Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| io.github.issuecapture/mcp-server issuecapture/issuecapture Install the IssueCapture bug reporting widget for Jira. Auto-detects your framework. | |
| Isto Intents istointents/isto-intents-mcp Ask a local listing portal to keep looking for a used car or home; the user confirms there. | |
| p-e relay (remote) it-start/relay-ui Remote MCP access to the p-e relay store. Reads are open; writes and waits are signed. | |
| Itamos MCP Tools itamos-technologia/itamos-mcp-tools Code-map tools for AI agents: see a repo's structure first, then edit only what matters. | |
| ShipMyCar Vehicle Logistics Quote Connector itboffins/smc-website-nextjs UK/EU and international car transport quotes with HMRC, IVA, DVLA and logistics costings. | |
| view-sim itelo/view-sim See a site on phones, tablets and laptops in Safari, Chrome, Firefox or Zen frames; PNG screenshots. | |
| ITEON MCP Server iteonpl/iteon-apps Polski software house B2B: 5 public + 7 OAuth 2.1 private MCP tools (AI estimate, draft, risk). | |
| Iteration Layer iterationlayer/iterationlayer Composable APIs for document extraction, image transformation, and document & sheet generation. | |
| io.github.iTophua/iterminal itophua/iterminal MCP Server for iTerminal SSH Connection Manager - Control SSH servers through Claude. | |
| HubVibe: Pay-per-Call Agent Tools: Web Search, Email Verify, Contact Screening, Stocks, Crypto, News its-fortunatefolly/hubvibe 75 metered agent services: research, verification, audits, data and media over MCP, A2A and HTTP. | |
| io.github.itsflaid/devmap itsflaid/devmap Query a codebase map (routes, features, flows, impact) built by static analysis. | |
| The Lounge itsmalware/the-lounge Agent-only social space for AI agents. No humans allowed. | |
| Mazza Group AI APIs itsmeadamdamroma/mcp-server 21 AI APIs pay-per-call with USDC on Base via x402. No keys, no signup. | |
| Delightful's Game Research Starter Pack itsmepants2/games-research-starter-pack Where to look for games industry research: 873 sources across ten markets, cited and free. | |
| io.github.ItsOdeLeo/codex4ever itsodeleo/codex4ever Plan OpenAI Codex usage from local quota, banked resets and extra-reset forecasts. | |
| io.github.itsoft7/egrul-mcp itsoft7/egrul Проверка организаций, ИП и физлиц по данным ЕГРЮЛ/ЕГРИП ФНС: санкции, иноагенты, банкротство. | |
| Pondchat ivanaka/pondchat Ephemeral P2P WebRTC video rooms — create a pond, share the link, talk. | |
| io.github.ivangr1/walletap ivangr1/walletap-mcp Issue and manage Apple Wallet & Google Wallet passes from any AI assistant. | |
| WSG Check ivanoats/wsg-check Check websites against the W3C Web Sustainability Guidelines and look up the guidelines | |
| Ventru ivanontech/ventru-net Free contact network for AI agents and people. Find, verify, and message anyone. | |
| Agent Conversion — AI Website Conversion Testing ivanpq98/agent-conversion Test whether AI agents complete SaaS pricing, signup or sales journeys; get evidence-backed reports. | |
| io.github.IvanSFlowGit/paypilot-ach-returns-mcp ivansflowgit/paypilot Read-only decision table over ACH return codes: 17 codes, 5 decisions, rule shown. | |
| UNLAV Supplier Quote Compare ivansky1/unlav-data-tools-mcp Compare complete supplier quotes with exact totals and shipping. 0.05 USDC on Base via x402. | |
| TLE Satellite Tracker ivanstan/tle-api Access TLE orbital data for thousands of satellites including ISS, Starlink, and Hubble. | |
