Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| CurrencyGuard Guard Pricing FX protection for SMEs — price Guards, live spot/forward rates, settlement dates, and more. | |
| com.curtilo/site Curtilo: the site's own MCP server — dataset; every answer cites the site. | |
| Custosa Tools Scans schema metadata to classify PHI, score HIPAA readiness, and generate compliant migrations. | |
| CutConvert Convert subtitles, transcripts, broadcast captions (SCC/MCC/STL), EDLs, and Premiere files. | |
| CutLuma video editor Free online video editor: search tools, guides and templates, video sizes, pricing, editor links. | |
| Cutshed Free browser tools, Studio prices, and the public clipper quote. Account tools need OAuth. | |
| com.cve-security/cve-intelligence CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions, CPE configurations. | |
| CVElens Vulnerability Intelligence CVE triage in one call: NVD, CVSS, CISA KEV, EPSS, public exploits and an explained risk score. | |
| CVEmber Tailor your resume to any job, get an ATS score and download the PDF from ChatGPT or Claude. | |
| Cyber Library Search and read Cyber Library, a free structured cybersecurity knowledge base. Read-only, no auth. | |
| Cycle Intelligence EU Digital Product Passport (DPP/ESPR) requirements, product readiness scoring and GS1 validation. | |
| CycleCalcs Astronomy Read-only astronomy calculations: sun, moon, planets, eclipses, twilight and star positions. | |
| Cycles IQ Cycle analysis of your own time series: dominant cycles, cycle scans, cyclic RSI and consensus. | |
| Cycling Coach AI AI cycling coach: training plans, workouts, nutrition, strength training, Strava, Garmin and Wahoo. | |
| Cyclone Machining Co. agent door File a quote request with a prototype and R&D machine shop in Grand Rapids, Michigan. | |
| EventTrader Research (read-only) Read-only market research: index funds, event cards, CLOB data, fund analytics. No orders. | |
| Tuatara Decide Train a text classifier from your labelled examples in a minute; label texts with probabilities. | |
| Tuatara Embed Stocks Stock-symbol vectors: which listed symbols an event, theme or headline moves, ranked in one call. | |
| Tuatara Summarize Extractive document summarizer: returns the text's own sentences, so it cannot add facts. | |
| Tuatara Topics The topics in a set of documents in one call, with each document's topic mixture. Nothing stored. | |
| Cypher eSIM Buy no-KYC travel eSIMs and eSIMs with a real phone number in 180+ countries, paid in crypto. | |
| com.cypruscompanycost/site Cyprus Company Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a... | |
| com.cyprusgrosstonet/site Cyprus Gross to Net: the site's own MCP server — calculator, enquiry (enquiry = a human handoff,... | |
| com.cyprusnondomcalculator/site Cyprus Non-Dom Calculator: the site's own MCP server — calculator, enquiry (enquiry = a human... | |
| com.cytado/cytado Real academic citations with printed page numbers - verified sources or an honest not-found. | |
| Dadras — Iranian law (دادرس) 95,000+ articles of Iranian law, a legal glossary and 8 Iranian legal calculators. Free. | |
| Daggy Query your data in plain English or SQL, build datasets, and fit Bayesian models. | |
| com.dailylogdesk/site DailyLogDesk: the site's own MCP server — dataset; every answer cites the site. | |
| Daisycon (MCP server) Search Daisycon affiliate programs, manage campaigns and leads, and track earnings and statistics. | |
| Dajsve Discover current products, services, travel deals and offers from Croatian merchants. | |
| com.damagerestorehq/site DamageRestore HQ: the site's own MCP server — dataset, enquiry, entities (enquiry = a human... | |
| DAMO Market State Crypto market state, 44 assets: 4 states x 10 timeframes. Recorded, never recomputed, verifiable. | |
| Dane Rolne: pasze, sery, sklepy i gospodarstwa w Polsce Pasze dla drobiu, przepisy i kultury do sera, sklepy i gospodarstwa w Polsce, ze źródłem i datą. | |
| The Mirror System — AI Citability Request a Brand Discovery Record: the human-approved facts AI cites. One tool, then a person. | |
| Danny Keane Danny Keane's profile as read-only tools: background, work history, contact, and site pages. | |
| Danu Astrology Real natal charts for you and your people: compare charts, map your Circle, see your week. | |
| com.dapdip/youtube-growth Audits any YouTube channel against its own history. Every claim carries its sample size. | |
| Dapper Latin American regulatory intelligence: bills, regulations, votes and political actors. | |
| Dardaris Your rental portfolio from any assistant: leases, rent, buildings, tenants and documents. | |
| Dart AI-native project management for tasks, docs, collaboration, and agents. | |
| DartzDabz AI agent tool directory Read-only search of 2,189 AI agent tools (MCP servers, x402 APIs) with daily automated trust scores. | |
| DashThis Work with your marketing reporting dashboards and turn the numbers into client-ready updates. | |
| Data APIs SEC Event Intelligence API Data APIs SEC Event Intelligence API for SEC API/EDGAR filings, OpenAPI, MCP, A2A at data-apis.com. | |
| Data SL Consulting Offres, prix publics et contenus de Data SL Consulting, conseil data et IA à Paris. | |
| Data and APIs Search, read and call 125+ data APIs: sanctions, barcodes, IP intelligence, companies, holidays | |
| com.dataart/case-studies Search DataArt case studies by technology, industry, service, or keyword. | |
| Dataceen Describe a business and get a running system: data model, API, MCP server, SDKs and a hosted app. | |
| Dataconto: who buys company records and code Who pays owners for company records, code and datasets, closed companies included. Sourced terms. | |
| DataCrate360 Guides & Fixes Search verified fixes and guides for data tools (Snowflake, dbt, Airflow, Spark…). Paste an error. | |
| Dataddo Data to AI Connect LLMs to business data. Serve data from CRMs, databases, ERPs or SaaS apps via Dataddo MCP. |
30,801–30,850 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.