Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| genpark-agentic-payment-tokenized-authorization-sentinel-skill alphaparkinc/genpark-agentic-payment-tokenized-authorization-sentinel-skill It enables agents to handle delegated payments and tokenized checkouts while enforcing spend limits, velocity thresholds, merchant whitelists, and issuing ephemeral single-use authorization tokens. | |
| genpark-agentic-post-purchase-dispute-arbiter-skill alphaparkinc/genpark-agentic-post-purchase-dispute-arbiter-skill Enables agents to ingest carrier webhook events, track stalled or failed shipments, evaluate compensation eligibility, and emit structured merchant claim payloads over MCP. It runs as a zero-dependency Python JSON-RPC stdio server or import | |
| AgenticPriceDropRefundArbiter alphaparkinc/genpark-agentic-price-drop-refund-arbiter-skill Enables tracking post-purchase prices across Shopify, Walmart, Best Buy, and Target, detecting drops within merchant price-match windows, verifying eligibility, and synthesizing automated refund claims. | |
| genpark-agentic-prompt-compression-token-sieve-skill alphaparkinc/genpark-agentic-prompt-compression-token-sieve-skill Compresses multi-turn conversation history by stripping verbose boilerplate and filler tokens while preserving critical tool parameters and named entities, deterministically cutting inference costs by 40-60%. Runs as a zero-dependency Pytho | |
| Agentic RAG HyDE Query Expander alphaparkinc/genpark-agentic-rag-hyde-hypothetical-document-generator-skill Enables clients to transform sparse user queries into multiple hypothetical answer passages from different perspectives, improving dense retrieval and vector search recall. Exposes this capability through MCP JSON-RPC 2.0 tools with no exte | |
| genpark-agentic-recurrent-subscription-autopilot-skill alphaparkinc/genpark-agentic-recurrent-subscription-autopilot-skill Enables autonomous detection of recurring charges, price creeping, and zombie subscriptions, then generates automated cancellation workflows through MCP-compatible tools. | |
| GenPark Agentic Schema Translation Semantic Normalizer alphaparkinc/genpark-agentic-schema-translation-semantic-normalizer-skill GenPark MCP server for normalizing and translating structured data schemas. | |
| AgenticShipmentDeliveryRescheduler alphaparkinc/genpark-agentic-shipment-delivery-rescheduler-skill Enables ingesting FedEx, UPS, DHL, and SF Express tracking webhooks, detecting failed delivery attempts and customs delays, and automatically negotiating delivery windows, locker holds, and neighbor safe-drop instructions. | |
| Agentic Smart Contract Vulnerability Static Sentinel alphaparkinc/genpark-agentic-smart-contract-vulnerability-static-sentinel-skill Enables users to perform static security audits on EVM Solidity contract code for critical flaws such as reentrancy state changes, unhandled external calls, unchecked delegatecall, and tx.origin authentication vulnerabilities, returning ris | |
| genpark-agentic-supply-chain-bullwhip-dampener-skill alphaparkinc/genpark-agentic-supply-chain-bullwhip-dampener-skill Enables users to compute dampened reorder quantities for SKUs by detecting order surges and applying safety-stock PID damping, order smoothing, and lead-time demand volatility filtering across multi-tier supplier networks. | |
| genpark-agentic-tabular-sql-schema-linking-synthesizer-skill alphaparkinc/genpark-agentic-tabular-sql-schema-linking-synthesizer-skill Enables deterministic SQL query synthesis from tabular schemas and query verification via MCP, with zero external dependencies. | |
| genpark-agentic-travel-multi-leg-itinerary-synthesizer-skill alphaparkinc/genpark-agentic-travel-multi-leg-itinerary-synthesizer-skill Enables users to translate natural-language vacation or business travel goals into multi-leg flight segments, lodging selections, layover buffers, baggage-fee optimization, and consolidated reservation manifests. | |
