Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| open-source-project-shortlisting Build requirements-based open-source project shortlists using Crawlora GitHub metadata, releases, contributors, and public project documentation. Use to compare libraries or tools by supported capabilities, maintenance evidence, license dec | |
| opensea-research Researches OpenSea NFT collections, items, marketplace activity, listings, offers, traits, categories, chains, and creator profiles via the Crawlora API, returning clean JSON. Use when the user wants to inspect an NFT collection, compare ma | |
| patent-landscape-analysis Map a technology area using Crawlora Google Patents and USPTO search/detail tools with explicit query coverage, patent-family grouping, assignee normalization, dates, and classifications. Use for an exploratory technology landscape or portf | |
| patents-research Researches patents and patent applications via the Crawlora API — Google Patents (full-text search by keyword/inventor/assignee, bibliographic detail, claims/citations/family, CPC classification lookup, recent-publications browse, database | |
| pet-care-provider-shortlisting Build pet-care or dog-training shortlists from Crawlora public Rover listings and profiles. Use to compare advertised services, starting rates, local fit, experience claims, and sampled reviews with price units, availability, badges, and sa | |
| pet-services-research Researches public Rover sitter and trainer profiles through the Crawlora API, returning clean JSON. Use when the user wants to discover pet sitters, dog walkers, trainers, or inspect a public provider profile without scraping Rover pages. | |
| pinterest-research Researches Pinterest profiles, boards, pins, ideas categories, and search results via the Crawlora API, returning clean JSON. Use when the user wants a Pinterest user's profile/boards/pins, a pin's or board's detail, a category feed, or a k | |
| podcast-discovery-research Discovers and compares public podcast shows, episodes, charts, rankings, and related programs using Apple Podcasts and Spotify Podcasts through the Crawlora API. Use for show research, guest discovery, and listening-market snapshots. | |
| podcast-guest-research Find podcasts suited to a proposed guest using Crawlora's podcast catalog, live show and episode data, and public show websites. Use for guest-appearance shortlists, recent-topic research, and tailored pitch angles supported by actual episo | |
| podcast-topic-landscape Map podcast topics across public show and episode samples with Crawlora Apple Podcasts and Spotify tools. Use for a podcast editorial landscape, comparable-show topic matrix, or reading/listening shortlist with identity, sampling, descripti | |
| prediction-markets-research Research prediction-market odds, order books, price history, and public market-rule context from Polymarket, Kalshi, Metaculus, and DraftKings Predictions. DraftKings routes expose categories, availability maps, and rules, not live quote da | |
| prescription-price-research Compare public GoodRx pharmacy price snapshots using Crawlora drug and option discovery. Use to compare posted prices for a specified medication, form, strength, quantity, and US location; excludes diagnosis, dosing advice, medication chang | |
| product-price-research Researches products, prices, sellers, and reviews across major online marketplaces and big-box/specialty retailers (Amazon, eBay, Shopify stores, Shop.app, Target, Costco, Walmart, Nike, Zara, Adidas, Best Buy, Home Depot, Sephora, SHEIN, I | |
| real-estate-autos-research Researches homes and used cars via the Crawlora API — Zillow and Redfin property search/estimates/market trends, plus CarMax, Autotrader, and Cars.com vehicle search and dealer/listing detail — returning clean JSON. Use when the user wants | |
| reddit-research Researches public Reddit posts, comments, communities, user history, and trends through the Crawlora API. It also supports explicitly requested buying-intent lead discovery that scores public posts. Use for community research, sentiment, tr | |
| reddit-stock-sentiment-research Summarize sampled Reddit discussion about a publicly traded company or ticker and, when useful, compare it with same-window Yahoo Finance price context. Use for requests like “what are Reddit investors saying about NVDA?” or “summarize bull | |
| relocation-cost-comparison Compare city relocation budgets with Crawlora itemized Numbeo costs and optional US housing-market context. Use for household expense scenarios, rent comparisons, or choosing between cities with explicit currency, household, and price-basis | |
| rental-housing-research Research public rental communities and NYC housing listings or market series through Crawlora StreetEasy and Greystar. Use to build a rental shortlist, inspect buildings or units, compare advertised housing offers, or put NYC asking prices | |
| resale-secondhand-research Researches secondhand, resale, handmade, and musical-instrument marketplaces via the Crawlora API. Use to compare live listings and sellers, check sneaker or used-gear sale history, or source handmade and vintage goods with condition and pr | |
| restaurant-food-delivery-research Researches restaurants and grocery/food delivery via the Crawlora API — Yelp reviews, OpenTable reservations, DoorDash and Uber Eats restaurant search/menus, and Instacart grocery search — returning clean JSON. Use when the user wants resta | |
| restaurant-menu-benchmarking Compare restaurant menu breadth, matched dishes, bundles, and location-specific prices with the Crawlora API. Use for restaurant competitor benchmarks or comparisons of direct, pickup, and delivery menus in a defined market. | |
| retail-assortment-gap-analysis Compare competing retail assortments through Crawlora catalogs. Use to find observed gaps in categories, brands, product attributes, variants, and price bands, with explicit catalog coverage and product-matching evidence. | |
| samsclub-research Researches Sam's Club's catalog — department/category navigation, category product grids, product detail with pricing/availability/ratings, related-item shelves, and curated content pages — using the Crawlora API, returning clean JSON. Use | |
| sec-filings-research Research SEC EDGAR filings and financial disclosures through Crawlora, including company filings, extracted sections, normalized financials, insider transactions, and institutional holdings. Use for sourced filing briefs and period-aware co | |
