Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Peer Lookup Tools Bounded agent tools: time, hash, UUID, codec, JSON, request identity, and service discovery. | |
| PeerPush Find and compare software, SaaS, developer, and AI tools: alternatives, pricing, platforms, trends. | |
| Pending You One queue for everything your AI assistants are waiting on you for, answered from phone or desk. | |
| 台灣 AI 工具價格 台灣 AI 工具價格：AI 訂閱與 API 費用換算新台幣。台灣繁體中文 MCP 工具。 | |
| 網紅開團合規工具箱 網紅開團合規工具箱：開團廣告用語、定價、稅務與上架。台灣繁體中文 MCP 工具。 | |
| 台灣加密貨幣資料 台灣加密貨幣資料：交易所、USDT 匯率溢價、法規與防詐。台灣繁體中文 MCP 工具。 | |
| 美食神仙籤筒 今天吃什麼？神明抽籤選料理，並從臺灣附近營業中的店家抽一間。台灣繁體中文 MCP 工具。 | |
| 遊戲發售日與預告片資料庫 遊戲發售日與預告片資料庫：新作發售日、延期消息與官方預告。台灣繁體中文 MCP 工具。 | |
| AI 與科技名詞白話解釋 AI 與科技名詞白話解釋：MCP、RAG、AI 代理人等名詞的白話定義。台灣繁體中文 MCP 工具。 | |
| 台灣健康資訊 台灣健康資訊：篩檢、慢性病與飲食等健康資訊整理。台灣繁體中文 MCP 工具。 | |
| AI 代理人任務中樞 一個入口整合全部台灣繁中 MCP 工具：生活、旅遊、台股、AI 工具、遊戲、電影、運動等 | |
| 生活即時查詢 生活即時查詢：油價、統一發票、國定假日、樂透。台灣繁體中文 MCP 工具。 | |
| llms.txt 檢查工具 llms.txt 檢查工具：檢查網站的 llms.txt、robots 與 sitemap。台灣繁體中文 MCP 工具。 | |
| AI 模型下架與替代日程 OpenAI、Claude、Gemini 模型下架日、剩餘天數與官方建議替代，可檢查程式碼裡的模型。每筆附官方來源。 | |
| 網頁動畫工具箱 網頁動畫工具箱：CSS 動畫、easing、影片壓縮與互動設計。台灣繁體中文 MCP 工具。 | |
| 電影影集動畫上映日 電影影集動畫上映日：院線、串流與新番上映日與預告。台灣繁體中文 MCP 工具。 | |
| 搜尋引擎與 AI 爬蟲工具箱 搜尋引擎與 AI 爬蟲工具箱：搜尋指令、爬蟲驗證、收錄與 AEO 健檢。台灣繁體中文 MCP 工具。 | |
| 好片分享排行榜 好片分享排行榜：台灣網友分享的熱門影片與貼文日週月年排行。台灣繁體中文 MCP 工具。 | |
| 購物比價紀錄 購物比價紀錄：3C、美妝、家電價格比較。台灣繁體中文 MCP 工具。 | |
| 台灣運動賽事日程 台灣運動賽事日程：中職、MLB、NBA、TPBL、亞運、世界12強、奧運的日期與台灣轉播，每筆附官方出處。 | |
| 台股題材與高股息 台股題材與高股息：AI 題材股與高股息 ETF 資料。台灣繁體中文 MCP 工具。 | |
| 符文戰場新手指南 符文戰場新手指南：卡牌規則與新手教學。台灣繁體中文 MCP 工具。 | |
| 亞洲公仔扭蛋情報站 亞洲公仔扭蛋情報站：萬代與 Takara Tomy Arts 扭蛋公仔發售表、中日搜尋、交換局。繁體中文 MCP 工具。 | |
| 2027 連假與訂票指南 2027 連假與訂票指南：2027 連假請假攻略與訂票時程。台灣繁體中文 MCP 工具。 | |
| 出國與國旅實用查詢 出國與國旅實用查詢：匯率、入境手續、退稅與國旅資訊。台灣繁體中文 MCP 工具。 | |
| 二行程經典車資料庫 二行程經典車資料庫：經典二行程機車規格、零件與保養。台灣繁體中文 MCP 工具。 | |
| 真人意見站 真人意見站：真人心得與評價討論。台灣繁體中文 MCP 工具。 | |
| 數位健康與遠距醫療指南 數位健康與遠距醫療指南：視訊看診、心情自評與睡眠放鬆。台灣繁體中文 MCP 工具。 | |
| com.pentonym/clearance US & EU trademark, domain & handle clearance — a signed three-state verdict, not legal advice. | |
| People Analytics Toolbox People analytics + compensation as MCP tools: JobFrame, pay modeling, wage compliance, HR metrics | |
| People Can Build Exhibition stand builder, Poznań/EU: company facts, reference projects, design-fee estimate, RFQ | |
| PepEvolution Peptide Sources Find where to buy peptides from vetted, COA-tested vendors and check if a peptide vendor is legit. | |
| PeppolStatus Peppol market intelligence and network monitoring: migrations, provider churn, leads, and uptime. | |
| PeptoClinic store Browse PeptoClinic peptide vials (Argentina and US) and build a checkout link for the buyer. | |
| Peptul Live research peptide prices, price history, vendor trust records and a reconstitution calculator. | |
| Perceptlayer Live web data for AI agents: structured JSON from 248 websites through one API key. | |
| com.perdiemdesk/site PerDiemDesk: the site's own MCP server — dataset; every answer cites the site. | |
| com.perdiemo/site Perdiemo: the site's own MCP server — dataset; every answer cites the site. | |
| PerfectVector Image to SVG with a vectorization model we trained in-house. Clean, editable logos, icons, line art. | |
| Perkadoo Manage Perkadoo giveaways, streak programs and perks, plus verifiable draws and streak badges. | |
| Perkusai (US) AI shopping search: real, in-stock US and Amazon products with prices, ratings and buy links. | |
| PermitStack U.S. building permits, permit histories by address and contractors from city and county records. | |
| Permitame Building permit answers for Kitsap County, WA and its cities, quoted from official sources. | |
| PermitInfoBroker Daily US building permits for 30 cities and counties. Free counts; records paid per call via x402. | |
| PermitReporter — US Building Permit Intelligence Source-linked building-permit search across 34 US states and DC, with county-level coverage. | |
| Permit Scouter Daily Tampa Bay, Southwest and Central Florida permits with job value and contractor. Pay via x402. | |
| PermitSnag US backcountry permit and campground rules, dates and recorded openings. Read-only, no sign-in. | |
| PerpFinder Read-only perp futures data: all-in trading cost, venue fees, funding rates and volume ranking | |
| Personyze Manage web personalization campaigns, audiences and visitor data in Personyze. | |
| Persqo AI personas test your site like real users and return scored reports with fix prompts. |
33,751–33,800 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.