| genpark-agentic-webhook-signature-verifier-skill alphaparkinc/genpark-agentic-webhook-signature-verifier-skill Enables agents to authenticate and route webhooks from Shopify, Stripe, GitHub, Slack, and PayPal using HMAC-SHA256 constant-time verification and timestamp replay-window validation. It then multiplexes verified events into agent workflows | |
| genpark-agentic-workflow-state-checkpoint-skill alphaparkinc/genpark-agentic-workflow-state-checkpoint-skill Enables AI agents to commit stateful workflow checkpoints by calculating state hashes and rollback points through the Model Context Protocol. It provides deterministic, dependency-free checkpoint management for autonomous agent execution. | |
| genpark-agentic-zero-knowledge-pii-token-vault-masker-skill alphaparkinc/genpark-agentic-zero-knowledge-pii-token-vault-masker-skill Enables reversible anonymization of sensitive PII such as SSNs, credit cards, passport numbers, emails, and phone numbers before sending prompts to external LLMs, then restores original values locally using HMAC isolation. | |
| genpark-api-rate-limit-token-bucket-throttle-skill alphaparkinc/genpark-api-rate-limit-token-bucket-throttle-skill Enables high-throughput API rate limiting with deterministic token bucket throttling and burst quota management for AI agents. | |
| genpark-ast-import-dependency-rewriter-skill alphaparkinc/genpark-ast-import-dependency-rewriter-skill Enables deterministic, AST-based rewriting of Python imports and callsites, so module paths can be re-aliased and migrated across a codebase without regex errors. It also supports dependency graph auditing and refactoring planning with toke | |
| genpark-ast-taint-source-sink-flow-tracer-skill alphaparkinc/genpark-ast-taint-source-sink-flow-tracer-skill Enables static AST-based dataflow analysis to trace untrusted sources to sensitive sinks, supporting automated code review and security auditing through MCP. | |
| genpark-async-unhandled-promise-rejection-triager-skill alphaparkinc/genpark-async-unhandled-promise-rejection-triager-skill Enables MCP-compatible clients to audit asynchronous control flow, identifying unawaited promises and race conditions through deterministic AST and taint flow analysis. | |
| genpark-automated-compliance-policy-evaluator-skill alphaparkinc/genpark-automated-compliance-policy-evaluator-skill Enables automated evaluation of e-commerce advertising content against compliance policies, detecting prohibited claims and trademarks through an MCP-compatible interface. | |
| genpark-automated-dsar-gdpr-compliance-exporter-skill alphaparkinc/genpark-automated-dsar-gdpr-compliance-exporter-skill Enables automated GDPR/CCPA data subject access request compliance by exporting data subject profiles through OneTrust. Provides deterministic, zero-dependency MCP integration for AI agents and enterprise pipelines. | |
| genpark-automated-red-teaming-adversarial-probe-skill alphaparkinc/genpark-automated-red-teaming-adversarial-probe-skill Enables automated adversarial safety probing and jailbreak fuzzing of AI systems through MCP, returning structured execution telemetry and output dossiers. | |
| genpark-automated-treasury-cash-sweep-optimizer-skill alphaparkinc/genpark-automated-treasury-cash-sweep-optimizer-skill Enables autonomous financial agents and payment webhooks to pool corporate treasury cash, rebalance liquidity automatically with yield-optimized sweeps and zero-overdraft safety buffers, and record every transaction in a balanced double-ent | |
| genpark-autonomous-ai-fleet-governance-circuit-breaker-skill alphaparkinc/genpark-autonomous-ai-fleet-governance-circuit-breaker-skill Enables operators to monitor distributed agent fleets for token-burn velocity, recursive subagent spawning cascades, and cyclic deadlocks, while enforcing system-wide kill-switch containment with cryptographically verifiable audit tokens. | |
| genpark-autonomous-browser-action-planner-skill alphaparkinc/genpark-autonomous-browser-action-planner-skill Enables AI agents and MCP clients to translate high-level web automation goals into deterministic, resilient browser selector action sequences. It runs as a zero-dependency Python MCP server that returns structured execution plans and telem | |
