Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| fit-device-id-modifier Modify FIT files to set device manufacturer to Garmin (1) and product ID to Edge 500 China (1030) for proper recognition on Garmin Connect. | |
| onelap-ride-download 从顽鹿竞技 (Onelap) 下载骑行记录 FIT 文件。用于批量导出用户的骑行数据。 | |
| upload-fit-to-blackbird-web Automatically batch upload modified _GM.fit files to the Blackbird Cycling web platform with login detection and upload status handling. | |
| Acmesh Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Acmesh concepts, best practices, and implementation patterns. | |
| Actuator Actuator selection and sizing calculator | |
| Ad Copywriter 广告文案生成器。信息流广告、朋友圈广告、搜索广告、直通车标题、巨量引擎创意、Google Ads文案、A/B测试文案、ROI计算器、平台适配文案。Ad copywriter for feeds, search ads, social ads, A/B testing, ROI calculator, platfo... | |
| Age age file encryption reference — the modern, simple alternative to GPG. Covers key generation, X25519 encryption, SSH key support, passphrase mode, pipe patte... | |
| Ai Code Helper Review, validate, and generate code with AI-powered linting. Use when fixing bugs, generating boilerplate, formatting, or running analysis. | |
| Allergy Log allergens, track reactions, and chart symptom patterns over time. Use when identifying triggers, preparing reports, or setting reminders. | |
| Animation Generate CSS and SVG animation code snippets using bash and Python. Use when building UI animations, keyframes, or transition effects. | |
| Antlr4 Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Antlr4 concepts, best practices, and implementation patterns. | |
| Api Generator API code generator. Generate RESTful endpoints, GraphQL schemas, OpenAPI/Swagger docs, API clients, mock servers, authentication, rate limiting. | |
| Api Router Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for API Router concepts, best practices, and implementation patterns. | |
| Apollo Client Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Apollo Client concepts, best practices, and implementation patterns. | |
| Autohotkey Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Autohotkey concepts, best practices, and implementation patterns. | |
| Azuredatastudio Azure Data Studio is a data management and development tool with connectivity to popular cloud and o azuredatastudio, typescript, azure, azure-data-studio. | |
| Baby Guide 育儿指南助手。新生儿护理、辅食添加、疫苗接种、早教启蒙、睡眠训练、亲子互动。Baby care guide with feeding, vaccination, sleep training, early education. 育儿百科、宝宝成长、母婴护理。Use when parents need baby c... | |
| Backuptool Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Backuptool concepts, best practices, and implementation patterns. | |
| Bearing Bearing selection and life calculator | |
| Bilibili Helper B站创作助手。视频标题优化、标签推荐、简介模板、投稿策略、UP主运营、弹幕互动。Bilibili video creator assistant. B站运营、视频SEO、粉丝增长、投币收藏、充电计划。Use when creating content for Bilibili. | |
| Blast Use when exploring Blast L2 chain features, understanding native yield mechanics, comparing gas costs, bridging assets, or discovering Blast ecosystem projec... | |
| Bookmark Keeper Save, organize, and search web bookmarks with tags and categories. Use when collecting research links, organizing lists, or reviewing resources. | |
| Bookshelf Track reading progress, rate finished books, and manage your library. Use when logging books, reviewing reading stats, or planning reading goals. | |
| Bookworm Log books, track reading habits, and review reading streaks over time. Use when recording reads, maintaining goals, or analyzing genre preferences. | |
| Brand Namer Generate brand names with domain checks and analysis. Use when naming a startup, checking domain availability, or brainstorming product names. | |
| Browser Fingerprinting Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Browser Fingerprinting concepts, best practices, and implementati... | |
| Budget Tracker Track income, expenses, and generate monthly reports locally. 支持多币种记账、预算设置及收支报表生成。Use when managing personal finances, tracking project costs, or auditing mo... | |
| Budgetly Set category budgets, log expenses, and visualize spending limits. Use when tracking grocery costs, monitoring subscriptions, or forecasting spend. | |
| Calctool Perform basic, scientific, and financial calculations from the terminal. Use when computing interest, converting units, or solving quick math. | |
| Calculus Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Calculus concepts, best practices, and implementation patterns. | |
| Caption Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Caption concepts, best practices, and implementation patterns. | |
| Cashflow Track personal cash flow with simple terminal commands and local storage. Use when logging daily expenses, reviewing balance, or exporting records. | |
| Clamav ClamAV open-source antivirus reference. clamscan, freshclam database updates, clamd daemon configuration, custom signatures, quarantine workflows, automated... | |
| Class Class & OOP reference — inheritance, polymorphism, composition, SOLID principles, design patterns. Use when designing class hierarchies, refactoring object-o... | |
| Cli Builder CLI tool generator. Project scaffolding, command adding, argument parsing, help docs, config handling, publish checklist, interactive prompts. | |
| Cluster Perform data clustering analysis using k-means and hierarchical algorithms. Use when you need to group, classify, or segment datasets. | |
| Cms cms reference tool | |
| Cnc CNC machining program manager | |
| Cobot Collaborative robot task planner. Use when json cobot tasks, csv cobot tasks, checking cobot status. | |
| Colorpick Color picker and converter. Use when you need colorpick. | |
| Compose Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Compose concepts, best practices, and implementation patterns. | |
| Conduit Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Conduit concepts, best practices, and implementation patterns. | |
| Consensus Analyze consensus operations. Use when you need to understand consensus mechanisms, evaluate protocol security, or reference on-chain concepts. | |
| Contact Book Store personal contacts with tags, search, and relationship tracking. Use when adding contacts, searching details, planning follow-ups. | |
| Container Runner Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Container Runner concepts, best practices, and implementation pat... | |
| Currency Your personal Currency assistant. Track, analyze, and manage all your travel planning needs from the command line. | |
| Customer Service Reply 客服回复模板。售前咨询、售后处理、退换货、投诉回复、好评引导、升级处理、行业FAQ、满意度挽回。Customer service reply templates for pre-sale, after-sale, returns, complaints, escalation, FAQ generation, s... | |
| Daily Journal Daily Journal — Daily Journal — write, reflect, remember. Personal daily-use tool for tracking and organizing your life. Use when you need Daily Journal capa... | |
| Dailylog Record daily wins, challenges, and learnings with streak tracking. Use when logging reflections, tracking streaks, reviewing weekly progress. | |
| Datasets Browse and load ready-to-use AI/ML datasets with fast manipulation. Use when searching datasets, loading training data, transforming formats. |
21,051–21,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.