Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| ArtifactBridge Search team documents and propose governed-document changes for human review and approval. | |
| ArtifactDeploy Deploy what Claude builds to a live link: previews, who-opened-it links, stats, forms, domains. | |
| Artifact Publisher Agents publish self-contained HTML to a stable review link, with page-level feedback and revoke. | |
| Artificial Wit AI MCP server unifying ERPs, CRMs, APIs and knowledge base for Claude, ChatGPT and Gemini. | |
| Artnap Search 497,000+ public domain paintings, prints and drawings from 72 museums, with museum records. | |
| ArtsDot Art Search & Quotation Discover art you love and see what a print or painting would cost. | |
| Artyfile Music Licensing Search & license real-orchestra music from your agent: EUR 29.90 one-time, WAV + certificate. | |
| ARYSPHERE x402 chain reads and token verdicts Pay-per-call onchain reads (Base, Ethereum, Gnosis), token verdicts and LLM chat over x402 USDC | |
| ASA Condor Run Apple Search Ads from Claude: performance, recommendations, keywords, budgets, launches. | |
| com.asalsold.app/canadian-mortgage-deadlines Last day to make an offer and still fund inside a Canadian rate hold. Needs the expiry date. | |
| Black Label Golf Website MCP Search and read public Black Label Golf pages with source URLs. | |
| A股数据 API (A-Share Data API) A-share data over MCP: quotes, profile, order book, K-line, financials, money flow, boards. 31 tools | |
| AShareHub — Chinese A-Share Market Data Cloud MCP server for Chinese A-share and ETF market data, news, financials and capital flows. | |
| com.ashtonforge/directory Read-only directory of vetted AI implementation agencies from the Ashton & Forge marketplace. | |
| Asia Pulse Korea & Japan market records for agents. x402 payment inside MCP, Base USDC. | |
| Asipipes Hosted, versioned data pipes for agents: return only new items from feeds, filings and prices. | |
| Ask AI Ask questions across Shopify, Klaviyo, GA4 and 20+ e-commerce sources in plain English. | |
| ask10ais Independent measurements of how 12 AI models answer brand questions in Chinese and English. | |
| AskAiRank How ChatGPT, Claude, Perplexity and Gemini mention your brand: visibility, mentions, competitors. | |
| AskBase Search, write and keep your help centre current. Changes are drafted for a person to approve. | |
| AskEditor Video editor beside your chat: cut, caption, add music, titles and motion graphics on a timeline. | |
| Gabriel Supplements at cost-plus, your Gabriel health and routine, care search and clinician-reviewed Rx. | |
| Matchbox Describe a problem in plain language; get matching products with honest caveats. Never sponsored. | |
| Ask My Envoy Discover meeting-coordination Envoys. Work in progress; identity discovery is coming soon. | |
| AskMyEV Tesla data for your AI: battery, range, charging, tires, alerts, history. Controls off by default. | |
| Onhand MCP server for local business availability: in-stock items, open appointment slots and shop hours | |
| AskRentAI Ask your Rent Manager portfolio anything: live, read-only financials, rent roll, leasing. | |
| AskScores Sports stats questions in plain English: NBA, WNBA, NFL, MLB, NHL and college football. | |
| Sereno A cron job monitor your AI agent sets up and can ask why a job failed. Free for up to 200 checks. | |
| ASOClimb App Store and Google Play keyword research, rank tracking, competitors, charts and niche analysis. | |
| ASO Skill Current App Store rankings, keyword metrics, app metadata, and credit balances for AI agents. | |
| Assay Systems procurement register Public procurement register, 75 countries: suppliers, buyers, contracts, single-bid awards | |
| AssessAll Assessment Catalogue Search AssessAll's assessment catalogue, free practice tests and guides, with INR and USD prices. | |
| AssessLane Create, review, assign and track team training assessments from your AI client. | |
| Assetzaar Marketplace Search Assetzaar's catalog of UI components, agent skills, SaaS kits and automations. | |
| Bob Research Tools Paid web research, news, company briefs, fact-checks and US weather data for AI agents | |
| Assindo AI phone assistant: real calls to businesses for you, plus tasks, posts and research. | |
| AsterNym Birth charts for agents: BaZi, Chinese and Western zodiac, numerology. Keyless and read-only. | |
| Asteroid XRPL Hub Read-only XRPL tools for ASTEROID: identity, market, supply, liquidity, escrows, holders, AMM quotes | |
| AstralHoro Tropical natal charts, transits, and Sun, Moon, and rising from a birth date and place. | |
| AstralRead Natal charts, transits, the sky of a day, Vedic chart and dasha. Read-only, no account. | |
| Astraluno Birth charts, Big Three and sky events with explicit uncertainty. Free; birth data never stored. | |
| WaBot Your own WhatsApp in Claude and ChatGPT: read chats, draft replies, send messages you approve. | |
| AstraNL Dutch counterparty check Check a Dutch supplier before you pay: KvK register, name match, VIES VAT, EU sanctions. No key. | |
| AstraNL Crossing Look before work, claim it, check a spend, mark the outcome. For agents sharing tasks. No key. | |
| AstraNL local proof NL Verify a place in the Netherlands: a verified local hand checks it, you get a sealed receipt. | |
| AstraNL Dutch construction facts with measured accuracy + NL coordination. Never holds third-party funds. | |
| AstraVerify Domain Trust Check Email security and AI discoverability scores for any domain, with the exact record or tag to fix. | |
| Astryke Hub Every project you have going, on one board your coding agents keep current and you actually read. | |
| ATAbooking Book hotels direct through your AI, for a 5% fee. Demo: sample hotels, no real bookings yet. |
29,851–29,900 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.