Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Locus paladini/locus-mcp Lightweight MCP server for LSP code intelligence — symbol lookup, refs, types, diagnostics. | |
| Datawrapper palewire/datawrapper-mcp A Model Context Protocol (MCP) server and app for creating Datawrapper charts using AI assistants | |
| io.github.palimkarakshay/abap-mcp palimkarakshay/abap-mcp Offline SAP ABAP/RAP tools for AI agents: lint, Cloud readiness, released APIs, knowledge. | |
| Palisade palisadeemail/palisade-mcp Monitor and manage email authentication (SPF, DKIM, DMARC, MTA-STS, BIMI) for your domains. | |
| mendeley-mcp pallaprolus/mendeley-mcp MCP server for Mendeley reference manager - search, retrieve, and manage your academic library from Claude and other MCP clients | |
| agentRamen palrajjp/agentramen Local-first codebase intelligence for coding agents: indexes code and Git history into SQLite. | |
| EstateTrace Pre-Probate Intelligence palunallc/mcp-server-estatetrace Pre-probate and inheritance real estate intelligence with Base L2 USDC settlement. | |
| Palveron MCP Server palveron/mcp-server Early access - AI governance gateway for MCP tool calls (policies, PII masking, audit). | |
| io.github.pamela-0/boot-doctor-mcp pamela-0/boot-doctor-mcp Deterministic PC no-boot/no-POST diagnostics: real beep-code tables, no LLM guessing. | |
| io.github.pamela-0/safe-fix-mcp pamela-0/safe-fix-mcp Finds real dead code and proposes a safe, test-gated branch+PR to remove it. | |
| PandaDoc MCP Server pandadoc/mcp-server-guide PandaDoc MCP server for creating, sending, signing, and tracking PandaDoc documents. | |
| Sooveryn pandaprogparis/sooveryn-mcp AI personas with a lasting, encrypted memory per project, for Claude Code. Hosted in France. | |
| Panda Video pandavideo/panda-video-mcp Video hosting: upload, organize and configure videos, analytics, AI subtitles and Shorts. | |
| WokiToki pandeyvishwas51-oss/wokitoki Walkie-talkies for AI coding agents: peer-to-peer, end-to-end encrypted messaging via MCP. | |
| creatorloop pandich93/creatorloop Instagram content studio for Claude: analytics, competitors, Reels, publishing queue. | |
| io.github.Panelica/panelica-mcp panelica/panelica-mcp Manage a Panelica hosting panel in plain English - 404 scoped, HMAC-signed tools. | |
| Panella panellatech/panella Governed, self-hosted memory for AI agents: writes queue until a named person approves. | |
| Pangolinfo Amazon Data MCP pangolin-spg/amazon-data-mcp Enables AI agents to access Amazon commerce intelligence, WIPO design-patent data, Google Trends, and local market data through 19 business data tools via a stdio bridge to a hosted MCP server. | |
| Pangolinfo Amazon Data MCP pangolin-spg/pangolinfo-mcp Real-time Amazon, WIPO & PACER data for AI agents — 19 tools via the MCP protocol. | |
| Pangolinfo Review Mining MCP pangolin-spg/pangolinfo-review-mining-mcp Amazon review mining for AI agents — complaint detection, sentiment trends, complaint topics. | |
| com.pangolinfo/amazon-mcp pangolinfo/pangolinfo-mcp Amazon data MCP: products, reviews, niches, WIPO design/IP + US litigation, AI search & trends. | |
| MCP Gateway panossalt/mcp-gateway Multi-tenant MCP platform with OAuth 2.1, Entra SSO, RBAC and audit logging. | |
| Email Verifier MCP panstories/email-verifier-mcp Verify email deliverability with RFC format, MX, SMTP and disposable-domain checks. | |
| Ethics for AI MCP panstories/ethics-for-ai-mcp A deterministic daily ethics feed for AI agents, from a four-module curriculum. | |
| Free and Cheap Tokens (FaCT) panstories/free-and-cheap-tokens Human-verified daily catalog of free and cheap AI model API credits and token promos. | |
| MCP Stock Analyst panstories/mcp-stock-analyst Real-time quotes, fuzzy search and K-line history across 13 global stock markets. | |
