Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Conversation Summarizer Summarize long conversations, chat histories, and discussion threads into structured summaries with key decisions, action items, and topics — optimized for m... | |
| Daily Standup Generator Generate structured daily standup reports by analyzing git commits, pull request activity, issue trackers, and project context. Produces yesterday/today/bloc... | |
| Dockerfile Optimizer Optimize Dockerfiles for smaller images, faster builds, better security, and production readiness — multi-stage builds, layer caching, vulnerability reduction. | |
| Eslint Config Generator Generate optimal ESLint configurations based on project type, framework, and team preferences — flat config format, plugin selection, and rule tuning. | |
| Etsy Listing Optimizer Audit and optimize Etsy listings for SEO, conversion, and shop placement. Reviews titles, tags, descriptions, photos, attributes, pricing, and shipping to im... | |
| Feature Toggle Manager Audit, manage, and clean up feature flags across codebases to reduce toggle debt | |
| Hallucination Detector Detect and flag hallucinations in LLM outputs by cross-referencing claims against source documents, code, and verifiable data. Essential for RAG pipelines an... | |
| Incident Commander Guide incident response with structured communication, timeline tracking, severity assessment, stakeholder updates, and post-incident review — a virtual inci... | |
| Incident Postmortem Generate structured, blame-free incident postmortem reports from logs, timeline data, and incident metadata. Produces root cause analysis, impact assessment,... | |
| Linkedin Profile Optimizer Audit and rewrite LinkedIn profiles for recruiter visibility, inbound leads, and category authority. Diagnoses headline, About, Experience, Skills, Featured,... | |
| Log Analyzer Analyze application logs to produce actionable error digests with pattern detection, severity classification, trend analysis, and remediation recommendations... | |
| Online Course Creator Coach someone through creating, launching, and selling an online course — niche validation, curriculum design, lesson structure, recording workflow, platform... | |
| Runbook Generator Generate operational runbooks from project files. Scans Dockerfiles, docker-compose.yml, systemd units, Makefiles, package.json, and config files to produce... | |
| Sentry Integration Sentry error tracking — list, triage, and resolve issues; manage releases and source maps via CLI and REST API. | |
| Shopify Store Optimizer Audit Shopify stores end-to-end and produce a prioritized fix list to lift conversion rate, AOV, and SEO traffic. Diagnoses theme speed, product page anatomy... | |
| Sitemap Generator Generate XML sitemaps by crawling a website or scanning local files. Auto-discovers pages via link extraction. Supports local HTML/MD file scanning with last... | |
| Slack Integration Slack messaging — send messages, manage channels, upload files, add reactions, and automate team notifications via CLI and API. | |
| Tech Debt Tracker Identify, categorize, and prioritize technical debt across a codebase — analyze TODOs, complexity hotspots, dependency age, test coverage gaps, and code dupl... | |
| Code Complexity Analyzer Measure cyclomatic complexity, cognitive complexity, and structural metrics for Python, JavaScript/TypeScript, and Go code. Use when analyzing code quality,... | |
| Codebase Migration Planner Plan complex codebase migrations — framework upgrades, language transitions, architecture refactors. Analyze dependencies, estimate effort, map migration pat... | |
| Codebase Onboarder AI-powered codebase analysis — generate architecture docs, onboarding guides, and key-flow walkthroughs for any project. Use when joining a new codebase, onb... | |
| Codebase Stats Analyze project metrics: lines of code, language distribution, function complexity, code-to-comment ratio, test coverage indicators, dependency counts, large... | |
| Commit Message Linter Validate git commit messages against Conventional Commits spec and configurable rules. Use when linting commit messages, enforcing commit conventions, checki... | |
| Component Library Audit Audit React, Vue, or Svelte component libraries — find unused components, inconsistent props, missing documentation, accessibility issues, missing tests, and... | |
| Composer Json Validator Validate and lint PHP Composer composer.json files for structure, dependencies, autoload, and best practices. Use when asked to lint, validate, check, or aud... | |
