Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| GTYT Reconcile (共同赢账单 vs 到货单对账) 共同赢（GTYT）供应商账单与到货单的三阶段对账流程。用于按月核对「共同赢X月账单-上海-共同赢.xls」与「到货单明细表」在每店每产品上的「单价」「数量」「金额」是否一致，输出两份 Excel：(1) 两表金额差异对比 .xls（全量店名对比 + 25 店差异清单），(2) 共同赢X月账单-已标差异 .xls（在原账单上用黄色背景标出每个差异单元格）。触发关键词：「对账」「核对」「共同赢」「到货单差异」「标差异」「账单 vs 到货」。 | |
| context-game 多题材开放世界对话博弈游戏《上下文》（硬科幻政治惊悚/现代都市/军事/悬疑/商战/校园/情感/穿越/修仙/封闭囚笼/宫廷权谋/末日废土/谍战/江湖武侠十四大题材）。当玩家说"开始游戏/继续游戏/新开一档/玩《上下文》"或要求查看状态、存档、退休写史书时使用。agent 担任游戏引擎，玩家以自由文本行动。 | |
| memories.sh CLI CLI reference and workflows for memories.sh — the persistent memory layer for AI agents. Use when: (1) Running memories CLI commands to add, search, edit, or... | |
| 🦄 Unicon CLI Add and manage 19,000+ icons from 9 libraries in React, Vue, Svelte, or web projects using the Unicon CLI for search, bundles, previews, and tree-shakable co... | |
| findthehuman Social deduction game — 5 AI bots try to identify the human in a chatroom. Compete on a persistent Elo leaderboard. | |
| Accelerator Application Coach End-to-end coach for founders applying to startup accelerators (Y Combinator / Techstars / 500 Global / Antler / a16z Crypto Speedrun / Plug and Play / Mass... | |
| Accessibility Scanner Scan web applications for accessibility issues — WCAG 2.2 compliance, screen reader compatibility, keyboard navigation, color contrast, and ARIA usage. | |
| Adr Generator Architecture Decision Record generator — analyze codebases and document technical decisions with context, alternatives, and consequences. Use when asked to d... | |
| Affiliate Marketer Coach End-to-end affiliate marketer coach (content sites, niche review sites, comparison sites, deal sites, coupon sites, YouTube + TikTok affiliate, newsletter af... | |
| api-cost-tracker Track, analyze, and optimize AI API costs across OpenAI, Anthropic, OpenRouter, Google, and other LLM providers. Parses billing data, usage logs, or API resp... | |
| Airflow Dag Analyzer Analyze Apache Airflow DAG definitions for quality, reliability, and operational best practices. Checks task dependencies, SLA compliance, retry policies, re... | |
| API Changelog Generator Generate and maintain API changelogs from OpenAPI/Swagger specs — track endpoints added, removed, deprecated, or modified between versions. Detect breaking c... | |
| API Contract Tester Validate API contracts between services using consumer-driven contract testing. Generate and verify Pact contracts, OpenAPI compliance tests, and schema comp... | |
| API Diff Compare two OpenAPI 3.x or Swagger 2.0 specs and generate a changelog of breaking and non-breaking changes. Detect removed endpoints, new required parameters... | |
| API Documentation Generator Generate comprehensive API documentation from code — extract endpoints, parameters, response schemas, and examples from Express, FastAPI, Django, Rails, and... | |
| API Mock Generator Generate mock API servers from OpenAPI 3.x and Swagger 2.0 specs. Use when creating mock/stub APIs for frontend development, testing, demos, or CI. Generates... | |
| API Rate Limiter Designer Design and implement API rate limiting strategies — token bucket, sliding window, fixed window, leaky bucket with Redis-backed distributed rate limiting. | |
| Argocd Deployment Analyzer Analyze ArgoCD application sync status, detect configuration drift, review manifests for security and best practices, and diagnose sync failures. | |
| Astro Project Analyzer Analyze and optimize Astro projects — audit configuration, performance, SEO, accessibility, content collections, and integration setup. | |
| Autoscaling Policy Designer Design autoscaling policies based on traffic patterns, cost constraints, and performance SLOs | |
| Avro Schema Manager Manage Apache Avro schemas — validate structure, check forward/backward compatibility, plan schema evolution, audit namespace conventions, and generate code... | |
| AWS Cdk Analyzer Analyze AWS CDK applications for best practices, security, cost optimization, and deployment safety — covers construct patterns, IAM policies, and CloudForma... | |
| B2b Cold Email Coach Coach B2B senders to write, sequence, and deliver cold emails that boost opens and replies without hurting domain reputation or hitting spam. | |
| B2b Saas Pricing Coach Coach for B2B SaaS founders on pricing — choosing the value metric (per-seat, per-API-call, per-MAU, per-revenue-processed, per-asset-monitored, per-feature-... | |
| Babel Config Validator Validate Babel config files (babel.config.json, .babelrc, .babelrc.json, package.json#babel) for deprecated presets, plugin conflicts, ordering issues, and b... | |
