Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| app-privacy-disclosure-comparison Compare public App Store privacy labels, Google Play data-safety declarations, and listed Android permissions through Crawlora. Use for an app shortlist or disclosure matrix with publisher/app identity, taxonomy, market, missing data, and r | |
| app-release-feedback-analysis Compare app review themes around documented releases using Crawlora version notes and live/stored reviews. Use for a dated release-feedback brief with platform/app/version identity, review timestamps, sampling, missing release history, and | |
| app-review-mining Mines App Store and Google Play data via the Crawlora API — app details, reviews, ratings, store rankings, and similar apps — as clean JSON. Use when the user wants mobile-app reviews, ratings, store charts/rankings, or competitive ASO (app | |
| app-store-research Researches apps and browser extensions across the Apple App Store, Google Play, and Chrome Web Store using the Crawlora API, returning clean JSON. Use for app discovery, publisher and product comparisons, ratings and reviews, permissions, p | |
| apple-jobs-research Researches Apple job postings via the Crawlora API — searches jobs.apple.com and pulls full posting detail (description, qualifications, location, team) — returning clean JSON. Use when the user wants to search Apple careers listings, check | |
| apple-maps-research Researches places, categories, guides, routes, transit, and travel times through Apple Maps via the Crawlora API, returning clean JSON. Use when the user wants local-business discovery, directions, nearby places, an Apple Guide, reverse geo | |
| ats-job-boards-research Fetches any company's job openings straight from its Applicant Tracking System (ATS) via the Crawlora API — Greenhouse, Lever, Workday, Ashby, SmartRecruiters, Workable, Personio, Recruitee, iCIMS, Oracle Recruiting, Rippling, Pinpoint, Eig | |
| auction-research Researches Bonhams auctions and lots via the Crawlora API — upcoming and past sales, lot search, estimates, realized prices, departments, and auction detail — returning clean JSON. Use when the user wants auction-house research, comparable | |
| bluesky-research Researches Bluesky profiles, posts, follower/follows graphs, account search, and trending topics via the Crawlora API, returning clean JSON. Use when the user wants a Bluesky account's stats, a post's thread/engagement, a Bluesky account se | |
| book-market-positioning Compare book niches and title positioning through Crawlora Goodreads catalogs, editions, review samples, and Apple Books/Audible listings. Use for comparable-title maps, edition-aware reception, or evidence-based publishing hypotheses with | |
| book-research Researches books, authors, and audiobooks via the Crawlora API — Goodreads (books, authors, reviews, lists, quotes), Apple Books (books, audiobooks, series, reviews, charts), and Audible (audiobook catalog search, product detail, narrators/ | |
| brand-mention-research Build a sourced brand-mention and reputation brief from bounded Reddit, TikTok, and YouTube searches and comment samples through Crawlora. Use to resolve brand aliases, deduplicate mentions, compare discussion themes, or inspect a product i | |
| broadcast-coverage-comparison Compare indexed television coverage across stations and shows with Crawlora GDELT TV search, charts, timelines, and discovery. Use for a bounded broadcast topic brief with speech/caption/OCR/visual channels, station windows, processing lag, | |
| business-complaint-pattern-analysis Analyze public BBB business complaint narratives, response threads, statuses, and reporting-window totals using Crawlora. Use for a sourced complaint-pattern or response-process comparison with business identity, incomplete lists, redaction | |
| business-location-screening Compare user-supplied candidate locations for a local business using nearby competitors, public access signals, review samples, and available city-level context. Use for an early screen, not a lease or viability recommendation. | |
| business-review-trust-research Researches software/SaaS products, business reputation, and crowdfunding campaigns via the Crawlora API — Product Hunt launches/makers/alternatives, Trustpilot business reviews, TrustMRR revenue-verified startups, Capterra software reviews, | |
| casino-game-research Research public casino game catalogs and source-published game descriptions from FanDuel and DraftKings. Use for game-category or feature lookups, not wagering strategy or recommendations. | |
| chain-store-footprint-analysis Compare observed chain-store coverage using Crawlora Starbucks directories, live chain locators, and Google Maps business records. Use for branch counts, geographic overlap, amenity coverage, or footprint gaps within a defined area with sou | |
| chrome-extension-research Compare Chrome extensions using Crawlora's live store listings and stored adoption, publisher, permission, and privacy history. Use for extension shortlists, market comparisons, or investigating observed changes; store disclosures alone do | |
| Collectibles Market Research Help with Collectibles Market Research tasks | |
| company-fundamentals-comparison Compare public companies' reported financial statements across matched fiscal periods using SEC EDGAR data and Yahoo Finance industry context. Use for sourced peer metrics, not stock valuation or buy/sell recommendations. | |
| company-identity-reconciliation Reconcile company and brand identities across Crawlora public domains, LinkedIn profiles, SEC registrants, and employer records. Use to deduplicate company lists or build a provenance-aware ID mapping with parent/brand/subsidiary, ambiguous | |
| company-ranking-research Research Fortune company directories and ranking editions and Forbes public billionaire/person records with Crawlora. Use to compare ranked companies, build a source-attributed business shortlist, or inspect ranking and wealth-profile evide | |
| competitor-intelligence Compare companies or products using Crawlora website extraction, traffic estimates, reviews, product listings, and hiring data. Use for competitor briefs, positioning and pricing comparisons, or evidence-backed competitive battlecards. | |
| congressional-disclosure-research Research House and Senate public financial-disclosure filings through Crawlora and parse supported Senate reports. Use for filing inventories or transaction evidence briefs with owner, reporting dates, amount ranges, duplicates, and documen | |
