Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Dataify Linkedin Builder Collect Linkedin Builder data and return results | |
| Dataify Live Research Produce current, cited multi-source research briefs | |
| Dataify MCP Configure and route Dataify MCP tools safely | |
| Dataify Price Intelligence Compare prices and produce normalized pricing findings | |
| Dataify Reddit Comment By URL Collect Reddit Comment By URL data and return results | |
| Dataify Reddit Posts Collect Reddit Posts data and return results | |
| Dataify Review Intelligence Turn customer reviews into evidence-backed product actions | |
| Dataify Capability Router Route outcomes to the right Dataify capabilities | |
| Dataify Scraper Builder Inspect a site and generate a Dataify scraper starter | |
| Dataify SEO Audit Audit crawlability, metadata, headings and structured data | |
| Dataify Task Operations Wait for Dataify tasks and return final results | |
| Dataify Task Result Download a completed Dataify task result | |
| Dataify Task Status Check the status of a Dataify scraper task | |
| Dataify Tiktok Builder Collect Tiktok Builder data and return results | |
| Dataify X Builder Collect X Builder data and return results | |
| Scraper Walmart Products Collect Walmart Products data and return results | |
| Dataify Web Unlocker Unlock blocked or JS-heavy pages through Dataify | |
| Dataify Yandex Search Search Yandex | |
| Dataify YouTube Audio By URL Collect YouTube Audio By URL data and return results | |
| Dataify YouTube Comment By ID Collect YouTube Comment By ID data and return results | |
| Dataify YouTube Product By ID Collect YouTube Product By ID data and return results | |
| Dataify YouTube Profiles Collect YouTube Profiles data and return results | |
| Dataify YouTube Transcript By ID Collect YouTube Transcript By ID data and return results | |
| Dataify YouTube Video By URL Collect YouTube Video By URL data and return results | |
| Dataify YouTube Video Post Collect YouTube Video Post data and return results | |
| Dataify Airbnb Builder Prepare Dataify builder requests for the airbnb.com scraper family rooted at airbnb_product_by-searchurl. Use when needs to work with the successful Dataify... | |
| Dataify ChatGPT Answers Collect ChatGPT answers and return results | |
| TraderBro - Credit Rating for Investment Influencers Query analyst predictions, content, and market research from the TraderBro platform. | |
| 一个功能强大的屏幕浏览、OCR识别和屏幕分析技能包，专为AI助手设计 此技能应被用于任何需要捕获屏幕截图、分析屏幕内容或处理屏幕图像的任务。包括：使用Python PIL库捕获整个屏幕或特定区域的截图；保存截图到指定位置；分析截图中的文字内容（支持中英文OCR识别）；对截图进行基本图像处理（裁剪、旋转、调整大小）。当用户提到"屏幕截图"、"截屏"、"查看屏幕"或需要分析屏幕上的内容... | |
| Discord Server Admin Manage Discord servers with a narrow, medium-risk scope using direct Bot API calls. Use when creating, renaming, moving, or deleting channels/categories; cre... | |
| worldcup-analyzer Predict English Premier League football match outcomes first, keep World Cup national-team support for compatibility, include schedule/result context, answer in the user's language, and keep output as statistical reference only, never betti | |
| instagram-campaign-monitor Monitor recent public Instagram posts from campaign or branded hashtags through Apify, with optional brand-term filtering and webhook delivery. Use for recurring campaign tracking, UGC discovery, brand mentions, or scheduled hashtag reports | |
| instagram-followers-scraper Extract follower lists from public Instagram profiles through Apify. Use when a user asks who follows one or more Instagram accounts or needs follower usernames and public profile fields; do not use for following lists, Stories, Highlights, | |
| instagram-following-scraper Extract the accounts followed by public Instagram profiles through Apify. Use when a user asks who an Instagram account follows or needs following-list usernames and public profile fields; do not use for follower lists, Stories, Highlights, | |
| instagram-highlights-scraper Extract public Instagram Highlights from Highlight URLs through Apify, including their story media and available metadata. Use when a user supplies instagram.com/stories/highlights URLs or asks to download Highlight contents; do not use for | |
| instagram-stories-scraper Scrape current public Instagram Stories by username through Apify, including media URLs and rich story metadata. Use when a user needs live Stories, story downloads, mentions, links, music, locations, or paid-partnership signals; do not use | |
| Datayes 宏观指标 查询 Datayes/通联的宏观与行业指标数据。用户询问 GDP、CPI、PPI、PMI、M2、社融、利率、就业、贸易、产量、价格等宏观或行业时间序列时使用。优先通过仓库内 Python 脚本搜索候选指标并拉取明细，不要手写 HTTP 请求。 | |
| Datayes Stock Analysis 个股全面分析 Skill。当用户请求分析某只股票、了解股票基本面/行情/经营情况、或询问某股票是否值得关注时触发。覆盖五大维度：基本信息、行情走势、经营分析（主营/财务/重大事项）、行情分析（估值/资金/技术）、综合结论，调用 datayesMCP 系列工具（5个MCP服务/10个工具）获取数据，进行分析，输出报告。 | |
| Datayes Web Search 通用 AI 语义搜索技能，通过 Datayes gptMaterials/v2 API 执行结构化语义搜索。用户询问最新资讯、研报、公告、会议纪要、行业动态、指标背景材料时使用。优先通过仓库内 Python 脚本发起请求，不要手写 HTTP 请求，不要在 skill 中硬编码 token。 | |
| AIOZ UI Skills Build UI components and pages using AIOZ UI V3 design system. Use this skill whenever the user wants to create, edit, or style React components using AIOZ UI... | |
| AIOZ UI V3 Skills Build UI components and pages using AIOZ UI V3 design system. Use this skill whenever the user wants to create, edit, or style React components using AIOZ UI... | |
| Voice Transcription 语音转文本技能 - 基于 SiliconFlow API (SenseVoiceSmall/TeleSpeechASR)，支持四川话等多种方言识别 | |
| dat-test-skill ByteRover usage metrics report. Runs the metrics script to summarise query and curate activity — counts, durations, file changes, and quota errors. Accepts o... | |
| Datris Memory Use the Datris Platform as a long-term semantic memory layer through the Datris MCP server. Local markdown memory files (MEMORY.md, memory/*.md) stay canonic... | |
| Sefaria API MCP Provides access to the Sefaria API MCP server for retrieving, searching, and exploring Jewish texts and related content via MCP interface. | |
| Echarts Chart Skill Generate charts from natural language or tabular data, recommend chart types, and export ECharts-based HTML or SVG. Use when users ask for one-sentence chart... | |
| Sentry Issues Fetch and analyze issues from Sentry error tracking. Use when asked to check Sentry errors, pull issues, investigate exceptions, review error trends, or get... | |
| Openclaw Shopify Manager Connect OpenClaw to Shopify with guided setup, local `.env` secret storage, Shopify OAuth, webhook validation, product and content operations, and host or Do... | |
| rwa-data-api Buy live stablecoin, RWA, DeFi, and AI-agent-economy market data for AI agents. Pay-per-call in USDC on Solana via x402 — no accounts, no API keys. Use when you need crypto market metrics, stablecoin peg checks, price snapshots, claim verif | |
| AI stock watchdog Daily monitoring for Indian equity holdings (NSE/BSE) using a documented severity rubric. Silent by default — only surfaces Sev-1 events (governance, cash fl... |
24,351–24,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.