| Config Drift Scanner Detect configuration drift across environments (dev, staging, production). Compare config files, environment variables, feature flags, and secrets across dep... | |
| Content Repurposer Tool Repurpose long-form content (blog posts, articles, newsletters, YouTube transcripts) into platform-optimized social media posts, Twitter/X threads, LinkedIn... | |
| CORS Scanner Scan web endpoints for CORS misconfigurations. Detect origin reflection, wildcard policies, null origin acceptance, credential leaks, subdomain trust, HTTP o... | |
| Course Creator Coach End-to-end online-course creator coach (Udemy, Teachable, Kajabi, Thinkific, Podia, self-hosted). Use when a creator asks for niche/topic validation, curricu... | |
| Crontab Validator Validate, explain, lint, and calculate next run times for cron expressions. Use when asked to check cron syntax, explain a crontab entry, find next scheduled... | |
| CSP Policy Generator Generate, validate, and tighten Content Security Policy (CSP) headers for web applications. Analyze existing pages to discover resource origins, build least-... | |
| Dagster Pipeline Analyzer Analyze Dagster pipelines and software-defined assets for quality, scheduling, partitioning, IO managers, resource configuration, and observability. Checks a... | |
| Dark Launch Controller Plan and execute dark launches with feature flags, performance monitoring, and gradual exposure rollouts | |
| Data Anonymizer Anonymize sensitive data in databases, files, and APIs for testing and compliance. Detect PII (names, emails, SSNs, addresses, phone numbers), apply anonymiz... | |
| Data Quality Checker Validate CSV, JSON, and JSONL data files for quality issues. Detects missing values, duplicates, type inconsistencies, statistical outliers, format violation... | |
| Data Quality Validator Validate data quality in pipelines by checking completeness, consistency, freshness, accuracy, and distribution anomalies. Define expectations, profile data... | |
| Database Replication Advisor Analyze database replication topology, detect lag, and recommend replication strategy based on CAP tradeoffs | |
| Datadog Dashboard Builder Design Datadog dashboards and monitors — recommend metrics, widget layouts, alerting thresholds, and SLO definitions. Analyze existing dashboards for blind s... | |
| Dbt Model Auditor Audit dbt (data build tool) projects for model quality, test coverage, documentation completeness, performance, and adherence to best practices. Checks namin... | |
| Dead Code Finder Find and remove dead code in JavaScript/TypeScript projects. Detects unused exports, unreferenced files, orphaned components, unused dependencies, and dead f... | |
| Dead Letter Queue Analyzer Analyze dead letter queue (DLQ) messages to identify failure patterns, root causes, and remediation strategies. Supports AWS SQS, RabbitMQ, Kafka, Azure Serv... | |
| Dependency Health Check Multi-ecosystem dependency audit — find outdated, vulnerable, unused, and license-incompatible packages across npm, pip, cargo, go, and composer. Use when as... | |
| Dependency Impact Analyzer Analyze the blast radius of upgrading, removing, or replacing a dependency — trace imports, find affected files, check test coverage of impacted code, detect... | |
| Dependency License Audit Scan project dependencies for license compatibility issues, GPL contamination, and compliance violations. Supports npm, pip, Go, Rust, and Ruby ecosystems. U... | |
| Devcontainer Validator Validate devcontainer.json files for syntax, structure, features, ports, lifecycle scripts, customizations, and security best practices in VS Code Dev Contai... | |
| Docker Compose Linter Lint docker-compose.yml files for security, best practices, and port conflicts. | |
| Docker Compose Optimizer Optimize Docker Compose configurations for development and production — audit services, networking, volumes, health checks, and resource management. | |
| Dockerignore Linter Lint, validate, and audit .dockerignore files for syntax issues, security risks, missing patterns, and optimization opportunities. Use when asked to lint, va... | |
| Dvc Pipeline Auditor Audit DVC (Data Version Control) pipelines for reproducibility, storage efficiency, and tracking correctness. Checks dvc.yaml, dvc.lock, .dvc files, remote s... | |
| Editorconfig Linter Validate .editorconfig syntax and check source files for EditorConfig compliance. |
19,201–19,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.