| GemstoneAI iveye-inc/gemstoneai-agents Analyze jewelry photos, see comparable listings and sales, and save the piece to a collection. | |
| AgentCommons.me ivgolovach/agentcommons-mcp Public working memory for AI agents: messages, shared pages, and resumable tasks. | |
| io.github.Ivy-Innovation/cubelife ivy-innovation/cubelife Give AI agents a persistent pixel-art character reflecting their state in real time. | |
| io.github.iwanek86/pricemyrepair-mcp iwanek86/pricemyrepair-mcp UK car repair and servicing cost ranges per car model, in GBP, from PriceMyRepair. | |
| Asks ixoworld/ixo-plugins People and AI agents post paid asks, answer with evidence; a verifier checks; approval pays. | |
| Tollmint iyonx/tollmint Per-call data for agents: graded behavioural science, dark-pattern detection, web fetch, geocode. | |
| AVCS izagood/avcs AI-native version control where intent, operation, evidence and decision are first-class objects. | |
| io.github.IzikLisbon/mufmuf-mcp iziklisbon/mufmuf Score how visually compatible two photos are (1-10), with sub-scores and an explanation. | |
| Discord MCP j-256/discord-mcp Least-privilege Discord MCP for privacy-safe reads, audits, and reviewed administration | |
| ドメイン番人 j-doi/domain-shield ドメインの設定を調べる MCP サーバー。SPF / DKIM / DMARC・DNS・SSL 証明書・セキュリティヘッダ・サブドメイン・類似ドメインを、公開情報だけで確認します。登録不要・無料。 | |
| IFC Viewer Online j03rul4nd/ifc-viewer-online IFC/BIM with a 3D viewer: validate IFC, check IDS, Health Score, drawings, digital twins. | |
| Code Assistant j0hanz/code-assistant Gemini-powered MCP server for code analysis. | |
| Code Review Analyst j0hanz/code-review-analyst-mcp Gemini-powered MCP server for code review analysis. | |
| Memory MCP Server j0hanz/memory-mcp SQLite-backed MCP server for persistent memory, full-text retrieval, and graph traversal. | |
| io.github.j0hanz/superfetch j0hanz/super-fetch-mcp-server Intelligent web content fetcher MCP server that converts HTML to clean, AI-readable JSONL format | |
| GasNow j0n777/gasnow Live crypto fees: USDT transfer costs on 12 networks, exchange withdrawals, bridges and gas. | |
| Washlib j1034567/washlib Find car washes in France, check live slots, get exact prices and start a booking. | |
| fixture.email — Email Testing for Agents j6-integrated/fixture.email Disposable test mailboxes on a real domain: send, receive and assert on real email. | |
| FilingFirehose jaablon/filingfirehose-python SEC EDGAR filings parsed: 8-K body-text classification, 13D activist tagging, S-3 ATM detection. | |
| Piku jabclari/piku-plugin Find creators and read their Rate Cards. Creators draft quotes and invoices on their Piku account. | |
| io.github.jack1590/RokuMCP jack1590/rokumcp MCP server for Roku device automation — deploy, ECP control, screenshots, and debug console | |
| DrillSpark MCP Server jackasser/flowmind Create and manage Mermaid.js flowcharts and diagrams with AI agents via MCP. | |
| Friday Flight Deals jackculpan/friday-flight-deals The newest cheap flight deals from the Friday Flight Deals newsletter. | |
| BuilderVet: NSW and QLD builder licence and risk history jackfieldman/buildervet BuilderVet: is this NSW or QLD builder licensed, insolvent or disciplined? 290k+ official records. | |
| SIC Codes UK jackmmaher/siccodes.co.uk UK SIC code lookup, GICS/ICB mapping, and Companies House search. 731 codes, 5.6M companies. | |
| Verika - Verifica P.IVA, Codice Fiscale e IBAN jackpons/partita-iva-mcp Verifica partita IVA, codice fiscale e IBAN italiani con dati ufficiali (VIES, IPA, ISTAT) |
24,201–24,250 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.