Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Deweloperuch MCP Polish flat prices on deweloperuch.pl: RCN sale prices (valuation, stats, rankings), asking prices. | |
| eBay MCP Search any eBay marketplace and fetch full item details for one listing. | |
| FlightAware MCP Live flight status and scheduled-route search via the official FlightAware AeroAPI. | |
| Google Flights MCP Live Google Flights fares: search routes, discover cheap deals from an origin. | |
| Google Hotels MCP Live Google Hotels search: properties with rates and ratings, plus photos and reviews. | |
| Google Maps MCP Google Maps places: local search, place details, reviews, and turn-by-turn directions. | |
| Google Search MCP Fast Google web search: organic results and related questions, no ads. | |
| Google Shopping MCP Google Shopping product search: listings with prices, merchants and ratings. | |
| Gratka MCP Polish property on Gratka.pl/Morizon.pl (one database): flats, houses, plots, premises, buy or rent. | |
| Kayak MCP Builds a Kayak.com flight-search deep link for a route and dates — URL only, no prices. | |
| Wondel.ai MCP servers 26 authless MCP servers: flights, stays, maps, shopping, web search, Polish web (Allegro, OLX, NBP). | |
| NBP MCP Official Polish central bank (NBP) exchange rates, currency conversion and gold prices. | |
| Nieruchomosci Online MCP Polish property listings on nieruchomosci-online.pl: flats, houses, plots, premises to buy or rent. | |
| Noclegi MCP Stays in Poland on noclegi.pl: hotels, guest houses, apartments, cottages, total prices for dates. | |
| OLX MCP OLX.pl classifieds in every category: property, cars, electronics, jobs, free items; offer details. | |
| Otodom MCP Polish property on Otodom.pl: flats, houses, rooms, plots, commercial to buy or rent; offer details. | |
| Skyscanner MCP Live Skyscanner fares in PLN: one-way or round-trip itineraries, cheapest/fastest, booking links. | |
| Slowhop MCP Slow stays on Slowhop.com, mostly in Poland: cabins, agritourism, glamping, guesthouses, PLN prices. | |
| Wizzair MCP Wizzair fares, routes, timetables and flight details across its network. | |
| YouTube MCP YouTube search: find videos, fetch details and comments, pull full transcripts. | |
| WorkforceGPT HR and recruiting: score a job description, or generate a structured role profile. No API key. | |
| WorkingMemory Persistent personal memory for AI assistants — save, search, and recall across every MCP client. | |
| Worklayer HR in Worklayer: people, time off, tasks, approvals, expenses and analytics, with your permissions. | |
| Workledge A growing notebook shared by every AI you use. Save in conversation, recall from any connected AI. | |
| workonit Work in your workonit account: people, records, app actions and AI agents. | |
| workonit What workonit is: its sites, the apps and AI agents in its store. Read only, no sign-in. | |
| Writingmate MCP Use AI models for chat, image, and video generation from Claude Code and other MCP hosts. | |
| Wubble Create, inspect, and manage Wubble music, speech, voice, and sound-effect requests through MCP. | |
| 72QR: Make Scannable Art Make scannable art as QR code from reference images. Free tier: share links only | |
| XCut AI – Viral Content Research Find viral posts, outliers, hooks and ads on Instagram, TikTok, YouTube and Facebook, then write. | |
| xfix Check if AI assistants and shopping agents can read a website or online store | |
| Xorventa Connect Xora to review your Xorventa account and request supported work under owner controls. | |
| H-Index Capability registry for the agentic economy. Semantic search over verified MCP server listings. | |
| Xyla AI Social posts for Shopify and WooCommerce stores: approve posts, see results, change settings. | |
| Yempik Company Brain Governed company memory: search decisions, rules and client facts; propose updates for review. | |
| Yenta Directory Restaurants and bars in 10 cities: hours, menus, dietary tags, events and booking; destinations. | |
| Yir Generate images, videos and audio across many AI models via one API, with quotes before you pay. | |
| Human for AI Ask a human for legal review, confirmation, a signature, or a physical-world act | |
| Zabio Zabio AI router: docs, models, prices, your usage and calls, and questions to Zabio's models. | |
| Zaira Labs Guide Trust signals for AI agents: an open agent-readiness standard and developer tool guide. Read-only. | |
| Zalcro Generate architecture docs, implementation plans, and dev tickets from your project requirements. | |
| Zaptu Connect people with independent local home-service contractors. For plumbing, the person dials. | |
| Zark Learn, Play & Create. Make and edit pictures, videos, music, voice and short films with AI. | |
| zdte.ai SPX Market Structure SPX 0DTE dealer market structure: GEX, walls, gamma flip, regime, flow. Free preview; pay per read. | |
| ai.zencap/zencap Institutional financial data with SEC filing citations, for every AI agent. OAuth 2.1. | |
| Zenning Run your Zenning AI employees and act across 2,000+ connected apps from any MCP client. | |
| Zephira Company Intelligence Search company records, officers, ownership, group structures and financials with provenance. | |
| ZeroNoise Agents that watch the sources you approve and write cited Briefs, from your AI tools. | |
| ZeroWidth Caliper Build datasets and rubrics, then run evals that score your AI in Caliper. | |
| ZeroWidth Compass Read and update your Compass map: pages, changes, opportunities and interviews. |
27,801–27,850 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.