Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Dominick Prevete: Instant Fix-and-Flip Term Sheet Written fix-and-flip term sheets for 1–4 unit investment purchases, by email. Business-purpose only. | |
| Dominick Prevete: Instant Term Sheet Written term sheets for 1–4 unit DSCR investment property loans, by email. Business-purpose only. | |
| Dom Kozak: pDOOH and Built for MENA Search Dom Kozak's Built for MENA podcast and pDOOH 101/201 lessons, with quotes and source links. | |
| Done Bear Local-first task manager: create, edit, and complete tasks, projects, and checklists via MCP. | |
| Go-Live Check Checks HTTP response headers you paste: 7 security checks with copy-paste fixes. No fetching. | |
| DontMynd Calm weekly planner. Let Claude read and manage your This Week, Next Week and Backlog tasks. | |
| DooDates Create a group date poll in one sentence; participants vote with no account. | |
| DoodleSale Search, bid on and lease domain names from DoodleSale. Bids and offers need user confirmation. | |
| Doorfarer Door-to-door trips: every airport within reach of your home, with the train or bus there. | |
| DoorProfit Crime & Neighborhood Data US crime scores, incidents, neighborhood demographics, rent data, and offender search by address. | |
| com.doorsetbook/site DoorsetBook: the site's own MCP server — dataset; every answer cites the site. | |
| Doors Funded: 1-4 unit investor lender terms Published terms of 13 investor lenders for 1-4 unit rentals, flips and builds, with a deal match. | |
| Doseedo: Film Scoring, AI Instruments, Sound Effects & Stems Score video & make music as an agent: 50+ AI instruments play your MIDI, audio, stems, Logic/Ableton | |
| Doseedo Film Score: spot a video, play your score on AI instruments, mix it to picture Score video as an agent: cue sheet from the cut, 50+ AI instruments play your MIDI, mixed to picture | |
| DosePlot Agent API PK serum simulation, reconstitution math and compound data for agents. Paid tools $0.01 via x402. | |
| .prompts .prompts, the home to all your AI prompts, everywhere you need them. | |
| dotsweep Domain availability across 1,200+ TLDs, with renewal price, minimum term and eligibility | |
| Doppelreim Rhymes Multisyllabic, vowel and classic rhymes plus rhyming lines in 56 languages for lyrics and poems. | |
| DoubleVoix Interpret or dub spoken video (sermons, talks, interviews) into another language on your account. | |
| Doucebeads · Image to Bead Pattern Convert PNG/JPEG into fuse-bead charts with MARD codes, PNG, CSV and an editable web link. | |
| Aster National Insurance Group Licensed CA agency: GL, workers' comp, auto, bonds. Check appetite or send a quote request. | |
| CalRisk Insurance Center Licensed CA agency: GL, workers' comp, auto, bonds. Check appetite or send a quote request. | |
| DouxProcess: find a licensed insurance agency Find a licensed US insurance agency by state and line, then send it a quote request. | |
| Dovemails Email inboxes for AI agents: send, wait for mail, reply in thread, forward and label. | |
| Doviandi Cyprus corporate and tax Reviewed Cyprus corporate and tax facts, statutory tests, and company register search. | |
| Is This Site Down? Check if any website is down, from two continents, with uptime history and TLS expiry | |
| com.dpf-it/mcp-server AI-powered data integration platform. Onboard users and run DPF data workflows. | |
| Dplooy Publish a complete website to a live URL from your AI assistant: forms, bookings, content, chatbot | |
| Draftboard Warm intros to any target via your own network: who can introduce you, and how strong the path is. | |
| DraftKings API Observed DraftKings sportsbook lines, Pick6 rows, DFS salaries and box scores. Independent service. | |
| DrapeCut Simulate composite fabric draping on CAD surfaces; compare fibre angles and export DXF/PDF patterns. | |
| com.drawscheduleworks/site DrawScheduleWorks: the site's own MCP server — dataset; every answer cites the site. | |
| Fair Random Fair, reproducible randomness for agents: dice, coins, integers, list picks, shuffles, with seeds. | |
| Lottery Numbers Lottery picks in any format, past draws, ticket check, and a link for numbers drawn from a sentence. | |
| Dream On Concierge Luxury crewed catamaran charter in the BVI: availability, published-rate quotes and hold requests. | |
| Dreamz Studios A film studio inside your own Claude, better every day. Films, voices and music on your own keys. | |
| Apex by DRIP: A/B testing for online shops A/B testing for online shops. Read results, build and preview test variations from chat. | |
| Dripost Schedule, check and retry social posts from Claude or ChatGPT; going live waits for a tap. | |
| DripRaven WhatsApp campaigns Run WhatsApp Business campaigns from any AI assistant: contacts, segments, and broadcasts. | |
| Drivings Published driving guides, source-backed UK and US test-centre search, and study-plan previews. | |
| DrMaker3D: custom 3D printing, figures, cookie cutters and gifts 3D printing studio in Connecticut: instant prices and checkout links for model files, and quotes. | |
| Drobber Read, reply to and resolve client feedback pinned on websites, PDFs, images and video. | |
| DroneClear Thailand Thailand drone rules for hobby pilots: CAAT/NBTC registration, insurance, flight limits. Sourced. | |
| DroneLedger Source-backed drone incident dossiers worldwide: search incidents, evidence states, sources, trends. | |
| Agent Receipts Issue & verify signed (ed25519), hash-chained, timestamped provenance receipts for agent actions. | |
| AI API Radar Live LLM API price + status radar across 11 providers, with public per-model price HISTORY. | |
| com.dropwatchhq/bio-catalyst Verified biotech catalyst calendar (PDUFA/AdComm/trial readouts) anchored to official sources. | |
| com.dropwatchhq/cassandra-predict Cassandra prediction hub: one MCP door over govcon forecasts (recompete, contractor signals). | |
| com.dropwatchhq/compliance-evidence Dated, signed compliance-evidence packs: gov-fact-grounded claims + exclusion screens + trap-facts. | |
| com.dropwatchhq/compliance-radar US small-biz & foreign-LLC filing deadlines: FinCEN BOI, IRS 5472, franchise tax, 1099 (sourced). |
31,001–31,050 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.