Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Pipedrive Pipedrive API integration with managed OAuth. Manage deals, persons, organizations, activities, and pipelines. Use this skill when users want to interact with Pipedrive CRM. For other third party apps, use the api-gateway skill (https://cla | |
| podio Podio API integration with managed OAuth. Manage workspaces, apps, items, tasks, and comments. Use this skill when users want to read, create, update, or delete Podio items, manage tasks, or interact with Podio apps and workspaces. For othe | |
| PostHog PostHog API integration with managed authentication. Product analytics, feature flags, session recordings, experiments, and more. Use this skill when users want to query analytics events, manage feature flags, analyze user behavior, view se | |
| QuickBooks QuickBooks API integration with managed OAuth. Install only if you need QuickBooks accounting administration. Connect with a least-privileged QuickBooks account, verify the intended connection ID before each request, and revoke unused conne | |
| quo Quo API integration with managed OAuth. Manage calls, messages, contacts, and conversations for your business phone system. Use this skill when users want to send SMS, list calls, manage contacts, or retrieve call recordings/transcripts. Fo | |
| reducto Reducto document processing API integration with managed API key authentication. Parse, extract, split, and edit documents. Use this skill when users want to process documents, extract structured data, or modify PDFs and DOCX files. For oth | |
| Resend Resend API integration with managed authentication. Send transactional emails, manage domains, contacts, templates, and broadcasts. Use this skill when users want to send emails, manage email templates, create contact lists, or set up email | |
| Salesforce Salesforce CRM API integration with managed OAuth. Install only if you need Salesforce CRM administration. Connect with the narrowest Salesforce permissions available, prefer sandbox orgs for destructive or batch work, verify the intended c | |
| SendGrid SendGrid API integration with managed OAuth. Send emails, manage contacts, templates, suppressions, statistics, sender identities, unsubscribe groups, and SendGrid API keys. All write operations require explicit user approval. Sending email | |
| Sentry Sentry API integration with managed authentication. Monitor errors, issues, and application performance. Use this skill when users want to list issues, retrieve events, manage projects, teams, or releases in Sentry. For other third party ap | |
| Microsoft SharePoint SharePoint API integration via Microsoft Graph with managed OAuth. Access SharePoint sites, lists, document libraries, and files. Use this skill when users want to interact with SharePoint for document management, list operations, or site c | |
| SignNow SignNow API integration with managed OAuth. E-signature platform for sending, signing, and managing documents. Use this skill when users want to upload documents, send signature invites, create templates, or manage e-signature workflows. Fo | |
| Slack Slack API integration with managed OAuth. Send messages, manage channels, search conversations, and interact with Slack workspaces. Use this skill when users want to post messages, list channels, get user info, or automate Slack workflows. | |
| snapchat Snapchat Marketing API integration with managed OAuth. Manage ad accounts, campaigns, ad squads, ads, creatives, and audiences. Use this skill when users want to create and manage Snapchat advertising campaigns, view ad performance stats, o | |
| squarespace Squarespace Commerce API integration with managed OAuth. Manage products, inventory, orders, customer profiles, and transactions. Use this skill when users want to manage e-commerce operations on Squarespace stores. For other third party ap | |
| Square Square API integration with managed OAuth. Install only if you need Square administration. Connect with the least-privileged Square account and OAuth scopes available, verify the intended connection ID before each request, and revoke unused | |
| Stripe Stripe API integration with managed OAuth. This is a write-capable financial integration for customers, subscriptions, invoices, products, prices, and payments. Install only if you need Stripe administration. Connect with the least-privileg | |
| sunsama Sunsama MCP integration with managed authentication. Manage daily tasks, calendar events, backlog, objectives, time tracking, and email threads from connected accounts (Gmail, Outlook). Use this skill when users want to interact with Sunsam | |
| Supabase Supabase API integration with managed authentication. Access database tables via PostgREST, manage auth users, and handle storage buckets. Use this skill when users want to interact with Supabase projects - querying database tables, managin | |
| Systeme.io Systeme.io API integration with managed OAuth. Manage contacts, contact tags, contact custom fields, tags, course enrolments, community memberships, and subscriptions. Use this skill when users want to manage Systeme.io contacts, enroll stu | |
| Tally Tally API integration with managed OAuth. Manage forms, submissions, workspaces, webhooks, organization users, and organization invites. All write operations require explicit user approval. Organization user removal and invite management af | |
| Tavily Tavily API integration with managed API key authentication. Perform AI-powered web search, extract content from URLs, crawl websites, map site structure, and run research tasks. Use this skill when users want to search the web, extract page | |
| Telegram Bot Telegram Bot API integration with managed authentication. Send messages, manage chats, handle updates, and interact with users through your Telegram bot. Use this skill when users want to send messages, create polls, manage bot commands, or | |
| TickTick TickTick API integration with managed OAuth. Manage tasks, projects, and task lists. Use this skill when users want to create, update, complete, or organize tasks and projects in TickTick. For other third party apps, use the api-gateway ski | |
| Todoist Todoist API integration with managed OAuth. Manage tasks, projects, sections, labels, and comments. Use this skill when users want to create, update, complete, or organize tasks and projects in Todoist. For other third party apps, use the a | |
