Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Nitrozen nitrozenio/nitrozen-mcp Manage Nitrozen.io changelog projects, entries and API tokens from any MCP client. | |
| io.github.Nitrych/eurovalidate-mcp nitrych/eurovalidate-mcp Validate EU VAT numbers (VIES), IBANs and EORI, look up company data (GLEIF) and VAT rates | |
| stock-mcp-server niuheilong/stock-mcp-server Real-time A-share stock data for AI assistants. Provides real-time stock prices, K-line data, financial indicators, and sector fund flow analysis for Chinese A-share market. Multi-source data validation ensures accuracy. | |
| io.github.SirinivasK/chron nivaya/chron Timestamped audit log for every AI conversation — stored locally in SQLite, owned by you. | |
| DreamAgent nivethaug/dreamagent-mcp-server Build and deploy websites, Telegram and Discord bots from chat via the DreamAgent platform. | |
| MCP for Primavera P6 nizarhamza/p6-mcp Primavera P6 MCP server: critical path, DCMA checks, what-if and safe write-back to the P6 database | |
| pdfnative MCP — PDF generation, PAdES signing & introspection nizoka/pdfnative-mcp PDF MCP server: PDF/A, PDF/X-4, PAdES (LTV), forms, 32 scripts, JPEG 2000, spot colours. 28 tools | |
| pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving nizoka/pkinative-mcp PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools | |
| zipnative MCP — ZIP creation, inspection, secure extraction & verification nizoka/zipnative-mcp ZIP MCP server: create, inspect, verify, extract, canonicalize, merge, modify. 15 tools | |
| CoderSwap MCP Server njlnaet/mcp-server Build searchable AI research knowledge bases with hybrid vector search directly in Claude Desktop. | |
| mcpsurfr nkapila6/mcpsurfr Local web search with multi-engine deep research and on-device re-ranking. No API keys. | |
| Perspect nkbros12k/perspect-mcp Convene a panel of expert AI personas to debate any decision from every side. | |
| Corresync nkiyohara/corresync Local-first mail, calendar, and task MCP with isolated accounts and guarded writes. | |
| io.github.NKO-STUDIO/find-missing nko-llc-tech/nko Checks if an LEI-holding entity has a match in the national registry its jurisdiction expects. | |
| io.github.nkpar/coda nkpar/coda-mcp Interact with Coda.io documents, tables, and rows via the Coda API | |
| LWS nkstud/lws-mcp Manage LWS (lws.fr) domains, DNS zones, hosting and account from any MCP client. | |
| Cabrini Market Data nlapi/cabrini-py US equity data for AI agents — 23 years intraday + daily, SEC filings. x402 USDC payments. | |
| nlqdb — analytical memory for AI agents nlqdb/nlqdb Analytical memory for AI agents: a real Postgres queried in plain English over MCP. One command. | |
| NLQueries nlqueries/nlqueries Natural language to SQL engine with multi-connector support (PostgreSQL, MySQL, Snowflake, BigQuery, DuckDB), document QA, semantic caching, and self-hosted MCP server. | |
| LightSpot nmarijane/lightspot-mcp Audit a website for SEO and AI search visibility (ChatGPT, Perplexity, Gemini) and read the fixes. | |
| Tu Vi Horoscope MCP Server nmhaaa3218/tuvimcp Calculates Vietnamese Tử Vi horoscope charts, generating structured JSON with Thiên Bàn and Địa Bàn, transit analysis, and local persistence via SQLite. | |
| kg nnar1o/kg Local knowledge graph memory MCP server for AI assistants. | |
| iwdp-mcp nnemirovsky/iwdp-mcp iOS Safari debugging via ios-webkit-debug-proxy — MCP server with full WebKit Inspector Protocol support | |
| io.github.nnnoel/ytranscript-mcp nnnoel/ytranscript-mcp YouTube transcripts for AI tools. No proxies needed; transcribes videos without captions. | |
| io.github.nntoan/figma-mcp-rust nntoan/figma-mcp-rust Figma MCP server in Rust: plugin bridge, no API token, no rate limits, 73 tools. | |
