Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| MCP Agents amajakai14/mcp-agents Provides FastMCP-based servers with various tools for AI assistants including math operations, file management, note-taking, todo management, and database operations. Offers both basic and advanced server configurations with tools, resource | |
| Update Night MCP amajorai/updatenight-mcp Provides tools for AI assistants to search and explore the Update Night catalog of AI development tools, including agent frameworks, skills, and MCP servers. Enables querying entries by category, fetching detailed entries, and browsing rece | |
| MCP by Amal Alexander amal-alexander/mcp An MCP server that connects AI assistants to SEO platforms like Google Search Console, GA4, Bing Webmaster Tools, and Adobe Analytics, enabling natural language queries about SEO performance. | |
| token-saver-mcp amalbiju0104/token-saver-mcp Automatically reduces token usage in Claude Code sessions using algorithmic optimizations like code compression, smart file reading, output summarization, and prompt rewriting, with no extra API calls or cost. | |
| claude-voice-mcp amaldeep98/claude-realtime-voice-mcp Provides bidirectional local voice for Claude Code on Apple Silicon, enabling hands-free conversation and spoken replies using local Whisper STT and Kokoro TTS, with optional ElevenLabs backend and a Stop hook for automatic speech. | |
| obsidian-cli-mcp amalikn/obsidian-cli-mcp MCP server for the Obsidian CLI with controlled profiles for governed read-only and mutation operations, plus a personal-unrestricted profile for full access. | |
| ollama-agents-mcp amalikn/ollama-agents-mcp Runs a local Ollama multi-agent pipeline with collector, writer, and reviewer roles to transform messy notes into structured reports with a quality gate. | |
| smart-coding-mcp amalikn/smart-coding-mcp Enables AI assistants to perform intelligent semantic code search across codebases using local AI embeddings for meaning-based retrieval. | |
| Conduit amalinakurniasari/conduit Enables AI agents to interact with Figma in real-time through a WebSocket connection. Supports comprehensive design operations including text manipulation, layouts, components, variables, and export functionality. | |
| hubspot-conversations-mcp amalodev/hubspot-conversations-mcp MCP server providing 1:1 tool parity with Arcade.dev's HubSpot Conversations API toolkit, enabling reading and sending conversation messages, managing threads, inboxes, channels, and custom channels from any MCP client. | |
| weather-mcp-server amalphonse/weather-mcp-server MCP server providing real-time weather data and forecasts via Open-Meteo, with tools for current conditions, multi-day forecasts, and umbrella recommendations, integrated with Databricks Agent Bricks for natural-language queries. | |
| Clockify MCP amalychev/clockify-mcp An MCP server for Clockify that provides tools for managing timers, time entries, projects, tasks, tags, people, reports, and time off, with natural language parsing of times and durations. | |
| GitLab MCP amalychev/gitlab-mcp MCP server for GitLab that provides 85 tools covering issues, merge requests, repositories, CI/CD, wiki, packages, and attachments, with support for both gitlab.com and self-hosted instances. It can read attachments so models can see screen | |
| Mail MCP amalychev/mail-mcp MCP server for any IMAP mailbox that lets AI models read, search, send, and manage email, including processing attachments as images. | |
| OpenRouter MCP Multimodal Server amama-fatima/openrouter-multimodeal-mcp Enables chat and image analysis through OpenRouter.ai models. Supports text chat, image generation, and analysis with multiple images and custom questions. | |
| GitHub MCP Wrapper amamirugi/gh-mcp-wrapper Enables claude.ai to connect to GitHub MCP using OAuth, providing full toolset for repository, issue, PR, Actions, and gist operations. | |
| Subwatch MCP amamirugi/subwatch-mcp Enables reading public Reddit posts and comments on demand, with tools to search, get recent posts, post details, top comments, and server status. Runs on Cloudflare Workers for use with Claude and Open WebUI. | |
| ableton-mcp amamparo/ableton-mcp MCP server for controlling Ableton Live, enabling AI assistants to interact with Live sessions through tools for track/clip/scene management, playback control, and device parameter adjustments. | |
| Woodpecker CI Pipeline Analyzer aman-11/woodpecker-mcp-server Enables automated analysis of Woodpecker CI pipeline failures with intelligent error detection and fix suggestions. Supports both direct pipeline analysis and IDE-integrated git-context analysis using repository names, PR numbers, or branch | |
| Google Services MCP Server aman-husain-123/mcp_project MCP server for Claude Desktop that provides tools to read/write Google Sheets, manage Gmail, schedule Google Calendar events, and run queries on Neon Postgres databases. | |
| playlist-agent aman1601s/playlistagent Enables natural-language creation, management, and optimization of Spotify playlists via MCP tools like search, generate, analyze, and recommend. | |
| mcp-compliance-router aman210122/mcp-compliance-router Screens text for PHI/PII, classifies it, redacts sensitive content, and routes it to approved model tiers based on a declarative policy, with built-in evaluation metrics. | |
| IT Onboarding Automator MCP Server aman3786/it-onboarding-automator Enables AI assistants to inspect employee access, list failed onboarding events, and retry provisioning operations. | |
| Universal MCP Server amana03/universal-mcp-server Multi-mode MCP server supporting both Claude Desktop (STDIO) and OpenAI (HTTP/SSE) integrations with file operations including read, write, delete, and search capabilities. | |
| obsidian-rag amanaakash/obsidian-rag-with-claude-mcp Enables semantic search and reading of Obsidian Markdown notes through read-only MCP tools, allowing Claude to retrieve relevant passages from a local vault. | |
