Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Put Me In AI meme video templates: how-tos, recommended settings, example prompts and FAQ. Free, no key. | |
| Qanvo Stock Screener Screen global stocks, options, ETFs and crypto in plain English, and set email alerts on any screen. | |
| GiftQuest Wrap a digital gift (text, link or file) in a quest the recipient must solve to unlock. | |
| QR Maker Create styled, scannable QR codes with previews, scan checks, editable links and scan statistics. | |
| Quant Daily Daily verified GRE and GMAT quant drill: graded answers, hints and worked solutions. | |
| QueryAtlas Query selected Google and Bing analytics, search, and advertising reports through MCP. | |
| Quotalis Weekly benchmark of AI search visibility tools, plus on-demand AI-readiness site audits. | |
| ThornGuard Remote MCP security gateway for auth, redaction, policy enforcement, and audit logging. | |
| Race Calendar F1 Anonymous read-only Formula 1 tools, resources, prompts, completion, and interactive dashboard. | |
| AgentWorkmark Search reviewed AI services, inspect completed-work evidence, and check current availability. | |
| app.railway.up.airy-enthusiasm-production/ai-commerce The first marketplace where AIs buy from AIs. Browse, register, and purchase autonomously. | |
| Vérif Entreprise FR French company KYB (SIREN): status, insolvency, VAT, BODACC monitoring alerts. Free preview; x402. | |
| VHGENGINE Agents-first viral-hook engine: generate, score, and remix short-form hooks over MCP. | |
| Stablecoin rails, corridors and payment provider data Cited stablecoin rails, corridors, providers, rail holidays, regulators for agents. x402/MPP paid. | |
| Irish rent benchmarks and house price comps Irish rent, rent limits, house price comps (IE, NL, EU), housing report. x402/MPP paid. | |
| WOD Coach: AI Personal Trainer Fitness MCP: AI personal trainer, workouts, injury exercise swaps, race pacing. Pay-per-call x402. | |
| RankBrain AI Finds why Google and AI cannot read your site, gives the exact fix, applies it once you approve. | |
| Ranya The planner you can call: your tasks, calendar, notes, goals and habits, in your AI assistant. | |
| Raster Browse, search, upload, tag, transfer, and delete images in your Raster libraries over MCP. | |
| Leaf AI assistant integration for Leaf — track books, log reading sessions, and manage your library. | |
| Recl Search, read and review your saved videos, links and notes; save links and ask your library. | |
| Calories Club: AI Food Tracker AI-powered calorie tracking with photo recognition, barcode scanning, and voice logging | |
| Recordo: Task Planner & Notes Brain dump, routines, task planning, focus, and instant thought retrieval | |
| Refcat Search 1M real UI flows and 3.3M screens from shipped apps, sites, emails and games. | |
| Releavo Your team's PRD, UX spec, architecture and stories: read them, build a story, keep it current. | |
| RELTO AI virtual staging that doesn't change the house. | |
| app.repage/repage Publish HTML & Markdown to shareable links with versions, comments, and project organization. | |
| Free Agent Economy Lab Free buyer-side outcome verification and provider comparison for supplied agent receipts. | |
| Paid Base Token Tools Base token facts and ERC-20 allowance checks. Per-call USDC on Base; x402 wallet required. | |
| RepoPilot Repository evidence for agents before they adopt dependencies, enter codebases, compare, or merge. | |
| Reviewder Job board: developers post paid review gigs for apps, websites and games; creators name their price. | |
| rezee Issues, pull requests, docs, chat and CI runs across a rezee workspace. | |
| Ripey Let your agent open a store, list digital products and share USDC checkout links. Test mode. | |
| Rivioo Analyse App Store and Google Play reviews in Claude: counts, trends and real quotes for any app. | |
| RIZZA RIZZA — your AI dating wingman: conversation-aware replies, openers, and profile feedback. | |
| Roamward MCP Plan U.S. road trips across 104 published drives with reviewed stops and honest detour costs. | |
| Robisie — agent-readable execution board Operators rank work; agents take, reserve, execute, attach evidence, and submit it for review. | |
| RoboHub Robot Catalog Vendor-neutral catalog of 300+ commercial robots: search, compare specs, request vendor intros. | |
| app.rombik/rombik Code → ДСТУ/GOST 19.701-90 (ISO 5807) flowcharts: 10 languages, 8 export formats, OAuth | |
| Roomline Rent, rooms and tenants for rent-by-the-room landlords: who is late, vacancies, reminders. | |
| RoughSketch Search, read, preview, create, update, rename, arrange and trash sketches in your Google Drive. | |
| Rovyn Your assistant curates. Rovyn plays. Podcast plans become tap-to-play editions; receipts come back. | |
| AI Visibility Audit — Can AI crawlers read and cite your site? One-call audit: robots.txt AI-bot rules, llms.txt, JSON-LD, meta tags, sitemap. Score plus fixes. | |
| Auth Posture — Email Deliverability & Spoofability Audit One-call domain audit: MX receiving, SPF/DMARC/DKIM spoofing protection, disposable-address risk. | |
| catchlog A fishing catch logbook: record, list and tally catches over REST and MCP. Counted, never estimated. | |
| CAZ Cost UK Clean Air Zone daily charges by council, per vehicle class, and what a trip costs. | |
| Dubai Log UAE travel and living cost calculators with the published source behind every number. | |
| GBU Compliance German Gefaehrdungsbeurteilung: assess against the ArbSchG s5(3) checklist and build the s6 record. | |
| Hive Ledger — deterministic varroa treatment rotation Checks a beekeeping varroa treatment rotation for resistance risk and withdrawal-period conflicts. | |
| HK Transit Cost — MTR fares and the government fare subsidy Hong Kong MTR fares and the government fare subsidy, computed and recorded. |
28,301–28,350 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.