Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Agentic Commerce — Lifestyle, Wellness, & Gifts Agentic Commerce skills enables agents to autonomously browse and search for quality lifestyle, wellness, and tech products and gifts, view details, create o... | |
| Agentic Commerce — Lifestyle, Wellness, & Gifts Enables AI agents to autonomously browse lifestyle and wellness products, place multi-chain crypto orders with CULT discounts, and track shipments from For t... | |
| active-campaign ActiveCampaign API integration with managed OAuth. Marketing automation, CRM, contacts, deals, email campaigns, automations, tags, lists, users, accounts, custom fields, notes, and webhooks. All write operations require explicit user approv | |
| acuity-scheduling Acuity Scheduling API integration with managed OAuth. Manage appointments, calendars, clients, and availability. Use this skill when users want to schedule, reschedule, or cancel appointments, check availability, or manage clients and calen | |
| airtable Airtable API integration with managed OAuth. Manage bases, tables, and records. Use this skill when users want to read, create, update, or delete Airtable records, or query data with filter formulas. For other third party apps, use the api- | |
| API Gateway Call third-party APIs through the Maton gateway, which injects the credential for an app the user has already connected.
Use this skill when the user names a connected app and a concrete action in it - read a mailbox, query a CRM, file an i | |
| Apify Apify API integration with managed authentication. Run web scrapers, manage actors, datasets, key-value stores, and schedules. Use this skill when users want to interact with Apify - running web scraping actors, managing datasets, or schedu | |
| Apollo Apollo.io API integration with managed OAuth. Search and enrich people and companies, manage contacts and accounts. Use this skill when users want to prospect, enrich leads, or manage sales data. For other third party apps, use the api-gate | |
| Asana Asana API integration with managed OAuth. Access tasks, projects, workspaces, users, and manage webhooks. Use this skill when users want to manage work items, track projects, or integrate with Asana workflows. For other third party apps, us | |
| Attio Attio API integration with managed OAuth. Manage CRM data including people, companies, and custom objects. Use this skill when users want to create, read, update, or delete records in Attio, manage tasks, notes, comments, lists, meetings, o | |
| basecamp Basecamp API integration with managed OAuth. Manage projects, to-dos, messages, schedules, documents, and team collaboration. Use this skill when users want to create and manage projects, to-do lists, schedule events, or collaborate with te | |
| Baserow Baserow API integration with managed API key authentication. Manage database rows, fields, and tables. Use this skill when users want to read, create, update, or delete Baserow database rows, or query data with filters. For other third part | |
| beehiiv beehiiv API integration with managed OAuth. Manage newsletter publications, subscriptions, posts, custom fields, segments, and automations. Use this skill when users want to manage newsletter subscribers, create posts, organize segments, or | |
| box Box API integration with managed OAuth. Manage files, folders, collaborations, and cloud storage. Use this skill when users want to upload, download, share, or organize files and folders in Box. For other third party apps, use the api-gatew | |
| Brave Search Brave Search API integration with managed authentication. Search the web, images, news, and videos with privacy-focused search. Use this skill when users want to search the web, find images, get news, or search videos using Brave Search. Fo | |
| Brevo Brevo API integration with managed OAuth. Email marketing, transactional emails, SMS, contacts, and CRM. Use this skill when users want to send emails, manage contacts, create campaigns, or work with Brevo lists and templates. For other thi | |
| Buffer Buffer API integration with managed authentication. Schedule and manage social media posts across multiple platforms. Use this skill when users want to schedule posts, manage channels, view organizations, or create content ideas in Buffer. | |
| Cal.com Cal.com API integration with managed OAuth. Manage event types, bookings, schedules, availability, calendars, conferencing, webhooks, teams, verified resources, and user profile. All write operations require explicit user approval. Webhooks | |
| Calendly Calendly API integration with managed OAuth. Access event types, scheduled events, invitees, availability, and manage webhooks. Use this skill when users want to view scheduling data, check availability, book meetings, or integrate with Cal | |
| CallRail CallRail API integration with managed OAuth. Track and analyze phone calls, manage tracking numbers, companies, and tags. Use this skill when users want to access call data, manage tracking numbers, view call analytics, or organize calls wi | |
| chargebee Chargebee API integration with managed OAuth. Install only if you need Chargebee billing administration. Connect with least-privilege access, verify the intended connection ID before each request, and revoke unused connections promptly. Thi | |
| ClickFunnels ClickFunnels API integration with managed OAuth. Manage contacts, products, orders, courses, forms, and webhooks. Use this skill when users want to create sales funnels, manage contacts, process orders, or build marketing automation. For ot | |
| ClickSend ClickSend API integration with managed authentication. Send SMS, MMS, and voice messages, manage contacts, lists, verified email addresses, and account configuration. All write operations require explicit user approval. Sending SMS/MMS/voic | |
| ClickUp ClickUp API integration with managed OAuth. Access tasks, lists, folders, spaces, workspaces, users, and manage webhooks. Use this skill when users want to manage work items, track projects, or integrate with ClickUp workflows. For other th | |
| clio Clio API integration with managed OAuth. This is a write-capable integration — it can read, create, update, and delete legal practice data including matters, contacts, activities, tasks, documents, calendar entries, time entries, and billin | |
