Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| AgentGate Check an AI agent is registered, Active and Verified in Concordium's registry. By Crypto Money Maker | |
| YourAITools Credits Prepaid credits for every YourAITools agent API: quote a call and check a credits key balance. Free. | |
| DomainCheck Domain and email trust checks for agents: DNS, SPF/DMARC, disposable email. By Crypto Money Maker | |
| YourAITools MCP Hub All 22 YourAITools agent APIs in one MCP server. Most tools free; pay with credits or x402. | |
| InjectScan Scan text for prompt injection: risk score, verdict, matched spans. Built by Crypto Money Maker | |
| PayGuard OFAC SDN sanctions screen for crypto addresses, for agents that send payments. By Crypto Money Maker | |
| PerpCheck Hyperliquid pre-trade order check: will it be rejected, fix values, liquidation, impact, funding. | |
| SmartPerps Read-only Hyperliquid smart-money positioning: top-trader bias, flows. Not financial advice. | |
| ToolFit + MCPCheck Audit, pin and diff agent tool lists; preflight and watch remote MCP servers. Free tier; x402. | |
| ToolPick Find and live-check the paid x402 API for an agent task, ranked by real 30-day payers and price. | |
| ToolRoute Route each agent task to the few tools it needs (BM25 shortlist). Free tier; x402 or credits. | |
| Transcribe (speech-to-text) Pay-per-minute speech-to-text: audio URL to text, SRT or VTT. Paid via x402 or credits. | |
| WebRead Turn any public web page into clean Markdown for LLMs; respects robots.txt. By Crypto Money Maker | |
| Zeroslide Match Private B2B matching: your agent finds clients, partners and investors; you meet on double opt-in. | |
| 7Running Build or change your 7Running running plan by talking to your AI assistant. Road and trail. | |
| Cold Call Coach Call Insights Read graded sales call reports, agents and scorecards from Cold Call Coach. | |
| Dara A club coaching platform: plan sessions, draw plays, tag match video and build team-talk decks. | |
| freddy Connect your wearables, rings and training apps, then ask your AI about your own health data. | |
| Prose Coach Deterministic writing filter. Marks 43 AI patterns with the line and the fix. | |
| codes.find/verified-codes Verified discount & referral codes for crypto exchanges, cards and more — tested first-hand. | |
| moa Your moa meeting notes and transcripts: decisions, to-dos, who said what, and the wiki. | |
| QRFLOW.codes Create QR codes, re-point printed dynamic codes, name links on your domain, read scan analytics. | |
| bag.coffee Search in-stock specialty coffee from hand-picked roasters, priced per 100g, and each week's drops. | |
| pwned.coffee Live security incidents, updated hourly: fix status, fixed versions, lockfile and repo checks. | |
| 0DTE Confluence Gamma rails, options flow tape, and graded 0DTE setups for SPY/QQQ/IWM. Advisory only. | |
| PantryPOS — Food Pantry Finder and TEFAP Rules Find US food pantries near a ZIP or City, ST, and look up a State's TEFAP rules with sources. Free. | |
| Ringback: Missed-Call Text-Back for Contractors Missed-call text-back for contractors: missed-call cost math, how it works, owners read their calls. | |
| Scholarize: Study Plans, Citations, Quizzes & Flashcards Free study plans, thesis statements and citations. Quizzes, flashcards and AI tutor need an account. | |
| SDSentry: Safety Data Sheet Lookup, GHS Pictograms & HazCom SDS lookup, GHS pictograms, HazCom dates; customers: list my chemicals, sheets due, PPE, hazards. | |
| com.1001locals/catalog Search & add local tours and experiences (Italy/EU). Operators: first 100 bookings free, then 5%. | |
| GPX by GreenPeak Ranked lenders and investors for real asset deals, with appetite level reasoning. | |
| 101 Soundboards Search millions of sound and soundboards on 101soundboards.com | |
| 1099Policy Verify, quote and track contractor insurance in your 1099Policy account. | |
| 10Life Insurance Compare 10Life insurance. Single-trip travel is live. Stateless POST. GET returns 405. | |
| 10Life Travel Compare 10Life single-trip travel plans. Stateless POST. GET returns 405. | |
| 1211 - your picture on a shirt Put any picture on a shirt, hoodie, cap, tumbler or tote; get the link where the person buys it. | |
| 18 Cores Tracker Read and update tickets, deals, tasks, and contacts in 18 Cores Tracker. | |
| 1stCollab Manage influencer campaigns, negotiations, contracts, and creator content on 1stCollab. | |
| com.1stdibs/1stDibs MCP server for browsing and searching items on 1stDibs marketplace. | |
| 21RISK Read and update your 21RISK data: sites, audits, compliance, actions, claims and insurance values. | |
| 24好玩 · 互动营销模板与案例库 检索 24好玩 H5 互动营销平台的活动模板库、客户案例库与帮助知识库。匿名只读，无需 API Key。 | |
| LivePage · 活页 Turn finished agent work into a shareable, updatable web page that opens in WeChat. OAuth required. | |
| 25karats — Made-to-Order Wedding & Engagement Rings Search and price made-to-order rings, jewelry, and lab-grown diamonds from the 25karats catalog. | |
| 304NotModified Sourced answers on FR/EU rules + French company search (SIREN, NAF) for agents, quoted and budgeted | |
| 313 Automations Read-only facts, starting prices, pages as Markdown and site search for 313 Automations, Lahore. | |
| 321label Quote, buy and track real shipping labels (GLS, PostNord, DHL, UPS…) in DK, GB, DE, NO, NL. | |
| 3D2HOLO Lenticular printing toolkit for AI: pitch test charts, print quotes, and workflow guides. | |
| com.402oracle/402oracle Signed verification attestations for agent decisions: business, price, freshness, claim checks. | |
| 402post Paid classifieds for AI agents: post a listing over MCP, pay with x402. No account. | |
| Compass by 402rates Free agent tests (no account or payment); paid ping. |
29,351–29,400 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.