Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| flight-itinerary-comparison Compare public Agoda and Expedia flight offers through Crawlora with matched airports, dates, passengers, cabin, price basis, segment timing, and connection evidence. Use for a flight shortlist or itinerary tradeoff brief while preserving o | |
| football-match-performance-analysis Explain a completed football (soccer) match from SofaScore statistics, incidents, and lineups, including beginner-friendly briefs for coaches or parents. Use for sourced post-match explanations; use multi-sport-match-research for basic cros | |
| football-player-comparison Compare football players using Crawlora FotMob profiles, player-specific season statistics, and bounded match samples. Use for role-aware form comparisons, statistical scouting briefs, or explaining differences with minutes, competition, se | |
| football-viewing-guide Build a dated, country-specific football broadcast guide using FotMob schedules or Flashscore match-level TV listings. Use for listed channels and market comparisons without promising streaming access. | |
| forecast-consensus-comparison Compare public event forecasts across Crawlora Polymarket, Kalshi, and Metaculus tools. Use for a matched-question consensus brief or dated forecast divergence analysis with resolution rules, outcome labels, scales, timestamps, liquidity, a | |
| fotmob-research Research football fixtures, match reports, player form, transfers, standings, and broadcast listings through Crawlora FotMob tools. Use for a football match brief, team or player comparison, league leaders, transfer coverage, or where a mat | |
| game-price-history-research Research observed Steam price history and compare current game editions or PlayStation offers using Crawlora. Use for a dated discount brief, observed price-range analysis, or game offer comparison with currency, SKU, subscription, and hist | |
| gaming-research Researches video games via the Crawlora API — Steam (store pages, pricing, reviews, player counts, charts, tags, achievements) and PlayStation Store (products, categories, deals) — returning clean JSON. Use when the user wants a game's pric | |
| gdelt-research Researches global news and US television coverage via the Crawlora API — GDELT web-news search/context/timeline/sentiment, plus GDELT Television 2.0 AI's index of US TV transcripts, captions, on-screen text, and visual labels — returning cl | |
| german-amateur-football-research Research German amateur-football clubs, teams, competitions, local fixtures, results, tables, and player match records through FUSSBALL.DE. Use for grassroots and regional football, not professional scouting or player outreach. | |
| google-finance-research Retrieve Google Finance quote, company, chart, financial, news, related-instrument, and market snapshots using Crawlora. Use for source-attributed market lookups, instrument comparisons, or Google Finance market briefs; excludes trading and | |
| google-jobs-research Searches Google's public careers site (careers.google.com) via the Crawlora API and pulls single job postings by id, returning clean JSON. Use when the user wants to search Google Jobs, see what roles Google is hiring for in a location, or | |
| google-maps-research Search Google Maps businesses and places, retrieve place details, and inspect review samples or photos through the Crawlora REST API. Use for current place lookups and comparisons, including addresses, ratings, review themes, and business i | |
| google-trends-research Compare search interest, regional patterns, seasonality, and rising queries through Crawlora's Google Trends endpoints. Use for topic-demand briefs, keyword comparisons, and trending-topic research with correctly interpreted relative indice | |
| health-provider-research Find and compare public physician, hospital, pharmacy, urgent-care, and group-practice directory records through Crawlora Healthgrades. Use for a provider shortlist, specialty/location discovery, or directory and review evidence; confirm in | |
| hiring-demand-analysis Compare advertised hiring demand across roles, skills, locations, and seniority using Crawlora's jobs dataset. Use for labor-market snapshots, employer concentration, remote-work comparisons, and salary analyses with explicit coverage and c | |
| hm-research Researches H&M's catalog — storefront categories, product listings, product detail, free-text search, and nearby physical stores — using the Crawlora API, returning clean JSON. Use when the user asks to find a product on H&M, browse an H&M | |
| horse-racing-research Research horse-race schedules, race cards, runner histories, and results through public FanDuel Racing and DraftKings Racing data. Use for race-day context or past-performance records, not wager picks. | |
| housing-market-research Compare US housing markets through Crawlora's historical housing dataset and Redfin tools. Use for city, metro, county, or ZIP-code comparisons of prices, inventory, sales activity, time on market, and explicitly qualified affordability tre | |
| indeed-research Searches Indeed job postings and pulls single job listings via the Crawlora API — keyword + location search, location autocomplete, and job detail by job key — returning clean JSON. Use when the user wants to search Indeed for jobs, look up | |
| influencer-discovery Find and shortlist TikTok, Instagram, YouTube, and Substack creators for a campaign using Crawlora's creator datasets and live profile/content endpoints. Use for creator sourcing, newsletter discovery, comparing campaign fit, and producing | |
| instagram-research Researches Instagram profiles, posts, and Reels via the Crawlora API, returning clean JSON. Use when the user wants a public Instagram profile's stats, a specific post's media/engagement, or a user's Reels feed — instead of scraping the app | |
| institutional-ownership-research Compare reported institutional-manager 13F holdings through Crawlora live SEC and stored position tools. Use for portfolio concentration, reported-position overlap, or issuer-holder evidence with manager identity, filing lag, truncation, se | |
| investor-fit-research Build investor and fund shortlists from Crawlora public PitchBook profiles and stored investor, fund, and company records. Use for fundraising research based on observed strategy, geography, stage clues, and portfolio evidence with incomple | |
