Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Env Config Validator Validate .env files against schemas, compare environments (dev vs prod), detect common mistakes (trailing spaces, placeholders, invalid ports, missing protoc... | |
| Environment Promoter Manage environment promotions (dev → staging → prod) — compare configs between environments, detect drift, generate promotion plans, validate prerequisites,... | |
| Error Budget Tracker Track SLO error budgets across services. Calculate remaining budget from SLI metrics, alert on budget burn rate, recommend development vs reliability investm... | |
| Error Diagnosis Analyze error messages and logs to identify root causes of crashes, build failures, or runtime errors and suggest actionable fixes with code examples. | |
| Eslint Flat Config Validator Validate ESLint v9+ flat config files (JSON-exported) for structural correctness, language options, rules configuration, plugin hygiene, file patterns, and b... | |
| Etsy Seller Coach End-to-end Etsy private-label / handmade / digital-product seller coach. Use when a seller asks for niche validation, listing SEO, ads strategy, account-qual... | |
| Feature Flag Cleanup Audit feature flag debt across LaunchDarkly, Unleash, Flagsmith, GrowthBook, Split, and home-grown flag systems. Detects stale flags (older than 90 days, ful... | |
| Fiverr Gig Optimizer Coach Fiverr sellers (and Etsy/Creative Market gig-style platforms) on gig titles, descriptions, packaging, pricing, gig images/video, search ranking (Fiverr... | |
| Flaky Test Detective Detect, diagnose, and fix flaky tests. Identify tests with non-deterministic outcomes by analyzing CI history, test timing, shared state, race conditions, an... | |
| Freelance Developer Coach End-to-end coach for freelance / contract / independent software developers (full-stack / backend / frontend / mobile / DevOps / data / ML / staff-eng-as-a-s... | |
| Gdpr Data Export Tool Build, audit, and operate Article 15 (right of access) and Article 20 (data portability) data export pipelines for GDPR, plus the equivalent CCPA/CPRA "right... | |
| Git Changelog Generator Generate structured changelogs from git history using conventional commits, with support for multiple formats, AI-enhanced descriptions, and customizable ran... | |
| Git Release Notes Generate polished release notes and changelogs from git history. Analyzes commits between tags/refs, categorizes changes (features, fixes, breaking changes,... | |
| Git Repo Cleaner Audit and clean up Git repositories. Find stale/merged branches, large files in history, orphaned tags, repo bloat, and generate cleanup scripts. Use when as... | |
| Github Actions Linter Lint and validate GitHub Actions workflow YAML files for common mistakes, security issues, deprecated actions, and best practices. Use when asked to lint, va... | |
| Github Actions Optimizer Optimize GitHub Actions workflows for speed, cost, security, and reliability — analyze run times, cache strategies, job parallelism, and runner selection. | |
| Gitlab CI Linter Lint and validate GitLab CI/CD pipeline YAML files (.gitlab-ci.yml) for syntax errors, security issues, deprecated patterns, and best practices. Use when ask... | |
| Grant Writing Coach Coach non-profits, researchers, and artists to write, structure, and improve grant proposals and match projects with appropriate funders across major funding... | |
| Helm Chart Linter Lint and validate Helm charts for structure, security, dependencies, and best practices. Use when asked to lint, validate, check, or audit Helm charts, verif... | |
| Htaccess Toolkit Generate, validate, lint, and explain Apache .htaccess files. Use when asked to create htaccess rules, redirect URLs, set security headers, enable caching, c... | |
| HTTP Security Headers Analyze HTTP security headers for any URL. Check for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CORS, and more.... | |
| Incident Postmortem Generator Generate structured, blame-free incident postmortem reports from logs, timeline data, and incident metadata. Produces root cause analysis, impact assessment,... | |
| Incident Response Runbook Create, maintain, and execute detailed incident response runbooks to guide triage, communication, and post-incident reviews for production outages. | |
| Infrastructure Drift Detector Detect drift between Infrastructure-as-Code definitions (Terraform, Pulumi, CloudFormation, CDK) and actual deployed state. Identify untracked resources, man... | |
| Jest Config Validator Validate jest.config.ts/js/json and Jest configuration in package.json for deprecated options, transform conflicts, and best practices. Use when validating J... | |