| toggl-track Toggl Track API integration with managed OAuth. Track time, manage projects, clients, and tags. Use this skill when users want to create, read, update, or delete time entries, projects, clients, or tags in Toggl Track. For other third party | |
| Trello Trello API integration with managed OAuth. Manage boards, lists, cards, members, and labels. Use this skill when users want to interact with Trello for project management. For other third party apps, use the api-gateway skill (https://clawh | |
| Twenty CRM Twenty CRM API integration with managed authentication. Manage companies, people, opportunities, notes, tasks, workflows, and workspace members. Use this skill when users want to interact with Twenty CRM data - contacts, deals, activities, | |
| Twilio Twilio API integration with managed OAuth. SMS, voice calls, phone numbers, and communications. Use this skill when users want to send SMS messages, make voice calls, manage phone numbers, or work with Twilio resources. For other third part | |
| typeform Typeform API integration with managed OAuth. Create forms, manage responses, and access insights. Use this skill when users want to interact with Typeform surveys and responses. For other third party apps, use the api-gateway skill (https:/ | |
| unbounce Unbounce API integration with managed OAuth. Build and manage landing pages, track leads, and analyze conversion data. Use this skill when users want to interact with Unbounce for landing page management and lead tracking. For other third p | |
| Vercel Vercel API integration with managed OAuth. Manage projects, deployments, domains, teams, and environment variables. Use this skill when users want to interact with Vercel - deploying apps, managing projects, checking deployment status, or c | |
| vimeo Vimeo API integration with managed OAuth. Video hosting and sharing platform. Use this skill when users want to upload, manage, or organize videos, create showcases/albums, manage folders, or interact with the Vimeo community. For other thi | |
| WATI WATI (WhatsApp Team Inbox) API integration with managed authentication. Send WhatsApp messages, manage contacts, and handle templates. Use this skill when users want to send WhatsApp messages, manage WhatsApp contacts, or work with message | |
| WhatsApp Business WhatsApp Business API integration with managed OAuth. Send messages, manage templates, and handle conversations. Use this skill when users want to interact with WhatsApp Business. For other third party apps, use the api-gateway skill (https | |
| WooCommerce WooCommerce REST API integration with managed OAuth. Access products, orders, customers, coupons, shipping, taxes, reports, webhooks, payment gateways, store settings, and system status tools. All write operations require explicit user appr | |
| WordPress.com WordPress.com API integration with managed OAuth. Manage posts, pages, sites, and content. Use this skill when users want to create, read, update, or delete WordPress.com posts, pages, or manage site content. For other third party apps, use | |
| Wrike Wrike API integration with managed OAuth. Manage tasks, folders, projects, spaces, team collaboration, and administrative functions (users, invitations, access roles, audit log, data export). All write operations require explicit user appro | |
| xero Xero API integration with managed OAuth. Manage contacts, invoices, payments, accounts, and run financial reports. Use this skill when users want to interact with Xero accounting data. For other third party apps, use the api-gateway skill ( | |
| YouTube Analytics YouTube Analytics API integration with managed OAuth. Retrieve channel analytics reports and manage video/playlist/channel groups. Use this skill when users want to query YouTube channel metrics (views, watch time, subscribers), analyze per | |
| YouTube YouTube Data API integration with managed OAuth. Search videos, manage playlists, access channel data, and interact with comments. Use this skill when users want to interact with YouTube. For other third party apps, use the api-gateway skil | |
| YouTube Reporting YouTube Reporting API integration with managed OAuth. Schedule and download bulk YouTube Analytics reports as CSV files. Use this skill when users want to schedule bulk reporting jobs, list available report types, download daily generated r | |
| zoho-bigin Zoho Bigin API integration with managed OAuth. Manage contacts, companies, pipelines, and products in Bigin CRM. Use this skill when users want to read, create, update, or delete CRM records, search contacts, or manage sales pipelines. For | |
| zoho-bookings Zoho Bookings API integration with managed OAuth. Manage appointments, services, staff, and workspaces. Use this skill when users want to book appointments, manage services, view staff availability, or manage workspaces in Zoho Bookings. Fo | |
| zoho-books Zoho Books API integration with managed OAuth. Manage invoices, contacts, bills, expenses, and other accounting data. Use this skill when users want to read, create, update, or delete invoices, contacts, bills, expenses, or other financial | |
| zoho-calendar Zoho Calendar API integration with managed OAuth. Manage calendars and events with full scheduling capabilities. Use this skill when users want to read, create, update, or delete calendar events, manage calendars, or schedule meetings. For | |
| Zoho CRM Zoho CRM API integration with managed OAuth. Manage leads, contacts, accounts, deals, and other CRM records. Use this skill when users want to read, create, update, or delete CRM records, search contacts, manage sales pipelines, access orga | |
| zoho-inventory Zoho Inventory API integration with managed OAuth. Manage items, sales orders, invoices, purchase orders, bills, contacts, and shipments. Use this skill when users want to read, create, update, or delete inventory items, sales orders, invoi | |
| zoho-mail Zoho Mail API integration with managed OAuth. Send, receive, and manage emails, folders, and labels. Use this skill when users want to send emails, read messages, manage folders, or work with email labels in Zoho Mail. For other third party | |
| zoho-people Zoho People API integration with managed OAuth. Manage employees, departments, designations, attendance, leave, and arbitrary Zoho People forms (including custom forms). The forms API provides access to any form configured in the Zoho Peopl |
17,851–17,900 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.