Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Shortik Creator Create short content (mini-games, quizzes, videos) with your AI and publish it to Shortik's feed. | |
| Shotlee Peptide and GLP-1 dosing math (dose to syringe units) plus search over Shotlee's articles. | |
| Show It Works Verification videos for AI coding agents: record the run, upload over MCP, share a viewer link. | |
| SHVL Review overdue invoices, synced Xero invoices and contacts, and live Xero reports. Read-only. | |
| Sickle — every mailbox for your agent Gmail, Outlook, iCloud, Fastmail and any IMAP mailbox for your agent. Scoped OAuth, approved sends. | |
| SignSimple Send PDFs for legally binding e-signature, free and unlimited. Track status; free legal templates. | |
| Sitejar Web Compliance Scanner Scan a web page for accessibility, security, privacy, quality and SEO issues, with fixes. | |
| Siteprint examples Website designs as DESIGN.md: real Siteprint exports of Linear, Stripe, Ramp and Cal.com. | |
| SLXD AI API Pricing Look up, compare and track AI model API prices from an AI assistant. No sign-in needed. | |
| SLXD Creator Design and edit e-learning courses, lessons and bricks from an AI assistant. | |
| SLXD Finance Query invoices, purchases, budgets and project financials from an AI assistant. | |
| SLXD LMS MCP Manage your Moodle sites (courses, users, grades, reports) from an AI assistant. | |
| SLXD LRS Query xAPI and cmi5 learning statements, KPIs and learner progress from an AI assistant. | |
| SLXD People Manage employees, absences, clockings and schedules from an AI assistant. | |
| SLXD Projects Manage projects, tasks, time tracking, tickets and retainers from an AI assistant. | |
| SLXD ShareSCORM Register SCORM packages and manage client dispatches and usage from an AI assistant. | |
| SLXD Tender Search public tenders, analyse them against your company and manage bids from an AI assistant. | |
| SLXD Training Manage training records, groups, enrolments and certificates from an AI assistant. | |
| Smacros: smarter macro tracking All the ease of Claude. All the rigor of a real macro tracker. | |
| SmartGenius Draft Instagram posts, carousels and stories, and draw images in your brand's style. | |
| SnapCount Live counts, daily per-store and per-worker reports, and live counting links from SnapCount. | |
| Social Expert TikTok content ideas, trends, posting times, keywords, hashtags and timestamped video feedback. | |
| SocialRainbow Draft, validate, publish, schedule, and manage social posts across connected accounts. | |
| Soclo Soclo: content, socials, ads and takings on iOS, Google Play and web - connected to your AI. | |
| SoKal Ask about your week, find a time with friends, see what a friend is up to, and plan where to go. | |
| Somvia Apple Health training load, recovery, HRV and workout detail for Claude, ChatGPT and any MCP client. | |
| Sorsa Amazon FBA arbitrage toolkit: product analysis, deal feeds, price alerts and sourcing management. | |
| SoulStack Read MRR, churn, users, errors, AI costs and 0-100 health scores for every app you run. | |
| Sparks Scribe Official first-party facts about Sparks Scribe: what it is, pricing, trial. | |
| Spliteo Split group expenses, settle debts and track budgets in 107 currencies. Needs Spliteo Premium. | |
| Spoonjoy Your personal recipe kitchen: save, fork, and cook recipes, build cookbooks, and shopping lists. | |
| Spreadcast Create branded social media posts and carousels, then schedule and publish them from AI chat. | |
| app.sprkly/sprkly Schedule, publish and track social posts across TikTok, Instagram, Threads and YouTube Shorts. | |
| SquadRide Turn sports picks into one link that opens them, loaded, in any US sportsbook. Free. | |
| StackPick Free read-only StackPick rankings of AI dev tools. Scores are never paid. | |
| Stackpulse 8,900+ services' status, and your Stackpulse dashboards and URL monitors. Needs Pro. | |
| Stamp Tour (스탬프투어) Find Korean stamp tours (free GPS stamp travel events with gifts) by region, place or location. | |
| Statuz Schedule and publish posts to X, Bluesky, Mastodon, LinkedIn and Reddit from your agent. | |
| SteadyFeed Tell your agent what to post about; SteadyFeed writes, designs and posts on Instagram. | |
| STEADYWRK Agentic Readiness Probe, Store Guard and Dispatch Keyless storefront readiness probe linking a Store Guard audit, plus dispatch estimates and quotes. | |
| Stipp Notes and actions in one app. Let Claude or ChatGPT read and update them. | |
| Stone Project Countertop shops: projects, clients, quotes, invoices, orders and slab inventory in Stone Project. | |
| app.strikemission/surf-trip-planner Surf trip planner: live 0-100 Strike Scores, 10-day forecasts, and trip picks for 1,100+ spots. | |
| Studiohaus Read-only MCP server for interior design studios: projects, overviews, weekly activity. No writes. | |
| Subdomain API Find known subdomains of a domain. Passive data; may include historic entries. List or count. | |
| Subtly Transcribe audio and video, and translate subtitles into 50+ languages. | |
| Subvencióname Subvenciones, licitaciones y contratos adjudicados de España, de fuentes oficiales. Solo lectura. | |
| SUMMARU Breath Breathing guide with voice and bowl, looping music, binaural beats, and a player link for users. | |
| Sunset Strip: GTA 6 GTA 6 unlock times by country, launch facts, Leonida map regions and top clips. | |
| Suparelay International calls from your AI agent: price per minute and a Call link to the browser dialer. |
28,401–28,450 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.