| no_human no-human-ai/no_human File a task with your local no_human and check on it: task_add and task_status over stdio. | |
| Hirð no-materials/hird Compiler introspection for the Hirð language (typed actors and effect rows on the BEAM): type inference, definition lookup, effect-row explanation, IR fragments, actor protocol and supervision graphs, and token-budget-aware symbol summaries | |
| AgentPay (all tools) noah-silver/agentpay Pay-per-call web extract, DNS/WHOIS/IP lookup, PDF/RSS/sitemap tools. x402 USDC on Base/Algorand. | |
| io.github.noahhyden/erbina noahhyden/erbina Bootstrap, verify, and update CLI tools & MCP servers in Claude Code from recipes; audit scopes. | |
| EndzoneAPI noahowsh/endzoneapi-mcp NFL player props by sportsbook since 2023, plus play-by-play with EPA, stats and odds. REST and MCP. | |
| No License Nearby nobanks/nolicense-nearby-mcp Search 880+ artist-owned tracks and get sync licenses for social, TV and film. | |
| Shotcut MCP nobanks/shotcut-mcp Edit video through Shotcut's MLT engine: timelines, cuts, filters, titles, crossfades and renders. | |
| The Real Cost nobanks/therealcost-mcp Free US money calculators with the math shown, from The Real Cost. Education only. | |
| NobetciEczane.org nobetcieczane/nobetci-eczane Türkiye ve KKTC'de güncel nöbetçi eczaneler: il, ilçe veya konuma göre eczane adı ve adresi. | |
| com.nobleblocks/nobleblocks-mcp nobleblocks/nobleblocks-mcp Search 340M+ academic papers — citation graphs, semantic similarity, and AI literature reviews. | |
| NoClick noclickapp/noclick Build agents to automate any background task. Works with your ChatGPT/Claude subscription. | |
| OPC UA Modeler node-opcua/node-opcua-modeler-mcp-server OPC UA companion spec types, namespace dependencies, and engineering units for AI agents | |
| node9 node9-ai/node9-proxy Access control for AI agents and MCP servers: allow, hold for approval, or block each tool call | |
| io.github.NodeDex/nodedex nodedex/nodedex-v0.1 Your project's decision history for agents: decisions, dead-ends, constraints - queryable, local. | |
| Nodegrove VRAM: can I run it? nodegrove/vram-mcp Can this LLM run on my GPU? VRAM, speed ceiling and what fits instead, for any model and GPU. | |
| NodeMaven nodemaven/nodemaven-mcp NodeMaven residential proxies: geo-targeted proxy URLs, sticky sessions, checks and usage | |
| projectmind nodemint-dev/projectmind Persistent project memory for AI coding agents: one compact digest instead of re-reading the repo. | |
| Nodes2Cloud nodes2cloud-com/n2c-mcp Build, validate and deploy workflows as Cloudflare Workers in your own account, with approval. | |
| Noetive noetive/noetive-mcp Your agents share what they learn. Semantik finds it by meaning, with no topic names to agree on. | |
| Riffle noetive/riffle Your agent uses the web as text, not screenshots. Several steps per call, only changes come back. | |
| Noeto noeto-tasks/noeto-mcp Work a Noeto kanban board: read and search it, create, move and comment on cards, keep docs on them. | |
| NOETRA noetra2/noetra Local-first evidence tracking, formal logic checks and prerequisite planning for AI agents. | |
| io.github.nogoo9/mcp-server-cloud-fs nogoo9/mcp-server-cloud-fs Cloud replacement for mcp-server-filesystem — 20 tools for S3, Azure Blob, and GCS | |
| io.github.nogoo9/no-crd nogoo9/no-crd Dynamic pod spawner & proxy for ephemeral AI agent workspaces on Kubernetes without CRDs | |
| Nogra nograai/nogra-mcp Verify-before-done trust layer for AI-assisted work. 32 tools, local-first, no credentials. |
13,851–13,900 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.