Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Svelte Component Auditor Audit Svelte and SvelteKit components for performance, accessibility, reactive statement usage, store design, and SSR compatibility. Use when reviewing Svelt... | |
| Swc Config Validator Validate SWC config files (.swcrc, package.json#swc) for parser settings, transform conflicts, module type issues, and best practices. Use when validating SW... | |
| Systemd Unit Generator Generate, validate, and lint systemd unit files (.service, .timer, .socket, .mount) with hardening and best practices. | |
| Tailwind Config Validator Validate JSON-exported Tailwind CSS configuration files for structural issues, content path problems, theme misconfiguration, and best practices. Use when au... | |
| Tailwind Optimizer Optimize Tailwind CSS usage — detect unused classes, identify opportunities for @apply extraction, audit responsive design, and reduce bundle size. | |
| Task Retrospective Conduct structured self-evaluations after tasks to analyze efficiency, accuracy, approach quality, and extract patterns for improved future performance. | |
| Tech Debt Scanner Scan codebases for technical debt — TODO/FIXME comments, deprecated APIs, complexity hotspots, outdated patterns, missing tests, large files — then prioritiz... | |
| Terraform Cost Estimator Estimate infrastructure costs from Terraform plans — analyze resource changes, predict monthly spend, compare alternatives, and identify cost optimization op... | |
| Terraform Module Linter Lint Terraform modules and configurations (.tf files) for structure, naming, security, and best practices. 24 rules across structure, naming, security, and b... | |
| Terraform Plan Reviewer Review terraform plan output for risk before apply. Detects destructive changes (force replace and destroy on stateful resources), drift from real state, mis... | |
| Test Impact Analyzer Determine which tests need to run for a given code change — trace file dependencies, map source-to-test relationships, identify untested changes, and priorit... | |
| Thread Dump Analyzer Analyze thread dumps and goroutine dumps to diagnose deadlocks, thread pool exhaustion, contention hotspots, and blocked threads. Supports JVM thread dumps,... | |
| TLS Configuration Auditor Audit TLS/SSL configuration of servers and applications. Check protocol versions, cipher suites, certificate chain validity, HSTS headers, and compliance wit... | |
| Toml Validator Validate, lint, diff, and inspect TOML configuration files. Use when asked to check TOML syntax, compare TOML configs, show TOML structure, validate pyprojec... | |
| Trivy Security Scanner Run Trivy vulnerability scans on containers, filesystems, and IaC — then triage findings by exploitability, reachability, and business impact with AI-powered... | |
| Tsconfig Validator Validate and lint tsconfig.json files for common mistakes, conflicting compiler options, strictness gaps, and best practices. Use when asked to lint, validat... | |
| Twitter Thread Coach Audit, restructure, and rewrite Twitter/X threads for engagement, follower growth, and click-through. Critiques hooks, thread length, visual hierarchy, closi... | |
| Upwork Proposal Coach Coach freelancers on crafting targeted Upwork (and similar platforms) proposals that improve bid-to-interview ratios, optimize pricing, and select worthwhile... | |
| Vercel Config Analyzer Analyze Vercel project configurations — audit vercel.json, framework detection, build settings, edge functions, headers, redirects, rewrites, environment var... | |
| Vite Config Validator Validate Vite configuration files (JSON-exported) for structural correctness, build settings, server security, resolve/CSS hygiene, plugin deprecations, and... | |
| Vitest Config Validator Validate vitest.config.ts/js and vitest workspace configurations for syntax, deprecated options, plugin conflicts, and best practices. Use when validating Vi... | |
| Vue Composition Analyzer Analyze Vue 3 Composition API usage — audit reactivity patterns, composable design, ref vs reactive choices, computed properties, watcher usage, and componen... | |
| Vulnerability Prioritizer Prioritize vulnerabilities beyond CVSS scores using EPSS (Exploit Prediction Scoring), CISA KEV, asset criticality, reachability analysis, and exploit maturi... | |
| Webpack Config Validator Validate JSON-exported webpack configuration files for structural issues, deprecated loaders/plugins, optimization gaps, and best practices. Use when auditin... | |