| consumer-product-opportunity Assess a physical consumer-product idea using public search-interest signals, marketplace listings, and sampled customer feedback in a specified market. Use for product-launch hypotheses, not one-off shopping, market-size estimates, or prof | |
| costco-research Researches Costco products, categories, warehouse stock/availability, and reviews using the Crawlora API, returning clean JSON. Use when the user asks to find a Costco product, check delivery/warehouse availability, browse Costco categories | |
| courtlistener-research Researches public US legal opinions, courts, and judicial people through CourtListener via the Crawlora API, returning clean JSON. Use when the user wants to search opinions, browse courts, or look up public judge/person records without scr | |
| crawlora Fetches structured public web data through Crawlora's hosted REST API, including broad search, bounded web crawls, and durable cross-corpus research jobs. Calls require a user-provided API key and successful requests may consume credits. Us | |
| crawlora-datasets Queries Crawlora's pre-built hosted datasets — Airbnb markets, App Store/Google Play apps, GitHub/Instagram/X users, job postings, US housing markets, Google Maps businesses, Goodreads, PitchBook, Steam, TrustMRR, Product Hunt, SEC companie | |
| creator-membership-comparison Compare public Patreon tiers and Substack subscription plans through Crawlora. Use for a creator membership shortlist or offer benchmark with creator identity, published benefits, currency, cadence, web/in-app pricing, disabled plans, and h | |
| cricket-player-team-comparison Compare cricket player or team records through Crawlora Cricinfo Statsguru, records, matches, and discovery. Use for format-specific batting/bowling/fielding comparisons with class, innings, dates, opposition, overs notation, and source tab | |
| cross-corpus-research Run bounded research across Crawlora public-web, paper, and indexed developer-document sources, retaining source snapshots, evidence, and partial-coverage warnings. Use for focused cited briefs or structured research jobs, not exhaustive we | |
| crowdfunding-campaign-research Compare Kickstarter campaigns through Crawlora using funding snapshots, reward tiers, creator updates, risks, and sampled backer comments. Use for campaign benchmarks, launch research, or evidence-based progress and fulfillment briefs. | |
| crypto-market-research Researches public cryptocurrency markets, coins, exchanges, categories, global metrics, news, NFTs, token unlocks, and treasuries through CoinGecko via the Crawlora API. Use for market snapshots and comparative research, not trading or fina | |
| customer-feedback-analysis Analyze public customer reviews and discussions through Crawlora to identify complaint themes, feature requests, praise, and competitive gaps. Use for voice-of-customer briefs and product-feedback comparisons with cited examples and explici | |
| deal-discovery-research Find and compare Slickdeals and RetailMeNot offers through Crawlora deal search, categories, advanced facets, deal detail, and community comments. Use to find discounts, assess a posted bargain, or build a current deal shortlist with eligib | |
| developer-oss-research Researches GitHub repos/users/orgs and Chrome Web Store extensions via the Crawlora API — search, profiles, contributors, releases, trending, and extension detail/reviews/permissions — returning clean JSON. Use when the user wants a repo or | |
| developer-talent-discovery Find developers through Crawlora public GitHub user datasets and verify relevant repository and contribution evidence. Use for role-specific technical shortlists or open-source collaborator discovery with public profile freshness and capabi | |
| Dining demand research Compare public restaurant availability snapshots | |
| earnings-event-research Build sourced pre- or post-earnings briefs through Crawlora by joining Yahoo Finance event, estimate, reported-result, and daily-price data with SEC filings and normalized financials. Use for upcoming earnings previews, earnings-surprise ch | |
| ebay-research Researches eBay listings, items, and sellers using the Crawlora API, returning clean JSON. Use when the user asks to search eBay, look up an item's details, or vet a seller's reputation and shop listings — instead of scraping eBay pages. | |
| entertainment-discovery-research Researches movies and TV titles across IMDb, TMDB, JustWatch, Rotten Tomatoes, and Metacritic using the Crawlora API. Use for title discovery, cast and crew, ratings, critic and audience reviews, streaming offers, similar titles, and releas | |
| event-venue-research Build event shortlists, dated calendars, and venue comparisons through Crawlora's Ticketmaster and TicketWeb endpoints. Use for public event research with verified venue identity, timing, age restrictions, ticket fees, and availability cave | |
| facebook-research Searches Facebook Marketplace listings and looks up public Facebook Page details (name, follower/like counts, category, contact info) via the Crawlora API, returning clean JSON. Use when the user wants Marketplace listing data for a locatio | |
| fantasy-sports-research Compare public daily-fantasy contest formats, rules, slates, and source-published player projections from DraftKings and FanDuel. Use for fantasy-sports research, not lineup or wager recommendations. | |
| film-box-office-comparison Compare theatrical film grosses through Crawlora Box Office Mojo charts, title/release records, and stored data. Use for comparable-film briefs, domestic/international mix, release-window comparisons, or franchise performance with title, re | |
| finance-markets-research Research stocks, crypto, SEC filings, insider/congressional trading, and private-market profiles through Crawlora. Use for one-ticker data, filing lookups, or market snapshots; for matched financial-statement comparisons across public-compa | |
| fiverr-research Researches Fiverr gigs and sellers via the Crawlora API — search gigs by keyword, pull a gig's full detail (packages, pricing tiers, rating, seller summary), and look up a seller's profile — returning clean JSON. Use when the user wants to | |
| flashscore-match-analysis Build a sourced Flashscore match report from covered player statistics, lineups, absences, momentum, box scores, point-by-point or darts feeds, and editorial coverage. Use for detailed event analysis; use multi-sport-match-research for basi |
22,851–22,900 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.