Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Superclaw Complete software development workflow enforcing design → plan → execution with checkpoints | |
| simp-dog-skill Distill a simp dog into an AI Skill. Import WeChat history, generate Simping Memory + Persona, with continuous evolution. | 把舔狗蒸馏成 AI Skill，导入微信聊天记录、朋友圈，生成舔狗... | |
| Investing Analyst Thesis-driven equity and options trading analyst. Use when: (1) evaluating a trade idea before entering a position, (2) analyzing options pricing via IV vs H... | |
| BrowserOS CLI Use when a task requires interacting with a website beyond just reading it — clicking elements, filling forms, submitting data, navigating through multi-step... | |
| Dexscreener API Query DexScreener market data - search pairs, inspect liquidity/volume, check boosted tokens, and fetch token orders. | |
| Gecko Terminal API Query GeckoTerminal market data - networks, DEXes, pools, tokens, OHLCV, trades, and trending/new pools. | |
| kalshi api Read-only Kalshi API skill for market discovery, liquidity checks, and market validation. Use for scanning and ranking Kalshi opportunities. Pair with a sepa... | |
| Kalshi Paper Trading Kalshi-native paper trading ledger and CLI for binary prediction contracts. Use for paper opens, marks, reconciliation, valuation, and review without relying... | |
| kalshi-trade Read-only Kalshi OpenAPI scouting skill for market discovery, liquidity checks, and market validation. Use for scanning and ranking Kalshi opportunities. Pai... | |
| kalshi trades Read-only Kalshi OpenAPI scouting skill for market discovery, liquidity checks, and market validation. Use for scanning and ranking Kalshi opportunities. Pai... | |
| Paper Trader Run a structured paper-trading loop with SQLite-backed event logging, position tracking, and PnL review. Use when opening/closing simulated trades, journalin... | |
| bruce-doc-converter-skill 双向文档转换工具，将 Word (.docx)、Excel (.xlsx)、PowerPoint (.pptx) 和 PDF (.pdf) 转换为 AI 友好的 Markdown，或将 Markdown (.md) 转换为 Word (.docx)。当用户请求文档转换、导出、读取、分析 Office/PDF/Ma... | |
| Draw.io Diagram Generator And Exporter **Use this skill** when the user wants to create any diagram: flowchart, architecture, UML (sequence/class), ER, mindmap, network topology, or any visual dia... | |
| Douyin Video Forge 抖音短视频全链路自动化制作。适用于：收到客户项目需要制作抖音推广视频、 策划短视频内容、生成视频脚本、分析抖音热点趋势、制作爆款短视频。 通过浏览器采集抖音热榜和视频数据，生成分段脚本，调用可灵API生成视频并拼接成片。 | |
| Massive(Polygon) Access Massive(Polygon) stock, crypto, forex, options, indices, futures, market data, and news APIs via CLI. | |
| self-backup-to-feishu AI助手状态自动备份到飞书文档。当用户需要：(1) 备份AI状态到云端，(2) 从飞书恢复AI记忆，(3) 设置自动备份机制，(4) 跨设备同步AI助手状态时使用此技能。触发词：「备份状态」「恢复状态」「从飞书恢复」「同步记忆」。 | |
| Pipeworx advice Crowdsourced life advice — search, browse, or grab a random slip of wisdom from the Advice Slip API | |
| Pipeworx agify Agify MCP — age prediction from first name (agify.io, free, no auth) | |
| Pipeworx ai-briefing Provides daily updates and searchable insights on AI tools, models, servers, APIs, SDKs, frameworks, and industry news. | |
| Pipeworx airports Airports MCP — wraps AirportGap API (free, no auth required) | |
| Pipeworx airquality Air Quality MCP — wraps air-quality-api.open-meteo.com (free, no auth) | |
| Pipeworx airtable Integrate with Airtable API to list bases, fetch and filter records, get record details, create new records, and retrieve base schemas. | |
| Pipeworx alphavantage Access real-time stock prices, historical data, company fundamentals, financial statements, and earnings for any stock symbol using Alpha Vantage. | |
| Pipeworx altos Provides real estate market intelligence including inventory trends, active listings, pending sales, new listings, and downloadable data files for specified... | |
| Pipeworx amplitude Retrieve and analyze user events, active counts, retention, and profiles in Amplitude with detailed date-range and granularity options. | |
| Pipeworx Analyst Access 252 data sources via one gateway to query trade, finance, pharma, housing, and government contracts using natural language questions. | |
| Pipeworx animequotes AnimeQuotes MCP — wraps animechan.io (free, no auth) | |
| Pipeworx archive Archive MCP — wraps the Internet Archive APIs (free, no auth) | |
| Pipeworx art Search and explore 500,000+ artworks in the Metropolitan Museum of Art's open-access collection | |
| Pipeworx artic Explore the Art Institute of Chicago's collection — artworks, artists, and exhibitions via the ARTIC public API | |
| Pipeworx bible Fetch Bible verses, passages, and random scripture from bible-api.com — multiple translations supported | |
| Pipeworx bls Access and search Bureau of Labor Statistics economic data series, fetch historical or latest employment, inflation, wages, productivity, and housing data. | |
| Pipeworx bluesky Read Bluesky profiles, posts, feeds, followers, and threads via the AT Protocol — 8 tools, mostly public endpoints | |
| Pipeworx boardgames Search and retrieve detailed info on board games, including popular titles, player count, playtime, rating, price, and descriptions. | |
| Pipeworx books Search and look up books via Open Library — titles, authors, ISBNs, and cover images from the world's largest open book catalog | |
| Pipeworx bored Beat boredom with random activity suggestions — filter by type (education, social, cooking) or group size | |
| Pipeworx breweries Discover craft breweries across the US — search by name, city, or ID via Open Brewery DB | |
| Pipeworx carbon UK national carbon intensity data — real-time, historical, and generation mix from the Carbon Intensity API | |
| Pipeworx cataas Retrieve random cat images, find cats by specific tags, and list available cat tags using the Pipeworx cataas service. | |
| Pipeworx catfacts Random cat facts and breed information from the Cat Facts API | |
| Pipeworx census Access U.S. Census Bureau housing data including ACS, building permits, housing starts, homeownership rates, and available census datasets by geography. | |
| Pipeworx census-trade Access detailed US international trade data including imports, exports, trade balance, and trends by commodity and country. | |
| Pipeworx chess Chess.com player profiles, game stats, match archives, and leaderboards from the public API | |
| Pipeworx chucknorris Chuck Norris jokes — random, by category, or keyword search from chucknorris.io | |
| Pipeworx citybikes Real-time bike-sharing station data for 600+ networks worldwide — Citi Bike, Velib, Nextbike, and more | |
| Pipeworx climate Long-range climate projections from Open-Meteo — temperature trends from 1950 to 2050 with multi-model comparison | |
| Pipeworx cocktails Cocktail recipes from TheCocktailDB — search by name, browse by ingredient, or discover a random drink | |
| Pipeworx colorapi Color identification, scheme generation, and format conversion via TheColorAPI — hex, RGB, HSL, and CMYK | |
| Pipeworx core-research Search open-access research papers by keyword and retrieve full metadata including title, authors, abstract, and full text by CORE ID. | |
| Pipeworx could-have-been-email Analyzes meeting transcripts to determine if the discussion could have been an email, returning filler word count and decisions. |
17,001–17,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.