Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| localhum What's on tonight at San Diego's small venues: live music, trivia, comedy, open mics, happy hours. | |
| Locize Locize TMS: read and update translations with glossary, style guide, TM and screenshot context. | |
| LotsStore Your online store: products, stock, orders, customers and payments into your own account. | |
| Loutre Hosted mock APIs from OpenAPI, TypeScript or Postman: realistic data, errors and latency on demand. | |
| LLMready Audit websites for AI search readiness and generate or validate llms.txt. Free quick check. | |
| Jessica Hill Holm — Coaching for Leaders Scaling Executive coach's agent for leaders driving change while scaling: answers, workbooks, intro calls | |
| LocalSchema Generate and validate LocalBusiness JSON-LD for local SEO. Free tools, no key needed. | |
| InvoiceVerify Check Peppol receivability (incl. Belgian client lists) and validate EU e-invoices. Free check. | |
| PrivacyPill GDPR cookie banners with Consent Mode v2, plus a free scan of what loads before consent. | |
| LogPulse Changelogs for coding agents: versions, breaking changes, migrations. Free changelog-to-JSON. | |
| Lowbird Amazon price history, real price drops, price alerts and a deals feed from your interests. | |
| Luala Photo shoots of you from your saved selfies: pick a pack, shoot, edit. | |
| LuckDrop Enter LuckDrop's free weekly on-chain prize draw, check the live draw, and claim prizes. | |
| LuckPanda Document Tools Create invoices, quotes, receipts and credit notes with GST or VAT, as prefilled links or PDFs. | |
| Lufthaven Flight Tracker Flight tracker: your trips, any flight's live status, routes, Starlink Wi-Fi checks and fares. | |
| Lukija Continue Finnish reading and practise saved words from an authenticated Lukija account. | |
| Lumaion Continuity Agent continuity: live continuity index, self-test contract, offline Continuity Proof verification. | |
| Mailcoach Read Mailcoach lists, campaigns and templates; optionally draft campaigns and templates. | |
| Mailera Email for AI agents: read, search and send from your Gmail, Outlook, Yahoo, iCloud or IMAP inbox. | |
| MailStream The first MCP server for physical mail: send postcards and letters, manage lists and campaigns. | |
| Makeroo Search the Makeroo product directory and submit your product from your own agent. | |
| Malinois Check a live app you own for public databases, leaked keys and exposed files. | |
| Manawa Terminal Live market data, financial analysis, and portfolio research tools across 10,000+ tickers. | |
| MapLedger Zoning, homes per lot, short-term rentals, tax and flood for any property in Austin and Nashville. | |
| Marketgenius Our free Marketgenius investment tools as live, interactive React MCP Apps. | |
| Marselia Tarot de Marseille reference: 78 sourced cards, tarot decks, Academy lessons and a random card draw. | |
| Mastheads Read and write your own AI newsroom: articles, their sources, the checks, the editor of record. | |
| MaxWorth (your cards) Read-only access to the cards, credit card credits and offers you track in MaxWorth. OAuth sign-in. | |
| MaxWorth Credit Card Benefits US credit card data: annual fees, credit card credits, earn rates, offers and cashback portal rates. | |
| Maylee Maylee AI email: read, search, triage, draft and send; manage labels, views and AI label rules. | |
| Meistron Auftraege, Rechnungen, Material und Zeiten eines Handwerksbetriebs abfragen und pflegen. | |
| Meles In-app surveys and announcements for B2B web apps: build, target, publish and read campaigns. | |
| app.memol/memol Search, read, create and edit your Memol notes from Claude. Team note-taking with AI search. | |
| Memtrove Let Claude search and read the files and bookmarks on your Mac by name, content or meaning. | |
| Merron Inspect selected project excerpts and screen user-confirmed facts for bounded EU AI Act readiness. | |
| app.mhai/knihajizd Czech mileage logbook (kniha jizd): AI journey drafts, statutory reimbursement, XLSX export | |
| Mi Basket Uruguayan basketball (FUBB): games, box scores, standings, schedules and player stats. Read-only. | |
| MilanAura Authority Check Free Authority Check of a professional profile: strengths, biggest gap, first action, a post. | |
| app.mizam/discovery Find restaurants on Mizam: live menus, allergens, prices, hours, table availability. Read-only. | |
| Mobela Your runs, walks, lifts, sleep and heart rate from Mobela, plus your AI coach's notes on you. | |
| Moflow Net worth tracker: ask your AI what you're worth, and have it update your ledger. | |
| Mojeeb AI customer service for WhatsApp, Instagram and Facebook: conversations, leads, contacts, knowledge | |
| Montik Edit short ads and social videos live in a browser editor, alongside your AI agent. | |
| Moonlauncher Prepare pump.fun token launches from your AI agent. You review and sign each one in your own wallet. | |
| Moose Tracker Retro synth plus sampled instruments: sound effects, UI sounds and songs as WAV, Ogg or Opus. | |
| Morphed Create AI images and videos, manage projects and credits, and use workspace campaign context. | |
| MORYA French real-estate intelligence: prices, rents, listings, yield, rental management. | |
| MoveMate: Gym Workout Tracker Gym workout tracker: review your training, PRs and progression, and schedule workouts in the app. | |
| Mutator Build and test short-form marketing automations from your agent. Nothing it does can post. | |
| Mycorr Shared, versioned tables with units, links and SQL. Agents read what your data means. |
28,151–28,200 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.