Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Liqwall market data Crypto liquidation maps, liquidations, funding, open interest: 4 tools without a key, 6 with one. | |
| Prelo Drafts eBay listings from your item photos: title, description, price and condition. | |
| Little Milwaukee Sourced facts on locally owned places, records, events and neighborhoods in Milwaukee County. | |
| Littles Weekly Checked things to do with kids 0–6, city by city, plus free event submissions for review | |
| Live Earnings Speaker-attributed earnings call transcripts, live and after the call: who said what, by name. | |
| Live Football API Live football scores, fixtures, standings, lineups and player stats for 1400+ leagues. | |
| Private AI Media Generation Paid AI image/video generation for agents — x402 USDC or API key, no account needed. | |
| liz's doc public knowledge Read-only search and Markdown access to liz's public docs, prompts, resources, and an MCP App. | |
| Llama Logger Exception tracking for .NET. Let your AI coding agent search and triage errors and stack traces. | |
| LLCDrop Search Florida business filings. Needs an LLCDrop key (Starter, Agency or Enterprise plan). | |
| com.llclane/site LLC Lane: the site's own MCP server — dataset; every answer cites the site. | |
| New York LLC Publication NY LLC publication rules, clerk details, notice text and LLC Publishers' price in all 62 counties. | |
| LLM Abacus Compare up-to-date pricing for 40+ LLMs (incl. Chinese) & estimate cost from tokens. EN/zh. | |
| LLM Cutover Checks if a cheaper model agrees with your GPT, Claude or Gemini outputs, and what routing saves. | |
| Fable 5.1 Authenticated async Fable 5.1 agent with status polling and artifact results. | |
| Fable 5 Agent Authenticated async Fable 5 Agent agent with status polling and artifact results. | |
| GPT-5.6-luna Agent Authenticated async GPT-5.6-luna Agent agent with status polling and artifact results. | |
| GPT-5.6-sol Agent Authenticated async GPT-5.6-sol Agent agent with status polling and artifact results. | |
| GPT-6 Astra Authenticated async GPT-6 Astra agent with status polling and artifact results. | |
| GPT-6 Sol Authenticated async GPT-6 Sol agent with status polling and artifact results. | |
| Opus 4.8 Agent Authenticated async Opus 4.8 Agent agent with status polling and artifact results. | |
| Opus 5.5 Authenticated async Opus 5.5 agent with status polling and artifact results. | |
| Sonnet 5 Agent Authenticated async Sonnet 5 Agent agent with status polling and artifact results. | |
| Omnia Exchange Omnia Exchange is the institutional liquidity and execution infrastructure layer powered by LMAX | |
| LinkDrop Share PDFs as trackable links and see who opened them, which pages they read and for how long. | |
| com.lobbyvo/site Lobbyvo: the site's own MCP server — dataset; every answer cites the site. | |
| com.lobbyvoices/receptionist-toolkit Free receptionist tools: phone scripts, IVR menus (EN+ES), ElevenLabs prompts, missed-call math | |
| com.lobstermatch/lobstermatch Tools for finding agents, dialogs, and completed work on LobsterMatch. | |
| Loc8ID Turn a GPS coordinate into a shareable short link and QR code, as your own signed-in account. | |
| Local AI Picks Find open-weight AI models that fit your hardware, with weight sizes, memory and sources. | |
| LocalCan Give AI agents Public URLs (tunnels), captured HTTP traffic, Snapshots, and access control. | |
| Local Gym Finder directory Gyms in all 50 states and DC: search by city, type and hours; book with partner gyms. | |
| LocalHelpNow Licensed local home-repair pros by trade and town, how they are checked, and fair repair prices. | |
| LocalSelections Real local places, events, and movie/TV picks, plus decision-maker games (wheel, dice, bracket). | |
| com.localtonet/mcp Secure tunneling, reverse proxy and remote access for local applications. | |
| Locate Jobs Network Job Search Search live U.S. jobs and unemployment benefits for 13 states, by role or place. No sign-in. | |
| LociHub Your agents' memory: search and read your own nodes, and capture chats for you to review. | |
| Lockally Email Stateful email for AI agents — read inboxes, reply in-thread, draft with approval. | |
| LockTrip Hotels Search hotels worldwide, compare rooms, prices and cancellation terms, then get a link to book. | |
| Reach (Google Business Profile) Hosted Google Business Profile MCP server: reviews, posts, profile edits, Maps rank. OAuth sign-in. | |
| Lodi Kids Activities Free directory of youth programs and licensed daycares in Lodi, CA. 72 tools. | |
| com.logiccommons/calculators Find and run trustworthy calculators with clear methods, provenance, and sources. | |
| Loglune Reproduce, inspect, diff and bisect feature-flag rulesets; author and publish flag changes. | |
| Logospell AI-agent image generation: image sets, character sets & illustration sets. Edit, extend, export. | |
| lokalapi – Indonesian reference data Official Indonesian region codes and KBLI 2025 business codes, pay-per-call via x402 (USDC on Base). | |
| Loker Dollar Jobs Free remote-jobs search for AI agents: worldwide remote roles, USD pay, apply links. | |
| Lokuli: book local pros and get prices Book local businesses on Lokuli, or get prices from local pros anywhere in the US. | |
| London Tourist Map London sights, hidden gems, checked opening hours, ticket prices, step-free Tube and a day planner. | |
| com.longserviceleavecalc/site Long Service Leave Calculator: the site's own MCP server — calculator, enquiry (enquiry = a... | |
| com.longtailo/site Longtailo: the site's own MCP server — dataset; every answer cites the site. |
32,701–32,750 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.