Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Rectifier Rectifier circuit design calculator. Use when json rectifier tasks, csv rectifier tasks, checking rectifier status. | |
| Regex Builder Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Regex Builder concepts, best practices, and implementation patterns. | |
| Reward Reward system design reference — behavioral reinforcement, loyalty programs, gamification, incentive structures. Use when designing reward programs, loyalty... | |
| Rfid RFID technology reference — tag types, frequency bands, read ranges, EPC standards, inventory tracking. Use when designing RFID systems, selecting tags/reade... | |
| Rivalwatch Generate competitor analysis with SWOT and market positioning. Use when comparing features, checking market share, analyzing differentiation strategies. | |
| Rkhunter Rkhunter reference tool. Use when working with rkhunter in sysops contexts. | |
| Score Track game scores, brackets, and player statistics. Use when recording results, scoring rounds, ranking leaderboards, reviewing game history, computing stats. | |
| Secret Sealer Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Secret Sealer concepts, best practices, and implementation patterns. | |
| Seedgen Generate reproducible seeds and deterministic test data. Use when creating random seeds, rotating salt values, auditing randomness, storing seed records. | |
| Seedphrase Seedphrase reference tool. Use when working with seedphrase in blockchain contexts. | |
| Serverless Runner Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Serverless Runner concepts, best practices, and implementation pa... | |
| Servo servo | |
| Shopify Helper Shopify建站助手。店铺搭建、主题定制、产品管理、SEO优化、应用推荐、上线检查。Shopify store builder with setup, theme, product, SEO, apps. | |
| Signup Organize and track signups with simple terminal commands and export. Use when logging registrations, checking status, analyzing trends, generating reports. | |
| Site Change Alert Use when monitoring websites for content changes, comparing page snapshots with diff, scheduling periodic checks, or sending alerts via email and webhook not... | |
| Sitemapper Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Sitemapper concepts, best practices, and implementation patterns. | |
| Sku SKU management reference — naming conventions, hierarchy design, lifecycle management, and inventory classification. Use when designing product catalogs, cre... | |
| Slashing Analyze slashing operations. Use when you need to understand slashing mechanisms, evaluate protocol security, or reference on-chain concepts. | |
| Sms Manage SMS templates with variable substitution and formatting. Use when preparing bulk messages. | |
| Social Automator Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Social Automator concepts, best practices, and implementation pat... | |
| Sop Writer SOP标准操作流程编写工具。创建SOP、流程图、检查清单、审核评估、模板库、培训材料。SOP writer with create, flowchart, checklist, audit, template. | |
| Sortino Sortino reference tool. Use when working with sortino in finance contexts. | |
| Spec Workflow Mcp Serve spec-driven dev tools via MCP for AI-assisted workflows. Use when adding tasks, planning iterations, tracking completion, reviewing quality. | |
| Spend Tracker Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Spend Tracker concepts, best practices, and implementation patterns. | |
| Sqlformat Format, lint, and pretty-print SQL with dialect conversion. Use when checking style, validating syntax, formatting queries, generating clean SQL. | |
| Stochastic Stochastic reference tool. Use when working with stochastic in finance contexts. | |
| Subtitle Translator Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Subtitle Translator concepts, best practices, and implementation ... | |
| Survey Build surveys, collect responses, and analyze results. Use when creating forms, checking responses, converting data, analyzing trends, generating reports. | |
| Switchgear Switchgear specification manager. Use when json switchgear tasks, csv switchgear tasks, checking switchgear status. | |
| Sysadmin Handbook A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and m the book of secret knowledge, python, awesome. | |
| taobao-listing | |
| Terminal Dashboard Tool for shell commands execution, visualization and alerting. Configured with a simple YAML file. terminal-dashboard, go, alerting, charts, cmd. | |
| Terms Of Service 服务条款生成器。SaaS/电商/App服务条款、更新通知、白话版。Terms of service generator. 服务条款、用户协议。 | |
| Thesaurus Look up synonyms, antonyms, and related words with history and export. Use when finding alternatives, checking usage, running drills, analyzing frequency. | |
| Thesis Helper 论文写作助手。论文大纲生成、文献综述框架、摘要生成、引用格式转换、格式规范检查、答辩准备。Thesis helper with outline generation, literature review, abstract writing, citation formatting, style guide. | |
| Theta Theta reference tool. Use when working with theta in finance contexts. | |
| Thresh Grain threshing reference — threshing methods, combine harvester operation, crop-specific settings, grain loss reduction, and post-harvest handling. Use when... | |
| Tire Your personal Tire assistant. Use when you need tire. | |
| Ui Component UI组件HTML/CSS代码生成。表单、表格、卡片、模态框、导航栏，输出完整可运行HTML文件。UI component generator: form, table, card, modal. | |
| Unixtime Convert Unix timestamps to dates and back. Use when parsing epoch values, calculating time differences, debugging logs, or generating relative dates. | |
| Urea Urea fertilizer reference — nitrogen management, application methods, volatilization loss, soil chemistry, and crop-specific rates. Use when planning nitroge... | |
| Utxo Utxo reference tool. Use when working with utxo in blockchain contexts. | |
| Warehouse Warehouse - command-line tool for everyday use Use when you need warehouse. | |
| Webpack Webpack reference tool. Use when working with webpack in frontend contexts. | |
| Webpack Config Webpack/Vite配置生成。项目配置、插件、Loader、优化、代码分割、迁移。Webpack/Vite config generator with plugins, loaders, optimization, code splitting. Webpack、Vite、构建工具。 | |
| Windows Setup Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Windows Setup concepts, best practices, and implementation patterns. | |
| Wordcraft Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Wordcraft concepts, best practices, and implementation patterns. | |
| 文档整理技能 (convert-markdown) 文档处理与转换技能，基于 MarkItDown 工具。支持将 PDF、Word、PowerPoint、Excel、图片、音频等多种格式文件批量转换为 Markdown。适用于文档数字化、知识库构建、内容提取等场景。 | |
| 文档整理技能 (document-organizer) 支持批量将旧版 Office 文档（.doc/.xls）高质量转换为 Markdown 并保持目录结构与格式完整。 | |
| AI Image & Video Generation Generate images and videos using the VibeVideo API. Use when the user asks to create AI images or videos, check generation status, list available models, or... |
17,701–17,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.