Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| com.consentvia/site Consentvia: the site's own MCP server — dataset; every answer cites the site. | |
| ConstituChat: Constitución de Venezuela Busca y lee los 350 artículos de la Constitución de Venezuela (1999), con cita y fuente oficial. | |
| Consulate - AI Dispute Resolution (Crypto + Traditional + General) Unified dispute resolution: crypto, payments, SLA violations. 95% AI automation. | |
| com.containermath/cbm Calculate shipment volume (CBM/CFT), weight, and how cargo fits standard shipping containers. | |
| com.contaktly.app/contaktly See which companies visited your website, what they looked at and who to call. Read-only. | |
| contboxx Procurement Plans, prices and non-binding quotes for contboxx digital signage content. Nothing is bought here. | |
| Contextaco Never explain the same context twice. Capture it once, load it anywhere, fork it to make it yours. | |
| Contextflo Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit. | |
| Contextli Voice Notes Search, browse and read your Contextli voice notes and transcriptions from any MCP client. | |
| Context Window Supply Browse merch for AI builders, get US shipping quotes, and create Stripe checkout links. | |
| ContinueOps Public MCP BC/DR & compliance tools: DORA, NIS2, NIST CSF, GDPR, SOC 2, CMMC, CAF, ISO 27001, FCA/PRA. | |
| Contract Lily UK tenancy and employment rule checks: deposits, notice, rent increases, holiday and minimum wage. | |
| com.contractorleadquotes/site Contractor Lead Quotes: the site's own MCP server — dataset, enquiry (enquiry = a human handoff,... | |
| com.contractorroster/contractorroster Verified US licensed-contractor data: 879k+ state-board records, metered per record, free discovery. | |
| com.controlargastos/gastos-compartidos Consulta y opera gastos compartidos, deudas, presupuestos e ingresos de tu grupo. | |
| ControlDrill List, schedule, and retrieve evidence for ControlDrill incident-response tabletop exercises. | |
| Controlflare A hard budget cap for Cloudflare Workers: see estimated spend and pause or resume Workers. | |
| conved.com file converter Convert files between hundreds of formats: documents, images, audio, e-books, fonts, GPS and more. | |
| Convertlyft Web analytics that names the fix: funnels, replays, errors, page speed and SEO for your site. | |
| Convert To It Check which file formats convert to which, and get links that open the converter. | |
| com.conveyancingfeesaustralia/site Conveyancing Fees Australia: the site's own MCP server — enquiry (enquiry = a human handoff, not... | |
| com.conveyancingfeesireland/site Conveyancing Fees Ireland: the site's own MCP server — enquiry (enquiry = a human handoff, not a... | |
| Convoca Open literary prizes and contests in Spanish and Catalan, with winners and awarded books. | |
| CookieInspector Check what a site's cookie banner really blocks: CMP, trackers, cookies before consent. | |
| com.cookievo/site Cookievo: the site's own MCP server — dataset; every answer cites the site. | |
| CookieYes Manage cookie banners, run cookie scans and check GDPR/CCPA compliance from your AI assistant. | |
| Cooking with Robots Plan weekly meals from your pantry, search allergy-safe recipes, and build grocery lists. | |
| CoPantry Your household recipes, pantry, meal plan and shopping lists. | |
| Canopy by Copp Oak Book local service pros from your AI assistant: real availability, instant booking, easy cancels. | |
| CopyTheVideo Find MP4 download options for public Facebook videos and Reels. No login or local file upload. | |
| com.corapilot/whatsapp Let Claude or ChatGPT search, read and send your WhatsApp messages over MCP. OAuth sign-in. | |
| Corazor Technology Global AI product engineering partner: services, case studies, fit check, booking | |
| Corbah: open line for agents Talk to cycling brand Corbah, get team kit quotes, commission designs, browse the catalog. | |
| Cork & Curve wine travel Verified wineries and wine bars in 31 regions with provenance, wine festivals, tours and stays. | |
| Corollary — scientific AI models, tools and databases Find open biology and chemistry AI models, bioinformatics tools and databases, and run them online. | |
| CorpoAPI Company registry data for US states and countries. Search, verify, and run KYB checks. | |
| Corpole Requirements authority for AI coding agents: binding requirements and acceptance criteria. | |
| Corporary French company data: SIREN search, legal profile, financials, changes, groups, filings, scores. | |
| Corporate Gift Picks Corporate gift ideas by budget and recipient, USPS holiday ship-by dates and a gift budget tool. | |
| Corpus Car Fix — book mobile mechanic in Corpus Christi Book mobile mechanic in Corpus Christi, TX: prices, ZIP coverage, free callback. | |
| CorpusFetch O(1) symptom routing and warrant-first fetch over 622 concluded records. | |
| Correkt: The AI-Native Online Marketplace for Physical Products Correkt: online marketplace built for AI agents. Shop 10M+ physical products from verified sellers. | |
| Corridome Cited register of US private equity firms, banks, funds and their deals. Membership required. | |
| Corroborum Search 220M+ scholarly papers with abstracts, DOIs, retraction flags and citation links. | |
| com.cortexpad/cortexpad Google Keep-style notes app with an MCP server for AI agents to read/write notes. | |
| CoSchedule Ask about your CoSchedule marketing calendar: projects, campaigns, tasks and social posts. | |
| com.coshhvo/site Coshhvo: the site's own MCP server — dataset; every answer cites the site. | |
| Cosmic Ephemeris 78 astrology calculations, Tarot, symbolic readings and Vedic calendars via two scoped MCP tools. | |
| Côte Privée: private driver in Burgundy Private driver in Beaune, Burgundy: places, events, prices, availability, quotes, bookings. | |
| Cotribute MCP Connect AI agents to financial institution origination, analytics, and compliance workflows. |
30,651–30,700 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.