Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| JYOTINT Sealed Forecasts Bitcoin-anchored sealed-forecast record: search, grades, calibration, luck test. Read-only, no key. | |
| K-Φ Query financial statements, KPIs, ratios, cash forecasts and budgets from your general ledger | |
| K2 Study Decks & Algorithm Study decks for 8 languages plus the K2 spaced-repetition engine, runnable on your items. | |
| Kaalshodh — Indian astronomy time machine Observatory-grade Indian astronomy, years -5000..+5000: positions, eclipses, panchang date search. | |
| Kahve Tabela — Türkiye heritage, food & coast Read-only MCP tools for Turkey's heritage places, regional-food atlas, and Mavi Koy coastal atlas. | |
| Kai AGI - Autonomous AI Agent AI predictions, model comparison, research and web search from an autonomous AI running 24/7. | |
| KaiCast Ocean Conditions Ocean conditions by location: water visibility, swell, wind, tide, plus dive and snorkel spot picks. | |
| Kairo Calorie tracker app for ChatGPT and Claude: read meals, macros, weight and log meals from chat. | |
| Kairos Find a time for a group meeting: a week people mark their free hours on, one link to send. | |
| Kajabi Manage Kajabi from any MCP client — products, pages, contacts, offers, emails, analytics. | |
| KaleMap dietary menu finder Find restaurants and sourced dietary dish evidence. Free discovery; metered menus need an API key. | |
| Kalshi MCP Hosted MCP for Kalshi prediction markets: search, odds, order books, settlement rules, and trading. | |
| KalshiSpy What Kalshi's top-earning traders won and hold: settled wins free, live markets with an API key. | |
| KanbanMCP Hosted kanban board where AI agents claim cards, check in, and hand off with notes. | |
| Kaneme — Your writing identity, measured and portable Build a voice from your own texts, measure whether a text still sounds like you, then write in it. | |
| KANONYR publication checks Before/after page checks: EUR 2 or USD 2. Free inspection, eligible repairs and audits. | |
| Kanorio Create, edit, publish and connect custom domains for small-business websites on Kanorio. | |
| Karatry Look up records in a Karatry jewelry ERP workspace and file proposals for an admin to approve. | |
| Kariaa Find jobs worldwide, check posts for scams, see typical pay, and apply to DataHouse remote tasks. | |
| com.karusele/mcp Search Karusele stainless steel products and get product details via AI agents. | |
| com.kasahorow/kasahorow Bilingual dictionary lookup and translation validation for kasahorow Fellows. | |
| Kashif Scores a website's online presence 0-100 and lists the top issues to fix. English/Arabic. | |
| com.kasprdata/data-mcp Internet quality by district since 2019, and scores for your own locations: grades and disruptions. | |
| com.kasprdata/predict-mcp Ranks the hours before a deadline for batch jobs and transfers by expected network roughness. | |
| com.kasprdata/timing-mcp Is there a materially better time for this call, stream or upload, given where everyone is? | |
| Kasset Search and read your Kasset meetings and conversations: notes, transcripts and action items. | |
| Katana — Japan Stock Screener Screen every listed company in Japan by financials, custom formulas, and annual report text. | |
| Kaupia Where AI agents buy things for people: real US stores, delivered price and date, one order. | |
| Kawaa email verification Check whether an email address can receive mail, one address or a list, without sending to it. | |
| 卡有谱流量卡查询 Search and compare mobile data plans for mainland China, with terms, sources, and source dates. | |
| com.kbasevo/site Kbasevo: the site's own MCP server — dataset; every answer cites the site. | |
| KBD Machine Your KBD business, connected to your AI: reads, drafts, approvals — nothing sends without your yes. | |
| KBeauty Verified™ — K-beauty ingredient rules K-beauty ingredient rules for Korea, the EU, the U.S. and 7 more markets, plus recalls. | |
| KC Plumb — book plumber in Kansas City Book plumber in Kansas City, MO: prices, service area by ZIP, free callback from a local pro. | |
| KC Volts — book electrician in Kansas City Book electrician in Kansas City, MO: prices, service area by ZIP, free callback from a local pro. | |
| KC Windshield — book windshield replacement in Kansas City Book windshield replacement in Kansas City, MO: prices, ZIP coverage, free callback. | |
| KDP Coloring Book Studio Create coordinated, print-ready coloring book interiors with quotes and explicit confirmation. | |
| Keel Stats NBA and NFL stats: profiles, head-to-head, schedules, ratings, EPA, injuries, projections. | |
| KeelTools AI Directory Search KeelTools AI tools, Skills and prompts: taglines, pricing model, features and FAQ. | |
| KeenIELTS Free IELTS prep: band-scored student essays and interactive Listening/Reading drills graded in-chat. | |
| KeepBal Search, inspect and run agent tools with one key and one prepaid wallet. | |
| KEILTY Realty Management Eastern Ontario rental property management: check fit, read fees, request a rental evaluation. | |
| Olia Practice management for French law firms: matters, time entries and invoices from your AI agent. | |
| com.kenoodl/verify Runs your code against a contract; HELD or BROKE at the exact input. Deterministic. 0.10 USDC/call. | |
| com.keptbits/keptbits Turns long videos into captioned vertical clips, cut at the moments that stand on their own. | |
| Kestrel Voice AI receptionist: calls, leads, credits, usage, workflows and guided setup via OAuth | |
| Public Agent Lounge Open chat room for bots: messages, private DMs, directory, task board, E2E keys, WebRTC signals. | |
| Agent Lounge Tools Agent Lounge helper: key checks, batch lookup, signing helpers, DMs; x402 paid tool on Base mainnet. | |
| KEVWire Exploited vulnerabilities, critical CVEs, breaches and AI security incidents, with primary sources. | |
| com.keysvo/site Keysvo: the site's own MCP server — dataset; every answer cites the site. |
32,451–32,500 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.