| sec-insider-transaction-analysis Analyze reported company insider transactions using Crawlora live SEC and stored Form 3/4/5 records. Use for transaction-code, owner-role, date-window, and share/value evidence briefs with filing coverage, amendments, derivative scope, and | |
| serp-keyword-research Runs SERP and keyword research via Crawlora — Google, Bing, Brave, DuckDuckGo, Yahoo, Baidu, Yandex, selected Qwant/Startpage suggestions, and Google Trends. Use for localized search snapshots, autocomplete ideas, or trend context; it does | |
| shop-app-research Researches products, variants, shops, and reviews on Shop.app — Shopify's own cross-store shopping/discovery app, distinct from individual Shopify storefronts — using the Crawlora API, returning clean JSON. Use when the user asks to find a | |
| shopify-research Researches independent Shopify-powered storefronts — products, collections, pages, sitemaps, search suggestions, and product recommendations — using the Crawlora API, returning clean JSON for any store by domain, plus 14 pre-wired DTC brand | |
| short-term-rental-market-research Compare short-term rental market supply, listing density, room mix, price distributions, and review signals using Crawlora Airbnb aggregates and selected live listings. Use for market comparisons, with explicit sampling and freshness limits | |
| social-media-research Researches public profiles, posts, trends, and Facebook Marketplace listings across Instagram, TikTok, Threads, Bluesky, X, Pinterest, LinkedIn, Facebook, Reddit, Bilibili, and Patreon through the Crawlora API. It also supports explicitly r | |
| software-vendor-shortlisting Build a requirements-based software shortlist using Crawlora product discovery, public vendor pages, and review samples. Use to compare vendors against must-haves, pricing assumptions, integration needs, and demo questions before a buying d | |
| sports-betting-research Research public sportsbook and match-market snapshots with event context from DraftKings Sportsbook, ESPN, SofaScore, and Flashscore. Use for time-stamped odds comparisons, not wagering, account actions, or financial advice. | |
| sports-scores-research Pulls sports scores, standings, rosters, player/team stats, public sports news, editorial, wiki/video content, and betting odds through the Crawlora API — ESPN, SofaScore, MLB, Strava, DraftKings Sportsbook, Cricinfo, and Sportskeeda. Use f | |
| sports-team-player-research Build a sourced Flashscore player or team dossier from profiles, squads, career and match records, fixtures, transfers, injury history, and public news. Use for sports roster and career research; source records do not establish fitness, ava | |
| startup-acquisition-research Screen startups listed for sale using Crawlora's TrustMRR marketplace, stored company records, and daily metric history. Use for acquisition candidate shortlists, asking-price comparisons, revenue-history checks, and evidence-based diligenc | |
| startup-launch-research Screens startup launches, public traction signals, verified revenue profiles, and crowdfunding campaigns using Product Hunt, TrustMRR, and Kickstarter through the Crawlora API. Use for launch research and acquisition screening, not investme | |
| steam-market-opportunity-research Evaluate Steam game niches using Crawlora's game catalog, chart and player-count history, live pricing, reviews, and release news. Use for comparable-title studies, positioning and price research, and evidence-backed game opportunity hypoth | |
| streaming-availability-comparison Compare movie, show, season, and episode viewing offers across countries and providers using Crawlora JustWatch. Use for where-to-watch shortlists or regional availability matrices with subscription, rental, purchase, presentation, title id | |
| substack-research Research Substack publications, writers, public posts, recommendations, categories, and Notes through Crawlora. Use to find newsletters, compare editorial coverage, inspect a publication archive, or sample public discussion and writer netwo | |
| supplier-sourcing-research Discover and compare suppliers behind brands using Crawlora's ImportYeti company reports and public business websites. Use for supplier shortlists, observed sourcing relationships, shipment-activity comparisons, and questions to qualify pot | |
| supply-chain-concentration-analysis Analyze observed supplier and origin concentration using Crawlora ImportYeti company reports and public company evidence. Use for a sourced supply-chain exposure brief with importer/supplier identity, shipment measures, periods, incomplete | |
| target-research Researches Target's catalog — categories, products, filters, prices, questions, and reviews — using the Crawlora API, returning clean JSON. Use when the user asks to find a product on Target, browse a Target category, compare Target prices/ | |
| techstack-prospecting Find and qualify company websites by their detected technologies using Crawlora's tech-stack dataset and live website checks. Use for technology-based account lists, integration targeting, or qualifying an existing domain list. | |
| tesla-jobs-research Researches Tesla job postings via the Crawlora API — search Tesla's careers site (tesla.com/careers) by title, department, or location, and pull a single posting's full description by id — returning clean JSON. Use when the user wants to se | |
| threads-research Researches public Threads (Meta) profiles, posts, replies, and search results via the Crawlora API, returning clean JSON. Use when the user wants a Threads profile's stats, a post's content/replies, a profile's recent posts, or a keyword se | |
| tiktok-ad-research Research TikTok Creative Center Top Ads by brand, market, industry, and objective through Crawlora. Use for competitor-ad comparisons, creative briefs, messaging and format analysis, and inspection of public ad-performance charts. | |
| TikTok Creator Research Vet public TikTok creators and content | |
| tiktok-research Research public TikTok profiles, videos, comments, hashtags, search results, trending feeds, and Creative Center signals through Crawlora. Use for TikTok-specific discovery or verification instead of scraping TikTok directly; use tiktok-ad- | |
| TikTok Trend Research Build evidence-backed TikTok trend briefs | |
| topic-demand-validation Validate broad topic, problem, audience, or content demand by comparing autocomplete, Google Trends, search results, and sampled discussion. For a physical product launch hypothesis that needs marketplace listings, prices, and review eviden |
22,951–23,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.