| VIES VAT Validator MCP panstories/vies-vat-validator-mcp Validate EU VAT numbers against the official VIES service with a local pre-check. | |
| Odoo MCP Pro pantalytics/odoo-mcp-pro Connect AI to Odoo ERP 14-20: search, create, update and manage records in natural language. | |
| Image Puma panth-net/image-puma Plan and run local batch image preparation with explicit confirmation before writing files. | |
| Sancho Fetch panth-net/sancho-fetch Local-first public-data MCP server that writes inspectable records and working files. | |
| io.github.Pantheon-LadderWorks/omni-scanner pantheon-ladderworks/omni-scanner Codebase observatory with 56+ scanners for git health, architecture, and documentation. | |
| Chrome MCP Server (Security Hardened) pantheon-security/chrome-mcp-secure Enterprise-grade Chrome automation for AI agents with compliance-ready logging, post-quantum encryption, and SIEM integration. | |
| Cuecaps pantheonn3d/cuecaps-mcp Animated word-by-word captions for your video and audio files, rendered on your machine by Cuecaps. | |
| Panther MCP Server panther-labs/mcp-panther mcp-panther | |
| Pantrist pantrist-dev/pantrist-mcp Manage your Pantrist pantry, shopping list, recipes, and weekly meal plan from Claude. The server wraps the same public REST API that powers the iOS, Android, and web apps, so your changes show up in real time on every device.
* "What's on | |
| Lead Leak Check paopao-studio-ai/lead-leak-check-mcp Finds where inbound leads are silently dropped in Zapier, Make and n8n pipelines. Offline. | |
| African Speech Corpora Quality Audit papasega/african-speech-mcp Read-only, provenance-aware selection of Wolof speech corpora by measured quality. | |
| io.github.paperandbeyond23-gif/edgrapi-skills paperandbeyond23-gif/edgrapi-skills US government + SEC data as clean JSON: SAM.gov, USAspending, Grants.gov, Congress, SEC filings. | |
| io.github.paperandbeyond23-gif/propzapi paperandbeyond23-gif/propzapi-skills Render-and-verify API: HTML/CSS to image or PDF, screenshot any URL, confirm the text rendered. | |
| RestoSignals paperandbeyond23-gif/restosignals-mcp Pre-opening US restaurant and bar leads, scored from liquor, permit and business filings. | |
| io.github.paperdavid/manoma paperdavid/manoma MCP server for soul.md — your portable AI identity layer across every LLM. | |
| AgingResearch.News paperfoot/agingresearch-news-mcp Search every new aging paper, judged on evidence, plus trials, grants, drug pipelines and news. | |
| Paper Nexus papernexus/papernexus-mcp Find related scientific papers through their citation network, from OpenAlex and Semantic Scholar. | |
| PaperOffice AI paperoffice-ai/paperoffice-mcp-setup Document AI and headless DMS: OCR, IDP, search, workflows, signatures. EU-hosted, OAuth 2.1. | |
| Paper Plane Post paperplanepost/agents Create and send an AI-illustrated postcard anywhere in the world | |
| PapersFlow papersflow-ai/papersflow-mcp Academic research MCP server for paper search, citation checks, graphs, and deep research. | |
| xkcd Comic Suggester papjuli/xkcdai Suggests a relevant xkcd comic during a conversation, via semantic search over every comic. | |
| paprika3d (the three.js toolset for coding agents) paprika3d/paprika3d Three.js MCP server: see, play, test and profile the three.js and WebGL pages your agent builds | |
| ai.papyruslabs/seshat-mcp papyruslabs-ai/seshat-mcp Structural code intelligence for AI agents: real call graphs, blast radius, and change history. | |
| caisse-enregistreuse-mcp-server paracetamol951/caisse-enregistreuse-mcp-server Connect to a sales recorder system (or POS, cash register). |
14,401–14,450 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.