Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Fitralo European directory of freight carriers: find carriers by route, equipment and certificates. | |
| Fit Shapes Your Fit Shapes food log, targets, and weight trend, and logging food and weigh-ins when you ask. | |
| FixedQR Generate static QR codes that never expire, as PNG images or SVG. No account or API key needed. | |
| FixMyContract — contract clause information Explains common contract clause types, with CUAD frequency data. Informational — not legal advice. | |
| Fixty CRM for mobile mechanics and small shops: customers, jobs, estimates, invoices, texts, payments. | |
| Fjordgull Fjordgull omega-3 subscription: product, price and delivery status. No orders or payment. | |
| Flaghand AI agents draft X, LinkedIn, TikTok and YouTube posts over MCP; you approve each with a passkey. | |
| FlareWarden Check if a site or service like Stripe is down, and monitor your sites, cron jobs and status pages. | |
| Flathead Trades Builders, tradespeople and home services in Montana's Flathead Valley, with phones and websites. | |
| com.flatratebook/site FlatRateBook: the site's own MCP server — dataset; every answer cites the site. | |
| Florida Insurance Florida's published auto insurance averages. Not a quote; we are not licensed here yet. | |
| Flautoquotes Indicative US auto insurance prices for agents: rating facts only, no PII, consented path to agents. | |
| com.flevy/flevy Search 10,000+ consulting frameworks, templates, financial models, and management case studies | |
| Flex on the Job MCP server for Flex on the Job: inventory, jobs, customers, invoices, purchasing, sales orders. | |
| Flight MCP Search and compare flight offers through a cache-aware Streamable HTTP MCP server for AI agents. | |
| com.flightdelayhq/site FlightDelayHQ: the site's own MCP server — dataset, enquiry (enquiry = a human handoff, not a... | |
| flingflyers Share an HTML page or PDF as a short public link. No account or API key, expires on its own. | |
| Flipnem Build and study spaced-repetition flashcards with your agent. | |
| Fliprofit reseller fee calculator Exact US seller fees, payout and profit for eBay, Poshmark, Mercari, Etsy, Amazon and 7 more. | |
| Flit Short links, QR codes and click analytics on Flit. Tools: create/list/stats/delete links. | |
| flockfs A real-time, multiplayer filesystem for agents and humans: shared files, live edits, history. | |
| Flock Synthetics Synthetic UX reviews, findings, evidence images, and repair prompts. OAuth required. | |
| Flocon AI Publish SEO pages from Claude or Cursor to your website. Next.js now, more frameworks soon. | |
| Flomailr Design on-brand emails with your AI, preview them in chat, and send through server-side guardrails. | |
| Flomixy Social media scheduling for agencies. AI drafts and schedules posts, a human approves first. | |
| com.floot/floot Build and publish full-stack web and mobile apps on Floot from any MCP client. Building is free. | |
| com.floridahvacreplacementcost/site Florida HVAC Replacement Cost: the site's own MCP server — enquiry (enquiry = a human handoff,... | |
| com.floridaroofreplacementcost/site Florida Roof Replacement Cost: the site's own MCP server — enquiry (enquiry = a human handoff,... | |
| com.floridasolarcostcalculator/site Florida Solar Cost Calculator: the site's own MCP server — calculator, enquiry (enquiry = a... | |
| com.floridawaterdamagecost/site Florida Water Damage Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a... | |
| com.flowaiapi/agent-bus Durable addresses and crash-safe FIFO mailboxes so AI agents message each other, free. | |
| Flowctory Create images, video and audio; reuse assets and build Canvas workflows from your AI assistant. | |
| Flowsery Web analytics for AI agents: realtime visitors, revenue, funnels and AI-detected site issues | |
| Flowwoods — Real-user research recruiting Recruit real AI coding tool users for interviews: pricing and free feasibility inquiries. | |
| com.fluentedi/tools 49 free agent tools: WHOIS, PDF to text, email checks, FX rates, X12 EDI, JSON repair. No API key. | |
| Fluid Recall Agent-native spaced-recall system of record. Deterministic dueAt via remote MCP for Muse/any agent. | |
| FluidTalk Create AI Characters and generate their DM and comment replies from any MCP client. | |
| FluoTest Create, edit and publish scored quizzes and read results from any MCP client. Free plan included. | |
| FlyItalyADSB Live and historical aircraft tracking from an open ADS-B/MLAT network, with a live map in chat | |
| Fly Where To? Worldwide nonstop flight routes from Wikipedia: airports, destinations, connections, airlines. | |
| com.fmlane/site FMlane: the site's own MCP server — dataset; every answer cites the site. | |
| FocalGraph Signal Car dealer GA4 analytics: traffic, ASC event audits, verified households, DMS sales by source. | |
| Foca Upscaler Upscale images from HTTPS URLs with account credits and retrieve async results. | |
| com.focusvo/site Focusvo: the site's own MCP server — dataset; every answer cites the site. | |
| Focxle: AI governance for B2B deals between agents AI governance for B2B agent deals: negotiate, lock agreements, check payments. Plus x402 USDC. | |
| Focxle (retired listing): see com.focxle/b2b-agent-negotiation-governance Retired: Focxle no longer issues cards. Use com.focxle/b2b-agent-negotiation-governance. | |
| Focxle: negotiation rooms and locked agreements for B2B AI agents Negotiate B2B deals agent to agent: every offer recorded, owner rules checked, agreements locked. | |
| Focxle directory: find and hire AI agents, and get hired Find AI agents to do work, hire them, and list yourself so others hire you. Free, no signup. | |
| Fokals Company signals in your assistant: technologies, hiring, buying intent, news and site changes. | |
| Fold Laundry Book, track and manage laundry & dry-cleaning pickup in Los Angeles and San Francisco. |
31,501–31,550 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.