Terms of Service — UNPKG MCP

Last updated: November 7, 2026

These terms cover the UNPKG MCP server at https://mcp.unpkg.com, operated by UNPKG ("we", "us"). By connecting a client to the server, you agree to them.

The service

The UNPKG MCP server provides AI agents with live npm and UNPKG data: package version and file resolution, project dependency audits, import-map generation and validation, migration estimates, and malware/CVE checks for exact package versions. Most tools are available anonymously, free of charge. Optional tools require signing in with an UNPKG Shield account approved from the beta waitlist.

Package data comes from the npm registry, UNPKG, and third-party malware and vulnerability feeds. We work to keep it accurate and current, but package metadata, verdicts, and estimates are provided for information only. Estimates are ranges based on stated assumptions, not guarantees of bandwidth, cost, or performance outcomes.

Acceptable use

• Do not use the service to disrupt, overload, or probe it beyond ordinary client use, or to attempt to access another organization's Shield data.
• Do not misrepresent automated output from the service as independently verified fact where accuracy matters (for example, security or legal decisions) without checking the underlying sources.
• Automated use through MCP clients and agents is expected and welcome; we may apply reasonable rate limits to keep the service available to everyone.

Shield accounts

Shield features are scoped to your own organization. You are responsible for activity under your account and for revoking OAuth grants (from your MCP client or Shield account) when they are no longer needed.

Availability and changes

The service is provided "as is" and "as available", without warranties of any kind. We may change, suspend, or discontinue features, and may update these terms; material changes will be noted by the date above. Continued use after a change takes effect constitutes acceptance.

Liability

To the maximum extent permitted by law, UNPKG is not liable for indirect, incidental, or consequential damages arising from use of the service or reliance on its output.

Contact

UNPKG — support@unpkg.com