Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| com.beycome/listing beycome/mcp.beycome.com List on MLS, sell, show, compare and close your real estate property on beycome. | |
| BeyondFolder Directories beyondfolder/beyondfolder-landing-page Track SaaS directory submissions for your products via API key–gated Streamable HTTP MCP. | |
| Mailyond beyondfolder/mailyond Read, reply to and send email across every domain you connect to Mailyond, via API key over HTTP. | |
| Evolith Architecture Governance beyondnetcode/evolith_arch32 Executable architecture governance: an unevaluated rule is reported as a failure, never a pass. | |
| DalalOS: Indian Stock Market Research (NSE/BSE) beyondnoww/dalalos-indian-stock-research Filing-grounded Indian stock research (NSE/BSE): financials, ratios, screens. Sourced and dated. | |
| DalalOS beyondnoww/indianstock-data-mcp Indian NSE/BSE research data and mechanically-computed ratios; read-only market tools. | |
| FixThis beyondwin/fixthis Local-first MCP handoff for Jetpack Compose UI feedback and source candidates. | |
| io.github.bg4ff8mtdn-dotcom/ownership-provenance-protocol bg4ff8mtdn-dotcom/ownership-provenance-protocol MCP protocol requiring task acceptance and provenance tags. Self-hosted only - see README. | |
| ReasonGraph Cloud memory bgokden/reasongraph Graph memory for AI agents: entities, cause-effect links, cross-session recall, time travel. | |
| Ariadne for Therapists bgrieco22/ariadne-mcp Free Google Business Profile audits and sample posts for therapists in private practice. | |
| io.github.bharath-krishna/mcp-test bharath-krishna/mcp-test A simple MCP server with an echo tool for testing purposes | |
| ALIGN bharatreachdsp/align-cli Your team's confirmed decisions, with receipts, for every coding agent (local stdio server). | |
| ai.smithery/bhushangitfull-file-mcp-smith bhushangitfull/file-mcp-smith Manage files and folders directly from your workspace. Read and write files, list directories, cre… | |
| TechEnthus Hardware Data API bibekstha/data-techenthus-dev Authenticated GPU/CPU/PSU lookup; beta power-budget estimate. Coverage/freshness vary by source. | |
| au.com.bidit/registry bidit-au/bidit-registry Does this retailer take offers, and does it price match? Verified answers, checked by a person. | |
| BIGHUB bighub-io/bighub Decision learning for AI agent actions. Evaluate, score, decide, and learn from outcomes. | |
| BiglySales bigly-sales/biglysales-mcp Configure the AI sales assistant (voice, SMS, follow-ups, web calling) of your BiglySales workspace. | |
| ai.smithery/BigVik193-reddit-ads-mcp bigvik193/reddit-ads-mcp Manage Reddit advertising across accounts, campaigns, ad groups, posts, and ads. List accounts, fu… | |
| ai.smithery/BigVik193-reddit-ads-mcp-api bigvik193/reddit-ads-mcp-api Manage Reddit advertising end to end across accounts, funding methods, campaigns, ad groups, and a… | |
| ClaimHit bikram2112/claimhit-mcp Find products & standards using a patent - verified targets for licensing or enforcement. | |
| Bilbop x402 bilbop1/bilbop-x402-mcp Pay-per-call summarize, Solana data, TTS, and brand feedback via api.bilbop.org. | |
| com.azurecarbon/kodiak bildow/kodiak Verifiable fact-checking: verdict, confidence, sources, and a tamper-evident certificate. | |
| 知一刻 Zhiyike biletian/zhiyike-connect Free read-only Chinese AI news MCP: verified events, reports, products. No API key. | |
| BillDog billdogai/billdog-mcp Set up and inspect app paywalls, subscriptions, offerings and analytics from your AI agent. | |
