Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| GitEasy MCP greenmtnsun/giteasy Plain-English git for agents: 22 tools to branch, commit, push and tag. Free tier. | |
| io.github.greenmtnsun/wikimint greenmtnsun/ps-wiki-central Generate wiki docs from source code. Supports PowerShell, Python, Go, C#, Java, COBOL. | |
| Datanem greenzenith/datanem-mcp Turn PDFs, scans and photos into a queryable database. Invoices, CVs, receipts, in bulk. | |
| io.github.gregcastro23/planetary-agents gregcastro23/alchm-agents-app Converse with planetary-agent personas, council feeds & culinary debates from alchm.kitchen | |
| io.github.gregcastro23/alchm-kitchen gregcastro23/whattoeatnext Live transits, ESMS ingredients, cosmic recipes, synastry & transit×natal overlays by alchm.kitchen | |
| PRONA Board gregkish50/prona-board-mcp Free board where your AI agent runs a hard task stage by stage, with decisions in plain sight. | |
| Roast My Design System gregkozakiewicz/roast-my-design-system Audit your Design System and serve your Agent the rules that keep AI-written UI on-system. | |
| ai.monnet/mcp gregoirecasoetto/monnet-mcp MCP server for Monnet — motions, plans, files, approvals, and the team's company brain. | |
| AIContextBuilder gregordadera/aicb Symbol-aware C# and .NET code context for AI coding assistants. | |
| Agent Daily gregpunch/agent-daily Live health of 65 agent APIs/MCPs plus a 15-min LLM leaderboard; recommend(task) picks a provider. | |
| Gamedev Tavern — MCP for the game industry grendizer1/gamedev-tavern-plugin Your AI agent briefs Gamedev Tavern on you and your studio. Have a goal: a quest. No goal: get goals | |
| SpryTools API MCP Server grenzfrei/sprytools-mcp Utility tools for AI agents: hashing, text stats, validation, DNS, currency, GEO audits. | |
| pline.ai grepsr/pline-api Scrape, crawl, batch-scrape, map, and search the web through the hosted pline.ai API. | |
| Bibooks greysonbmiller/bibooks-mcp Search and read free bilingual audiobooks for language learners: parallel text, CEFR levels, audio. | |
| dev.kanta/cli griffinkanta/kanta-dev Kanta Verify, Find, and Database: email verification, email finding, and B2B contact search. | |
| Orca Site Guide griffmurder/basecamp-app Public read-only Orca guide: product, pricing, docs, and signup links. | |
| Straws Soda griffmurder/straws-website Public read-only MCP for strawssoda.com: menu, hours, and order or contact links. | |
| PumpView — Solana Trading & Live Data grinchdev/pumpview-agent-kits Solana swaps with local signing, confirmed receipts, trading volume and filtered live trade data. | |
| Sidequest grmkris/sidequest Connect an agent to Sidequest’s hosted job exchange to hire work, find work and settle on Monad. | |
| CN Internet Theories / 中文互联网理论库 grokkkkkk/cn-theories Search viral Chinese-internet theories (大水理论, 薄肌理论…) with sources, in Chinese and English. | |
| Cafe24 groove79/kmcp Cafe24 mall MCP: products, variant stock, orders, board posts. 카페24 쇼핑몰 MCP 서버. | |
| Coupang Wing groove79/kmcp Coupang Wing seller MCP: products, item stock/price, order sheets, ship confirmation. 쿠팡 윙 MCP. | |
| Delivery Tracking (Korea) groove79/kmcp Parcel tracking for Korean and global carriers (CJ, 우체국, 한진, 롯데, 로젠, 쿠팡, Yamato, DHL…). 택배 조회 MCP. | |
| HWP to Markdown groove79/kmcp Convert Korean HWP/HWPX (한글) documents to Markdown and extract tables. No keys needed. | |
| Japan → Korea Bridge groove79/kmcp Japan→Korea sourcing: Rakuten/Yahoo search, JPY→KRW landed cost, Smart Store draft. 일본구매대행 MCP. | |
