Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Device Magic MCP by usefulapi m190/usefulapi-mcp Read Device Magic forms, submissions, devices and groups; send and revoke dispatches. | |
| DialMyCalls MCP by usefulapi m190/usefulapi-mcp Manage DialMyCalls contacts and groups; read broadcasts; send text and voice broadcasts on approval. | |
| Disqus MCP by usefulapi m190/usefulapi-mcp Read forums, threads and comments; approve, spam or delete comments and close threads in Disqus. | |
| DNSimple MCP by usefulapi m190/usefulapi-mcp MCP server for DNSimple — domains, DNS zone records, availability, pricing and contacts. | |
| Docparser MCP by usefulapi m190/usefulapi-mcp Run Docparser parsers: import documents by URL or upload, check status, read parsed results. | |
| DocRaptor MCP by usefulapi m190/usefulapi-mcp Turn HTML or a live URL into polished PDF and Excel files — hosted downloads, async jobs, history. | |
| Documenso MCP by usefulapi m190/usefulapi-mcp Read and send documents for signature — templates, recipients, fields and folders. | |
| Docupilot MCP by usefulapi m190/usefulapi-mcp Read templates, schemas, versions, folders, deliveries and merge history in Docupilot. | |
| DoorLoop MCP by usefulapi m190/usefulapi-mcp Read DoorLoop properties, units, leases, tenants and payments; create tasks and task updates. | |
| DrChrono MCP by usefulapi m190/usefulapi-mcp Read and write DrChrono patients, appointments, offices and clinical notes. | |
| Dropbox Sign MCP by usefulapi m190/usefulapi-mcp Hosted MCP server for Dropbox Sign — signature requests, templates, and account for AI agents. | |
| Drupal MCP by usefulapi m190/usefulapi-mcp Read and write Drupal JSON:API nodes, taxonomy terms, users and files. | |
| Dub MCP by usefulapi m190/usefulapi-mcp Short links with click, lead and sale analytics, customers, tags and the partner programme. | |
| e-Boekhouden MCP by usefulapi m190/usefulapi-mcp Read e-Boekhouden relations, invoices, ledgers, bookings and products; create relations, invoices. | |
| e-Courier MCP by usefulapi m190/usefulapi-mcp Read delivery orders, quotes, customers, drivers, manifests, invoices and payment records. | |
| EasyPost MCP by usefulapi m190/usefulapi-mcp MCP server for EasyPost — rate shipments, buy & refund labels, track packages, verify addresses. | |
| EasyStore MCP by usefulapi m190/usefulapi-mcp Read EasyStore orders, products and customers; manage stock, fulfillments and customer records. | |
| Ecwid MCP by usefulapi m190/usefulapi-mcp Read store products, orders, customers, categories and coupons; adjust inventory and update orders. | |
| eDesk MCP by usefulapi m190/usefulapi-mcp Work with eDesk support tickets, replies, internal notes, contacts and sales orders. | |
| EffectConnect MCP by usefulapi m190/usefulapi-mcp Read channels, product selections, products, orders and processes in EffectConnect. | |
| eGestor MCP by usefulapi m190/usefulapi-mcp Read contacts, products, sales, receivables and payables; create contacts in eGestor. | |
| Elation Health MCP by usefulapi m190/usefulapi-mcp Read Elation Health patients, appointments, problems, allergies, medications, notes and vitals. | |
| Elvanto MCP by usefulapi m190/usefulapi-mcp Look up people, groups, service rosters, songs, follow-up flows and giving in Elvanto. | |
| Emailable MCP by usefulapi m190/usefulapi-mcp Verify email addresses with Emailable one by one or in batches, and read credits and batch results. | |
| Emailchef MCP by usefulapi m190/usefulapi-mcp Read lists, contacts, campaign stats; add contacts; draft, schedule and send campaigns and SMS. | |
| EmailOctopus MCP by usefulapi m190/usefulapi-mcp Manage lists, contacts and campaigns, and read campaign performance reports on EmailOctopus. | |
| Emma MCP by usefulapi m190/usefulapi-mcp Read audiences, groups, mailings and campaign results without sending email or changing contacts. | |
| Enboarder MCP by usefulapi m190/usefulapi-mcp Read workflows, forms and brands; launch, update and cancel workflows in Enboarder. | |
| Enchant MCP by usefulapi m190/usefulapi-mcp Work with Enchant help desk tickets: list, read, reply, add notes and labels, manage customers. | |
| Encharge MCP by usefulapi m190/usefulapi-mcp Manage Encharge people, tags, segments and fields, and track events for email automation. | |
| Enerflo MCP by usefulapi m190/usefulapi-mcp Read customers, installs, tasks and notes; add leads and notes in Enerflo. | |
| Engagedly MCP by usefulapi m190/usefulapi-mcp Read employees, learning progress, certificates and recognition in Engagedly. | |
| Enginemailer MCP by usefulapi m190/usefulapi-mcp Read Enginemailer subscribers, lists and campaigns; add subscribers, create and send campaigns. | |
| Equicty MCP by usefulapi m190/usefulapi-mcp Read public horse profiles, pedigrees and media of a stable in Equicty. | |
| Estuary Flow MCP by usefulapi m190/usefulapi-mcp Inspect Estuary Flow captures, materializations, collections and stats. | |
| Evenium MCP by usefulapi m190/usefulapi-mcp Read Evenium events, guests, contacts and hotels; register guests and update contacts and statuses. | |
| Eventbrite MCP by usefulapi m190/usefulapi-mcp Manage Eventbrite events, ticket classes, venues and discounts; read attendees, orders and reports. | |
| Eventee MCP by usefulapi m190/usefulapi-mcp Read an Eventee event's program, participants and reviews; create sessions, speakers; invite. | |
| eventOne MCP by usefulapi m190/usefulapi-mcp Read events, programmes, speakers, registration orders, tickets and attendance in eventOne. | |
| Eventzilla MCP by usefulapi m190/usefulapi-mcp Read Eventzilla events, tickets, orders, attendees and users; open or close ticket sales. | |
| ExakTime / Arcoro MCP by usefulapi m190/usefulapi-mcp MCP server for Arcoro and ExakTime — workforce data, jobs, cost codes and locations. | |
| Exoscale MCP by usefulapi m190/usefulapi-mcp Inspect Exoscale: instances, volumes, SKS, DNS, IPs, quotas and usage; start, stop, reboot VMs. | |
| ExpenseIn MCP by usefulapi m190/usefulapi-mcp Read expenses, invoices, receipts and card transactions, and add expenses or notes in ExpenseIn. | |
| Extensiv MCP by usefulapi m190/usefulapi-mcp Read Extensiv warehouse records, create outbound orders and cancel eligible orders. | |
| eyworks MCP by usefulapi m190/usefulapi-mcp Read companies, nurseries, rooms, employees, children and availability in eyworks. | |
| EZRentOut MCP by usefulapi m190/usefulapi-mcp MCP server for EZRentOut — rental orders, assets, customers, inventory and work orders. | |
| Facturalia MCP by usefulapi m190/usefulapi-mcp Create invoices and credit notes; check whether invoices are sent and paid in Facturalia. | |
| Fakturowo MCP by usefulapi m190/usefulapi-mcp Read invoices, clients and products in Fakturowo; create documents and update payment status. | |
| fal.ai MCP by usefulapi m190/usefulapi-mcp Run fal.ai models, poll the inference queue and read model schemas. | |
| Famly MCP by usefulapi m190/usefulapi-mcp Review Famly sites, staff, invoices and payments through its public API. |
25,501–25,550 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.