| Backpressure Analyzer Detect and resolve backpressure issues in data pipelines, message queues, and streaming systems. Identify bottleneck stages, measure queue depths and process... | |
| Biome Config Validator Validate and lint Biome (biome.json) configuration files for structure, rule conflicts, deprecated options, and best practices. 22 rules across structure, li... | |
| Book Launch Coach Coach an author through writing, launching, and selling a book — fiction or non-fiction, self-published or trad-pubbed, debut or backlist relaunch. Covers co... | |
| Branch Protection Auditor Audit GitHub/GitLab branch protection rules across repositories. Check required reviews, status checks, force push restrictions, admin bypass, and CODEOWNERS... | |
| Browserslist Validator Validate .browserslistrc files and browserslist config in package.json for syntax errors, deprecated browsers, redundant queries, and best practices. Use whe... | |
| Bug Bash Facilitator Plan, run, and debrief a structured pre-release bug bash session. Defines scope (areas, devices, user roles), invites the right participant mix (eng/PM/desig... | |
| Bun Workspace Optimizer Optimize Bun workspaces and monorepos — analyze dependency hoisting, script performance, build pipelines, and workspace configuration for maximum speed. | |
| Cache Strategy Advisor Design and optimize caching strategies for applications. Analyze data access patterns, recommend cache layers (browser, CDN, application, database), configur... | |
| Canary Deployment Analyzer Analyze canary deployments by comparing metrics between canary and baseline. Provide data-driven promotion/rollback recommendations based on error rates, lat... | |
| Capacity Planner Forecast infrastructure capacity needs using historical metrics, growth projections, and cost modeling. Identify bottlenecks before they cause outages and ri... | |
| Cargo Toml Validator Validate Rust Cargo.toml manifests for dependency issues, missing metadata, feature conflicts, workspace config, and crates.io publishing readiness. Use when... | |
| Celery Task Analyzer Analyze Celery task configurations for reliability, performance, and debugging. Checks retry policies, task routing, serialization, result backends, worker c... | |
| Certificate Lifecycle Manager Manage TLS/SSL certificate lifecycle — discovery, monitoring, renewal planning, and rotation. Track certificates across services, alert before expiry, automa... | |
| Changelog Linter Validate CHANGELOG.md files against the Keep a Changelog format (keepachangelog.com). Checks version ordering, date formats, section types, link references,... | |
| Chaos Test Designer Design chaos engineering experiments to test system resilience. Generate failure injection scenarios, define steady-state hypotheses, blast radius controls,... | |
| Chief Of Staff Onboarding Coach Coach a newly-hired Chief of Staff (CoS) through their first 90 days — a role that is high-leverage but role-ambiguous, where success is determined more by s... | |
| Ci Build Cache Advisor Optimize CI/CD build caching across GitHub Actions, GitLab CI, CircleCI, and Jenkins — analyze cache hit rates, recommend cache keys, and reduce build times. | |
| CI Pipeline Optimizer Analyze CI/CD pipelines (GitHub Actions, GitLab CI, CircleCI) and suggest optimizations — caching strategies, parallelization, step elimination, Docker layer... | |
| Circleci Config Validator Validate .circleci/config.yml files for syntax, structure, security, and best practices. Use when validating CircleCI pipeline configuration, auditing CI/CD... | |
| Client Report Generator Generate professional client-facing reports from raw data, metrics, and KPIs. Supports analytics summaries, project status reports, monthly/weekly performanc... | |
| Cloud Tag Enforcer Enforce cloud resource tagging policies for cost allocation, compliance, and governance across AWS/GCP/Azure | |
| Cluster Upgrade Planner Plan Kubernetes cluster upgrades with API deprecation checks, addon compatibility verification, and rollback-safe runbooks | |
| Api Cost Tracker Track, analyze, and optimize AI API costs across OpenAI, Anthropic, OpenRouter, Google, and other LLM providers. Parses billing data, usage logs, or API resp... | |
| Code Review Assistant AI-powered code review assistant that analyzes pull requests for bugs, security issues, performance problems, and style violations with actionable feedback. | |
| Content Repurposer Repurpose long-form content (blog posts, articles, newsletters, YouTube transcripts) into platform-optimized social media posts, Twitter/X threads, LinkedIn... |
19,151–19,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.