Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Instagram Mobile MCP by Nova (CIVAI) Instagram Direct, profiles, search, posts, comments, and likes via mobile API replay. | |
| Jiji Nigeria MCP by Nova (CIVAI) Search and buy on Jiji Nigeria, browse listings, message sellers, and manage your ads. | |
| LiveScore MCP by Nova (CIVAI) Live football scores, fixtures, teams, and players. | |
| PDF Generator MCP by Nova (CIVAI) Create PDF documents from your request. Preview the content first, then download when ready. | |
| Polymarket MCP by Nova (CIVAI) Browse prediction markets, check odds, and follow big trades. | |
| Tweet Downloader MCP by Nova (CIVAI) Get the text and download links from a public X post. | |
| YarnGPT MCP by Nova (CIVAI) Turn text into speech with Nigerian and African-accented voices. | |
| Brevo by Nova (CIVAI) Campaigns, contacts, and CRM via Brevo’s official MCP. | |
| Browser Control MCP by Nova (CIVAI) Control your Chrome from chat: open websites, read what's on the page, click buttons, and fill in f… | |
| Deep Research by Nova (CIVAI) Iterative research with configurable depth and breadth for complex topics. | |
| Firecrawl by Nova (CIVAI) Scrape, crawl, and search the web via Firecrawl’s official hosted MCP. | |
| Hacker News MCP by Nova (CIVAI) Browse Hacker News from chat: top stories, search, read comment threads, and post or upvote when yo… | |
| Juicyway by Nova (CIVAI) Manage your Juicyway business account from chat: check balances and movements, send bank payouts, v… | |
| Lagos Life by Nova (CIVAI) Play Lagos Life from chat: sign in, see who is on the map, read and send Phone DMs, check daily rew… | |
| Linear by Nova (CIVAI) Issues, projects, cycles, and roadmaps via the official Linear hosted MCP server. | |
| LLM Scraper by Nova (CIVAI) Scrape websites by following links and extract structured data from natural language instructions. | |
| SaaS Studio by Nova (CIVAI) Turn your website into plugins AI assistants can use. SaaS Studio records your product in a real br… | |
| Slack MCP by Nova (CIVAI) Use Slack from chat: see channels, catch up on messages, post updates, and reply in threads in your… | |
| Music Agent by Nova (CIVAI) I do everything related to music and lyrics | |
| Nova Inbox Agent by Nova (CIVAI) Read and send mail from your Nova Inbox (@nova.civai.co) for OTPs, directory signups, and inbound m… | |
| OpenClaw Agent by Nova (CIVAI) I execute requests through OpenClaw as a personal AI agent with persistent context, browser and she… | |
| PDF Agent by Nova (CIVAI) I create PDF documents from markdown, preview, then generate a downloadable file | |
| Product Admin by Nova (CIVAI) I manage your Nova products, create/update/delete, payment & logistics config, icons, webhook secre… | |
| Research Agent by Nova (CIVAI) I do everything related to research and reports | |
| Slidegen Agent by Nova (CIVAI) I do everything related to image and slide asset generation | |
| Support Agent Admin by Nova (CIVAI) I manage your Support Agent CRM, pipeline analytics, follow-ups, Leads Discovery, and workspace out… | |
| Telegram Agent by Nova (CIVAI) I use your linked Telegram MTProto session (Integrations → Telegram) to list groups, members, and s… | |
| Terminal Command Agent by Nova (CIVAI) I run shell commands on your private cloud environment (bash, sh, zsh) | |
| Twitter Agent by Nova (CIVAI) I do everything related to Twitter posting and campaigns | |
| WhatsApp Web Agent by Nova (CIVAI) I send and manage WhatsApp Web messages through your linked session | |
| Clutch.co Trusted B2B service providers with verified client reviews | |
| CodeWays — AI-Native Web, Mobile & Cloudflare Studio Explore CodeWays full-stack software engineering services, AI agent readiness, and project quotes. | |
| ColossalCapital — Akashic Corpus & Agentic Platform Akashic corpus + Laya routing. Anonymous read; free signup in-band. | |
| Connic Build, test, deploy, and operate Connic agents. | |
| Cookie Compliance Add a cookie consent banner that blocks trackers before consent and records proof of consent. | |
| Corpus Plan Free SEO/GEO audits of public websites and AI answer-engine citation checks. No login or API key. | |
| Cosign Find people, companies, and jobs; manage your professional network with Cosign. | |
| Cosmic Chemistry Free Vedic astrology: birth chart, dasha, Sade Sati, Saturn return, panchang, planetary hours. | |
| Cross + Covenant Bible Public-domain Bible text (WEB and KJV), reading plans and a daily devotional. Read-only. | |
| Church Year Western church year: seasons, colors, feasts, Easter and Pascha, and the 1979 BCP Sunday lectionary. | |
| Datafiniti Search, count, and download Datafiniti business, people, product, and property data. | |
| Dead Brands Bot Arena Live multiplayer game arena for AI agents: register, join matches, play turns, climb the board. | |
| Dealwize Analyse B2B sales deals, uncover risks, stakeholders, next steps, and winning actions. | |
| Developh Lisbon design and development studio: case studies, website audits and project inquiries. | |
| Dijin Memory Dijin is a Memory Layer: recall notes, decisions, and evidence-backed answers across every AI. | |
| Economico Business books operated by your agents, with exact amounts and evidenced activity. | |
| eSIMCompare: travel eSIM prices Cheapest travel eSIM plans for a trip from every provider eSIMCompare tracks, plus a price index. | |
| evai Short-form video intelligence: your TikTok, Reels and Shorts data, reports, Studio, live editor. | |
| FastAF 22 web-data tools: search, Bing, images, Reddit without authors, jobs, patents, flights and YouTube. | |
| FastGPU Compare live GPU cloud rental prices and match workloads to the cheapest provider. |
29,151–29,200 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.