Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Oman Payments (Tap Payments — cards / Apple Pay) junter1989k-ai/oman-payments-mcp Oman payments for AI agents — cards / Apple Pay via Tap Payments. Never holds funds. | |
| Pakistan Payments (Safepay — Safepay checkout) junter1989k-ai/pakistan-payments-mcp Pakistan payments for AI agents — Safepay checkout via Safepay. Never holds funds. | |
| Paraguay Invoices (SIFEN e-Kuatia via FacturaSend) junter1989k-ai/paraguay-invoice-mcp Paraguay SIFEN e-Kuatia: AI agents issue and query electronic invoices, stateless BYO. | |
| Peru Invoices (CPE factura/boleta electrónica, SUNAT) junter1989k-ai/peru-invoice-mcp Peru CPE invoices for AI agents - issue, query, void facturas/boletas via SUNAT (2 backends). | |
| Peru Payments (Mercado Pago — Yape / PagoEfectivo) junter1989k-ai/peru-payments-mcp Peru payments for AI agents — Yape / PagoEfectivo via Mercado Pago. Never holds funds. | |
| Philippines Payments (PayMongo — GCash / Maya / cards) junter1989k-ai/philippines-payments-mcp Philippines payments for AI agents — GCash, Maya, cards via PayMongo. Never holds funds. | |
| Poland Invoices (KSeF 2.0 national e-invoice API) junter1989k-ai/poland-invoice-mcp Poland KSeF 2.0 national e-invoices for AI agents: issue FA(3) faktura, query by KSeF number. | |
| Poland Payments (Stripe — BLIK) junter1989k-ai/poland-payments-mcp Poland payments for AI agents — BLIK via Stripe. Never holds funds. | |
| Portugal Payments (Stripe — Multibanco) junter1989k-ai/portugal-payments-mcp Portugal payments for AI agents — Multibanco via Stripe. Never holds funds. | |
| Qatar Payments (Tap Payments — cards / Apple Pay) junter1989k-ai/qatar-payments-mcp Qatar payments for AI agents — cards / Apple Pay via Tap Payments. Never holds funds. | |
| Romania Invoices (ANAF e-Factura national API) junter1989k-ai/romania-invoice-mcp Romania e-Factura invoices for AI agents: build UBL 2.1 CIUS-RO, upload to ANAF/SPV, query. | |
| Romania Payments (Stripe — cards / Apple Pay) junter1989k-ai/romania-payments-mcp Romania payments for AI agents — cards / Apple Pay via Stripe. Never holds funds. | |
| Rwanda Payments (Flutterwave — MTN MoMo) junter1989k-ai/rwanda-payments-mcp Rwanda payments for AI agents — MTN MoMo via Flutterwave. Never holds funds. | |
| Saudi Arabia Payments (Tap Payments — mada / STC Pay) junter1989k-ai/saudi-arabia-payments-mcp Saudi Arabia payments for AI agents — mada / STC Pay via Tap Payments. Never holds funds. | |
| Saudi Invoices (ZATCA Fatoora Phase 2 reporting & clearance) junter1989k-ai/saudi-invoice-mcp Saudi ZATCA Fatoora Phase 2: AI agents report B2C and clear B2B tax invoices, stateless. | |
| Senegal Payments (Flutterwave — Orange Money / Wave) junter1989k-ai/senegal-payments-mcp Senegal payments for AI agents — Orange Money / Wave via Flutterwave. Never holds funds. | |
| Serbia Invoices (SEF eFaktura national API) junter1989k-ai/serbia-invoice-mcp Serbia SEF eFaktura invoices for AI agents: build UBL 2.1 SRB-CIUS, upload to SEF, query, cancel. | |
| Singapore Payments (HitPay — PayNow QR) junter1989k-ai/singapore-payments-mcp Singapore payments for AI agents — PayNow QR via HitPay. Never holds funds. | |
| Slovakia Payments (Stripe — cards / Apple Pay) junter1989k-ai/slovakia-payments-mcp Slovakia payments for AI agents — cards / Apple Pay via Stripe. Never holds funds. | |
| Slovenia Payments (Stripe — cards / Apple Pay) junter1989k-ai/slovenia-payments-mcp Slovenia payments for AI agents — cards / Apple Pay via Stripe. Never holds funds. | |
| South Africa Payments (Paystack — cards / EFT) junter1989k-ai/south-africa-payments-mcp South Africa payments for AI agents — cards / EFT via Paystack. Never holds funds. | |
| Spain Payments (Stripe — cards / Apple Pay) junter1989k-ai/spain-payments-mcp Spain payments for AI agents — cards / Apple Pay via Stripe. Never holds funds. | |
| Sweden Invoices (Peppol BIS 3.0 via Storecove) junter1989k-ai/sweden-invoice-mcp Sweden Peppol BIS 3.0 e-invoices for AI agents: send, check recipient, get delivery proof. | |
| Sweden Payments (Stripe — Klarna) junter1989k-ai/sweden-payments-mcp Sweden payments for AI agents — Klarna via Stripe. Never holds funds. | |
| Switzerland Payments (Stripe — TWINT) junter1989k-ai/switzerland-payments-mcp Switzerland payments for AI agents — TWINT via Stripe. Never holds funds. | |
| Taiwan Logistics (CVS pickup + home delivery via ECPay) junter1989k-ai/taiwan-logistics-mcp Taiwan CVS pickup + home delivery for AI agents: create, track, print labels via ECPay. | |
