Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Sre Practices Deep SRE workflow—SLOs/SLIs, error budgets, alerting, toil reduction, incident readiness, capacity, and balancing reliability with delivery. Use when improvi... | |
| Ssr Ssg Deep workflow for SSR, SSG, ISR, and hybrid rendering—choosing modes per route, data freshness, caching, streaming, hydration, SEO, and operational trade-off... | |
| Stakeholder Comms Deep workflow for stakeholder communication—audience mapping, narrative structure, status with honesty, trade-off framing, asks, and follow-ups. Use when wri... | |
| Startup Validator Structures early startup validation with commands for idea, competitive analysis, and MVP planning plus a standardized reporting template. | |
| Tech News 提供AI、硬核硬件、开源动向及前沿技术深度解析。 | |
| TED Talks 提供全球思想洞察、中英双语字幕及核心观点解析。 | |
| Tencent Video Provides summaries and data extraction from public Tencent Video pages including shows, rankings, updates, ratings, and guest info without downloads or bulk... | |
| Toutiao 提供今日头条公开文章和视频的关键词搜索、内容摘要及热点频道分布的轻量化检索与分析服务。 | |
| Toutiao 检索并摘要今日头条公开文章、视频和话题，提供标题、作者、发布时间及互动数据的轻量分析和提醒。 | |
| 网红景点 提供关于网红景点的推荐清单、打卡路线与指南。用户搜索网红景点或规划相关出行时调用。 | |
| Truecaller 整理Truecaller公开官网的功能介绍、版本信息、下载入口、权限说明及帮助文档内容。 | |
| UnionPay 提供银联扫码支付、转账及银行卡优惠汇总指引。 | |
| Vipshop 提供唯品会公开商品及活动页的价格、评价和规格摘要，支持关键词搜索和同类商品对比分析。 | |
| Wechat Extract and summarize publicly shared WeChat pages including announcements, app details, and group invitations without requiring login or account access. | |
| Wechat Extract and summarize publicly accessible WeChat shared pages including announcements, app info, and group invite details without login or private data access. | |
| Worktile Extract and summarize public project and announcement information from Worktile shared pages without requiring login or accessing private data. | |
| XiaoChi 通过美团外卖公开页面检索并摘要商家与商品信息，提供评分、价格、配送及销售数据对比分析。 | |
| Xiaohongshu 提供小红书公开笔记和作者主页的关键词搜索、内容摘要及时序表现对比分析功能。 | |
| Xigua Video Summarizes publicly available videos and short drama pages from Xigua Video with metadata like titles, authors, engagement stats, and update status. | |
| Xigua Video 整理并摘要西瓜视频公开视频和短剧页的信息，包括视频数据、短剧更新和榜单统计，便于轻量分析和检索。 | |
| Yicai Access and summarize public financial news from Yicai, providing keyword-based headlines, industry stats, and company event timelines without bulk scraping. | |
| Yiyan 提供百度文心一言公开页面的模型能力、定价和文档信息检索与摘要服务。 | |
| Zhaopin 提供智联招聘公开职位和公司信息的搜索与摘要，涵盖岗位详情、薪资、经验及公司规模行业等数据。 | |
| Zhipu 整理智谱公开页面的模型能力、定价及文档信息，提供结构化摘要与链接汇总服务。 | |
| Image Video Generation Workflow 基于 ComfyUI / MCP image server / 浏览器审看回路的图片与视频生成工作流技能卡，纳入 YouTube、Bilibili、Flickr 与 GitHub 的 source pack | |
| MCP for Beginners Microsoft 出品的 Model Context Protocol (MCP) 入门课程，通过 .NET/Java/TypeScript/JavaScript/Rust/Python 多语言实例教学 | |
| MoePeek AI Transcript 轻量级 macOS 划词翻译工具，纯 Swift 6 开发，支持 Apple 翻译（设备端隐私保护），安装体积仅 5MB | |
| PDF Math Translate 科学 PDF 文档翻译工具，保留公式、图表、目录和注释格式，支持多种语言和翻译服务 | |
| Clawpod Read any website or search Google, even when sites block bots or are geo-restricted. Handles CAPTCHAs, JavaScript rendering, and anti-bot protection server-s... | |
| Native Airtable Read Airtable bases, tables, and records directly via the Airtable API. Use when you need spreadsheet/database data from Airtable. Calls api.airtable.com dir... | |
| Native Google Analytics Query Google Analytics 4 (GA4) data directly via the Analytics Data API. Use when you need website analytics like top pages, traffic sources, sessions, users... | |
| Native HubSpot Query and manage HubSpot CRM data via the HubSpot API. Use when you need to search or manage contacts, companies, deals, tickets, or pipelines. Supports crea... | |
| Native Linear Query and manage Linear issues, projects, cycles, and teams via the Linear GraphQL API. Use when you need to list or create issues, check cycle status, manag... | |
| Native Monday Read and query Monday.com boards, items, workspaces, and users directly via the Monday.com GraphQL API. Use when you need project/task data, board contents,... | |
| Native Sentry Read Sentry issues, events, and production errors via the Sentry REST API. Use when the user wants to inspect errors, list recent issues, get stack traces, o... | |
| Native Stripe Query and manage Stripe data via the Stripe API. Use when you need to list charges, customers, invoices, subscriptions, payment intents, refunds, products, o... | |
| Native Typeform Read Typeform forms and responses directly via the Typeform API. Use when you need to list forms, retrieve survey responses, or get form performance stats. C... | |
| A11y Inclusive UI for real users—keyboard and focus, semantics for AT, contrast and motion, forms and errors. Use when fixing WCAG issues, auditing screens, or de... | |
| Ab Testing Experiment design, metrics, ethics, and analysis. Use when running product experiments responsibly. | |
| AC Repair 提供空调加氟、清洗保养、故障排查及上门维修预约指引。 | |
| Agent Arch Agent loops, memory, tools, and safety boundaries. Use when designing AI agents. | |
| Aliyun 提供阿里云公开产品规格、定价、账单趋势及服务公告的合规摘要，不涉及账号操作或敏感信息处理。 | |
| Api Compat Change public APIs without breaking clients—versioning schemes, additive vs breaking changes, deprecation windows, and comms. Use when shipping breaking chan... | |
| 网红游戏厅 提供关于网红游戏厅的推荐清单、打卡路线与指南。用户搜索网红游戏厅或规划相关出行时调用。 | |
| Arch Review Stress-test designs before they ship—constraints, trade-offs, failure modes, and ADR-worthy decisions. Use for ADRs, big refactors, new services, or when ‘it... | |
| 网红美术馆 提供关于网红美术馆的推荐清单、打卡路线与指南。用户搜索网红美术馆或规划相关出行时调用。 | |
| Arxiv Papers Find and summarize arXiv.org preprints—keyword/category search, abstracts, PDF links. Use for literature scans, paper IDs, or quick orientation (not peer-rev... | |
| Authentication Proving identity: sessions, tokens, MFA, recovery. Use when implementing login, token refresh, or auth bugs. | |
| Bazi Reading Chinese Four Pillars (BaZi 八字) chart interpretation—year, month, day, and hour pillars from birth data; Heavenly Stems, Earthly Branches, Five Elements, and... | |
| BBQ 提供关于网红烧烤的推荐清单、打卡路线与指南。用户搜索网红烧烤或规划相关出行时调用。 |
22,001–22,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.