| Jsonpath Query Query JSON data using JSONPath expressions. Use when asked to extract, filter, search, or navigate JSON data. Supports recursive descent, wildcards, array sl... | |
| JWT Debugger Decode, validate, and debug JSON Web Tokens. Inspect headers, payloads, signatures, expiration, claims, and key mismatches. Diagnose common JWT issues in aut... | |
| K8s Cost Optimizer Find and rank Kubernetes cost-saving opportunities from kubectl, metrics-server, kube-state-metrics, and cloud billing. Identifies overprovisioned CPU/memory... | |
| Kdp Author Coach End-to-end Amazon KDP (Kindle Direct Publishing) self-publishing coach. Use when an author asks for niche/keyword research, manuscript prep (front-matter, To... | |
| Key Rotation Planner Plan and track cryptographic key rotations for API keys, encryption keys, signing keys, and service credentials. Inventory all keys, assess rotation urgency,... | |
| Kpi Tree Design Coach Coach a CEO, COO, CFO, Head of Strategy, Head of Operations, or VP-level functional leader through designing or rebuilding a KPI tree (also known as North St... | |
| Legal Doc Summarizer Read contracts, NDAs, terms of service, employment agreements, leases, and SaaS MSAs and produce a structured summary that flags risk, surfaces hidden obliga... | |
| LLM Eval Harness Evaluate LLM outputs systematically — run test suites, score responses for accuracy/relevance/safety, compare models, and detect regressions in AI applications. | |
| Log Pii Redactor Detect and redact personally identifiable information (PII) in application logs to comply with GDPR, CCPA, HIPAA, and PCI DSS. Knows the realistic 2026 PII s... | |
| Logfile Analyzer Analyze application logs to produce actionable error digests with pattern detection, severity classification, trend analysis, and remediation recommendations... | |
| Makefile Linter Lint Makefiles for common issues — tabs, .PHONY, unused vars, portability, and best practices. | |
| Maven Pom Validator Validate and lint Maven pom.xml files for structure, dependencies, plugins, and best practices. Use when asked to lint, validate, check, or audit pom.xml fil... | |
| Migration Safety Checker Check database migrations for safety — detect data loss risks, locking operations, backward compatibility issues, and deployment ordering problems across SQL... | |
| Mobile App Launch Coach End-to-end coach for indie devs / small teams launching mobile apps on iOS App Store + Google Play (and emerging app stores). Covers idea + ASO niche validat... | |
| Monorepo Analyzer Analyze monorepo structure — detect workspace tools (npm/yarn/pnpm/lerna/nx/turbo/cargo/go), map inter-package dependencies, find unused packages, detect ver... | |
| Mutation Test Runner Run mutation testing to measure real test suite effectiveness. Inject code mutations (flip conditions, remove calls, change returns), run tests against mutan... | |
| N Plus One Detector Detect N+1 query problems in application code and ORM usage. Analyze database query patterns, find loops that generate excessive queries, and recommend fixes... | |
| Nginx Config Linter Lint, validate, and audit nginx configuration files for syntax errors, security issues, and performance problems. | |
| Nodemon Config Validator Validate nodemon config files (nodemon.json, .nodemonrc, package.json#nodemonConfig) for watch settings, ignore patterns, exec conflicts, and best practices.... | |
| Oauth Debugger Debug OAuth 2.0 and OIDC flows. Trace authorization code, PKCE, client credentials, and implicit flows. Diagnose redirect URI mismatches, scope issues, token... | |
| Okr Progress Tracker Track and evaluate OKR (Objectives and Key Results) progress by parsing OKR definitions from markdown, YAML, or JSON files. Scores key results, calculates ob... | |
| Openapi Validator Validate and improve OpenAPI/Swagger specifications — check for completeness, consistency, security definitions, and API design best practices. | |
| incident-postmortem Generate structured, blame-free incident postmortem reports from logs, timeline data, and incident metadata. Produces root cause analysis, impact assessment,... | |
| runbook-generator Generate operational runbooks from project files. Scans Dockerfiles, docker-compose.yml, systemd units, Makefiles, package.json, and config files to produce... | |
| Package Json Linter Lint and validate package.json files for common mistakes, missing fields, security issues, and best practices. Use when asked to lint, validate, audit, or ch... |
19,251–19,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.