Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Gramps Evidence ianderso/gramps-evidence-mcp Read/write a self-hosted Gramps Web family tree where every fact carries a citation. | |
| NARA Catalog ianderso/nara-catalog-mcp Genealogical research in the US National Archives Catalog: records, transcriptions, page images. | |
| SNAC Archives ianderso/snac-archives-mcp Find which archive holds the papers: SNAC's index of archival collections, plus ArchiveGrid links. | |
| US Places, Then ianderso/us-places-mcp US places then: county on a date, PLSS land, GNIS names, old topo maps, post offices. | |
| TACO Brasil ianhudsonai/taco-br-mcp Tabela Brasileira de Composição de Alimentos (TACO): 597 foods, nutrients and household measures | |
| SEO Skill iannuttall/seo Free Google Search Console MCP: your real GSC, Google Analytics and keyword data for AI agents. | |
| io.github.iarfhlaith/gaff-check iarfhlaith/gaff-check Irish property due diligence: planning, prices, flood, radon, zoning, BER and crime context. | |
| MemAuthority iasi777/memauthority Git-backed long-term memory authority for AI agents via MCP. | |
| io.github.ibeal/tidal-mcp ibeal/tidal-mcp MCP server for TIDAL - search tracks, manage playlists, and get personalized recommendations | |
| iBlueText ibluetext/ibluetext-mcp Send iMessage, SMS and WhatsApp from your business number, run text campaigns and read replies. | |
| Hadith Checker [Dorar.net] ibnsaleem29/dorar-hadith-mcp Research Hadith, authenticity, grading, Takhrij and Sharh [commentaries] in Claude Desktop for free. | |
| SEO Console ibrahimhajjaj/seo-console-mcp Search Console, Google Ads, App Store, Google Play, WordPress.org and Core Web Vitals over MCP | |
| io.github.IbrahimKhaled19/backgen ibrahimkhaled19/backgen Generate Express.js backend projects with ORMs, auth, payments, and DevOps | |
| Disney Lorcana TCG Collection icarobichir/lorcana-mcp MCP server for Disney Lorcana TCG: enrich collections, search cards, build decks, audit data. | |
| io.github.icedq-tools/mcp-server icedq-tools/mcp-server MCP Server for iceDQ Data Reliability Platform | |
| Icemoon — control a real iPhone with AI icemoon-dev/icemoon-mcp Control real, physical iPhones with AI: screen reading, human-like touch, no jailbreak. | |
| io.github.IceyWu/icloud-calendar iceywu/icloud-calendar-mcp Manage Apple iCloud Calendar through a reliable CalDAV MCP server. | |
| abb-rws-mcp ichbinmeraj/abb-rws-mcp Read-only MCP server for ABB robot controllers, through abb-rws-daemon on 127.0.0.1. | |
| org.onekash/icloud-calendar-mcp icloud-calendar-mcp/icloud-calendar-mcp MCP server for iCloud (Apple) Calendar access via CalDAV | |
| io.github.icohangar-ops/agent-conductor icohangar-ops/agent-conductor AGENTS.md + skills MCP with CHP R0 gate and adversary decision tools. | |
| io.github.icohangar-ops/battery-erp icohangar-ops/battery-erp Battery value-chain inventory MCP: lookup SKUs, status/reorder, bin-check, audited confirmation. | |
| io.github.icohangar-ops/chp-mcp icohangar-ops/cubiczan-chp-mcp Spend approval gate for AI agents: budget caps, HITL thresholds, signed audit hash. | |
| io.github.icohangar-ops/governed-mcp-gateway icohangar-ops/governed-mcp-gateway HTTP MCP gateway: principal on tools/call + SSE, allowlists, vault rotate, CHP gates. | |
| Warden MCP Server icoretech/warden-mcp MCP server for Vaultwarden/Bitwarden vault management. Enables AI agents to securely create, search, read, and update vault items via the official Bitwarden CLI, with safe-by-default redaction and support for both stdio and SSE transports. | |
| APSA mobile app security audit ictechgy/apsa Local, evidence-graded Android/iOS security audits of source, APK, AAB and IPA for AI agents. | |
| io.github.ictinnovations/ictcontact-mcp ictinnovations/ictcontact-mcp Monitor ICTContact / ICTDialer outbound campaigns, and start and stop them when writes are on. | |
