Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Flowershow flowershow/flowershow Publish Markdown and HTML from your AI session as a live website. No account needed. | |
| FlowLeap Patent AI flowleap-ai/flowleap-mcp EPO/USPTO search, citations, OCR, plus PATSTAT Portfolio Analytics, guarded SQL and Graph Analytics. | |
| Flowlines flowlines-ai/plugins MCP observability: analyse MCP server usage, investigate sessions, and instrument MCP servers. | |
| flowR flowr-analysis/flowr Static dataflow analysis, program slicing, linting, and dependency extraction for R code. | |
| Flowra flowradev/skills MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows | |
| Faultline fltln-io/faultline-mcp Check infrastructure health, manage incidents, and run runbooks in Faultline. | |
| io.github.Fluenta-Team/fluenta fluenta-team/fluenta-mcp Score business ideas on six live market signals. Launch Readiness Score (LRS) for AI agents. | |
| Fluentive MCP fluentive/mcp Information, FAQs, features, and pricing for Fluentive's task management platform. | |
| io.github.flukeatzerocool/holonovel flukeatzerocool/holonovel Holonovel MCP server: world-model base for tabletop RPG play (rooms, parser, narrative tools). | |
| FlutterSDK Docs fluttersdk/ai Search Wind UI, Magic, Dusk, Telescope and Artisan documentation. Hosted, public, no auth. | |
| FlutterSDK Telescope fluttersdk/telescope Inspect a running Flutter app: HTTP traffic, logs, exceptions and queries. Debug only. | |
| Fluxcut flux-ai-agent/fluxcut-plugin Your agent makes a product video; you approve each step and publish. Needs a Fluxcut agent key. | |
| Fluxmail fluxmailai/fluxmail Read, search, draft, send, and organize email through Gmail, Outlook, and IMAP/SMTP mailboxes. | |
| codev flxbl-io/codev-mcp Connect AI agents to codev for Salesforce projects, builds, releases, validations, and insights. | |
| App Store Top Charts, Reviews & App Ideas (by flyingkiwi) flyingkiwi-tools/apify-mcp-tools Apple App Store top charts by country and category, rank changes, review themes and AI app ideas. | |
| Greenhouse, Lever & Ashby Jobs (by flyingkiwi) flyingkiwi-tools/apify-mcp-tools Open jobs from Greenhouse, Lever, Ashby and 4 more ATSs in one schema, with new-job monitoring. | |
| PDF to Markdown & Document Converter (by flyingkiwi) flyingkiwi-tools/apify-mcp-tools PDF, Word, PowerPoint, Excel, HTML and EPUB to clean Markdown for RAG, with OCR. Pay per document. | |
| tashan flyingwhr/tashan Check any MCP server or agent skill before installing: upkeep, real adoption, and OSV advisories. | |
| Boostermage MTG Prices fmacpro/boostermage Live MTG sealed product prices across UK retailers. Search, compare, track deals and price drops. | |
| Frédérick Madore — Academic Record fmadore/website Search and cite Frédérick Madore's publications, talks, research projects, DH work and CV. | |
| viral.app fmd-labs/viral-app-agents UGC analytics and Creator Hub for TikTok, Instagram and YouTube: tracking, campaigns, jobs, events. | |
| fnlowl fnlowl/skills Read and manage fnlowl widgets, leads, email sequences and analytics from an AI assistant. | |
| KnownGate focusedcreativity/knowngate Food verification for people and AI agents: evidence-backed verdicts, with sources and dates. | |
| focxle — what your AI agents cost focxle/focxle-python Ask what your AI agents cost. Per agent, across every vendor, from your editor. | |
| Fold Laboratories fold-laboratories/fold-agents Original art from galleries and artists: search, details, delivered prices and checkout links. | |
| Sleepwalker followanton/sleepwalker AI Visibility and Content Intelligence tools for Claude and MCP-compatible agents. | |
| com.followontours/cricket-travel followontours/mcp-server Bespoke sports travel: cricket, golf, rugby, polo and playing tours. Tour operator, ABTOT 5718. | |
| OpenClaw量化交易工具集 followtz/openclaw 量化交易MCP工具集，27个工具覆盖策略指标、回测引擎、风控分析和数据管线 | |
| ORA · ORUM fomosdeimos-gif/awesome-x402 Autonomous organism: symbolic field-state, verified-provenance art licensing, x402 referral. | |
| app.vercel.ora-x402-gateway/sensations-mergulho fomosdeimos-gif/orum-ora-x402 MCP server for 0001SENSATIONS: 107-level textual descent, append-only trace logging | |
| Fonciq fonciq/fonciq Données foncières du Québec pour assistants IA (MCP) · Québec land data for AI assistants | |
| Ideabob Validation foodyogi/ideaflow-scorer Score, validate, and pressure-test startup ideas with AI from Claude or any MCP agent. | |
| io.foqal/Foqal foqal/mcp Foqal turns Slack/Teams into efficient support platforms with AI-powered ticketing. | |
| MDEngine forcefieldsilicon/mdengine MD workbench for agents: 13 analysis tools, renders, hosted GPU runs; LAMMPS + OpenMM. | |
| Foresee foresee-tech/foresee Let AI assistants shop for home and auto insurance: compare quote estimates across every carrier. | |
| AI4L Library forever-healthy/ai4l-library Local Markdown library of the papers an evidence review cites: metadata, abstract and full text | |
| Forever In Our Hearts forever-in-our-hearts/memorials-mcp-server Read-only lookup of public memorials, funeral notices and partner funeral homes. | |
| LEEVAR reliability battery forevercrab321-svg/leevar-battery Grade an AI agent's transcripts on 18 reliability tests. Thin evidence is NOT TESTED, not guessed. | |
| ANAF e-Factura foreverworks/mcps Read, check and file a Romanian company's e-invoices and e-Transport declarations with ANAF. | |
| ANAF SPV foreverworks/mcps Download what ANAF posts to your SPV inbox, request documents, and validate or file declarations. | |
| App Store and Google Play foreverworks/mcps Read and answer App Store and Google Play reviews, and see TestFlight feedback and crash logs. | |
| Bitwarden foreverworks/mcps Give your assistant its own Bitwarden vault for logins, passwords, 2FA codes and passkeys. | |
| BNR exchange rates foreverworks/mcps Look up the National Bank of Romania's rate for any day, and convert amounts to and from RON. | |
| Expo Application Services foreverworks/mcps Find out why an Expo build, workflow run or store submission failed, and roll out updates. | |
| Enable Banking foreverworks/mcps Read, search and export statements and balances from banks across Europe, without moving money. | |
| Google Workspace foreverworks/mcps Search and work in Gmail, Calendar, Drive, Docs, Sheets and Slides across several Google accounts. | |
| Home Assistant foreverworks/mcps Read your Home Assistant's states, areas and history, and run its actions, approving locks first. | |
| Notion foreverworks/mcps Search, read and write your Notion workspaces, with pages as Markdown and typed database queries. | |
| Oblio foreverworks/mcps Issue and track a Romanian company's invoices on Oblio, with totals computed as ANAF checks them. | |
| ONRC trade register foreverworks/mcps Follow your filings at Romania's trade register, with their documents, fee notes and invoices. |
23,101–23,150 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.