Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Generate Random IBAN Generate valid test IBANs for 91 countries and validate any IBAN. Public, no API key. | |
| Genexxis paid agent tools (x402) 90 x402 tools: deal-doc red flags, token verdicts, sanctions, SEC data, safe-pay checks, DeFi | |
| GenMB List, read, edit, and deploy your GenMB AI-generated apps from any MCP client. | |
| Gennons Design emails from a brief, send tests, send to your lists now or scheduled, and read delivery. | |
| Genoplot Ancestry on G25 and raw DNA: nMonte fits, PCAs, GEDmatch-style and G25 calculators, qpAdm models. | |
| Business Verify API Verify a US business exists and is active by name + state. Status, formation date, agent. | |
| Geo-Parity Cost of living, fair global pay, healthcare costs, nomad visas and tax residency. Free, no key. | |
| GeoArm Taxi — Tbilisi ⇄ Yerevan rides Book shared or private rides between Tbilisi and Yerevan: live prices, schedule, booking requests. | |
| Geode Use the Geode blockchain's apps: marketplace, social, surveys, messaging, DNS and GEODE transfers. | |
| Georgia Insurance Georgia's published auto insurance averages. Not a quote; we are not licensed here yet. | |
| Georgiaautoquotes Indicative US auto insurance prices for agents: rating facts only, no PII, consented path to agents. | |
| com.georgiaroofreplacementcost/site Georgia Roof Replacement Cost: the site's own MCP server — enquiry (enquiry = a human handoff,... | |
| Geospatial System — Location Profile Elevation, slope, terrain maps & 3-D surfaces for any site — near-global 30 m, US 10 m, AU/NZ 5 m. | |
| Geppetto Robot Directory Robot directory for AI agents: 830+ robots, 290+ brands, 1,000+ datasets, 260+ professions scored. | |
| GERDA German Election Data Read-only German federal election results for municipalities, with harmonized geography. | |
| Germandex Student Guides Read-only student guides to Germany: ten cities, housing, banking, jobs and everyday life. | |
| Flowie App Use the Flowie app from any AI client: purchase requests, approvals, tasks, budgets, flows. | |
| Flowie Developer Docs Search and read the Flowie Exchange API docs and OpenAPI contract. No sign-in needed. | |
| Flowie Exchange API Every Flowie Exchange API operation as a tool: send, receive and validate e-invoices. | |
| Flowie Answers about Flowie: platform, ERP integrations, e-invoicing compliance, pricing. Public. | |
| InstaMaps Geocode lists, measure, route drivers, check flood and crime risk, and map it, from spreadsheets. | |
| 3RD Your brand's visibility in AI answers: trends, competitor ranking, cited sources and next tasks. | |
| com.get409avaluation/site Get 409A Valuation: the site's own MCP server — checker, enquiry (enquiry = a human handoff, not... | |
| com.get4agent/marketplace Free KZ agent utilities (Kazpost tracking, IIN/BIN, IBAN, LEI, FX) + governed API marketplace. | |
| getAbstract Verified summaries of business books, articles and reports for workplace learning and AI upskilling | |
| AcqPath — content rights before RAG, AI and training Check content rights before RAG, AI input, training or indexing. Signed RSL evidence, not a license. | |
| Adónde Plan trips and find hotels, tours and flights; build day-by-day itineraries. Account required. | |
| Agent Provider Depot No-key MCP: pick the LLM, sandbox, search, email or DB provider; sourced prices; API error rescue. | |
| AICQ Messaging network for AI agents: talk to other people's agents over MCP. Free forever. | |
| Airefs Read-only AI search visibility, prompts, citations, competitors, and opportunities from Airefs. | |
| Appty Find open slots on any appty link and book solo providers. Providers manage bookings by API key. | |
| Arbo Site structure for client redesigns. Page tree with URL, keyword, status and redirect plan export. | |
| Get Around Hong Kong Hong Kong public transport trips (MTR, bus, minibus, ferry), live times, fares and border queues. | |
| com.getaxionlabs/axion-gateway Verified answers with named sources: UK parking appeals, NYC dismissal rates, UK MTD tax facts. | |
| BioFlow Manage BioFlow link-in-bio pages, blocks, leads, and analytics from AI agents. | |
| com.getboothiq/mcp Query your trade show leads, meetings, and events from BoothIQ | |
| Booyah Index AI-readable directory + commerce layer: 3,500+ SEA businesses, plus products from verified stores. | |
| 1845 Smoked Meat AI Gateway MCP gateway for 1845meat.com: products, prices, stock and cart links. Read-only, no auth. | |
| Huffines for Comptroller AI Gateway MCP gateway for donhuffines.com: articles, search and full text. Read-only, no auth. | |
| Eagles and Angels Limited AI Gateway MCP gateway for eaglesandangelsltd.com: products, prices, stock, cart links and articles. | |
| BotLens AI Gateway MCP gateway for getbotlens.com: articles, search and full text. Read-only, no auth. | |
| Mano DeAyala AI Gateway MCP gateway for manoforstaterep.com: articles, search and full text. Read-only, no auth. | |
| Raconteur AI Gateway MCP gateway for raconteur.com: articles, search and full text. Read-only, no auth. | |
| The Texas Voice AI Gateway MCP gateway for thetexasvoice.com: articles, search and full text. Read-only, no auth. | |
| BotOrNot Is a trading bot legit? Sourced bot fact sheets, regulator scam records and on-chain results. | |
| Boxkite — Xero Backup & Export Complete read-only backup and export of Xero accounting data as a ZIP plus a manifest. | |
| Caboo Find local services, read availability, and create short-lived booking holds. | |
| com.getcims/mcp Manage 230M+ influencers, track campaigns, and access real-time CIMS analytics via AI agents | |
| Clerion Your website analytics as read-only tools: traffic, pages, errors, speed and AI-assistant visits. | |
| Contextloop Team metric definitions for data agents. Learns from corrections, tracks SQL answer accuracy. |
31,701–31,750 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.