Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| SmartPro MCP Server abuali85/smartpro-mcp-server A basic skeleton for building MCP servers with Supabase-based authentication, RBAC, and audit logging. It provides tool and resource implementations for hub and contracts platforms, enabling secure, tenant-isolated operations. | |
| agent-memory-v1 abuarchiv/agent-mem Enables coding agents to store and retrieve source-backed context locally in SQLite, with FTS5 search, optional reranking, and stdio MCP tools. | |
| trclient-mcp abuaz01/trclient Enables local management of Trade Republic accounts, including portfolio, cash, orders, documents, and market data, with dry-run order previews and safety guardrails. | |
| SafeSQL abubaker91-hub/safesql Enables Claude Desktop and Claude Code to inspect a Postgres schema and run read-only SQL queries against a demo database through the tools describe_schema and query_readonly. Every proposed query passes the same deterministic guardrails — | |
| DART-MCP abubaman/abuba-dart-mcp A financial analysis MCP server that uses the DART API to analyze and visualize financial data of listed Korean companies. | |
| Hello MCP Server abudhu/hello-mcp A simple greeting server that responds to messages, particularly answering 'how are you' with 'I am great'. Supports both local stdio and HTTP deployment modes with Docker containerization. | |
| Memory MCP Server abudriman/local-mcp A lightweight MCP server that provides persistent key-value storage for AI agents using SQLite and Bun. It enables agents to store, retrieve, and manage memories with optional JSON metadata for long-term context retention. | |
| xiaozhi-mcp-music abugg-007/xiaozhi-mcp-music Enables 小智AI to search songs across multiple free music sources, resolve direct playback URLs, and stream audio to devices via the ResourceLink/resources/read protocol. | |
| Cloudflare Playwright MCP abuh112/playwright-mcp-do Enables AI assistants to control a browser for web automation tasks such as navigation, typing, clicking, and taking screenshots. | |
| xpense-mcp abujubair7/xpense-mcp A minimal MCP server with hello and echo tools. | |
| keyso-mcp abukreev-dev/keyso-mcp MCP server for Keys.so SEO API, enabling domain and keyword analysis, competitor research, and SEO metrics retrieval through natural language. | |
| OpenAPI MCP Server abumalick/openapi-mcp Enables LLMs to explore and query OpenAPI specifications, allowing natural language interaction with API endpoints, parameters, request bodies, and response schemas from any OpenAPI 3.x spec. | |
| appyzeen-mcp abusalehofficial/appyzeen-mcp Enables AI editors to build and sign release Android APK and AAB artifacts from Android, Flutter, or React Native project zips, returning download links without any local SDK, NDK, or JDK. It also reports build status and Gradle failures, m | |
| MCP from API abusedmedia/fff-mcp-from-api Enables users to expose arbitrary HTTP APIs as configurable MCP tools by defining tool specifications in a JSON configuration file. | |
| Self-Hosted Supabase MCP Server abushadab/selfhosted-supabase-mcp-basic-auth A Model Context Protocol server that enables interaction with self-hosted Supabase instances, allowing developers to query database schemas, manage migrations, inspect statistics, and interact with Supabase features directly from MCP-compat | |
| Gatherings MCP Server abutbul/gatherings-mcp A Model Context Protocol server that helps track expenses and calculate reimbursements for social events, making it easy to settle balances between friends. | |
| Gatherings MCP Server abutbul/gatherings-mcp-python An MCP server that helps AI assistants manage expense-sharing for social events, enabling the creation of gatherings, tracking of expenses, and calculation of fair reimbursements among participants. | |
| Wind API MCP Direct Server abuttoncc/wind-mcp A server that provides direct connection to Wind API through MCP interface, allowing HTTP or SSE-based access to financial data functions like wsd, wss, and wsq without requiring additional socket servers. | |
| Termux MCP Server abuzar-ansarii/termux-mcp Enables any external AI client to control an Android device's hardware, read sensors, fetch communications, and execute arbitrary shell commands via Termux. | |
| Termux MCP Server abuzar-ansarii/termux-mcp-server Enables AI assistants to remotely control an Android device from a PC, using Termux API for camera, location, SMS, notifications, and shell commands over SSH or SSE. | |
| @alexbuzo/dzengi-mcp abuzo/dzengimcp Enables safe, local MCP access to Dzengi market, account, order, and position data, with read-only tools and explicitly guarded trading mutations. | |
| Graylog MCP Server abuzo/graylog-mcp Enables AI assistants to search and analyze logs in Graylog using three powerful tools: generic log search with Lucene queries, smart UUID/trace ID lookup across multiple fields, and stream-specific message retrieval with automatic field no | |
| MCP Atlassian Node Server abuzo/jira_mcp Production-ready MCP server for Atlassian Jira and Confluence, providing tools for issue management, page retrieval, and content operations. | |
| victorialogs-mcp abuzo/victoria-logs-mcp A read-only MCP server that lets AI clients investigate logs stored in VictoriaLogs over stdio, offering LogsQL search, UUID/stream lookups, stream and field discovery, hit aggregation, and stats queries with time-range and filtering contro | |
| ue-tools abx-apps/ue_tools Enables automating a running Unreal Editor via the Remote Control HTTP API and searching/reading Unreal Engine source files on GitHub when access is configured. | |
