Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| ai.diezx/diezx Business Observability: process inventory, AP risk, sales temperature, savings. diezX customers only | |
| ai.dimetrics/dimetrics HPC lease economics, datacenter power, debt linkage, and political risk for miners and neoclouds. | |
| DirectCase Legal Search Search national and EU case law, legislation and regulation, with citations you can verify. | |
| Directories.ai Build and run directory websites from your own AI: listings, imports, claims, SEO and content. | |
| DiscoverIA Read-only registry of AI-assisted scientific claims and where their evaluation stands (fr/en) | |
| DispatchMind Job management for service companies: look up, book, tag, assign and note jobs from your AI. | |
| Distilla Grounded financial research for agents: filings, transcripts, news across US and Asia markets. | |
| Divinci AI Release management and QA for custom AI assistants: RAG, releases, scored QA, signed TrustBench runs | |
| Dockito One home for docs, live sheets, Slides, boards, API docs and DB designs, made by Humans and AI. | |
| Docspeed Extract, ask, compare and parse PDFs/images with source evidence. OAuth sign-in or API keys. | |
| DocuGuru Journal-formatted PDFs for 18,000+ journals, real DOI citations, posters & slide decks. | |
| DoneThat Privacy-first work tracking with summaries, reports, coaching, and AI-ready long-term memory. | |
| Dopamyn Crypto audience intelligence and DM outreach on X: find accounts, build lists, run DM campaigns. | |
| Dotpad Shared space for agents and humans: hubs of live pads, threads and tasks any agent can join. | |
| dotsy Build and publish static sites on dotsy with draft-first MCP tools, OAuth Connect, and API keys. | |
| Draconic Market Intelligence Live multi-signal market intelligence for supported instruments. Analysis only. | |
| ai.dragoneye/mcp Build zero-shot video models for object detection, and category and attribute classification. | |
| DripMetrics Institutional-grade market microstructure, a cent at a time. x402: Base USDC or Robinhood USDG. | |
| Drone Intelligence Drone-sector market intelligence for AI agents: free briefings and profiles, licenced tracker data. | |
| Dryos Live US power market prices, load, generation, weather and permits for AI agents. | |
| Dryos Workspace Build live US power market dashboards in your own Dryos workspace. Sign-in required. | |
| Duskly MLS compliance for edited listing photos: classify edits, write disclosures, verify provenance. | |
| ai.duvera/gateway Governed AI actions with signed, verifiable receipts: free keyless reads, human-approved writes. | |
| ai.dynamicfeed/dynamic-feed 94 keyless tools of live, verifiable data for AI: weather, hazards, space, CVEs. Ed25519-signed. | |
| e/acc AI news for agents: daily, weekly and monthly briefings, trending events and model prices. No key. | |
| EarlyLeads B2B leads at a buying moment, with the why and the outreach. Ask your AI about your leads. | |
| EasyTerritory MCP Build, balance, realign and analyze sales/service territories; geocode, route, schedule, live map. | |
| ai.echoloc/company-technographics Search 760K+ companies by technographics with direction of change: adopting, replacing, evaluating | |
| EcoCheck Vietnam GHG inventory obligation checker, 2026 regulations, CBAM and ESG articles (read-only). | |
| ai.edge-agents/intelligence Macro, market and decision intelligence over x402. Gaps are unavailable rather than estimated. | |
| ai.edusignal/districts K-12 school district data for all 50 US states. Enrollment, demographics, and academics. | |
| Eevy Shopify CRO platform via MCP: 100+ tools for analytics, experiments, authoring, proven lift. | |
| Elaichi Governed AI agents for the software your company already runs. 400+ connectors, one endpoint. | |
| FALA Build and install a voice + chat AI receptionist for any business website. | |
| Elicitly Pro Human-in-the-loop for AI agents over MCP: durable approvals with a hosted review page & audit trail | |
| Emisso Connect Connect AI agents to the legacy systems LATAM business runs on. Live in Chile: tax, banks, payroll. | |
| em[ai]l Read and draft email you forward to a private alias. Agents cannot send or delete mail. | |
| ai.enginy/mcp B2B prospecting from your Enginy workspace: find, enrich, and reach contacts and companies. | |
| Engramic Your organisation's decisions, goals and constraints, with the reasoning, for every agent. | |
| Enoki Test your AI agents for security and safety weaknesses, and re-verify the fixes. | |
| Circuit Sim Lab (電路模擬實驗室) PCB calculators: trace impedance, crosstalk, diff skew, crystal load cap, Vout tolerance, inrush. | |
| Entervista Find and book local service businesses (plumbers, HVAC, detailers) at real prices, with approval. | |
| entityindex.ai Verified hotels in Andorra for AI agents: search by area, spa, pets, ski-in, family; official links. | |
| ENYAL by Greenland AI Accounts are powered by ENYAL identity, and records are verifiable without trusting us. | |
| Enzo's Search US homes for sale by style and budget, with honest buy verdicts and video tours. | |
| EOSL.ai — Hardware End-of-Life Database Hardware end-of-life dates by part number, each linked to the vendor's own bulletin. | |
| Epox Read your Epox catalogue and credits; generate studio and lifestyle product images. | |
| eroq — AI video, images, voice and music Videos, images, voices and songs from eroq's named and uncensored engines, with your characters. | |
| Winquill Public tenders and contract awards in the UK, US, Canada and EU, and help preparing bids. | |
| EventGen Manage permitted EventGen events through account OAuth and reviewed actions. |
26,751–26,800 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.