| clockify Clockify API integration with managed OAuth. Track time, manage projects, clients, tasks, and workspaces. Use this skill when users want to track time, create or manage projects, view time entries, or manage workspace members. For other thi | |
| Coda Coda API integration with managed OAuth. Manage docs, pages, tables, rows, and formulas. Use this skill when users want to read, create, update, or delete Coda docs, pages, tables, or rows. For other third party apps, use the api-gateway sk | |
| cognito-forms Cognito Forms API integration with managed OAuth. Access forms, entries, and documents. Use this skill when users want to create, read, update, or delete form entries, or retrieve form submissions. For other third party apps, use the api-ga | |
| CompanyCam CompanyCam API integration with managed OAuth. Manage projects, photos, users, tags, groups, documents, checklists, labels, collaborators, webhooks, and company info for contractor photo documentation. All write operations (create, update, | |
| Confluence Confluence API integration with managed OAuth. Manage pages, spaces, blogposts, comments, and attachments. Use this skill when users want to create, read, update, or delete Confluence content, manage spaces, or work with comments and attach | |
| constant-contact Constant Contact API integration with managed OAuth. This is a write-capable integration — it can read, create, update, delete, and bulk-modify contacts, email campaigns, contact lists, tags, custom fields, segments, and marketing analytics | |
| Dropbox Dropbox API integration with managed OAuth. Files, folders, search, metadata, and cloud storage. Use this skill when users want to manage files and folders in Dropbox, search content, or work with file metadata. For other third party apps, | |
| dropbox-business Dropbox Business API integration with managed OAuth. Full admin access to team members, groups, team folders, devices, audit logs, member file access, sharing, and file requests for Dropbox Business teams. This is an admin-level integration | |
| ElevenLabs ElevenLabs API integration with managed authentication. AI-powered text-to-speech, voice cloning, sound effects, and audio processing. Use this skill when users want to generate speech from text, clone voices, create sound effects, or proce | |
| eventbrite Eventbrite API integration with managed OAuth. Manage events, venues, ticket classes, orders, and attendees. Use this skill when users want to create and manage events, check orders, view attendees, or access event categories. For other thi | |
| Exa Exa API integration with managed API key authentication. Perform neural web search, retrieve page contents, find similar pages, get AI-generated answers, and run async research tasks. Use this skill when users want to search the web, extrac | |
| fal.ai fal.ai API integration with managed API key authentication. Run AI models for image generation, video generation, audio processing, and more. Use this skill when users want to generate images (Flux, SDXL), create videos (Minimax), upscale i | |
| fastmail Fastmail JMAP API integration with managed authentication. Read, search, organize, and send email; manage mailboxes, threads, drafts, identities, contacts, and masked email addresses. Use this skill when users want to list or search Fastmai | |
| Fathom Fathom API integration with managed OAuth. Access meeting recordings, transcripts, summaries, and manage webhooks. Use this skill when users want to retrieve meeting content, search recordings, or set up webhook notifications for new meetin | |
| firebase Firebase Management API integration with managed OAuth. Manage Firebase projects, web apps, Android apps, and iOS apps. Use this skill when users want to list Firebase projects, create or manage apps, get app configurations, or link Google | |
| Firecrawl Firecrawl API integration with managed authentication. Scrape, crawl, map, and search web content. Use this skill when users want to extract content from websites, crawl entire sites, map URLs, or search the web. For other third party apps, | |
| Fireflies.ai Fireflies.ai GraphQL API integration with managed OAuth. Access meeting transcripts, summaries, users, contacts, and AI-powered meeting analysis. Use this skill when users want to retrieve meeting transcripts, search conversations, analyze | |
| Front Front API integration with managed OAuth. Manage conversations, messages, contacts, tags, inboxes, teammates, and teams. Use this skill when users want to interact with Front - managing customer communications, conversations, contacts, or t | |
| GetResponse GetResponse API integration with managed OAuth. Manage email marketing campaigns, contacts, newsletters, autoresponders, segments, workflows, ecommerce/shops, SMS, landing pages, webinars, transactional emails, forms, and account data. All | |
| GitHub GitHub API integration with managed OAuth. Access repositories, issues, pull requests, commits, branches, and users. Use this skill when users want to interact with GitHub repositories, manage issues and PRs, search code, or automate workfl | |
| gmail Gmail API integration with managed OAuth. Read, send, and manage emails, threads, labels, and drafts. Use this skill when users want to interact with Gmail. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/ | |
| Google Ads Google Ads API integration with managed OAuth. Query campaigns, ad groups, keywords, and performance metrics with GAQL. Use this skill when users want to interact with Google Ads data. For other third party apps, use the api-gateway skill ( | |
| google-analytics Google Analytics API integration with managed OAuth. This skill includes two separate APIs: the Admin API (write-capable — can create, update, and delete accounts, properties, and data streams) and the Data API (read-only — runs reports on | |
| google-apps-script Google Apps Script API integration with managed OAuth. Manage Apps Script projects, deployments, versions, and execute script functions. Use this skill when users want to create or update Apps Script projects, manage deployments and version | |
| Google BigQuery Google BigQuery API integration with managed OAuth. Run SQL queries, manage datasets and tables, and analyze data at scale. Use this skill when users want to query BigQuery data, create or manage datasets/tables, run analytics jobs, or work |
17,751–17,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.