| genpark-autonomous-form-autofill-resolver-skill alphaparkinc/genpark-autonomous-form-autofill-resolver-skill Enables MCP-compatible clients to analyze web checkout form fields and heuristically resolve buyer autofill parameters for autonomous form completion. | |
| genpark-autonomous-price-elasticity-optimizer-skill alphaparkinc/genpark-autonomous-price-elasticity-optimizer-skill Enables users and autonomous agents to calculate dynamic price elasticity of demand and identify marginal revenue maxima through a zero-dependency, MCP-compatible Python tool. | |
| genpark-autonomous-refund-dispute-arbitrator-skill alphaparkinc/genpark-autonomous-refund-dispute-arbitrator-skill Enables autonomous arbitration of refund and dispute cases by validating carrier proofs and policies through a deterministic, zero-dependency Python engine that integrates with MCP-compliant clients. | |
| genpark-autonomous-sla-breach-incident-escalator-skill alphaparkinc/genpark-autonomous-sla-breach-incident-escalator-skill Enables AI agents and MCP-compliant clients to autonomously evaluate SLA breach incidents, escalate alerts, and execute canary rollback playbooks with deterministic, zero-dependency Python tooling. | |
| genpark-autonomous-task-dag-decomposer-skill alphaparkinc/genpark-autonomous-task-dag-decomposer-skill Enables autonomous planning by decomposing prompts into directed acyclic task graphs and resolving dependency topologies for multi-agent pipelines. | |
| genpark-b2b-lead-waterfall-enrichment-cascade-skill alphaparkinc/genpark-b2b-lead-waterfall-enrichment-cascade-skill Enables autonomous B2B lead enrichment through a waterfall cascade and technographic stack verification, producing structured output dossiers for AI agents and enterprise pipelines. | |
| GenPark Bio-Agent alphaparkinc/genpark-bio-agent Exposes MCP tools that compute longevity and metabolic metrics (autophagy index, GKI, MAGE), cardio-renal biomarkers (BUN/creatinine ratio, cardiac output and TPR, nocturnal BP dipping), chronobiology estimates (DLMO, melanopic lux, caffein | |
| genpark-black-scholes-merton-greeks-engine-skill alphaparkinc/genpark-black-scholes-merton-greeks-engine-skill Enables users to compute European option prices and sensitivity metrics, run Monte Carlo GBM simulations, calculate historical/parametric VaR/CVaR, evaluate bond duration and convexity, and interpolate Nelson-Siegel yield curves through MCP | |
| genpark-bond-convexity-modified-duration-calculator-skill alphaparkinc/genpark-bond-convexity-modified-duration-calculator-skill Enables users to compute fixed-income bond prices, cash flow present values, Macaulay and modified duration, and price convexity through an MCP-compatible quantitative finance engine. | |
| genpark-browser-computer-use-element-anchor-skill alphaparkinc/genpark-browser-computer-use-element-anchor-skill Enables autonomous agents to anchor browser elements from vision inputs, providing stable DOM references resilient to click drift for reliable computer-use automation. | |
| genpark-calendar-timeblock-conflict-arbitrator-skill alphaparkinc/genpark-calendar-timeblock-conflict-arbitrator-skill Enables multi-timezone calendar event overlap resolution and deep-work buffer negotiation. It provides deterministic conflict arbitration and structured telemetry for MCP-compatible clients. | |
| genpark-canary-honeytoken-private-key-tripwire-skill alphaparkinc/genpark-canary-honeytoken-private-key-tripwire-skill Enables autonomous Web3 security monitoring by watching honeytoken decoy private keys in the mempool to detect intrusions and trigger tripwire alerts. It also supports smart contract auditing, callgraph verification, and DeFi vulnerability | |
| genpark-canonical-doi-bibtex-crossref-resolver-skill alphaparkinc/genpark-canonical-doi-bibtex-crossref-resolver-skill Enables resolving academic DOIs to canonical identifiers and generating BibTeX records via CrossRef, and can be integrated into MCP-compliant clients for automated research workflows. | |
