): Streamable HTTP

Token cost (estimate): approx. 2281 tokens, cl100k estimate (14 tools, measured 2026-11-11). This is an estimate from our testing of the tool names, descriptions and input schemas, counted with cl100k_base.

Permissions: 14 read, 0 write (state-changing), 0 unclassified · Auth: none · Rate limit: unknown · Pricing unit: unknown

Auth: none. Rate limit: unknown. Pricing unit: unknown.

  • audit_dependencies — read
  • build_file_url — read
  • check_importmap — read
  • estimate_migration_impact — read
  • generate_importmap — read
  • list_files — read
  • resolve_package — read
  • search_packages — read
  • shield_check_packages — read
  • shield_domain_packages — read
  • shield_simulate_request — read
  • shield_watchlist_status — read
  • shield_whoami — read
  • verify_url — read

remote handshake listed tools without credentials; no recorded key or OAuth

Score 90/100 · Tools 14 · Token cost approx. 2,281 tokens · Compare · Last tested 2026-11-06 · Server version 0.6.2 · Remote endpoint https://mcp.unpkg.com/mcp (streamable-http)

Summary: unpkg MCP (remote) completed an MCP handshake without credentials and exposed 14 tools.

Evidence summary

Handshake
pass
Tools listed
14
Context cost
approx. 2281 tokens, cl100k estimate (14 tools, measured 2026-11-11; an estimate) ranking · add up your servers' context cost
Login
No key needed for the tools we called
Tested
2026-11-06

Test results

TestResultPointsEvidence
installpass20Endpoint https://mcp.unpkg.com/mcp reachable over streamable-http (HTTP 200) in 0.3s; no install step for remote servers.
handshakepass30MCP initialize (protocol 2025-06-18, server unpkg-mcp 0.6.2) + tools/list over streamable-http succeeded with no credentials; 14 tools listed in 0.3s. Tool calls may still need a key.
maintenancepass25Vendor-hosted rule: scored from dated vendor X post announcing the MCP server 2026-11-05 (https://x.com/unpkg/status/2118159852698792106), 1 day before test. Registry: not in the official MCP registry
docspass15official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs (https://mcp.unpkg.com, https://unpkg.com/llms.txt, https://mcp.unpkg.com/.well-known/mcp.json).
licensefail0Vendor-hosted service with no public repo: no license to cite, so 0 (rule: no points without a cited source).

Local-model readiness

Token cost (estimate): approx. 2281 tokens, cl100k estimate for 14 tools · about 28% of an 8k context. This is an estimate from our testing (counted with cl100k_base).

Small-model friendly (schema heuristic, not a model result): unknown.

Not tested

Small-model task runs: Not yet tested.

What we tested and what we didn't

Tested on 2026-11-06

  • We connected to the vendor's hosted endpoint with no credentials and asked for its tool list: it listed 14 tools (Method details: MCP initialize then tools/list)
  • Auth response: none. The endpoint answered without any login
  • Vendor docs: official MCP docs page; states the endpoint URL; client setup instructions (15/15)
  • Maintenance: dated vendor source, dated vendor X post announcing the MCP server 2026-11-05 (25/25)
  • License: a hosted service has no license to cite (0/10)
  • Token cost (estimate)

Not tested

  • Security: not audited (hosted service; no code to review, no permission or data-flow analysis)
  • Behaviour after signing in, or with a real account
  • Source code, repository activity or an open-source license (none published for the hosted service)
  • Performance, rate limits or load
  • Real tasks (no functional task runs yet)

Methodology: how we test (vendor-hosted rule). A high score means it responds and its vendor documents and dates it, not that giving it access to your data carries no risk.

Known security issues

Not checked (remote-only): hosted endpoint, version unknown.

Monthly roundup: MCP security issues, October 2026.

Tool list changes

Unchanged since the previous snapshot (latest 2026-11-11).

Snapshot hash (fingerprint of the tool list)

d9b023a47ccf: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed.

Feeds: RSS · JSON.

Raw test record (JSON)
{
  "name": "unpkg-remote",
  "version": null,
  "registry": "remote",
  "status": "working",
  "tested": "2026-11-06",
  "tools_count": 14,
  "deprecated": false,
  "archived": null,
  "tests": {
    "install": [
      "pass",
      20,
      "Endpoint https://mcp.unpkg.com/mcp reachable over streamable-http (HTTP 200) in 0.3s; no install step for remote servers."
    ],
    "handshake": [
      "pass",
      30,
      "MCP `initialize` (protocol 2025-06-18, server unpkg-mcp 0.6.2) + `tools/list` over streamable-http succeeded with no credentials; 14 tools listed in 0.3s. Tool calls may still need a key."
    ],
    "maintenance": [
      "pass",
      25,
      "Vendor-hosted rule: scored from dated vendor X post announcing the MCP server 2026-11-05 (https://x.com/unpkg/status/2118159852698792106), 1 day before test. Registry: not in the official MCP registry"
    ],
    "docs": [
      "pass",
      15,
      "official MCP docs page; states the endpoint URL; client setup instructions. Vendor-hosted rule: scored from the vendor's official MCP docs (https://mcp.unpkg.com, https://unpkg.com/llms.txt, https://mcp.unpkg.com/.well-known/mcp.json)."
    ],
    "license": [
      "fail",
      0,
      "Vendor-hosted service with no public repo: no license to cite, so 0 (rule: no points without a cited source)."
    ]
  }
}

Install

https://mcp.unpkg.com/mcp

Tools listed

audit_dependencies, build_file_url, check_importmap, estimate_migration_impact, generate_importmap, list_files, resolve_package, search_packages, shield_check_packages, shield_domain_packages, shield_simulate_request, shield_watchlist_status, shield_whoami, verify_url

Tool history: captured Nov 11, 2026. All tool history.

Quick config

{
  "mcpServers": {
    "unpkg-mcp-remote": {
      "type": "http",
      "url": "https://mcp.unpkg.com/mcp"
    }
  }
}

Add to config Opens the config generator with this server selected.

Setup

  1. Install. No install step: it is a remote server at https://mcp.unpkg.com/mcp.
  2. Configure. Add the mcpServers entry below to your MCP client config.
  3. Verify. Restart the client and check that tools/list returns tools (14 in our test).
{
  "mcpServers": {
    "unpkg-mcp-remote": {
      "type": "http",
      "url": "https://mcp.unpkg.com/mcp"
    }
  }
}

Test history

Follow this server (RSS) · Monthly changelog

FAQ

Is unpkg MCP deprecated?

No. unpkg-remote was not deprecated or archived when we last tested it on 2026-11-06.

What replaces unpkg MCP?

Nothing; unpkg MCP (remote) is not deprecated as of 2026-11-06.

Does unpkg MCP need an API key?

No. It completed an MCP handshake with no credentials and listed 14 tools.

Embed the badge

TestedMCP: 90/100, tested 2026-11-06

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Claim this listing · Report an issue