Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| FuelTaxMath Official IFTA fuel tax rates plus IFTA, cost per mile, load profit and Form 2290 HVUT calculators. | |
| Fulfiller — print catalogue & quotes Print catalogue and live quotes from Fulfiller, a French online printer shipping across the EU. | |
| Fulveo Let your coding agent read and write your product boards, plans and tasks in Fulveo. | |
| com.funding-radar/radar Live crypto funding rates on 5 exchanges: events, pair search, briefings, calendar, spreads, alerts. | |
| com.funnelvo/site Funnelvo: the site's own MCP server — dataset; every answer cites the site. | |
| Furriq Cat Breed Identifier Identify cat breeds from descriptions or photos with furriq.com's 61-breed database. | |
| Furrsati Search Furrsati's Lebanese freelancers by skill, rate and rating, in English, Arabic or French. | |
| FUSE Health Commerce platform for health and wellness brands: offerings, pricing, promos, storefront and sales. | |
| Future AGI Build, test, monitor & improve AI with Future AGI via Claude, Cursor, Windsurf & more. | |
| China Futures Clock China futures trading days, session hours, contract expiries and exchange rule changes. | |
| Futurmatch Agent French market intelligence: companies to approach at the right time, with dated, sourced facts. | |
| fxapis — MetaTrader 5 Let AI agents trade and read MetaTrader 5 accounts. Hosted — no terminal for you to run. | |
| FxLayer Indian FEMA compliance: RBI purpose codes, EDPMS / IDPMS, Form 145 / 146 and export deadlines | |
| FXNewsBias Forex sentiment scores and session bias calls, with gold, silver, oil, crypto and US index reads | |
| GovCon MCP by G2X Federal opportunities, awards, agencies and companies from G2X, in any AI agent. | |
| Gaitkit Low-poly 3D assets as code for three.js, Godot, Unity: IK walkers, rolling vehicles, hinged doors. | |
| Galley Render JSON in, PDF out. Render invoices, certificates, reports and cards from a template and a payload. | |
| GameAnalytics Documentation Search GameAnalytics docs: Unity, Unreal, iOS, Android SDK and API guides for mobile game analytics. | |
| GamersPilot — Steam library tools Steam backlog, account value, buy-or-skip verdicts and Steam Machine checks. Hosted, keyless. | |
| GameServerApp Manage game servers, configurations, players, and groups through the GameServerApp MCP server. | |
| Gameshop Enter — retro Nintendo & Pokémon TCG (EU) Live catalog of tested retro Nintendo games and Pokémon TCG, with all-in delivered EU prices. | |
| Gangwaze Cruise Tools Search cruises, check fares and price history, look up cabins, ships, lines and ports. | |
| gankdat UK company lookup & monitor, UK/EU tenders, awards, planning, charities, schools, NHS, trade marks. | |
| GapCite Track AI mentions and recommendations of your business, and find what to fix with GapCite. | |
| Gaplessly Booking Find free times at Gaplessly businesses on a plan with AI booking, then get a link to book. | |
| Garage Sales Search Find garage sales and publish seller-verified listings directly from AI assistants. | |
| Garmin MCP Read-only Garmin data for your AI: sleep, Body Battery, activities, laps, and training status. | |
| GateRoam Amadeus flight search, pricing and client offers for travel agencies, on their own contract. | |
| Gateway Agent Tip Jar Optional creator-support terms and private contribution receipt tools for Gateway. | |
| Gateway Lines Tariff US import duty, HTS classification and tariff changes from the Gateway Lines tariff engine. | |
| GatherHQ Turn a business question into a customer research report from simulated interviews. | |
| Gather Agent Ratings Anonymous agent Q&A and reviews of MCPs, APIs and apps by task, speed, cost and reliability. | |
| Gaurmon Toronto grocery prices for your agent: flyer deals, shelf prices, and the flyer behind each one. | |
| gbtmind agent playground Free social space for AI agents: conversations, shared projects, puzzles and collaborative games. | |
| GC Airport Transfers GC & Brisbane airport + cruise transfers: quotes, availability; pay by emailed link. OAuth. | |
| GCC Brokers GCC Brokers instrument specs, swaps, trading hours, quotes, accounts and economic calendar. | |
| Gulf Coast Wellness & Recovery Spa Website MCP Search and read public Gulf Coast Wellness & Recovery Spa pages with source URLs. | |
| 制造业管理工具箱 · Manufacturing Management Toolkit 制造业管理工具箱：TBP问题解决/品质管理/TPM设备保全/J成本改善/OEE计算/活力组织诊断。一句话出成品报告。 | |
| Grand Livre French bookkeeping for freelancers and small businesses: entries, ledger, trial balance, matching. | |
| REP27 — EU & UK legal representative Check EU/UK GDPR Art. 27 and GPSR Art. 16 obligations, see plans, start a free trial | |
| Geckoboard Metrics Query live metrics and data lists from the business tools connected to your Geckoboard | |
| GeekWala Dependency Scanner Check dependencies for known CVEs with EPSS and CISA KEV context. Read-only; free API token. | |
| Geenuga Find your home and your car with your own AI assistant. Needs a Geenuga account. | |
| GeezerKeeper Referral Exit Routes and Deadlines Read-only senior-care exit routes, duplicate-referral deadlines, and templates; no PII or sending. | |
| Geistra Shared memory for your AI apps: Spaces of records, files and plans you and others can work in. | |
| Foliade Turn PDFs into mobile flipbook catalogues: upload private drafts, customise, publish, get stats. | |
| Genchi Spot projects predicted to miss their deadlines, from an anonymous team confidence vote in Slack. | |
| com.gencove.consumer/mcp Gencove consumer genomics: profile, kit status, ancestry, PRS, raw data. Requires Gencove auth. | |
| General Index Commodity price indices, forward curves and catalog search. Requires a General Index account. | |
| Generate Greetings Create family-friendly greetings in 15 languages for 30 occasions and four styles. |
31,651–31,700 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.