| job-market-research Researches job postings, hiring signals, and freelance gigs via the Crawlora API — Indeed, Google/Amazon/Apple/Meta/Tesla careers sites, any company's ATS board (Greenhouse, Lever, Workday, SmartRecruiters, Ashby, and more), plus Upwork and | |
| job-posting-comparison Compare advertised job postings using Crawlora jobs datasets, employer ATS boards, and Indeed detail. Use for a role shortlist or posting comparison with employer/requisition identity, location, seniority, compensation units, transport-depe | |
| journalist-media-research Build a relevant journalist and media shortlist for a story or PR brief using Crawlora's journalists dataset, news search, and public author pages. Use to find reporters by beat or outlet, verify recent coverage, and collect published work | |
| kohls-research Researches Kohl's catalog by browsing its category taxonomy (products, prices, ratings, and facets), pulls product reviews by web_id, finds nearby Kohl's stores, and returns search-box typeahead suggestions — all via the Crawlora API as cle | |
| linkedin-research Researches public LinkedIn company, product, and showcase pages via the Crawlora API. Look up known IDs or discover and search the public product directory by keyword or category. Does not access personal profiles or private content. | |
| Live-Event Ticketing Research Compare public StubHub and SeatGeek resale snapshots | |
| local-business-prospecting Build and qualify local-business prospect lists by category and geography using Crawlora's Google Maps dataset, live Google Maps, Apple Maps, Yelp, and public business websites. Use when the user wants a deduplicated lead shortlist or CSV w | |
| local-business-reputation-research Researches public local-business profiles, ratings, reviews, complaints, Scam Tracker patterns, menus, and photos across Yelp, BBB, Trustpilot, and OpenTable using the Crawlora API. Use for vendor due diligence, reputation comparisons, or b | |
| local-competitive-landscape Compare observed local business supply, categories, attributes, hours, and review-sample themes across defined areas using Crawlora's Google Maps dataset, live Google Maps, Apple Maps, and Yelp. Use for matched-area competitor landscapes an | |
| lululemon-research Researches Lululemon's catalog — category navigation, category listings, product detail with pricing/sizes/reviews, curated outfit recommendations, and the physical store directory — using the Crawlora API, returning clean JSON. Use when th | |
| Luxury Resale Research Compare luxury resale listings and sales | |
| macys-research Looks up a Macy's product's full detail and customer reviews by its numeric productId, and pulls Macy's own search-box (typeahead) suggestions, using the Crawlora API, returning clean JSON. Use when the user has (or can get) a Macy's produc | |
| medication-information-research Retrieve source-attributed GoodRx medication and health information with author and review dates. Treat it as secondary material; safety-critical claims remain unverified without official source text. Not for personalized diagnosis, dosing, | |
| meta-jobs-research Searches and pulls postings from Meta's public careers site (metacareers.com) via the Crawlora API — full catalog listing, filtered search by team/technology/location/employment-type, and single-posting detail — returning clean JSON. Use wh | |
| microsoft-store-research Research Microsoft Store apps and games using Crawlora search, categories, charts, publisher listings, product details, and reviews. Use to compare Windows apps, investigate a publisher, inspect store awards, or sample regional app reviews. | |
| mlb-statcast-player-comparison Compare MLB players using Crawlora Statcast leaderboards and player statistics with board-specific discovery, season, role, qualification, metric units, and sample controls. Use for an observed performance brief, pitch-arsenal comparison, o | |
| movie-tv-research Researches movies and TV shows — metadata, cast/crew, ratings, reviews, streaming availability, and box-office performance — via the Crawlora API across IMDb, TMDB, JustWatch, Letterboxd, Rotten Tomatoes, Metacritic, and Box Office Mojo, re | |
| multi-sport-match-research Compare public fixtures, live scores, match statistics, standings, and head-to-head records using Crawlora Flashscore and LiveScore tools. Use for multi-sport score checks, a sourced match preview or recap, or reconciling different scoreboa | |
| music-podcast-research Researches music, artists, playlists, and podcasts via the Crawlora API — Spotify tracks/albums/artists/playlists/profiles, Spotify Podcasts, Apple Podcasts, Discogs, and SoundCloud tracks/profiles/playlists — returning clean JSON. Use when | |
| music-release-landscape Map artist discographies and comparable music releases through Crawlora Spotify artist, album, and track tools. Use for a release-cohort or catalog-positioning brief with artist/recording identity, release types, date precision, editions, a | |
| news-briefing-research Builds source-aware news briefings from GDELT, BBC, CNN, The Guardian, and Yahoo News using the Crawlora API. Use for recent headlines, topic monitoring, source comparison, and coverage timelines with links, dates, and uncertainty preserved | |
| news-media-research Researches public news from international, regional, business, technology, sports, science, and entertainment publishers through the Crawlora API — headlines, article text, search, live coverage, and section/topic archives — returning clean | |
| newsletter-topic-landscape Compare editorial topics and coverage across Substack newsletters through Crawlora publication discovery and bounded public post samples. Use for a newsletter landscape, publication positioning map, coverage-gap brief, or topic-focused read | |
| nft-collection-liquidity-research Compare observed OpenSea collection depth, bids/asks, activity, holders, and traits through Crawlora. Use for a source-attributed liquidity snapshot with chain/contract/item identity, cumulative quantities, currencies, eligibility, observat | |
| nike-research Researches Nike's catalog — categories, search, product detail, colorways, reviews, and nearby stores — using the Crawlora API, returning clean JSON. Use when the user asks to find a Nike product, browse a Nike category, compare Nike colorw | |
| oldnavy-research Researches Old Navy's catalog (and its Gap Inc. sibling storefronts Gap, Banana Republic, Athleta) — categories, products, colors/sizes, in-store pickup availability, and reviews — using the Crawlora API, returning clean JSON. Use when the |
22,901–22,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.