Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Disney Plus Provides information on Disney Plus public pages including membership plans, content channels, creator guidelines, and help resources without accessing perso... | |
| 抖音电商 该技能介绍如何通过抖音电商实现变现；当你计划从事或优化抖音电商时调用。 | |
| Douyin 提供抖音公开视频和作者主页的内容检索与表现数据摘要，支持话题搜索、作者视频分析及热门榜单统计。 | |
| Eastern 整理东方航空公开航班信息、值机须知及公告新闻，提供班期时刻和影响范围摘要，不涉及购票操作。 | |
| Eggy Party 整理蛋仔派对官网公开的版本活动、赛事信息、社区规则及帮助内容，提供时间、奖励和参与方式等详情。 | |
| Faceu FaceU skill organizes publicly available information on templates, editing features, export specs, help docs, and pricing from faceu.com. | |
| Fantasy Organizes public info on Fantasy Westward Journey's updates, events, tournaments, rules, and official announcements without offering cheating or account serv... | |
| 信息流 提供信息流广告投放的可落地指南与SOP。在开展信息流广告投放相关工作时调用。 | |
| Free Fire 提供Free Fire游戏公开活动、版本更新、赛事信息及社区规则的整理与汇总，不涉及作弊或账号服务。 | |
| Weather Get current weather and forecasts (no API key required). | |
| Freshhippo 整理盒马公开页面的商家合作、服务规则、活动信息及帮助说明，提供本地化服务内容汇总。 | |
| Gadget 提供智能家居、硬核数码新品测评、购买建议及极客玩法。 | |
| Gaode 提供高德地图周边POI检索、路线规划及GCJ-02与WGS-84坐标双向转换，支持轻量信息整理与报告生成。 | |
| Habit Coach 习惯养成教练。充当AI问责伙伴，帮助建立、追踪和坚持好习惯。Keywords: 习惯养成, 自律, habit tracker, 打卡. | |
| Honor Of Kings Provides organized information on Honor of Kings' official events, updates, tournaments, rules, and community announcements from the public website. | |
| 网红小店 提供关于网红小店的推荐清单、打卡路线与指南。用户搜索网红小店或规划相关出行时调用。 | |
| Inke 提供映客短视频公开页面的热点视频与话题数据摘要，支持关键词检索和账号近期表现对比分析。 | |
| Qclaw 整理QQ输入法公开官网、下载页、帮助中心与功能说明的版本入口、权限说明与常见问题信息。 | |
| Js Design 整理与摘要公开项目页设计信息，包括页面列表、组件标注和设计资源链接，支持动态内容解析和频率控制。 | |
| Juejin 检索与摘要掘金公开技术文章和话题，提取标题、互动数据及技术要点，支持趋势统计，遵守采集限制。 | |
| Kdocs Retrieve and summarize titles, authors, updates, and key content from public Kdocs document shares, templates, and product pages. | |
| Kuaibao Provides summaries and analysis of public short videos and topics from Kuaibao/QQ Kankan for keyword, account, and trending list data. | |
| Kuaishou 提供公开快手视频和作者主页的内容检索与表现数据摘要，支持话题、作者和榜单分析。 | |
| Lagou 提供拉勾公开职位和公司信息的检索与摘要服务，不支持登录、投递或批量抓取操作。 | |
| Local Festivals 提供非遗活动列表、庙会灯会指南及传统节日文化科普。 | |
| Mafengwo Retrieve and summarize public travel notes and popular attraction data from Mafengwo for destinations, including ratings, reviews, tickets, and opening times. | |
| Mango TV 提供芒果热门综艺、青春剧集及粉丝互动指引。 | |
| Max 整理Max视频平台公开页面的频道、会员套餐、创作规则及帮助信息，汇总官方公开内容入口和说明。 | |
| Meituan 提供美团公开商家与优惠信息的搜索、价格和评价摘要，支持商家列表和商品核心指标对比分析。 | |
| Meituan 提供美团公开商家和优惠信息的检索与摘要，支持评分、价格、评价等核心指标比较分析。 | |
| Netease Video 提供网易视频及话题页的公开短视频信息检索与数据摘要，包括视频表现和榜单统计分析。 | |
| Netease Music 提供网易云音乐公开歌单、歌曲及歌手数据摘要，支持排行榜和作品表现的轻量分析与展示。 | |
| Oschina 提供开源中国公开项目和技术文章的关键词检索、项目摘要及技术文章要点提取服务。 | |
| packaging 提供包装优化的可落地指南与SOP。在开展包装优化相关工作时调用。 | |
| Pensions 提供商业养老保险分析、养老金账户模拟、退休收入测算及理财组合建议。 | |
| Pipixia Provides summaries and data analysis of public videos, short dramas, and topics on Pipixia without downloading or bulk scraping. | |
| Project Planning Deep project planning workflow—goals and non-goals, work breakdown, dependencies, critical path, risks and buffers, milestones, and communication rhythm. Use... | |
| Python Packaging Deep Python packaging workflow—pyproject metadata, dependencies and optional extras, build backends, wheels, versioning, publishing, and CI release hygiene.... | |
| Qianwen Summarizes and organizes public information on Alibaba's Qianwen model, including features, pricing, and documentation from official product pages. | |
| Qq Extract and summarize public QQ app pages, announcements, and group invites without login or message access. | |
| Rag Pipelines Deep RAG workflow—document ingestion, chunking, metadata, retrieval and reranking, grounding and citations, evaluation, and failure modes (hallucination, sta... | |
| Rate Limiting Deep rate limiting workflow—identifying actors and resources, choosing algorithms, distributed vs local limits, client UX (headers, retries), and abuse detec... | |
| React Patterns Deep React patterns workflow—component boundaries, composition, hooks rules, effects and data fetching, performance (memo, lists, suspense), testing, and acc... | |
| Segmentfault Access and summarize public SegmentFault Q&A and articles by keyword, extracting titles, tags, metrics, technology stacks, and key technical points. | |
| SEM投放 提供SEM投放的可落地指南与SOP。在开展SEM投放相关工作时调用。 | |
| SEO优化 提供SEO优化的可落地指南与SOP。在开展SEO优化相关工作时调用。 | |
| Skincare 提供肤质AI测定、成分党严选清单、医美项目科普及个人护理方案定制。 | |
| Smzdm Access and summarize public hot deals, rankings, and promotions from Smzdm for keyword-based price alerts and category statistics without ordering. | |
| Sogou 整理搜狗输入法官网公开的功能说明、版本下载、平台支持、权限隐私及帮助信息，提供准确入口与摘要。 | |
| Sql Optimization Deep SQL performance workflow—symptom framing, execution plans, indexing strategy, query rewrite, locking/transaction behavior, statistics, partitioning, and... |
21,951–22,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.