| Taiwan Payments & E-Invoice (ECPay 綠界 / NewebPay 藍新) junter1989k-ai/taiwan-payments-mcp Taiwan payments (ECPay 綠界 + NewebPay 藍新) & e-invoices for AI agents. Stateless, never holds funds. | |
| Tanzania Payments (Flutterwave — M-Pesa / Tigo Pesa) junter1989k-ai/tanzania-payments-mcp Tanzania payments for AI agents — M-Pesa / Tigo Pesa via Flutterwave. Never holds funds. | |
| Thailand e-Tax Invoices (Leceipt create, poll & download) junter1989k-ai/thailand-invoice-mcp Thailand Leceipt e-Tax: AI agents create, poll and download e-Tax Invoices, stateless BYO. | |
| Thailand Payments (Opn/Omise — PromptPay QR / cards / TrueMoney) junter1989k-ai/thailand-payments-mcp Thailand payments for AI agents — PromptPay QR, cards, TrueMoney via Opn (Omise). Never holds funds. | |
| Turkey Payments (iyzico — Turkish cards / taksit) junter1989k-ai/turkey-payments-mcp Turkey payments for AI agents — Turkish cards / taksit via iyzico. Never holds funds. | |
| United Arab Emirates Payments (Tap Payments — Apple Pay / cards) junter1989k-ai/uae-payments-mcp United Arab Emirates payments for AI agents — Apple Pay / cards via Tap Payments. Never holds funds. | |
| Uganda Payments (Flutterwave — MTN MoMo) junter1989k-ai/uganda-payments-mcp Uganda payments for AI agents — MTN MoMo via Flutterwave. Never holds funds. | |
| UK Logistics (buy Royal Mail + more labels + tracking via Shippo) junter1989k-ai/uk-logistics-mcp UK shipping labels for AI agents: buy Royal Mail Tracked and more, track and refund via Shippo. | |
| United Kingdom Payments (Stripe — Stripe checkout) junter1989k-ai/uk-payments-mcp United Kingdom payments for AI agents — Stripe checkout via Stripe. Never holds funds. | |
| Ukraine Payments (LiqPay — LiqPay cards / Apple Pay) junter1989k-ai/ukraine-payments-mcp Ukraine payments for AI agents — LiqPay cards / Apple Pay via LiqPay. Never holds funds. | |
| Uruguay Invoices (DGI e-Factura CFE, merchant-signed SOAP relay) junter1989k-ai/uruguay-invoice-mcp Uruguay DGI e-Factura (CFE): AI agents submit signed sobres to DGI e-invoicing, stateless forwarder. | |
| Uruguay Payments (Mercado Pago — Mercado Pago wallet) junter1989k-ai/uruguay-payments-mcp Uruguay payments for AI agents — Mercado Pago wallet via Mercado Pago. Never holds funds. | |
| USA Logistics (buy USPS/UPS/FedEx labels + tracking via EasyPost) junter1989k-ai/usa-logistics-mcp US shipping labels for AI agents: buy USPS/UPS/FedEx, track and refund via EasyPost. | |
| United States Payments (Stripe — Stripe checkout) junter1989k-ai/usa-payments-mcp United States payments for AI agents — Stripe checkout via Stripe. Never holds funds. | |
| Vietnam Invoices (MISA meInvoice create, publish & query) junter1989k-ai/vietnam-invoice-mcp Vietnam MISA meInvoice: AI agents create, publish and query e-invoices, stateless BYO. | |
| Vietnam Payments (MoMo — wallet QR / ATM / cards) junter1989k-ai/vietnam-payments-mcp Vietnam payments for AI agents — MoMo wallet QR, ATM, cards. Zero-setup sandbox. Never holds funds. | |
| Zambia Payments (Flutterwave — mobile money) junter1989k-ai/zambia-payments-mcp Zambia payments for AI agents — mobile money via Flutterwave. Never holds funds. | |
| Kitsune junyeong-nero/kitsune Let your coding agent use the Firefox, Zen, or LibreWolf browser you already have open. | |
| ai.starsinger/starsinger-mcp jupiterspins/starsinger-mcp Make a finished AI song with real vocals from a brief, or search and stream StarSinger's AI catalog | |
| ChemDraw MCP (unofficial) jurimaxam-dotcom/chemdraw-mcp Molecule names or SMILES to 2D structures, reactions, mechanisms, spectra - offline via RDKit. | |
| NeuroLink juspay/neurolink TypeScript AI SDK with a built-in MCP client: 58+ MCP servers over 4 transports (stdio, HTTP, SSE, WebSocket), 24+ LLM providers behind one interface, streaming, tool calling, RAG, voice (TTS/STT/realtime), and task scheduling. | |
| Just Domain. just-done/just-domain-mcp Check a domain name, both prices and whether it can transfer in. You register it on justdomain.ai. | |
| Just Publish just-done/just-publish-mcp Publish and update the website you built with AI at a live public URL. Sign-in required. | |
| read-website-fast just-every/mcp-read-website-fast Fast, token-efficient web content extraction tool that converts websites to clean Markdown for AI agents, featuring smart caching, content extraction with Mozilla Readability, and polite crawling capabilities. |
10,101–10,150 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.