Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Capture Screen MCP ochtum/capturescreenmcp Windows screen capture MCP server with display, region, and active-window capture tools. | |
| io.github.ocm-mcp-server/ocm-mcp-server ocm-mcp-server/ocm-mcp-server Guardrailed fleet ops for AI agents: multi-cluster Kubernetes via OCM with policy, approval, audit. | |
| Kebivo ocnai/kebivo Self-hosted inbox for questions your AI agents couldn't answer. Report knowledge gaps over MCP. | |
| OCOLO Project Requests ocolo-io/ocolo-agent-api Submit a data center colocation requirement to OCOLO; reaches 270+ providers. Email-verified. | |
| com.odooconsole/odoo oconsole/odoo-mcp-server Odoo ERP for AI agents: hosted OAuth endpoint, gated writes, one endpoint for every instance. | |
| Octagon Deep Research MCP octagonai/octagon-deep-research-mcp Provides specialized AI-powered comprehensive research and analysis capabilities by integrating with advanced deep research agents, offering unlimited queries with no rate limits and faster performance than comparable services. | |
| mcp-octagon octagonai/octagon-mcp-server Deliver real-time investment research with extensive private and public market data. | |
| io.github.Octen-Team/octen-mcp octen-team/octen-mcp URL to LLM-ready markdown — plus per-page category, page_structure, and query-driven highlights. | |
| io.github.Octid-io/osmp octid-io/cloudless-sky Agentic AI instruction encoding. 86.8% vs JSON. Inference-free decode. Any channel. | |
| 3D Printer MCP Server octoeverywhere/mcp 3D Printing MCP By OctoEverywhere | |
| Octoparse MCP Server octoparse/octoparse-mcp Official Octoparse MCP server for template discovery, cloud tasks, and structured data export. | |
| io.github.octoryn/octopus-blackboard octoryn/octopus-blackboard Shared memory & coordination for AI coding agents — a blackboard, not an orchestrator. | |
| OctoTrip Flights octotrip/flights Free, no-login flight search with real-time pricing from multiple airlines. | |
| Octri CLI octridev/octri-cli Push OpenAPI specs, build SDKs in ten languages, publish API docs, and triage production SDK errors. | |
| Octri API Docs octridev/octri-mcp Search an Octri project's API docs and call its endpoints as tools, shaped by its SDK Studio config. | |
| scamgate odaiameera/scamgate Offline scam check for agents: verify links and payments before acting (allow, ask or deny). | |
| io.github.Odds7/fia-signals-mcp odds7/fia-signals-mcp Crypto market intelligence: regime detection, funding rates, liquidations, prices, signals. | |
| 4D Results (Malaysia, Singapore, Cambodia) oddsflowai-team/4dlivetoday-mcp Official 4D lottery results and draw history for Malaysia, Singapore and Cambodia. Results only. | |
| HK Racing AI oddsflowai-team/hkracing-mcp Hong Kong horse racing: race cards, AI win chances, odds, results, form and stats. | |
| io.github.odela-pixel/asientouno odela-pixel/asientouno-mcp Registro Mercantil español (BORME) + subvenciones (BDNS) + contratos públicos (PLACSP), por empresa. | |
| Radicado Uno odela-pixel/radicadouno-mcp Colombian company and procurement data by NIT, each field with its official source. Free checks. | |
| Odichat odichat/mcp-odichat Manage your Odichat WhatsApp/IG/FB inbox from Claude: conversations, contacts, pipeline, reports. | |
| io.github.ODU33104/rive-mcp odu33104/rive-mcp Free, editor-less MCP server for Rive: create, edit, render .riv — plus an AI-collaborative Studio | |
| oec.sh oecsh/mcp-server Operate your oec.sh Odoo servers, projects and environments with your own API key. | |
| cursor-usage ofershap/cursor-usage AI coding usage analytics — track spend, model usage, and costs across Cursor and Claude Code sessions. | |
