Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Fantasy Solvers – Balatro Lab Supported Balatro scoring and exact small-deck play/discard analysis with verified explanations. | |
| FareDice Cheap multi-country trips and non-stop fares in Europe and SE Asia; trip calls past 20 a day US$0.01 | |
| FareEagle Travel Flights, hotels, buses and holiday packages in India at live fares, plus visa help; pay on fareeagle | |
| فريقي Arabic-first project management: projects, task lists, tasks, majlis topics, files and events. | |
| FarmNeural Public API Public, read-only MCP server for FarmNeural company facts, packages, and capabilities. | |
| Fast Surveys Create, edit and publish surveys, then read results from your AI chat. | |
| FastCAC account Register a Nigerian business with CAC from your FastCAC account. Sign in with OAuth. | |
| FastCAC Register a Nigerian business with CAC: name checks, fees, register search, TIN. Sign in when needed. | |
| Fate & Stars Tarot Knowledge 78 tarot card meanings, ranked topic search and nine spreads, with source links. | |
| Fat Heron Developer Platform MCP control plane for AI developers managing customer mail, DNS, projects, keys, and diagnostics. | |
| favowe search, read and organize your favowe bookmarks: boards, links, tags, notes and documents | |
| Faxify Send, receive and track real faxes in the US and Canada from Claude, ChatGPT or Cursor. | |
| Faxivo News News written and read by AI agents. Every article carries a verification status. | |
| com.faxlineindex/site Fax Line Index: the site's own MCP server — dataset, enquiry (enquiry = a human handoff, not a... | |
| com.fbaforwarders/site FBA Forwarders: the site's own MCP server — compare, enquiry (enquiry = a human handoff, not a... | |
| FBA Prep Finder Search verified Amazon FBA prep centers in the US, UK, Germany and Canada. Read-only, no auth. | |
| FeatQ Feature-request board for software teams: users vote, your coding agent pulls top requests over MCP | |
| FeatureJet The feedback board your AI agents work from: users vote, agents build over MCP. 22 tools. | |
| Fed-Spend Federal contract intelligence: $7T+ awards, SAM.gov opps, pWin verdicts, recompetes, protests. | |
| Federal Court Deadlines Federal civil deadlines (FRCP, FRAP 4, removal, listed district local rules), with the rule quoted. | |
| Fedor Chishchin — AI agents & MCP servers Read-only facts about AI engineer Fedor Chishchin: services, case studies, posts, courses, contact. | |
| FeedbackPulse Employee surveys, performance reviews, recognition, and team pulse for AI assistants. | |
| FeedbackThread Triage app feedback and store reviews, draft replies and release notes, tell reporters what shipped. | |
| Hipppo Search, organize, generate design guidance from, and reconstruct what you save in Hipppo. | |
| FeedHive Create, schedule and analyze social media posts across your connected accounts with FeedHive. | |
| com.feedsquad/feedsquad Schedule and publish to LinkedIn, X, and Threads from your AI. Content calendar, approval-first. | |
| FeedToMind Your YouTube library in Claude, ChatGPT and Cursor: transcripts, breakdowns, summaries, search. | |
| GEO-bot Free check whether a website is technically open to AI assistants (AI crawlers, llms.txt, JSON-LD). | |
| Test server Test server | |
| Second server! A non functional MCP server (yet) | |
| Fengshui Calculator Verifiable Chinese calendar & feng shui: BaZi, flying stars, Kua, almanac. SHA-256 replayable. | |
| Fensory Trading MCP server for AI agents, with live market data, account reads and controlled execution. | |
| Feranor Resilience Scan/purge hidden text & score web domains: TLS, DNS, headers, speed. Free scans, $0.01 actions. | |
| FernTool Network Tools 24 free tools: IP/VPN lookup, WHOIS, DNS, SPF/DMARC, site up/down, redirects, time zones. No key. | |
| Finished Listing: stage an empty room Virtual staging of one empty room from a public listing photo, labelled, original returned. | |
| FerryFlight Ferry-flight price estimates + aircraft, airport, FAA-registry, route & live-flight data. | |
| FET112 Security intelligence for AI agents monitoring Ethereum before actions. | |
| FetchDelta Web Markdown, diffs, pricing and daily watches. Paid x402 Base USDC tools; free previews. | |
| FetchPan Direct download URLs from Baidu, Quark, PikPak, Rapidgator and more. First files free, no sign-up. | |
| FetchRelay Extract public webpages as Markdown, map sites, and run bounded crawl jobs. API key required. | |
| FFmpeg API Run FFmpeg and FFprobe in the cloud: convert, compress, trim and analyze video and audio. | |
| Fibre Compare Check which fibre and broadband deals are available at a UK postcode or address (fibrecompare.com). | |
| Fidelip Set up and run a business's Fidelip loyalty cards, rewards, surveys and customer sign-up page. | |
| FIDE Snap Beta. Search screenshots and links you saved in FIDE Snap: products, places, to-dos, articles. | |
| FieldDraft Draft contractor quotes priced only from your own price book; find, edit and push them to Jobber. | |
| Fielder Find soccer fields for hourly rent in the US, check live availability and get booking links. | |
| FieldRobin Authenticated FieldRobin workspace tools, including scope-authorized customer and job creation. | |
| Field Station 13 A forum where AI agents post and humans only watch. Read the feed, sign, vote, write. | |
| Fieldstub Capture extra work on a jobsite and file it into Procore as a Change Event on real budget codes. | |
| FieldTranscript Verbatim transcription of public video/audio URLs to clean text, SRT, and timestamped records. |
31,401–31,450 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.