Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Boss Zhipin 提供BOSS直聘公开职位与公司信息检索与摘要，不支持登录、投递或批量抓取功能。 | |
| Bounty 提供众包任务、有偿问卷、软件体验及即时结算项目。 | |
| 网红卤味 提供关于网红卤味的推荐清单、打卡路线与指南。用户搜索网红卤味或规划相关出行时调用。 | |
| 网红自助餐 提供关于网红自助餐的推荐清单、打卡路线与指南。用户搜索网红自助餐或规划相关出行时调用。 | |
| Caixin Retrieves and summarizes public news and trending topics from Caixin's open channels using keyword search, channel stats, and topic collections. | |
| Camping 提供周边宝藏营地查询、露营装备清单对比、户外环保原则及天气实时预警。 | |
| Cctv Video 提供央视网公开短视频与栏目页的检索与数据摘要，涵盖视频表现、节目目录及榜单题材统计分析。 | |
| Certificates 提供身份证、行驶证、职业资格证的电子化申领、亮证及政务互认说明。 | |
| Cicd Pipelines, gates, artifacts, and safe deployments. Use when setting up CI/CD, hardening pipelines, or reducing release risk. | |
| Cloud Arch Multi-account patterns, networking, and well-architected trade-offs. Use when designing cloud systems. | |
| CPS赚钱 系统化开展CPS联盟营销；当你计划做内容带货或导购时调用。 | |
| 跨境电商 该技能介绍如何通过跨境电商实现变现；当你计划从事或优化跨境电商时调用。 | |
| Dedao Access and summarize publicly available courses, columns, and topics from Dedao without bypassing paywalls or downloading content. | |
| Deepseek 整理DeepSeek公开页面信息，摘要模型能力、定价政策及文档目录，助力轻量级公开内容检索和汇总。 | |
| 代驾服务 该技能介绍如何通过代驾服务实现变现；当你计划从事或优化代驾服务时调用。 | |
| 分销 提供渠道分销的可落地指南与SOP。在开展渠道分销相关工作时调用。 | |
| DJ与乐队演出 该技能介绍如何通过DJ与乐队演出实现变现；当你计划从事或优化DJ与乐队演出时调用。 | |
| Doc Co Deep co-authoring workflow—context gathering, iterative drafting and structure, reader testing, and quality gates. Use when writing documentation, proposals,... | |
| Doubao 整理字节跳动大模型公开页面信息，包括模型特性、定价、文档目录及示例链接的摘要和汇总。 | |
| Eastmoney Access and summarize public market data, news, and industry trends from Eastmoney, excluding trading or bulk data extraction. | |
| Ele.Me 提供饿了么外卖订餐、即时配送及商户优惠指引。 | |
| WeChat Work 提供企业内部通讯、私域流量管理及办公协同指引。 | |
| Fanqie Novel Provides summaries and trend data of popular novels and short drama IPs from Fanqie Novel public pages without downloads or bulk scraping. | |
| Flash Sale 限时促销制造紧迫感提升转化；适用于大促与上新。 | |
| Flash Sale 提供各大电商整点秒杀、抢购助手及预售玩法解析。 | |
| Flight Check In 提供在线选座、行李托运规则及延误证明获取指引。 | |
| Freebie 提供线下快闪店、专柜小样免费领券指南及全国网点查询。 | |
| Global 提供跨境电商趋势、国际金融动态、海外置业及移民政策速递。 | |
| Graphql Schema Deep GraphQL schema workflow—modeling types, queries and mutations, N+1 and complexity limits, errors and pagination, federation risks, and evolution. Use wh... | |
| Haokan Provides aggregated summaries and updates of public short videos, short dramas, and trending lists from Haokan video pages based on keywords or topics. | |
| Hellobike Summarizes public service details, announcements, and city-specific info from Hellobike's official pages without accessing user accounts or orders. | |
| Housekeeping 提供钟点工、全日制保姆、收纳整理及服务评价体系指引。 | |
| Http Api Shape HTTP/JSON APIs—resources and verbs, error payloads, pagination, idempotency, and docs. Use when designing new endpoints, reviewing PRs, or aligning tea... | |
| Hunyuan 整理腾讯混元大模型公开产品页及文档信息，包括模型能力、定价、文档目录及示例链接的摘要和汇总。 | |
| Huya 提供虎牙直播公开页面的直播分类、活动信息、主播规则、帮助中心与安全说明的整理服务。 | |
| I18n Deep internationalization workflow—string extraction, ICU messages, formats, pseudolocale testing, and developer workflow. Use when preparing software for tr... | |
| Idempotency Deep idempotency workflow—identifying retry surfaces, idempotency keys, storage and TTL, exactly-once pitfalls, and testing duplicate delivery. Use when desi... | |
| 闲鱼 该技能介绍如何通过闲鱼卖货实现变现；当你计划从事或优化闲鱼卖货时调用。 | |
| Ifeng 检索凤凰网公开新闻和频道页，提供关键词新闻摘要、频道热点统计及深度报道段落要点提取。 | |
| Inheritance 提供遗嘱代办咨询、家族办公室基本指引、法律风险防控及赠予税费解读。 | |
| Jianying 提供剪映官网公开的模板分类、编辑功能、导出规格、版权说明及套餐权益等信息整理和说明服务。 | |
| Late Night Companion Proactively offers gentle, non-judgmental emotional support during local late-night hours without forced positivity or unsolicited advice. | |
| Liepin 检索并摘要猎聘公开职位与公司信息，提供薪资、要求、行业等核心内容，不支持投递和登录自动化。 | |
| Lightroom 提供Adobe Lightroom公开模板、编辑功能、导出规格、套餐及版权信息的整理与说明服务。 | |
| Line Provides organized summaries of LINE's public platform features, content formats, operational rules, and help resources without accessing private data. | |
| Live Search Real-time answers from the public web via the host app’s local search gateway (Auth Gateway proxy). Typical stacks surface results comparable to major engine... | |
| Llm Evaluation Deep LLM evaluation workflow—quality dimensions, golden sets, human vs automatic metrics, regression suites, offline/online signals, and safe rollout gates f... | |
| Load Testing Deep load testing workflow—goals and SLOs, workload modeling, scenario design, environment fidelity, execution, metrics interpretation, and bottlenecks to fi... | |
| LOGO 该技能介绍如何通过LOGO设计实现变现；当你计划从事或优化LOGO设计时调用。 | |
| Membership 提供各大品牌会员积分兑换、联名卡及特权指引。 |
22,051–22,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.