| KakaoTalk Message groove79/kmcp KakaoTalk message MCP: send to self/friends, friends list, OAuth auto-refresh. 카카오톡 메시지 MCP. | |
| Korea Business Calendar groove79/kmcp Korean tax/payroll deadlines, public holidays, business-day math. No keys. 세무 일정·영업일 MCP. | |
| Cross-border Landed Cost groove79/kmcp Import duty + VAT/GST for parcels into US, UK, EU, JP, KR, CN, AU, CA, SG with de minimis rules. | |
| Naver Commerce groove79/kmcp Naver Smart Store MCP: list products, read orders and inquiries, update stock. 네이버 스마트스토어 MCP 서버. | |
| OFD Reader (China e-invoices) groove79/kmcp Read Chinese OFD documents: e-invoice (fapiao) fields, official documents, statements. No keys. | |
| Popbill (세금계산서·알림톡) groove79/kmcp Popbill MCP: Korean e-tax invoices (issue/cancel/search, Hometax sync) + KakaoTalk 알림톡. 팝빌 MCP. | |
| Korea Public Data groove79/kmcp Korean public data MCP: business status, holidays, addresses, apartment trades. 공공데이터 MCP. | |
| Toss Payments groove79/kmcp Toss Payments MCP: payment lookup, approval-gated cancel/refund, settlements. 토스페이먼츠 MCP. | |
| World Business Calendar groove79/kmcp Public holidays and working-day math for 200+ countries and regions, local weekends. No keys. | |
| io.github.groundhogday2011-byte/a2apay groundhogday2011-byte/a2apay Pay-per-call AI query and versioned task memory for agents. No account, no API key, via x402. | |
| xyz.groundtruths/groundtruth groundtruths/groundtruth-mcp Dev records, pump.fun + Robinhood Chain: launches, rugs, bonded, live last mint. Every figure has N. | |
| io.github.groupdocs-search/groupdocs-search-mcp groupdocs-search/groupdocs.search.mcp MCP server for GroupDocs.Search — index documents and run full-text search via AI agents. | |
| GRTwo Docs grtwo-jcansler/grtwo-docs Publish and share Markdown/HTML docs from AI assistants. Requires grtwo.app Pro. OAuth or API key. | |
| Gryz grtwo-jcansler/gryz-cursor-plugin Shared memory and workspace for your AI agent team, plus doc publishing. Free with a Gryz account. | |
| io.github.GRU-953/dev953 gru-953/dev953 dev953 method companion: exposes its multi-agent coding method as callable MCP tools. | |
| io.github.GRU-953/gru953-crew gru-953/gru953-crew GRU953 Crew's autonomous multi-agent coding method, exposed as callable MCP tools. | |
| weave grunion-ai/weave Connected tables, relations, workflows and markdown documents in one SQLite file, over MCP. | |
| io.github.grupoanesthy-spec/json-repair-mcp grupoanesthy-spec/json-repair-api Repairs malformed JSON from LLM output, validated against a schema. Paid per call via Stripe. | |
| XRPay Agent Commerce gsabbih6/ripple-pay Discover and buy digital products with XRP or RLUSD, with private downloads, orders and receipts. | |
| MCP GSC CPG gsc-em/a2a-mcp-cpg A2A MCP & CPG Rails: HBPC (Hygiene + Beauty Personal Care) procurement and ESG. | |
| Planify gsrathoreniks/planifyweb Schedule and publish social posts to Twitter, Instagram, LinkedIn, Pinterest, Bluesky and more. | |
| io.github.GstXu/mcp_test gstxu/mcp_test A simple MCP server example written in TypeScript that provides a multiplication tool. | |
| work.agentexchange.planets/agent-planets gtdfg6wgg8-ui/agent-planets-skill A galaxy where every AI agent owns a planet: claim free, terraform, build, visit, trade. | |
| io.github.guanqun-yang/mcp-server-r-counter guanqun-yang/mcp-server-r-counter A MCP Server Counting Number of r's for a Given Query | |
| Employed by Guaq AI guaq-ai/employed-plugins Live jobs from ~5,000 employer ATS boards, hiring profiles, your job profile and tracker. |
23,551–23,600 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.