| io.github.ictinnovations/ictdialer-mcp ictinnovations/ictdialer-mcp Monitor ICTDialer outbound auto-dialer campaigns, and start and stop them when writes are on. | |
| OpenGrok MCP Server icyhot09/opengrok-mcp-server MCP server bridging OpenGrok search engine with AI for instant context across massive codebases. | |
| Algora MCP Server idapixl/algora-mcp-server An MCP server that gives AI agents direct access to Algora's open-source bounty platform. Use it to discover, search, and analyze open bounties. | |
| Web Research MCP idapixl/idapixl-web-research-mcp Enables AI agents to search the web, fetch pages, and synthesize research through three tools: web_search, fetch_page, and research_topic, all in a single pay-per-use API call. | |
| idealo MCP Server idealo/mcp-server-guide Search products, compare prices and discover deals across 6 European markets with your AI assistant. | |
| UISandbox ideelab/uisandbox Play with your app's design in the browser: load a build, turn the knobs, export the code. | |
| Identik Firma Digital identik-me/identik-mcp Firma digital argentina: preparar y enviar documentos, seguir firmas y descargar PDF y constancia. | |
| Glyphloop ideoshi/glyphloop Create loop-perfect ASCII animations and website-ready embeds with an AI agent. | |
| Idescat MCP Server idescat/mcp Query official statistics of Catalonia (Idescat): tables, metadata and JSON-stat data via MCP. | |
| io.github.Idle-Sync/db-conn-mcp idle-sync/db-conn-mcp A dead-simple, self-hosted MCP server for securely querying databases via AI agents. | |
| WhatsApp Connect idle-sync/whatsapp-connect-mcp Read, search, and send personal WhatsApp messages from any MCP client, behind a send-confirm gate. | |
| io.github.IDNSIDNS/tenderapi-mcp idnsidns/tenderapi-mcp MCP server for French (BOAMP) + EU (TED) public procurement data via TenderAPI. | |
| io.github.IdoAzaCalls/cron-explainer idoazacalls/cron-explainer Cron expression parser: explains any cron + returns next N fire times. Timezone-aware. | |
| App Store Connect MCP idoo/app-store-connect-mcp MCP server for App Store Connect: releases, TestFlight, reviews, reports. Read-only by default. | |
| Connect IQ MCP idoo/connect-iq-mcp MCP server for Garmin Connect IQ developers: store portal, SDK builds, simulator. Read-only default. | |
| InfluxDB MCP Server idoru/influxdb-mcp-server A Model Context Protocol server that provides Claude with access to InfluxDB time-series database instances, enabling data writing, querying, and management of organizations and buckets through natural language. | |
| iDos Games SDK idos-games/idosgames-mcp Game modules, project scaffold and SDK skills for building web games on iDos Games. | |
| GitMCP idosal/git-mcp A free, open-source service that transforms GitHub projects into MCP endpoints, enabling AI assistants to access and understand project documentation without any setup. | |
| Doti Protocol (.i) MCP Server idotmy/doti-mcp-skill Sovereign .i Web3 identity and multi-chain domain tools across four EVM networks. | |
| IFORM Web3 Forms MCP Server idotmy/iform-mcp-skill Create, deploy, and manage decentralized Web3 forms on EVM chains via MCP. | |
| io.github.ie3jp/illustrator-mcp-server ie3jp/illustrator-mcp-server Adobe Illustrator MCP with 66 tools — more than the official Illustrator MCP. macOS | Windows. | |
| DiscoMCP ieranama/discomcp Teach any AI agent how you use an MCP server – Soft-Landing to your AI integrations | |
| Shortlist Price Index ies86/shortlist-mcp Software prices for AI agents: hosting, SEO, backup, antivirus, email and more. True 3-year cost | |
| Sorqen ifan6oy/sorqen-mcp Sportsbook-derived no-vig fair value with confidence, provenance, and history over REST/MCP. |
9,101–9,150 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.