Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Tiny Go MCP Server kioie/tiny-go-mcp-server Demo stdio MCP server (tools, resource, prompt) for tinymcp tests—not production use. | |
| Aviado AI kipmcc/aviado-mcp Cited supplement evidence, biomarker effects, interaction checks and brand quality | |
| ai.blast-radius/blast-radius kipmcc/blast-radius-live Blast Radius tools for AI strategy, diligence, and market updates. | |
| Aristocles Data API kiranz38/aristocles Subscription pricing, trade costs, and financial data for AI agents across 5 countries. | |
| GitHub Inside Claude Code kirchlive/github-inside-claude-code Normalized GitHub-CLI bridge for Claude Code — 89 ops, 6 families incl. federation sources | |
| Store API kirials86-eng/store-api-mcp GPT, Claude, Gemini, DeepSeek, Grok, Qwen and GLM through one API key. Pay per token. | |
| Expense Budget Tracker kirill-markin/expense-budget-tracker Track expenses, budgets, balances, transfers, and multi-currency reports with OAuth-secured tools. | |
| Nibomo Flashcards kirill-markin/flashcards-open-source-app Read, write, and conversationally review open-source flashcards through split read/write MCP tools. | |
| Fresh402 Agent Intelligence kirillradchenko96/fresh402 Persistent web/Base observations and recoverable results. Free Register, 7 paid tools; REST/MCP. | |
| Rogue Binary MCP kirkderp/rbinmcp Rust MCP server for binary analysis and reverse engineering. | |
| sharepa kirnski/sharepa-mcp Put chat-built pages online with your own address, forms, calendar bookings, password and stats. | |
| Provenza kironovlaziz-del/provenza Governed MCP gateway: approved tools only, each call policy-checked and recorded per agent | |
| KIRUPA Tutorials & Code Library kirupa/kirupawww Search and read hundreds of web development, JavaScript, CSS, canvas, and DSA tutorials from KIRUPA. | |
| X02 File Hosting kishanx08/x02.me Upload, find, organize and share files on your X02 account with scoped, revocable access. | |
| Hiring Signals kiskecske24/hiring-signals-mcp Live job openings from Workday, Greenhouse, Lever, Ashby, Workable and Personio career sites. | |
| Company Research kiskecske24/hiring-signals-mcp Website tech stack (7,600+ technologies) and screenshots for any company site, via Apify. | |
| Job Market Data kiskecske24/hiring-signals-mcp Live job vacancies: Germany (Arbeitsagentur), Sweden (Platsbanken) and global tech ATS jobs. | |
| Public Tenders (EU TED) kiskecske24/hiring-signals-mcp Search open EU public tenders and contract awards on TED by keyword, CPV, country and deadline. | |
| travel.kismet/mcp-server kismet-tech/kismet-travel-mcp-v2 Semantic hotel search with real-time availability and price comparison for Kismet Travel | |
| Heart kit-g/heart-api Your Heart workout log: workouts, records, templates, programs. Holds no health data. | |
| io.github.kitepon-rgb/aiterm-mcp kitepon-rgb/aiterm-mcp Claude Code drives Codex CLI's interactive TUI and durable tmux terminals over MCP. | |
| Put It Online kitsunde/putit-mcp Publish AI-made web pages and share files as short links from any MCP client. | |
| local.foundation kittyfromouterspace/local_foundation Community reads and consent-based member onboarding for local communities, over MCP. | |
| checklist.day Registry kitxor/ray-tracer Registry of Python AI/ML libraries: correct imports, quickstart code, and known footguns. | |
| Yaver kivanccakmak/yaver.io Phone-first local dev MCP for Claude Code and Codex: install Yaver, pair mobile, run, build, deploy. | |
| io.github.kKEo/memory-find kkeo/memory-find Local, explainable knowledge base for AI agents: hybrid search with provenance over SQLite. | |
| AIHOT kkkkhazix/aihot Chinese AI news: search topics, explore hot events, and read daily, weekly and monthly briefs. | |
| 校招宝 · 中国校园招聘岗位数据 kknee-dev/recruit-hub 中国校园招聘（秋招/春招/实习/提前批）在招岗位、企业档案、投递截止与求职攻略数据。免 API Key、免注册、只读。 | |
| io.github.kkohli-nyu/findvise-mcp kkohli-nyu/findvise AI-native local business data. Find businesses, browse menus, check ratings, and place orders. | |
| Klass Personal OS klassycoder/klass-personal-os-mcp Mac app that runs Claude or Codex on a schedule against your mail, calendar, and files. | |
| ai.klavis/strata klavis-ai/klavis MCP server for progressive tool usage at any scale (see https://klavis.ai) | |
| io.github.Klawdik/forex-mobile klawdik/forex-mobile Forex broker data, comparisons, recommendations & live rates for AI agents. | |
| Working Machines MCP Server klei30/working-machines Connect to 1,400+ apps and 15,000+ actions through one OAuth-protected MCP server. | |
| 3D Visualizer kleinicke/ply-visualizer Inspect, compare and export point clouds, meshes and calibrated depth data with inline 3D previews. | |
| io.github.klewicki7/vibelens-mcp klewicki7/vibelens VibeLens MCP tool for AI to visualize code changes with inline annotations in VS Code/Cursor | |
| ai.klipy/klipy klipyai/poc-nextjs-nylas AI CRO for Agencies and MSPs: full automatic CRM; multichannel tracking; draft follow-ups. | |
| Voice School Lesson Booking klishinoleg/voice Request online singing lessons with Voice School and Daria Klishina. | |
| io.github.klmlfl/case-doha-record klmlfl/dohasearch Search 30,000+ decided U.S. DOHA security-clearance decisions, cited to the public record. | |
| Sendinel kmdesle/sendinel-ai AI-controlled email ops for campaigns, contacts, segments, analytics, and sending. | |
| Synchronex kmdesle/synchronex Connect any AI agent to your Synchronex workspace — portable memory, decisions, and workers. | |
| com.knitli/codeweaver knitli/codeweaver Semantic code search built for AI agents. Hybrid, AST-aware, context for 166 languages. | |
| ERP Partner Finder knowlixgmbh/erppartnerfinder-mcp Search, compare and shortlist Odoo partners in Germany, Austria and Switzerland. | |
| MoldSim MCP Server kobzevvv/moldsim-mcp Injection molding simulation expertise — materials, process validation, and DFM checks | |
| Kochava for Advertisers — Official MCP Server kochava/kochava-k4a-mcp-server No account needed — connect, sign up, and query mobile attribution data from any AI tool | |
| GRC Lake koda-ai-studio/grc-lake Read-only connectors; local writes. Evidence and assessments for agents. Only people approve. | |
| io.github.kody-w/raptr-domains kody-w/airaptr Check and price up to 20 domain names at once; agents can register them, paying per request. | |
| io.github.kody-w/rar-agent-finder kody-w/rapp-chatgpt Find a free, ready-made AI agent for a task in the public RAPP Agent Registry. | |
| dev.agentstock/agentstock kohlercode/agentstock License-clean AI stock images and video for agents: semantic search, browse, and x402 purchase. | |
| io.github.KojimaHyui01/ja-normalize kojimahyui01/x402-ja-api Holidays/business days for 200+ countries; Japanese address, name, bank and company normalization. | |
| io.github.kolganovr/figma-mcp-bridge kolganovr/figma-mcp-bridge Write to a live Figma canvas, get a screenshot back, and roll back mistakes. Zero deps, free plan. |
24,801–24,850 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.