| Pastebase MCP Server abxn4r/pastebase-mcp Enables AI assistants to extract design systems, brand guidelines, copy, and sitemap structure from any live website via the Pastebase API. | |
| reading-companion aby0/reading-companion A 4-stage reading companion that helps users set reading goals, discover books, track progress, and deepen learning through reflection, integrated with Claude Desktop. | |
| ffmpeg-mcp-video-editor abyabyss/ffmpeg-mcp-video-editor Give any MCP client a real video editor — 32 typed tools over ffmpeg, Whisper and MediaPipe, plus an optional local UI with a drag-and-drop timeline. | |
| sheets-mcp abydin/sheets-mcp A minimal Google Sheets MCP server that exposes only three tools for reading and writing spreadsheet tabs. It prioritizes security by enforcing an allowlist, using RAW writes, and avoiding Drive scopes. | |
| open-vision-mcp abyssbugg/open-vision-mcp Provider-neutral Vision MCP Server — image analysis via 10 inference providers through a single MCP server. | |
| Task Manager abyssbugg/task-manager Enables users to manage tasks through a simple JSON file interface. Provides basic task management functionality by reading and writing to a configurable tasks.json file. | |
| PortHunter MCP abysswalkr/porthunter-mcp Analyzes PCAP/PCAPNG network capture files to detect port scanning techniques (SYN, FIN, Xmas), classify scan patterns, and enrich suspicious IP addresses with threat intelligence data. Provides comprehensive network security analysis throu | |
| Selenium MCP Server abyvarghesemandapathel/selenium-mcp-server Enables AI agents and MCP clients to automate web browsers via Selenium WebDriver, supporting Chrome, Firefox, and Edge in headless or visible mode with tools for navigation, interaction, content extraction, screenshots, and scripting. | |
| agent-memory ac0033/agent-memory Enables agents to manage persistent long-term memory through MCP tools for searching, adding, updating, giving feedback, and forgetting memories, with automated pipelines for redaction, distillation, and reconciliation. | |
| mcp-trust-scanner aca22akn/mcp-trust-scanner Scans MCP tools for trust drift, composition risks, and runtime policy violations, with optional LLM explanations. | |
| TradingView MCP Bridge acaca675/tradingview-mcp-analysis Connects AI assistants to your local TradingView Desktop app via Chrome DevTools Protocol for chart analysis, Pine Script development, and workflow automation. | |
| Vala-Fi MCP Server academicnair009/vala-fi-mcp A Bloomberg Terminal you can talk to. Query company relationships — suppliers, customers, competitors, supply chain paths — directly from Claude, Cursor, or any MCP-compatible AI assistant. | |
| serbian-data-mcp acailic/serbian-data-mcp Enables searching and analyzing over 3,400 datasets from the Serbian government open data portal, with built-in charting and data transformation tools. | |
| Contract Inspector MCP acaisec/contractinfomcp A local Ethereum contract analysis tool that retrieves on-chain information, integrates Etherscan and RPC data, and automatically executes view functions to provide comprehensive contract insights. | |
| bamboohr-mcp acalder-techpm/bamboohr-mcp Enables natural language interaction with BambooHR to manage employee records, time off, hiring, and benefits. It provides 74 tools and pre-built workflows to automate HR operations like onboarding, reporting, and performance tracking. | |
| Screaming Frog MCP Server acamolese/screaming-frog-mcp Enables AI assistants to analyze Screaming Frog SEO Spider crawl data through tool calls, supporting audits for broken links, redirects, indexability, and more. | |
| IT-MCP acampkin95/mcp Provides comprehensive macOS, Linux, and Windows system administration, diagnostics, and optimization tools including network inspection, security scanning, compliance auditing, database diagnostics, and structured DevOps task planning. | |
| SERVER-MCP acampkin95/mcpcentralmanager On-server agent for managing PostgreSQL, Redis, Keycloak, and NGINX on Ubuntu infrastructure with real-time monitoring, automated maintenance, and distributed command execution. | |
| amap-weather-mcp-server acane0320/amap-weather-mcp-server 基于高德地图API的中国城市天气查询MCP服务，支持实时天气和未来几天天气预报查询。 | |
| outlook-mcp-server acangialosi/outlook-mcp-server A local MCP server that gives Claude read/write access to a personal Hotmail/Outlook.com mailbox via the Microsoft Graph API, exposing tools for listing, searching, sending, and drafting emails. | |
| trendyol-mcp acar32furkan-glitch/trendyol-mcp Enables sellers to read Turkish marketplace order, return, stock, review, and price data, detect SLA breaches, stock and price traps, and unanswered reviews, and generate a prioritized daily Turkish action report. It is read-only by design | |
| hexstrike-ai acaranta/hexstrike-docker-mcp Enables remote execution of 150+ offensive-security tools through a streamable-HTTP MCP server, allowing MCP clients like Claude Code to drive the HexStrike toolset over the network. | |
| AgentForge acarchidi/agentforge-tools Enables AI agents to perform DeFi safety checks over MCP, including pre-signing transaction simulation, sanctions and scam address screening, token rug checks, risk-scored launches, and liquidation-risk assessment. | |
| shemcp acartine/shemcp An MCP server that provides sandboxed shell command execution with configurable security policies, enabling safe AI-assisted command runs within a project repository. | |
| cnj-processual acarvalhosp/cnj-processual Enables querying Brazilian judicial case data through CNJ public APIs: fetching case metadata and movements via DataJud, searching publications and intimations from the national electronic justice gazette (DJEN) by case number or OAB, and d |
23,301–23,350 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.