Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Statement Normalizer jfortier93/statement-normalizer-mcp Deterministic bank-statement parsing: messy CSV/OFX to clean categorized rows. In-memory only. | |
| Verified Numbers jfortier93/verified-numbers-mcp Current source-cited 2026 US tax constants and calculators for AI agents; every answer cites IRS. | |
| Verified Wages jfortier93/verified-wages-mcp Current source-cited US minimum wage, tipped wage, and FLSA constants for AI agents; cites DOL. | |
| JFrog Remote MCP Server jfrog/jfrog-mcp-server MCP Server for JFrog, providing tools for development and artifact management. | |
| io.github.jgador/websharp jgador/websharp Search the web and extract article text for LLMs. | |
| io.github.jgalea/mailbox-mcp jgalea/mailbox-mcp Multi-account email MCP server for Gmail, IMAP, and JMAP: search, send, drafts, labels. | |
| io.github.jgalea/telegram-mcp jgalea/telegram-mcp Telegram MCP server: read, send, and search messages and manage chats via your account. | |
| io.github.jghiringhelli/codeseeker jghiringhelli/codeseeker Graph-powered code intelligence with semantic search and knowledge graph for AI assistants | |
| ForgeCraft jghiringhelli/forgecraft-mcp Production engineering standards for AI coding assistants. Setup once, remove when done. | |
| SmartCut jgmedialtd/smartcut-api Cutlist optimization for sheet, linear and roll stock, with grain, kerf, nesting and saw exports. | |
| James's MCP Server jgpas/mcp-first-server MCP server with quote and live cryptocurrency price tools, local and cloud-deployed transports. | |
| draw.io jgraph/drawio-mcp Create draw.io diagrams in chat from Mermaid or XML, shown live and interactive. 10,000+ shapes. | |
| jCodeMunch MCP jgravelle/jcodemunch-mcp Gives AI agents the function they asked for, not the file. Commercial use needs a license. | |
| jDataMunch MCP jgravelle/jdatamunch-mcp Tabular data retrieval. Index CSV/Excel, query rows, aggregate. 99%+ savings vs raw file reads. | |
| jDocmunch MCP jgravelle/jdocmunch-mcp Section-level doc search for .md, .rst, .adoc, .ipynb, .html, .yaml, .json, and OpenAPI specs. | |
| io.github.jgravelle/jmunch-mcp jgravelle/jmunch-mcp Transparent MCP proxy. Turns fat tool responses into queryable handles: 88-99% fewer tokens. | |
| jgs-magic-sysmlv1-mcp jgsystemsconsulting/jgs-magic-sysmlv1-mcp MCP bridge to live SysML v1 models in CATIA Magic / Cameo Systems Modeler (No Magic MSoSA). Lets Claude Code or any MCP agent query, audit, and edit MBSE models — blocks, requirements, diagrams, parametrics, traceability — over a local, air | |
| Copilot Studio MCP jgt87/copilot-studio-mcp Build, test, ship and maintain Microsoft Copilot Studio agents from the editor | |
| io.github.Jhackman2019/codebase-context-mcp jhackman2019/codebase-context-mcp Codebase indexing and search via WASM tree-sitter. Works on ARM64 and x86_64. | |
| S-Bike Training Hub jharp199345/s-bike-training-hub Local training hub for cycling, running, swimming and lifting, with AI-led setup and planning. | |
| Page Monitor jhfg31410-ai/page-monitor-mcp-server Deterministic web page change monitoring with SHA-256 evidence; free diff, paid scheduled watch. | |
| Overseerr MCP Server jhomen368/overseerr-mcp Enables AI assistants to interact with Overseerr for automated media discovery, requests, and management in your Plex ecosystem, including searching for movies/TV shows, requesting media, checking request status, and managing approvals. | |
| Steam Reviews MCP jhomen368/steam-reviews-mcp About
Search Steam games, fetch user reviews, and analyze sentiment with topic drill-down to make informed purchasing decisions. | |
| io.github.jhonpork1233-beep/win-mind jhonpork1233-beep/win-mind See and drive any Windows app via the accessibility tree - no screenshots - plus 200+ native tools | |
| io.github.JhostinAleck/brightspace jhostinaleck/brightspace-mcp D2L Brightspace MCP server: courses, grades, rubrics, feedback, course files, calendar. Multi-auth. | |
