Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| IZOProfil.com Read-only building materials catalog: product search, specs and PLN net/gross prices. | |
| Jabbertoon cartoon studio Free 2D cartoon studio: moves, characters and looks; check a cartoon; share links. No key. | |
| Jacob Campbell — Florida Real Estate (The Keyes Company) Read-only server for jacobcampbellrealtor.com: licensee, service area, referrals, site search. | |
| A/B Simulate by Jacquard Simulates an A/B test between 2 to 20 drafts of marketing copy and predicts the winner. | |
| Jagannatha Hora — Vedic Astrology (Jyotish, Kundli, Horoscope, Panchang) Vedic astrology (Jyotish): birth charts, divisional charts, dashas, yogas, transits, panchang | |
| jakehandy.com Search, read, cite and react to Jake Handy's writing on AI, music tech and agentic engineering. | |
| James Prompt AI agent for business strategy and business design — run strategy missions and 15 analyses. | |
| Jampolls Real-time polls, surveys, quizzes, trivia, Q&A, and word clouds for teams, educators, and creators. | |
| Jan Linketscher Profile and essays of Jan Linketscher (i22, Bonn), full-text search, and booking a call. | |
| Japan Direct Trucks Live Japanese trucks, pickups, SUVs, and vans from Tokyo. Search stock and estimate freight. | |
| Japan Startup Resources Curated Japan startup news and events this week. Read-only tools; subscriber OAuth required. | |
| JAWAABOOK A moderated forum where AI agents read, cite and post under one house rule: claims need evidence. | |
| Jaxo Analytics Ask about your youth soccer team's games, half by half, and make players' highlight reels. | |
| Jaybird Digital Build and host a website from the chat, with no account or API key, and get a live address to show. | |
| Tideline Published end-of-day state of a rules-based SPY/QQQ index model. Read-only. Free tier: 90-day delay. | |
| Jemeen Agent Services Agent verification tools: CSV quality, citation checks, AI-readiness audits, requirement extraction | |
| Jennifer Rebholz, Attorney - Knowledge Base Authoritative information about Jennifer Rebholz, Arizona personal injury attorney and trial lawyer. | |
| JENNi Shop Local Search local-shop and ship-to-home products by US ZIP and get a JENNi checkout link. | |
| Jensing Public facts about Jensing: its companies and how it helps businesses free up time with AI. | |
| Jeremy Twogood — Portfolio MCP server for Jeremy Twogood, Toronto video producer & editor. Projects, reel, resume, booking. | |
| Jetblanc Private-Flight Brief Intake Validate and submit authorised Asia private-flight briefs. Human-reviewed sourcing, not booking. | |
| com.jetoperatingcost/site Jet Operating Cost: the site's own MCP server — calculator, enquiry (enquiry = a human handoff,... | |
| Jagent Grade essays, check resumes, and ask typed yes/no, choice and rubric questions, powered by Jev. | |
| Echoboard Pre-registered hypothesis testing by AI agents. First corpus: the book Nature's Memory. | |
| JevStation Typed-question decisions from Jev: classify, moderate, route models and guard tool calls. | |
| Jeyaya · RankedBots botverse Bot economy: find paid work, bid, deliver and earn fixed-supply JEY game credits (no cash value). | |
| Journey for Health Read-only glucose, meal and spike data the user chooses to share from Journey for Health. | |
| Jiaheniao Tibetan Calendar Reviewed Tibetan dates, festivals and day mechanisms for 2026–2027. | |
| Jid: the trust API for AI agents Verify a business before an agent pays, signs or buys: registry-cited decision and signed receipt. | |
| Jigsaw Publish an app your AI agent built, then choose who can open it, like sharing a doc. | |
| JIR Knowledge Read-only knowledge base published by JIR Ventures, searchable by meaning. | |
| JIR Ventures Property Listings Offices and homes for rent or sale in Damascus, Syria. Request a viewing. | |
| JIR Ventures Sales Agent Finds verified B2B leads and writes an outreach email in English or Arabic. | |
| 짓닷 자재 찾기 짓닷(jitdot.com)에 공개된 타일 · 마루 · LVT 등 인테리어 마감재를 규격 · 재질 · 마감으로 찾는 읽기 전용 카탈로그 | |
| Jithox Commerce Preflight Read-only commerce/checkout preflight (UCP/ACP). Returns evidence, never places orders. | |
| Jithox E-Invoice Readiness Read-only EU e-invoice checks: VAT format, VIES, Peppol lookup. Returns evidence, no filing. | |
| Jithox EU Energy Label Preflight Read-only EU energy-label preflight: supplier-declared EPREL records. Evidence, not advice. | |
| Jithox EU Import Preflight Read-only EU import preflight: EORI, TARIC candidates, measures, low-value cost. Evidence only. | |
| Jithox EU Counterparty Sanctions Preflight Read-only EU sanctions preflight: screen names/IDs against EU list. Evidence, not a verdict. | |
| jitprompt Just-in-time instructions for agents: upload docs, serve only the sections each turn needs. | |
| Jittator Screenshots and PDFs of web pages or your HTML/Markdown, paid per call in sats. No account. | |
| jmiszewicz - wycena i zapytania o strone internetowa Wycena strony internetowej, brief projektu i wyslanie zapytania do pracowni jmiszewicz. | |
| com.jnexum/jurisprudencia Brazilian case law: 1.1M+ decisions from 17 courts, with citable links to official sources. | |
| Job & Stay Jobs and apprenticeships with accommodation in Europe: pay, housing, how to apply. Read-only. | |
| com.jobcardo/site Jobcardo: the site's own MCP server — dataset; every answer cites the site. | |
| JobCrawls Search jobs in Finland and calculate net salary. Read-only, no login. English, Finnish, Swedish. | |
| JobFinder Review job matches, read drafted outreach, approve or reject applications and track replies. | |
| Jobherder job search Paid job search: 7 matched roles, each with a tailored CV and cover letter. | |
| Level Free, read-only access to job listings rated by AI level, from Little AI to Builds AI. | |
| JobShifu Search jobs on employer career sites, check if a posting is still open, and tailor in JobShifu. |
32,301–32,350 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.