Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Diagrams Generator Pro Generate professional diagrams including cloud architecture, data charts, academic figures, and more. Triggers on requests like "画架构图", "画图表", "画论文插图", "生成系统... | |
| Web Scraper Pro Intelligent web scraper that fetches any URL and returns clean Markdown content. Triggers on requests like "帮我抓取网页", "获取这个网页内容", "fetch this URL", "scrape th... | |
| OpenClaw Safe Config Use when editing openclaw.json, adding or changing config keys, troubleshooting a gateway crash after a config change, validating config before restart, or r... | |
| Session Bridge Use when context is lost after switching surfaces (Telegram to WhatsApp, TUI to Telegram), when handing off tasks between agents (Jon → Eddie, Cipher → Eddie... | |
| Shareabot.online - Agent 2 Agent directory Register your AI agent in the Shareabot directory to be discoverable and communicate with other agents via the A2A protocol. | |
| ocmesh Decentralized agent-to-agent mesh network for OpenClaw. Automatically discovers other ocmesh agents anywhere on the internet via Nostr relays — no shared net... | |
| 01 Ai 整理零一万物大模型公开页面信息，包括模型能力、定价、文档目录与示例链接的检索与摘要。 | |
| 12306 提供12306余票查询、候补监控和订单整理等铁路出行信息检索与流程自动化服务。 | |
| 360 Zhiniao 提供360智脑公开页面的模型信息、定价和文档摘要，支持内容检索与链接汇总，专注公开数据整理。 | |
| 51job 提供前程无忧公开职位与公司信息的检索与摘要，不支持投递或账号登录自动化，适合轻量级分析和提醒。 | |
| 58tongcheng 提供58同城官网及商家公开页的入驻、合作、服务、活动及售后规则信息整理与摘要。 | |
| Alipay Summarizes public Alipay product features, announcements, and city service updates without login or payment actions. | |
| Alipay Wallet 提供支付宝资产管理、卡包及收支分析指引。 | |
| Apifox 提供公开YApi产品及开源文档的功能摘要、目录提取和开源链接汇总，支持轻量信息整理与检索。 | |
| Apizza Provides summaries and organized information from Apizza's public product pages and documentation without account or project interactions. | |
| Arxiv Search and summarize papers from ArXiv. Use when the user asks for the latest research, specific topics on ArXiv, or a daily summary of AI papers. | |
| Asyncio asyncio patterns, concurrency pitfalls, and backpressure. Use when writing async Python services. | |
| 附近取款机 Find nearby ATMs. Invoke when user asks for cash withdrawal near me. | |
| Authz Permissions, roles, policies, and enforcement points. Use when designing RBAC/ABAC or fixing authZ holes. | |
| Api Backups, RPO/RTO, restores, and drills. Use when designing DR or testing restores. | |
| Baichuan Ai 整理并摘要百川大模型公开页面的模型能力、定价、文档目录与示例等信息，提供轻量级内容汇总服务。 | |
| Baidu Map 查询和比较百度地图POI信息及公交驾车路线，支持BD-09坐标标注与转换说明，限量自动化操作。 | |
| Bakery 提供网红面包店在线选品、节日蛋糕定制及专属会员配送服务指引。 | |
| Nearby Bars Find nearby bars. Invoke when user asks for drinks or nightlife near me. | |
| Nearby Beaches Find nearby beaches. Invoke when user asks for beaches near me. | |
| Nearby Beauty Salons Find nearby beauty salons. Invoke when user asks for beauty services near me. | |
| Nearby Bicycle Shops Find nearby bicycle shops. Invoke when user asks for bike shops near me. | |
| Bilibili 提供哔哩哔哩公开视频和专栏数据摘要，支持关键词搜索、UP主表现对比和排行榜统计，符合平台规定。 | |
| 爆品打造 提供爆品打造的可落地指南与SOP。在开展爆品打造相关工作时调用。 | |
| Nearby BnB Stays Find nearby BnB stays. Invoke when user asks for BnB stays near me. | |
| 品牌定位 提供品牌定位的可落地指南与SOP。在开展品牌定位相关工作时调用。 | |
| Nearby Camping Sites Find nearby camping sites. Invoke when user asks for camping near me. | |
| Camscanner 整理并摘要CamScanner官网公开的功能说明、套餐信息、模板入口及帮助文档，支持办公协作产品信息展示。 | |
| Candy 提供Candy Crush Saga公开版本更新、活动、赛事及社区规则的整理与汇总，不涉及作弊或账号服务。 | |
| Car Wash 提供周边洗车房查找、打蜡镀晶、内饰精洗及优惠套餐指引。 | |
| Childcare 提供婴幼儿生长曲线记录、早教互动课程、入托政策查询及疫苗提醒。 | |
| Claypot 提供关于网红砂锅的推荐清单、打卡路线与指南。用户搜索网红砂锅或规划相关出行时调用。 | |
| Nearby Clinics Find nearby clinics. Invoke when user asks for a clinic near me. | |
| Doc Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision do... | |
| Comics 提供全彩韩漫日漫阅读、条漫垂直社交、互动同人创作及正版周边选购。 | |
| Nearby Conference Centers Find nearby conference centers. Invoke when user asks for conference venues near me. | |
| Coworking Spaces Find nearby coworking spaces. Invoke when user asks for shared offices near me. | |
| CRM 提供CRM管理的可落地指南与SOP。在开展CRM管理相关工作时调用。 | |
| CSDN 提供程序员职业发展、技术博客及开源项目指引。 | |
| Ctrip 检索并摘要携程公开页的酒店与航班信息，提供价格、评分、行程组合等轻量分析服务。 | |
| Daojia 提供京东到家公开商家与商品信息查询，包含价格、库存、评价及配送时效的摘要与对比分析。 | |
| Db Design Deep database design workflow—entities and relationships, keys and constraints, normalization vs denormalization, indexing strategy, integrity, and operation... | |
| Db Migrate Deep database migration workflow—expand/contract, backward-compatible deploys, backfills, locking risks, and verification. Use when changing production schem... | |
| Deps Mgmt Deep dependency management workflow—inventory, upgrade policy, security patches, licensing, lockfiles, and supply-chain hygiene. Use when upgrading framework... | |
| Dingtalk Extract and summarize titles, authors, updates, and content from publicly shared Dingtalk pages, apps, and group invitations without internal API access. |
21,901–21,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.