| Valta billionaire664/valta-mcp Financial governance for AI agents — spend gates and audit trail exposed as MCP tools. | |
| Billium billiumhq/billium-node Official Billium MCP server: manage crypto invoices, payments, and webhooks from any MCP host. | |
| LiftMCP billmacuk/liftmcp Makes websites AI-agent-ready via MCP. Each property gets its own hosted MCP server. | |
| me.openbrowser/openbrowser-ai billy-enrizky/openbrowser-ai AI browser automation. Write async Python to navigate, click, type, and extract data. | |
| Raven — Solana Token Verification billybotticelli4u-collab/-launchguard Solana token-launch verification for AI agents — deterministic, replayable, returns 'unknowable'. | |
| Temporal Cortex Calendar MCP billylui/temporal-cortex-mcp 12 deterministic calendar tools — temporal context, scheduling, availability, and booking | |
| Sprig Fit Images billyqin/uploadfit Inspect local photos and crop, resize or compress images to exact dimensions and file-size limits. | |
| HAVN binarts/havn Read-only AI access to HAVN properties, leads, tasks, files, media, and analytics. | |
| WireTensors binarytechstaysol/wiretensors Neutral, verified AI tool reviews — search, compare and get recommendations across 260+ tools. | |
| MCP Browser bishwas-py/mcpbrowser Read Reddit, X, LinkedIn, Facebook and Pinterest through your own Chrome login. No API keys needed. | |
| io.github.bitatlas-group/bitatlas bitatlas-group/bitatlas Zero-knowledge encrypted storage for humans and AI agents. Client-side AES-256-GCM, EU-hosted. | |
| Bitbybit CAD MCP bitbybit-dev/bitbybit Bitbybit 3D parametric CAD API, version-exact, for coding agents: search, describe, examples, guide | |
| BitCLI bitcli-io/bitcli-mcp-server Real-time crypto futures order flow, BCT-30 matrices, and HFT alerts across 1,650+ contracts. | |
| Bitview bitcoinresearchkit/mono Read-only Bitcoin blockchain, mempool, mining, market, and on-chain analytics; no API key. | |
| com.zipirapp/zipir bitcomethub/zipir Turn a document into a source-cited video lesson from any MCP client. | |
| io.github.bitcompare/mcp-server bitcompare/services Crypto yield data for AI agents: lending, savings, staking, borrowing & stablecoin rates. 18 tools. | |
| Bitculator bitculator/bitculator-mcp Crypto market data for AI agents: live prices, OHLCV, sentiment, indicators and exchanges. | |
| bitfence Risk Oracle bitfenceai/bitfence Pre-transaction token risk checks for autonomous agents on six chains. Read-only; paid via x402. | |
| com.gitbuyer/mcp bitfent/gitbuyer Find the repo to build from: search 100k+ repos by base-fitness, clone free or buy over x402. | |
| lucid.page bitgate/lucid.page Publish Markdown from any agent: POST Markdown, get a gorgeous shareable URL. | |
| rows.page bitgate/rows-page-mcp Push CSV, JSON, JSONL or Parquet from your agent and get a link a human can explore. | |
| ship.page bitgate/ship.page Deploy HTML from any agent: POST markup, get a live URL. Static hosting API with MCP tools. | |
| GreenPick bithug01/greenpick Greener, cheaper cloud infra decisions — carbon + cost + latency tradeoffs, in-editor. | |
| Prolifik bitmamba24/prolifik-mcp Clip long videos, render branded short-form video, schedule to TikTok, Reels, Shorts and X. | |
| Block Genomics — Nexus Protocol bitmapasset/block-genomics-nexus Prove Bitcoin block ownership via BIP-322 and register sovereign AI agents on the Nexus Protocol. | |
| br.com.bitvisual/bitvisual-mcp bitplotagem-bitvisual/bitvisual-mcp Agent-ready print shop in Sao Paulo: catalog, official BRL quotes per m2, shipping, PIX orders. |
21,051–21,100 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.