| io.github.ofershap/npm-search ofershap/mcp-server-npm npm search MCP — find packages, view details, compare, check downloads. | |
| io.github.ofershap/postgres ofershap/mcp-server-postgres PostgreSQL MCP — query databases, inspect schemas, explain queries. | |
| Offense offense-research/offense Security tools for coding agents: dependency advisory audits and evidence for remediation. | |
| com.offensive360/o360-mcp offensive360/mcp-server Run Offensive360 SAST scans (60+ languages) on local code; findings with file/line and fixes | |
| Spicrawl officialspicrawl/mcp Web scraping MCP server: any URL to Markdown or JSON, with JavaScript rendering and batch jobs. | |
| io.github.OfficialTanishSharma/agentos officialtanishsharma/agentos Local-first persistent memory MCP server for AI coding agents. | |
| OfflineCreator Studio offlinecreatorstudio/offlinecreator-mcp Create images and videos with OfflineCreator Studio through OAuth or the npm stdio server. | |
| Offorte Proposal Software offorte/offorte-mcp-server MCP server for the Offorte API - Create & send proposals using AI | |
| io.github.offx366/ibangen-mcp offx366/ibangen-mcp Validate IBANs, generate test IBANs with real bank codes, look up BICs and bank codes (IBANgen). | |
| Contract Powers ofirbaranesad-agent/contract-powers-mcp Who can still change this EVM contract, and what can they do to holders? | |
| io.github.ogasurfproject-jpg/hs-audit-app ogasurfproject-jpg/horizon-shield 建設・リフォーム見積もりの誠実性を適正レンジで監査するMCP App(UI付き・出典検証込み) | |
| io.github.ogasurfproject-jpg/jhnrd ogasurfproject-jpg/jhnrd Japan home-visit nursing reimbursement rules, each with its source and that source's standing. | |
| io.github.ogconstrutorasp/apex-contabil ogconstrutorasp/apex-mcp-framework Framework MCP do Apex ERP Contábil: CNAEs, jurídico, obrigações, financeiro, marketing e WhatsApp. | |
| OpenTofu Test ogormans-deptstack/opentofu-test-mcp MCP server for the OpenTofu/Terraform native test framework: scaffold, mock, validate, run tests | |
| io.github.ogSINGH/contrast-checker-mcp ogsingh/contrast-checker-mcp MCP - WCAG 2.1 color contrast checker - contrast ratios, compliance and accessible color suggestions | |
| Raywake oguzhankayan/raywake-mcp 500+ AI image, video and audio models with USD quotes and user-approved generation. | |
| StoQuant — Quantitative Stock Research ohadf2015/stoquant-mcp StoQuant: 61 tools — Q-Score, ML, screeners, alt-data, portfolio, backtest, strategy. | |
| Groundlink ohhavefun/groundlink Cited web search for MCP hosts. Returns source-bearing results from Groundlink. | |
| ActiveCampaign ohneben/activecampaign-mcp ActiveCampaign API: ~325 endpoints (v3, SMS, WhatsApp, Segments) as safety-categorized MCP tools. | |
| Anytype (self-hosted HTTP) ohneben/anytype-mcp Self-hosted Anytype MCP server: the full Anytype API as an always-on Docker + HTTP endpoint. | |
| BuchhaltungsButler ohneben/buchhaltungsbutler-mcp BuchhaltungsButler API v1: alle 54 Endpunkte als 46 sicherheitskategorisierte MCP-Tools | |
| HubSpot ohneben/hubspot-mcp HubSpot API: 1,000+ endpoints as safety-categorized, hub- and plan-aware MCP tools, stdio or HTTP. | |
| LearnWorlds ohneben/learnworlds-mcp All 94 LearnWorlds LMS API endpoints as safety-categorized MCP tools (read/write/destructive). | |
| Wafeq ohneben/wafeq-mcp Wafeq accounting API: all 251 endpoints as safety-categorized MCP tools, over stdio or HTTP. | |
| OMOP MCP Server ohnlp/omop_mcp MCP server for mapping clinical terminology to OMOP concepts using LLMs, with vocabulary search and batch processing capabilities. |
14,051–14,100 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.