| dsh-baton jialaoliu/dsh-baton Hand tasks from Claude Code, Codex or any MCP client to a local DeepSeek Harness. | |
| io.github.JiangShan118/3d-texture-toolkit jiangshan118/3d-texture-toolkit-mcp Extract embedded PBR texture maps from local GLB files. | |
| frisk-mcp jiangw2718i/frisk Screens the counterparty of an x402 payment before an agent pays it. One tool, screen_payment, checks address sanity, dynamic-payTo swaps, transport safety and your spend policy, then returns allow / review / block with the reasons — adviso | |
| AI Signals (Signals API) jiangzhangcc-glitch/signals-api-mcp Daily AI signals for agents: today's 4 signals, what changed, ranked models and repos | |
| NBMEcalc MCP jiankn/nbmecalc-mcp Remote MCP server for deterministic educational practice-assessment score conversions. | |
| SavePinner Pinterest URL Tools jiankn/savepinner-mcp Parse, validate, classify, and normalize Pinterest URLs locally without network requests. | |
| zoxide-doctor jiankn/zoxide-doctor-mcp Read-only local zoxide diagnostics for MCP clients. | |
| MCP Doctor jiansen/mcp-doctor Check and improve the contract quality of any MCP server — for humans, agents, and platforms. | |
| Proxy Doctor jiansen/proxy-doctor Diagnose proxy misconfigurations that break AI coding tools (Cursor, VS Code, Windsurf) | |
| jev-ultrafast-mcp jiawei686/jev-ultrafast-mcp Hand browser work off to a server-side agent: read the page as a table, act, then verify. | |
| MCP Chess Server jiayao/mcp-chess A server that enables users to play chess against any LLM, with features for visualizing the board, making moves in standard notation, and analyzing positions from PGN files. | |
| io.serpjet/serpjet-mcp jibaoproxyofficial-pixel/serpjet-mcp Google SERP API for AI agents. 10 result types incl. shopping. 1,000 free searches/month. | |
| ShipPage jieshu666/shippage-skill Publish HTML or Markdown to a public URL in one call. Zero config, auto-registers on first use. | |
| PatchWarden jiezeng2004-design/patchwarden A local MCP server that provides a safe plan-and-execute workflow for AI coding assistants, storing plans and tasks, and executing agent commands with an allow-list for security. | |
| io.github.jigarkkarangiya/adobe-commerce-docs-mcp jigarkkarangiya/adobe-commerce-docs-mcp MCP server for Adobe Commerce / Magento 2 documentation — search, browse, and read official docs. | |
| io.github.JigSawFr/eurodns-mcp jigsawfr/eurodns-mcp Model Context Protocol server for the EuroDNS User API — domains, DNS zones, subscriptions and SSL. | |
| FoodCalorie China jihaochang1/foodcalorie-mcp Chinese chain-restaurant calories and macros for 103 menu items, no API key. | |
| Web3Juice jimbob1414/web3juice-mcp Evidence-backed DeFi yield data for ~17,000 pools: rates, yield sources, 90-day history. Read-only. | |
| Trello MCP Server jimdrews/fastmcp-trello Manage Trello boards, lists, and cards from any MCP-compatible AI assistant | |
| things-mcp jimfilippou/things-mcp An MCP server that integrates with the Things productivity app to create, update, and manage todos and projects using its URL scheme. | |
| BlastRadius MCP jimil-joshi/blastradius-mcp Enables agents to score, inspect, and gate tool calls before they execute, resolving shell commands the way a shell would in order to block destructive actions and detect multi-step attack sequences. It also redacts credentials and PII in e | |
| Airfare Brain jimiwalters-cmyk/airfare-brain-mcp True cost of flight extras (bags, seats, fees) on 29 airlines in Europe and North America, sourced. | |
| Car Rental Brain jimiwalters-cmyk/car-rental-brain-mcp Real cost of car hire at 120+ airports: second driver, cover, deposits, debit cards, desk hours. | |
| Stay Cost Brain jimiwalters-cmyk/stay-cost-brain-mcp Tourist and hotel taxes from official sources, worked out night by night for your dates and guests. | |
| Double AIgents DSAR service jimmyboy-git/doubleaigents-dsar-mcp GDPR DSAR deadlines, breach triage, AI tool checks, HR retention and letters (UK/EU/CH) |
9,701–9,750 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.