Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| CrewButton Find local pros for a home job, get more prices to compare a quote, and learn what to tell a pro. | |
| x402 Format Checker IBAN, EU VAT, NIP, REGON, PESEL, email checks. Only $0.001 (0.1 cent) per check via x402 on Base | |
| CrimeMapsUK Published UK police street-crime figures by postcode district, with a page link and citation. | |
| CrimeMetric Modeled crime rates per resident for U.S. addresses: 16 crime types vs the U.S., with 80% intervals. | |
| Crimson Crawler Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools. | |
| Criptonlabs Agent APIs Read-only XRPL and Solana data for agents: fees, slippage, readiness. Free /mcp; x402 /mcp/pro. | |
| CriptoNous Crypto market intelligence for AI agents: sentiment, flow, Oracle readings. x402. NFA. | |
| Ask a human expert Human-in-the-loop expert for when your agent is stuck: math, optimization, operations research, AI. | |
| CRM Connector The integration hub for your CRM, field service and accounting apps: integrations and AI agents. | |
| Cromanion Raise conversion on a site you manage. No API key, no human to wake — you prove the domain. | |
| CronPulser Manage CronPulser from an AI agent: HTTP, Runner and TLS jobs, alerts, Runners and run history. | |
| Crontap Manage scheduled requests, uptime monitors and heartbeats from your AI assistant. | |
| Crossmint Manage Crossmint orgs, projects, environments and API keys from your AI assistant. | |
| Crosspublish Create, schedule, and manage social media posts with AI assistants. | |
| Crosswire - payment infrastructure pricing, coverage and stack design Indicative pricing, coverage and stack design for high-risk and crypto payment infrastructure. | |
| Crow Nest Publish the apps you build with AI and share them like a Google Doc, with data, files and AI. | |
| G86 Racing Racing telemetry, saved-run analysis, tracks, car-computer guidance and live pit-wall workflows. | |
| Neptivum Manage sailing logs, trips, boats, sharing, attachments, and account entitlements. | |
| Recolor the Past Colorize and restore photos, manage the library, and use account credits. | |
| Crown of Silence Inner Circle Connect your AI agent to a private community for truth-seeking and philosophical discussion. | |
| CruiseHops Search Carnival and Royal Caribbean cruises, compare fare history and find Viator port experiences. | |
| com.cryptoamlpolicy/site Crypto AML Policy: the site's own MCP server — enquiry (enquiry = a human handoff, not a... | |
| CryptoDataAPI Live crypto market data: prices, funding, OI, liquidations, regimes, GEX, whales, sentiment, macro. | |
| com.cryptoexchangecomparehq/site Crypto Exchange Compare HQ: the site's own MCP server — dataset, enquiry (enquiry = a human... | |
| Cryptohopper Market Data Real-time crypto market data: candles, tickers, orderbooks across 13+ exchanges via MCP. | |
| CryptoKeyhole Read-only market and on-chain data for Bitcoin, Ethereum and more; on-chain from our own nodes. | |
| com.cryptolicencecosts/site Crypto Licence Costs: the site's own MCP server — calculator, enquiry (enquiry = a human... | |
| com.cryptorefills/mcp-server Buy gift cards and top-ups from the industry leader. 6000+ brands, 195 countries. 4.7★, 98% CSAT | |
| com.cryptowhaleinsights/whale-insights Free read-only crypto whale-tracking & market-data MCP tools across 14 chains. No auth. | |
| Cryptowisser News Latest crypto news, stories and articles from Cryptowisser, with news cards linking to full stories. | |
| CrystlQuant Sports win chances before every game, next to the market's, graded after. NFL, NBA, soccer, UFC. | |
| com.csatzo/site Csatzo: the site's own MCP server — dataset; every answer cites the site. | |
| CSIDIA — operational notes and capabilities AI regulation, data protection and compliance notes from CSIDIA, plus its capability catalogue. | |
| com.csquaredsystems/mcp-registry-test C Squared MCP Registry | |
| CT Injury Cases Connecticut personal injury litigation data: car accident cases, Hartford Judicial District. | |
| ctlsurf System-of-record notebook for AI coding agents: pages, datastores, tasks, skills over MCP. | |
| Google Hotels Scraper (Ctrio Lab) Google Hotels prices via Apify: price per booking site, rating, reviews and class for your dates. | |
| Google Sheets Import & Export (Ctrio Lab) Google Sheets via Apify: write Apify datasets or JSON rows to a sheet, or read a sheet as JSON. | |
| Google Trends Scraper (Ctrio Lab) Google Trends data via Apify: interest over time, by region, related queries and Trending Now. | |
| Merge & Deduplicate Datasets (Ctrio Lab) Merge Apify datasets and remove duplicates by any fields, keeping the first or the newest copy. | |
| Ask the Clock (Ctrl Worx Watch List) Live material weakness status and Clock figures for public companies, from their own SEC filings. | |
| CualBet MCP Football fixtures, standings, and odds intelligence for AI agents. | |
| Cuba Te Espera - Charter Flights Search published charter flights, routes, schedules and advertised fares to Cuba. | |
| Brimload Container Loading How many identical cartons fit in a container or space, where they go, plus a 3D loading plan. | |
| RotoSpider Layout Rotomolding mold-on-arm layout feasibility: which molds fit on a machine arm/spider, and how. | |
| Cuéntamo Personal finance with balance forecast; VAT and income tax for the self-employed in Spain. | |
| Cuevr Read-only tools: search the site, read pages, see plans, price a quote, cite sourced figures. | |
| Curaiz Remote Jobs Find fresh remote jobs matched to a person's experience, goals, and eligible locations. | |
| The Curator Search and explore taste-led finds in clothing, audio, designed objects and music. | |
| CuratorSearch Live museum and curatorial job listings from institutions' own careers pages, plus a salary archive. |
30,751–30,800 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.