| HubSpot MCP Server amanagarwal13/hubspot-mcp-shinzo Provides standardized access to HubSpot's CRM API for managing contacts, companies, deals, engagements, and other CRM data through comprehensive CRUD operations, batch processing, and advanced search capabilities. | |
| excel-mcp-server amanarneja/xspreadsheet Enables AI assistants to perform Excel file operations such as reading, writing, formatting, and chart creation through the Model Context Protocol. | |
| aman-mcp amanasmuei/aman-mcp Exposes identity, tools, workflows, guardrails, and evaluation as MCP tools — so any AI agent can read and write your ecosystem programmatically. | |
| amem amanasmuei/amem Provides persistent memory for AI coding tools, allowing them to remember corrections, decisions, and preferences across sessions and different tools. | |
| Luno MCP Server amanasmuei/mcp-luno A Model Context Protocol server that provides a standardized interface for AI models and applications to interact with the Luno cryptocurrency exchange API for trading operations. | |
| Malaysia Prayer Time MCP Server amanasmuei/mcp-server-malaysia-prayer-time An MCP server that provides access to Malaysia prayer time data through Claude Desktop, enabling users to retrieve prayer times for specific zones, list available prayer zones, and check current prayer time status. | |
| NodeMCU MCP Service amanasmuei/mcp-server-nodemcu A service for managing ESP8266/NodeMCU IoT devices that provides both REST/WebSocket APIs and implements the Model Context Protocol for AI assistant integration. | |
| BigTime MCP Server amanat361/bigtime-mcp-server Provides Claude with access to BigTime's time tracking and project management API, enabling retrieval of clients, projects, staff, time entries, and daily totals. | |
| Kolkata Puja Tourist MCP Server amanbasu20/kolkata-puja-mcp Enables AI assistants to answer tourist queries about Kolkata Durga Puja by providing tools and datasets for pandal details, nearby pandals, metro stations, driving routes, restaurants, and restaurant opening hours. | |
| MalBuddy amanbharti008/malbuddy MCP server that integrates a headless Ghidra instance for binary reverse-engineering, enabling automated analysis and decompilation through a standardized interface. | |
| Vanna AI MCP Server amanbhattshorthillsai/vanna-mcp-server An MCP server that uses Vanna AI and Azure OpenAI to translate natural language questions into SQL queries and execute them against a SQLite financial database, with detailed logging and cost tracking. | |
| mcpify amanbig/mcpify Turn any REST API into an MCP server in one command. Point mcpify at an OpenAPI spec and every endpoint becomes a tool your AI agent (Claude, Cursor, Windsurf) can call — zero glue code, always in sync with the spec. | |
| skillgod amancodingrepo/skillgod An MCP server that automatically injects relevant skills, project memory, and routes complex tasks to specialist agents into AI coding tools like Claude, eliminating cold starts and prompt engineering. | |
| TrainingPeaks MCP Server amanda50802/trainingpeaks-mcp Connects AI assistants to a TrainingPeaks account through the Model Context Protocol, enabling natural-language querying and editing of workouts, structured intervals, calendars, events, health metrics, equipment, and athlete settings. It a | |
| Z-Image Studio MCP Server amandaa79795/z-image-studio Enables AI agents and MCP clients to generate images with the Z-Image-Turbo model, list available models, and browse generation history via stdio, SSE, and Streamable HTTP transports. | |
| Turbular amandaleclerc361/turbular Enables LLM agents to connect to and query multiple database types through a unified API, with schema normalization, query transformation, and support for PostgreSQL, MySQL, SQLite, BigQuery, Oracle, MS SQL, and Redshift. | |
| mcp-server-duckdb amandaliu2433/mcp-server-duckdb Enables users to interact with DuckDB databases through the Model Context Protocol, supporting SQL queries, table creation, and schema inspection. Includes a read-only mode to prevent write operations and preserve data integrity. | |
| MCP Memory Keeper amandasasaki/mcp-memory-keeper Enables Claude coding assistants to store and retrieve persistent context across sessions, so saved decisions, progress, and file state survive context compaction or resets. Provides checkpoints, channels, search, diffing, and export/import | |
| Glance amandaschroder/glance An MCP server that gives Claude Code a real browser, letting it navigate, click, type, screenshot, run multi-step test scenarios with assertions, and monitor console and network activity. It also supports session recording, visual regressio | |
| Ollama MCP Server amandawood46/ollama-mcp Enables MCP-compatible applications to manage and use local or cloud-hosted models, including listing, pulling, generating, chatting, embeddings, and web search/fetch through a unified tool interface. | |
| multiCAD-mcp amanday6434/multicad-mcp Enables AI assistants like Claude for Desktop or Cursor to control supported CAD applications through natural language, including drawing, layer/entity/block management, data export, and file/session operations. | |
| MCP Calculator Service amandhunna/mcpserver A service that processes natural language requests to perform mathematical calculations by integrating Claude AI with a calculator API through the Model-Context-Protocol architecture. | |
| msforge amanesuzuha000/multisimforge A stdio MCP server that exposes tools to generate editable NI Multisim 14 circuits from JSON specs, self-check wiring offline, run real simulations, preview schematics, and capture instrument panels. It shells out to isolated CLI processes | |
| repo-rag amangit1314/repo-rag Enables conversational queries about a GitHub user's profile, using lazy indexing and tool calls to retrieve repository info and file contents, with cached results for efficiency. | |
| uc-mcp-server amangly/mcp-unknowncheat Enables reading and searching the UnknownCheats forum, including thread search, post retrieval, code extraction, attachment downloads, and game offsets lookup. |
27,901–27,950 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.