Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Privatrak Ask your website analytics in plain language and set up funnels, features and dashboards. | |
| PrizePicks API PrizePicks props, tiers, recorded line history, graded results and sportsbook comparisons. | |
| Probb Hiring copilot: shortlist, compare and interview candidates, and grow your talent pool. | |
| probe402 Independent health, price and history for x402/MPP endpoints. Metered over x402; free grade on web. | |
| com.probeledger/site ProbeLedger: the site's own MCP server — dataset; every answer cites the site. | |
| com.procedurecostchecker/site Procedure Cost Checker: the site's own MCP server — dataset, enquiry (enquiry = a human handoff,... | |
| Prodantix Product analytics, feature flags, experiments, session replay and messaging for your products. | |
| ProducerSpark Insurance brokers: get meetings with retail producers and CFOs using Claude. | |
| ProductByte Social posts, ads and insights for e-commerce. One connection for your agent. | |
| Production Engine Production management for commercial film and photo companies: jobs, budgets, crew and invoices. | |
| Production List Live film and TV productions in development and production, with companies and people attached. | |
| Produktly Connect your AI assistant to Produktly. Read changelogs, feedback responses, and roadmap items. | |
| Seneca Research Platform One prompt. ~100 independent AI models. One report: consensus, disagreements, and minority insights. | |
| Professor Otter Free printable kids activities: word searches, mazes, color by number, sudoku and more. | |
| Professor Sausages — Finance SEC filings, insider trades, 13F, IPO calendar, macro & FX MCP tools via x402. | |
| Professor Sausages — On-chain EVM gas, Chainlink prices, token-safety, swap quotes, ENS, OFAC & NFT via x402. | |
| Professor Sausages — Trust & Verification Email, phone, domain, URL & OFAC verification; phishing and IBAN checks via x402. | |
| Professor Sausages — Web & Documents Read pages & files to text, news, weather, market holidays and timezones via x402. | |
| ProfitDrawer Read-only small business Q&A, product prices, IRS datasets and calculators from ProfitDrawer. | |
| Profit for Partners Partner-led growth: the six partnership types and the vocabulary of partner deals. | |
| Prognyx oncology intelligence Live ClinicalTrials.gov oncology trial comparison around an asset, plus landscapes and CI briefings. | |
| Programación Siemens — Blog y Cursos Guías en español de PLC Siemens y TIA Portal: busca y lee +330 tutoriales (SCL, LADDER, AWL, HMI). | |
| Programme TV Noël Recherche de téléfilms de Noël et de leurs diffusions TV, en lecture seule, horaires Europe/Paris. | |
| progrss Sourced charts on how the world is shifting: power, economy, energy, people, planet, food. | |
| Project Fingerprint Personal context and preferences for AI via OAuth-approved profile sections and taste data. | |
| ProjectThunder ERP and B2B ecommerce rollout research: ERP fit, migration plans, site scans, ERP partner directory. | |
| Prokso Proxy Pay-per-GB residential, mobile and datacenter proxies: check traffic left and get proxy lines. | |
| Prometheor Your AI apps as one team: hand work to Codex or Claude Code on your Mac, with a shared logbook. | |
| PromoPilot Social posts, inbox, CRM, email, Meta and Google ads, funnels and websites for your brands. | |
| Promptafire Read Promptafire's AI-for-marketers lessons and blog. Optional sign-in unlocks Pro lessons. | |
| PromptBase Search and use 300,000+ AI prompts and skills for images, video, writing, games, apps and websites. | |
| Promptcelerator Find AI video prompts that really worked, each with its video and its credited creator. Free. | |
| com.promptswing/ecommerce-website-hosting-ai-business-intelligence Publish a site your AI built to paid hosting, then read it back, change a page or restore a version. | |
| com.prontofax/prontofax Verified US government fax numbers and send a fax from the chat. No account, $2.99 on delivery. | |
| ProofLayered Free passive growth-bottleneck scan for B2B SaaS websites: visibility, trust, conversion, scale. | |
| com.proofzo/site Proofzo: the site's own MCP server — dataset; every answer cites the site. | |
| com.propfirmpicker/site PropFirmPicker: the site's own MCP server — dataset, enquiry (enquiry = a human handoff, not a... | |
| PropoBox Create, send, track and follow up on client proposals from Claude. Flat-price proposal software. | |
| com.proscendia/google-workspace Permissioned access to Gmail, Drive and Calendar via the user's own Google account | |
| com.proscendia/microsoft-365 Permissioned access to Outlook, OneDrive and Teams via the user's own Microsoft account | |
| com.proservicesprices/site PRO Services Prices: the site's own MCP server — enquiry (enquiry = a human handoff, not a... | |
| buddybase Keep personal records like expenses, vocabulary and health logs in your own buddybase. | |
| Fracta Plan, update and complete your Fracta tasks and save memos. Fracta Pro required. | |
| Hachimo Keep your English lessons, review cards and daily plan in Hachimo. Subscription required. | |
| Hearth Log meals, weight and workouts in Hearth and review your progress. Subscription required. | |
| Ledgie Check and record your Ledgie household ledger. Ledgie subscription required. | |
| Lore Write articles and quizzes into your private Lore knowledge inbox. Subscription required. | |
| ProviderSignal: Dental Market Intelligence Read-only MCP: US dental intel, all-category Medicaid fee schedules, dentist lookup. Free tier. | |
| ProxyJam Buy and manage ISP proxies: offers, orders, renewals, traffic, whitelists and wallet. | |
| com.proxylink-mcp/mcp-server ProxyLink MCP server for finding and booking home service professionals |
34,001–34,050 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.