Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Coinmarketcap pipeworx-io/mcp-coinmarketcap CoinMarketCap MCP — crypto prices, market cap, rankings | |
| Coinpaprika pipeworx-io/mcp-coinpaprika Coinpaprika MCP — alternative crypto data source | |
| College Scorecard pipeworx-io/mcp-college-scorecard College Scorecard MCP — US Department of Education College Scorecard API | |
| Colombia Secop pipeworx-io/mcp-colombia-secop Colombia SECOP MCP — Colombian government procurement (public contracting). | |
| Color pipeworx-io/mcp-color Color utilities MCP. | |
| Color Pizza pipeworx-io/mcp-color-pizza Color Pizza MCP — names hex colors using human-friendly color-name lists. Wraps the keyless Color… | |
| Colorado Code pipeworx-io/mcp-colorado-code Colorado Revised Statutes — state statutes by citation, topic, and title. | |
| Colorapi pipeworx-io/mcp-colorapi Color API MCP — wraps thecolorapi.com (free, no auth) | |
| Comicvine pipeworx-io/mcp-comicvine Comic Vine MCP. | |
| Committee Releases pipeworx-io/mcp-committee-releases Committee Releases — documents congressional committees publish on their OWN websites: press… | |
| Commoncrawl pipeworx-io/mcp-commoncrawl Common Crawl's public web archive — find every time a URL was crawled since 2008 and read the… | |
| Commons Wikimedia pipeworx-io/mcp-commons-wikimedia Wikimedia Commons MCP — Action API for files. | |
| Companies House pipeworx-io/mcp-companies-house Companies House MCP — UK statutory company registry (BYO key) | |
| Complex Portal pipeworx-io/mcp-complex-portal EBI Complex Portal MCP. | |
| Comtrade pipeworx-io/mcp-comtrade Comtrade MCP — UN Comtrade API for international bilateral trade data | |
| Conceptnet pipeworx-io/mcp-conceptnet ConceptNet MCP — open multilingual word/phrase relation graph | |
| Confluence pipeworx-io/mcp-confluence Confluence MCP — wraps the Confluence Cloud REST API v2 (OAuth) | |
| Congress pipeworx-io/mcp-congress Congress MCP — US Congress bill/law/member data via the official congress.gov API (Library of… | |
| Congress Member Votes pipeworx-io/mcp-congress-member-votes Congress Member Votes -- how each U.S. House member voted, from the U.S. House Clerk's roll-call… | |
| Congressional Documents pipeworx-io/mcp-congressional-documents Congressional Documents — full-text search and retrieval over the official record of Congress… | |
| Connecticut Code pipeworx-io/mcp-connecticut-code Connecticut General Statutes — state statutes by citation. | |
| Conspiracy Theory pipeworx-io/mcp-conspiracy-theory conspiracy-theory MCP — wraps StupidAPIs (keyless — no credential needed) | |
| Coolprop pipeworx-io/mcp-coolprop coolprop — thermophysical fluid properties (PropsSI-style: give two independent state variables… | |
| Coordinates pipeworx-io/mcp-coordinates Coordinate geometry MCP. | |
| Copernicus Cds pipeworx-io/mcp-copernicus-cds The Copernicus Climate Data Store (C3S/ECMWF) catalogue — browse or search the ~140 published… | |
| Copernicus Dataspace pipeworx-io/mcp-copernicus-dataspace European Sentinel and Copernicus Contributing Mission archive from the EU's Copernicus Data Space… | |
| Core Research pipeworx-io/mcp-core-research CORE Research MCP — wraps CORE API (api.core.ac.uk/v3) | |
| Coresignal pipeworx-io/mcp-coresignal Coresignal MCP — LinkedIn-adjacent company + employee data (coresignal.com) | |
| Cornell Wex pipeworx-io/mcp-cornell-wex Cornell LII Wex MCP — the Legal Information Institute's free legal dictionary and encyclopedia… | |
| Corporate Apology pipeworx-io/mcp-corporate-apology corporate-apology MCP — wraps StupidAPIs (keyless — no credential needed) | |
| Corporate Satire pipeworx-io/mcp-corporate-satire Satirical generator: a joke tool that turns any announcement into a fabricated parody corporate… | |
| Could Have Been Email pipeworx-io/mcp-could-have-been-email could-have-been-email MCP — wraps StupidAPIs (keyless — no credential needed) | |
| Countries pipeworx-io/mcp-countries Countries MCP — world country data. | |
| Country News pipeworx-io/mcp-country-news Country News MCP — ranked top headlines for any country, via Google News RSS. | |
| Country State City pipeworx-io/mcp-country-state-city CountryStateCity MCP — wraps CountryStateCity API (api.countrystatecity.in/v1) | |
| Court Listener pipeworx-io/mcp-court-listener CourtListener MCP — Free Law Project's CourtListener API (v4). | |
| Covalent pipeworx-io/mcp-covalent Covalent / GoldRush MCP — unified wallet balances + transactions across 100+ chains (goldrush.dev… | |
| Cpsc pipeworx-io/mcp-cpsc CPSC MCP — US consumer-product safety recalls (CPSC, free, no auth). | |
| Crates pipeworx-io/mcp-crates Crates.io MCP — wraps the crates.io REST API v1 (free, no auth) | |
| Crawlbase pipeworx-io/mcp-crawlbase Crawlbase MCP — wraps the Crawlbase Crawling API (crawlbase.com, formerly ProxyCrawl). One… | |
| Crawlgraph pipeworx-io/mcp-crawlgraph CrawlGraph MCP — backlink intelligence on the public Common Crawl webgraph (4.4B edges, 120M… | |
| Crc pipeworx-io/mcp-crc Checksum MCP — CRC-32 & Adler-32. | |
| Creative Constraints pipeworx-io/mcp-creative-constraints creative-constraints — an original deck of 162 domain-neutral creative constraints, drawn by… | |
| Creditcard pipeworx-io/mcp-creditcard Credit-card number validation MCP. | |
| Cricket pipeworx-io/mcp-cricket Cricket MCP — wraps CricAPI (api.cricapi.com) for live cricket data. | |
| Cro Ireland pipeworx-io/mcp-cro-ireland cro-ireland -- the CRO (Companies Registration Office), Ireland's statutory register for companies… | |
| Crontab pipeworx-io/mcp-crontab Crontab expression MCP. | |
| Crossref pipeworx-io/mcp-crossref Crossref MCP — wraps the Crossref REST API (academic papers, free, no auth) | |
| Crs Reports pipeworx-io/mcp-crs-reports Congressional Research Service reports — Congress's own nonpartisan analysis, searchable and… | |
| Crtsh pipeworx-io/mcp-crtsh crt.sh — Certificate Transparency log search |
15,051–15,100 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.