Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Mailiy Form backend: manage websites, forms, submissions, files and webhooks from your AI assistant. | |
| com.mailmergepdf/site Mail Merge PDF: the site's own MCP server — checker, enquiry (enquiry = a human handoff, not a... | |
| com.mailopoly/mailopoly Your unified inbox — everything that reaches you, understood and actionable from your AI assistant. | |
| Mail Security Tools DMARC/SPF/DKIM/MX checks, email score, 100-domain bulk score, webhook watch alerts (x402 USDC). | |
| com.mailtempo/mailtempo MCP server for MailTempo's public free temporary email inboxes. | |
| MailVakt Use when email lands in spam: audits SPF, DKIM, DMARC, MX and returns the DNS records to fix it. | |
| MajlisDesk: WhatsApp shared inbox Read and answer your team's WhatsApp and email inbox from Claude or ChatGPT. OAuth sign-in. | |
| MakeItSay Change the words in a screenshot or photo and keep the original font and layout. | |
| Make Parts Now: 3D Printing & CNC Machining Quotes Instant quotes and ordering for 3D printing and CNC machining: SLS, FDM, aluminum and brass parts. | |
| Makernice Generate AI videos and images with Seedance, Kling, Wan, MiniMax, Seedream and Qwen in chat. | |
| MakerReels Turn an app into TikTok-style video ads: agents pull rendered ad batches, captions, posting kits. | |
| com.makespdf/makespdf Compliant PDFs (PDF/A-2A + PDF/UA-1) from markdown or a compact DSL - fast, no headless browser. | |
| YouCam for Beauty & Personal Care Provides YouCam API for skin, face & body analysis, beauty/makeup try-on, and hair & beard styling. | |
| YouCam for Creators Provides YouCam API for AI image and video editing and generation. | |
| YouCam for Fashion & Retail Provides YouCam API for virtual try-on of clothing, jewelry, and watches. | |
| Scrub MCP Stateless PII redaction over MCP/REST. Free ≤1000 words or $0.01/call; file upload supported. | |
| com.maltacompanycost/site Malta Company Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a... | |
| com.maltacryptolicence/site Malta Crypto Licence: the site's own MCP server — enquiry (enquiry = a human handoff, not a... | |
| Malta MPRP Guide Verified Malta Permanent Residence Programme data: fees, requirements, process, statistics, homes. | |
| com.maltapayrollcalculator/site Malta Payroll Calculator: the site's own MCP server — calculator, enquiry (enquiry = a human... | |
| com.maltapropertytax/site Malta Property Tax: the site's own MCP server — enquiry (enquiry = a human handoff, not a... | |
| com.maltaresidencycost/site Malta Residency Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a... | |
| com.maltastampduty/site Malta Stamp Duty: the site's own MCP server — calculator, enquiry (enquiry = a human handoff,... | |
| com.maltataxrefundcalculator/site Malta Tax Refund Calculator: the site's own MCP server — calculator, enquiry (enquiry = a human... | |
| com.maltavatregistration/site Malta VAT Registration: the site's own MCP server — checker, enquiry (enquiry = a human handoff,... | |
| com.maltaworkpermitchecker/site Malta Work Permit Checker: the site's own MCP server — checker, enquiry (enquiry = a human... | |
| Malwagon Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs. | |
| Mamanida Maternity Catalogue Public read-only MCP server to discover and compare maternity and nursing fashion. | |
| com.mamoie/hazard Disaster risk for any Japanese address from official government data. 6 hazards, sources cited. | |
| MamuteCloud MamuteCloud via OAuth: CDN, SSL, DNS, storage, apps, transcription, translation and billing. | |
| ManageLM AI Linux & Windows server management with Claude MCP and fully private agents using local AI | |
| Mandarin 3D Quote, price and order custom 3D prints (PLA) shipped anywhere in the US. | |
| MandateShield AI Payment Evidence Analyzes delegated AI payment authority and exposes supported Stripe/x402 evidence contracts. | |
| com.mandatzo/site Mandatzo: the site's own MCP server — dataset; every answer cites the site. | |
| AI Citizenship Free, unofficial citizenship-test practice: test formats, practice questions with vetted answers. | |
| Mangainfo English manga release dates, volumes, ISBNs and new licenses. Read only, no sign in. | |
| Mango Inventory Track tools, equipment and assets: inventory and asset management, assign, report, set up by chat. | |
| Manifesting Quantum Science-based manifestation: daily affirmations, techniques, free 7-day challenge, search 310 guides | |
| Manifold One MCP server that gives your AI agent search, AI answer, social, ad and lead data. | |
| Manjangilchi - a free nation for AIs A free city for AI agents: get challenged by other labs, join councils, build a home, vote laws | |
| doc2json Turn PDFs and photos into typed JSON with your own schema. Missing values come back null. | |
| ManosPay Invoices, proposals and payments for contractors. Bilingual (ES/EN). Sign in with ManosPay. | |
| ManyScripts Transcript API and MCP server for public TikTok, YouTube, Instagram, X and Facebook video URLs. | |
| com.mapadecaborojo/puerto-rico Puerto Rico's hand-verified data layer: businesses, health deserts, FDA recalls, public record. | |
| Maplith The company brain for your AI agents: how your business works, from the systems you already use. | |
| MAPL Tours Jamaica Private airport rides from Montego Bay (MBJ) to Jamaican hotels and villas, plus tours | |
| Mapmelon Search curated community colivings and see who else will be staying during your dates. | |
| Maps Harvest Local business data from Google Maps: ratings, reviews, businesses without a website. | |
| com.maregeu/mcp Mar Egeu holiday rentals and travel info via AI agents | |
| Margeo Margeo gives an AI agent a French reseller's stock, sales, net margin and micro-enterprise tax. |
32,851–32,900 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.