Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| BacklinkGenie Link-building outreach agent: find posts where you fit, approve pitches, read replies, track links. | |
| BackPR youth program data Free, sourced US youth program data: state rules, licensed programs, software pricing and templates. | |
| BackQuant Crypto options dealer gamma, IV, flow and trade tape for BTC, ETH, SOL and HYPE. | |
| BackResto Partner API Read-only HACCP records of a restaurant: deliveries, temperatures, cleaning, traceability. | |
| BAE Batteries USA product catalogue Find stationary batteries by chemistry, voltage or application; datasheets, SDS, quotes. | |
| com.bagsthatpay/site Bags That Pay: the site's own MCP server — dataset, enquiry, entities, listing (enquiry = a... | |
| Balladic Fluid cowork platform. Synthesizes work data across boundaries, with project tracking built in. | |
| Bandmixr AI mixing and mastering in the chat: check a song, mix your stems, change the mix in plain words. | |
| com.bankcodelookup/site Bank Code Lookup: the site's own MCP server — dataset, enquiry (enquiry = a human handoff, not a... | |
| BankingMCP Read-only access to your bank balances and transactions in Germany and the EU. Free trial. | |
| BankrollSZN DFS projections, ownership, optimizers and model picks for NFL, MLB, NBA, NHL, PGA, MMA and more. | |
| Barcode Report Look up products by UPC, EAN, GTIN or ISBN across 500M+ barcodes, or search by name. Free plan. | |
| Earlywire — Marketing & Growth Intelligence Marketing, growth & SEO intel: 120+ practitioner sources, judged daily, with citable summaries. | |
| 바로이집 (Baroezip) Korean apartment listings: list your home, post buyer requests, prices, registry | |
| BarterBanner Traffic exchange for independent websites: network stats, members, campaigns and site reports. | |
| BASE167 Claim BASE167 and enter Degen Games, a monthly on-chain trading contest on Base. | |
| Basecamp Basecamp's official server: projects, to-dos, cards, messages, docs, schedules, and Campfire. | |
| agent-check Process monitoring for AI agents: start runs, submit per-task evidence, complete runs. | |
| agent-talk MCP channel between two AI workspaces: send messages, wait for replies, read history. | |
| exec-brief Weekly 5-15 reports for executive teams: submit reports, fetch the Friday briefing. | |
| okr Team OKRs from your AI workspace: objectives, key results, and weekly check-ins. | |
| polls One-link team polls: create polls, vote, fetch results, and close polls. | |
| Base of AGI AI news in TR/EN/ES/RU, a daily stack brief and a verified MCP/plugin/skill catalog. Read-only. | |
| BasePic Upload, edit and share images by link: free image hosting for AI agents, no API key. | |
| Basis Crypto market data, 200 indicators, order flow and a chart link. No account, no API key. | |
| BasketWatch Irish grocery prices at Aldi, Tesco, SuperValu, Dunnes and Lidl: compare, baskets, offers, history | |
| Bastion Helix Agent Lens Web pages for AI agents: may-I-use checks, prompt-injection flags, Markdown, JSON, screenshots | |
| BHX Fab Quote Measure and price laser, plasma, waterjet and CNC jobs from DXF, G-code and STL files | |
| com.batesio/site Batesio: the site's own MCP server — dataset; every answer cites the site. | |
| BatterySnap Real-world Android battery stats from BatterySnap users: device, model and fleet rankings. | |
| Bavlio LinkedIn + cold email outreach: find leads, launch personalized campaigns, manage replies. | |
| Bazavo Classifieds for AI assistants: sell, buy, rent, hire and find local services, just by asking. | |
| Bazous Household cash-flow answers before payday: what's due, how low the balance goes, the best move. | |
| Beaches of Mallorca Live swimming and family conditions and reviewed guides for 77 Mallorca beaches | |
| com.beachvalencia/booking Beach Valencia holiday apartments (Valencia, Spain): availability, pricing, cancellation policy. | |
| Beamtrace AI visibility tracking & website fixes for better AI search presence | |
| beatandraise.com SEC Filings SEC EDGAR since 1993: search and read filings, insiders, 13F, statements; verify quotes and figures. | |
| Beaubi 行動美研 台灣到府美容服務（美甲、美睫、紋繡、採耳、肌膚管理、推拿；台北、新北、宜蘭、台中）：查服務項目與起跳價、單一服務細節、會員制度、怎麼預約（預約在 Beaubi App 完成）。 | |
| BedrockNews GRIN-scored news for agents: discover by verdict, pull full analysis, traverse extraction graphs. | |
| BedrockTap One MCP server over 253 data sources: Reddit, LinkedIn, YouTube, G2, search and AI answers. | |
| BeeIMG Image Hosting Upload, delete, and manage images on BeeIMG with albums, folders, privacy controls, and API access. | |
| Before the Lot Car-buying math and state rules: out-the-door prices, quote checks, leases and trade-ins | |
| BEFOREVIBE PRD, logo, and AI UI mockups from any app idea — PRD free, logo 1 credit, screens 1 credit each. | |
| Belanar Water Decisions Decision-only MCP for household water problems with governed, structured next-action guidance. | |
| Beleeg Run a recreational sports league from an AI assistant: standings, schedules, rosters, scores, dues. | |
| Beleeg (public, no account) Public league standings, schedules and brackets; start a league or bracket with no account. | |
| BenAwf BenAwf remote MCP for Strategy Lab. Streamable HTTP. Paper GA; live venue beta. | |
| BenchLeader Daily LLM leaderboard from independent benchmarks: ranks, scores, prices, speed and comparisons. | |
| Bereishes Search and read classical Jewish texts: Tanach, Talmud, Midrash, halacha, and commentaries. | |
| Bernuvia Marketplace of code templates: find, buy by card with Stripe, sell and manage your sales and cases |
30,001–30,050 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.