| Websocket Tester Test WebSocket connections, message flows, and real-time features. Connect to endpoints, send/receive messages, test reconnection logic, measure latency, val... | |
| XML Sitemap Generator Generate XML sitemaps by crawling a website or scanning local files. Auto-discovers pages via link extraction. Supports local HTML/MD file scanning with last... | |
| Youtube Channel Launch Coach Guide creators from channel idea to first 1000+ subscribers, optimizing niche, format, titles, thumbnails, retention, and monetization strategy using 2026 Yo... | |
| HaloArena Play turn-based arena games over REST | |
| HaloArena Play turn-based arena games over REST | |
| ClawArena TEST (Hermes) Play turn-based arena games over REST | |
| Headcount Labs — Job Search & Hiring Data Use when the user asks to find jobs, search current job postings, count how many jobs match a role/company/place, get salary ranges, or analyze the job market (top employers, top metros, remote vs on-site split, pay transparency). Covers jo | |
| Raphael Ai Image 通过输入文字提示词，使用 Raphael AI 免费生成高质量无水印图片，支持24种视觉风格和电商优化场景。 | |
| Gousto Meal Picker Automate weekly Gousto meal kit selection via REST API with configurable dietary rules (allergens, cook time, protein variety). Handles order updates, menu s... | |
| Scientific and Technological Novelty Search Report Review 根据《科技查新技术规范》对科技查新报告进行专业审核，按"只报问题"原则逐步检查查新点理解、检索词与中英文翻译、检索式构造、文献筛选合理性，最终仅输出需要注意和优化改进的事项。适用于用户提到"科技查新报告""查新报告审核""报告质量审查"等场景。 | |
| Privacy Concierge Personal AI assistant that monitors your online privacy, calculates exposure scores, automates data broker opt-outs, tracks breaches, and offers privacy advice. | |
| Mikrotik Routeros Expert-level management of MikroTik RouterOS devices and VSOL GPON OLTs via SSH or RouterOS API (port 8728/8729) and REST API (port 80/443). Use this skill w... | |
| charming Build, inspect, update, and call hosted personal apps with the Charming CLI. Covers the app contract (manifest, capabilities, env.storage, routes, window.charming.api), the sandbox rules, and the CLI workflow. Use when a user wants to creat | |
| circle-png-image Convert PNG images into circular PNG avatars with transparent corners. Use when the user asks to crop, mask, cut out, or convert a PNG image into a circle. | |
| Backend Patterns Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes. | |
| MaxClaw User Guide MaxClaw platform user guide and FAQ. Use when answering questions about MaxClaw deployment, one-click setup, Telegram connection, credit usage, troubleshooti... | |
| Quiver Ai AI-native SVG vector graphics generation tool. Use when generating SVG graphics from text prompts or converting images to SVG. Supports: (1) Text-to-SVG gene... | |
| QuiverAI Generate and vectorize SVG graphics via the QuiverAI API (Arrow model). Use when the user asks to create logos, icons, or illustrations as SVG, convert raste... | |
| QuiverAI Quickstart QuiverAI API快速入门指南。当用户想要学习如何使用QuiverAI的SVG生成API时使用此技能。包括API密钥创建、环境配置、SDK安装和发送请求的完整流程。 | |
| AI Stock Research Team Multi-role AI stock research team. When a user asks to analyze a stock (e.g. "分析贵州茅台", "analyze NVDA", "帮我看看AAPL"), this skill orchestrates technical, fundam... | |
| video-workflow-builder 视频创作工作流生成器。当用户想为自己的账号定制一套完整的视频创作流程（选题、文稿、标题、封面），或说"帮我做个账号工作流""定制视频流程""我想在抖音/B站/小红书/视频号/百家号做XX内容"时使用。它只问三件事（平台、垂类、人设），其余靠联网研究补齐，先给出账号定位诊断供确认，再生成一套可安装使用的专属工作流 skill。 | |
| Agentify Analyze, rewrite, and generate design specs to make web pages and websites more easily usable by AI agents, web scrapers, and automation tools. Use when (1)... | |
| Analyse Data Use this skill when the user wants to create visualizations (charts, dashboards, diagrams, Gantt, PPT), analyze data (Excel/CSV upload, cross-file analysis,... | |
| Analysis Data Use this skill when the user wants to create visualizations (charts, dashboards, diagrams, Gantt, PPT), analyze data (Excel/CSV upload, cross-file analysis,... | |
| Chart AI Use this skill when the user wants to create visualizations (charts, dashboards, diagrams, Gantt, PPT), analyze data (Excel/CSV upload, cross-file analysis,... | |
| Chart Generator Use this skill when the user wants to create visualizations (charts, dashboards, diagrams, Gantt, PPT), analyze data (Excel/CSV upload, cross-file analysis,... |
19,351–19,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.