| genpark-codebase-dead-code-unreachable-pruner-skill alphaparkinc/genpark-codebase-dead-code-unreachable-pruner-skill Enables deterministic AST static analysis and call-graph auditing to identify orphaned functions, unreachable methods, and token-bloat clusters, producing refactoring plans that reduce context waste. | |
| genpark-cognitive-load-budget-optimizer-skill alphaparkinc/genpark-cognitive-load-budget-optimizer-skill Enables agents to monitor running loops, estimate token consumption and monetary cost, prune verbose thinking chains near limits, and route sub-tasks between fast/cheap models and deep reasoning engines. It provides budget-aware model routi | |
| genpark-commerce-dynamic-bundling-recommender-skill alphaparkinc/genpark-commerce-dynamic-bundling-recommender-skill Enables agents to analyze cart items and intent, compute product complementary affinity scores, respect merchant margin constraints, and synthesize personalized discount bundles for cross-sell recommendations. | |
| genpark-conformal-prediction-coverage-guarantee-skill alphaparkinc/genpark-conformal-prediction-coverage-guarantee-skill Enables distribution-free split conformal prediction through MCP, producing adaptive prediction sets with finite-sample marginal coverage guarantees for agent routing, classification, and structured decision tasks. | |
| genpark-constant-time-crypto-validator-skill alphaparkinc/genpark-constant-time-crypto-validator-skill Enables secure validation of agent credentials through constant-time digest comparison, JWT HMAC-SHA256 checks, Merkle inclusion proofs, Schnorr zero-knowledge verification, and nonce replay protection. It integrates natively with MCP clien | |
| genpark-context-window-lost-in-middle-reorderer-skill alphaparkinc/genpark-context-window-lost-in-middle-reorderer-skill Enables agents to optimize context-window attention by reordering retrieved documents so critical evidence lands at prompt boundaries, mitigating lost-in-the-middle degradation. It combines BM25 lexical scoring, dense vector similarity, rec | |
| genpark-contextual-compression-filter-skill alphaparkinc/genpark-contextual-compression-filter-skill Enables AI agents and MCP clients to compress retrieved web documents against a query, pruning irrelevant noise through deterministic algorithmic scoring so downstream context stays lean. It exposes this capability over the Model Context Pr | |
| ContextualMemoryPruningImportanceAttributor alphaparkinc/genpark-contextual-memory-pruning-importance-attributor-skill Enables agents to calculate multi-factor salience scores for episodic memories using recency decay, user priority pinning, emotional valence, and entity graph connectivity, then deterministically prune low-utility entries to respect model c | |
| genpark-cosine-bm25-reciprocal-rank-fusion-skill alphaparkinc/genpark-cosine-bm25-reciprocal-rank-fusion-skill Enables hybrid retrieval over agent memory and documents by fusing BM25 lexical and cosine vector rankings with reciprocal rank fusion, plus knowledge graph expansion, semantic caching, and context reordering for RAG. | |
| genpark-crdt-lww-element-set-sync-skill alphaparkinc/genpark-crdt-lww-element-set-sync-skill Enables distributed agents to synchronize a last-write-wins element set using conflict-free replicated data types, Lamport timestamps, and deterministic two-way state merge over MCP. | |
| genpark-creator-affiliate-gmv-commission-ledger-skill alphaparkinc/genpark-creator-affiliate-gmv-commission-ledger-skill Enables autonomous creator affiliate GMV tracking and return-adjusted commission ledger calculations for influencer marketing and multi-agent campaign workflows. | |
| genpark-creator-audience-lookalike-cluster-finder-skill alphaparkinc/genpark-creator-audience-lookalike-cluster-finder-skill Enables AI agents and MCP clients to identify creator audience lookalike clusters and measure affinity overlap, producing structured output dossiers with deterministic zero-dependency execution. |
27,351–27,400 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.