Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Schedchie Schedule, publish and track posts on 12 social networks from your AI assistant. X is a paid add-on. | |
| ScheduleSensor Ask your AI about Japanese schedule/reservation pages you monitor: openings, change history, status. | |
| Schengen Counter Schengen 90/180-day calculator, earliest re-entry date and ETIAS check. Stateless, no data stored. | |
| ScienceShot data-centre intelligence and physics reference Cited radiation physics answers and dated European data-centre markets, grid connections and rules. | |
| Scientific Microservices Valid and reliable data engineering and statistical analysis without hallucinations. | |
| Sckian AI job matching in your assistant: ranked offers, tailored resumes, application tracking. | |
| SCModeling Supply-chain network design via simulation, optimization, and greenfield analysis. | |
| com.scopedly/site Scopedly: the site's own MCP server — dataset; every answer cites the site. | |
| ScopeLinq Reads what was agreed and answers whether a new request is Included, citing only confirmed lines. | |
| scorebadge Free website score for speed, SEO, security and AI search readiness, with the fixes. | |
| ScoreCompute 38 MCP tools: Rust computation, Discovery, composition, counterexample scans and signed checks. | |
| com.scoreinnov/outils Score innovation, benchmarks sectoriels et barometre cle-personne, en lecture seule. | |
| ScoreMindset — capital mental Tests, livre « Se poser les bonnes questions » et recherche plein texte, en lecture seule. | |
| ScoreStarling Turn recordings, videos and sheet music into playable, editable scores; export PDF, MIDI, MusicXML. | |
| Scout Monitoring Scout Monitoring data for AI assistants: slow endpoints, traces, N+1 queries, and errors. | |
| Scowty Free website previews, AI-search visibility checks, and plans and prices from Scowty. No sign-in. | |
| com.scrap-autos/scrap-autos-mcp Instant Canadian scrap-car value quotes by year/make/model, provincial rates, and pickup leads. | |
| ScrapeIO Public data from TikTok, Instagram, YouTube, X, Facebook and 28 more platforms. Pay per call. | |
| com.scrapelads/scrapelads TikTok creator emails, YouTube channel contacts and video transcripts for AI assistants. | |
| Scraper API One API for public web data across social, directories and real estate, as clean JSON. | |
| ScraperWatch Find and compare named scrapers using saved evidence; compare APIs, proxies and RAG extractors. | |
| ScrapeSelect Current pricing, cost estimates and recommendations for web scraping APIs, with official sources. | |
| com.scrapingant/mcp Cloud-based web access with real browsers and JS rendering by ScrapingAnt | |
| com.scraptik/tiktok Unofficial TikTok API & scraper: creator analytics, video data, comments, search. x402, no API key. | |
| com.screenata/compliance Manage compliance controls, policies, and audit readiness for SOC 2, HIPAA, ISO 27001 and more. | |
| ScreenMocks Design and export App Store / Play Store screenshots, localized across all 48 App Store locales. | |
| Screenrove: UI Design Reference & Screenshots (free Mobbin alternative) Real SaaS UI screenshots for coding agents: onboarding flows, pricing pages, design inspiration. | |
| ScreenshotAgent Keep docs and help-center screenshots current: find, recapture, mark up and embed them. | |
| Screvi Search and organize your reading library of highlights, saved articles, notes and tags. | |
| Scribase Supabase-compatible Postgres for agents: projects, branches, SQL, auth, storage, email. | |
| Scribble — Real Handwritten Cards Send real handwritten cards in the US. A machine writes each one in ink, then we mail it. | |
| ScribeToAny Transcribe audio and video into timestamped transcripts, and search and read your transcripts. | |
| ScribeTools OCR, editable Word, tables, translation and data extraction for Arabic-script documents | |
| ScriptCompiler Create motion and play it on The Handy, Autoblow, VacuGlide, Kiiroo, OSSM and Lovense toys. | |
| ScriptHaul API YouTube discovery, transcripts, library search, and monitors with API keys or OAuth. | |
| ScriptHaul Free YouTube transcripts, no API key: videos, channel lists, latest uploads, bulk download links. | |
| SCRIPTMASTERLABS — 402Proof Invoice/verify/score via RLUSD on XRPL. Own settlements proven end-to-end (SELF-PROOF). | |
| com.scriptmasterlabs/agent-browser Chromium browser agents pay per action via x402 — USDC on Base, USDC on Solana, or XRP on XRPL. | |
| SCRIPTMASTERLABS — SML agent-safety Three fast safety checks for agents, each with a signed hash-chained receipt: (1) prompt-injection c | |
| SCRIPTMASTERLABS — Agent Verify Proof, not ratings: verified paid agent-job records on Arc + a $0.05 signed Proof Check. | |
| SCRIPTMASTERLABS — B20 Truth Check Base B20 token claims against on-chain evidence. Settle-proven 2026-11-02 (SELF-PROOF). | |
| SCRIPTMASTERLABS — Bid-cast Agent job board: post Needs, bid, close matches with Arc escrow on delivery. 2 open jobs live. | |
| SCRIPTMASTERLABS — Calibration Court Calibration leaderboard + paid recalibration via x402. Settle-proven 2026-11-02 (SELF-PROOF). | |
| SCRIPTMASTERLABS — Cascade Graph Cascade Graph MCP: macro decision capsules + Jev jury review over a hash-chained calibration log. | |
| SCRIPTMASTERLABS — ClaimGate Fact-check claims against live web sources: verbatim evidence, coherence-gated verdict. | |
| SCRIPTMASTERLABS — GatePay Policy-gated Arc payment routing: hard caps, signed mandates, hash-chained proof. | |
| SCRIPTMASTERLABS — GhostKey MCP Remote MCP for compliant pay-per-use agent capabilities with x402 execution. | |
| SCRIPTMASTERLABS — MNEMOS Options Radar Options radar MCP: Astra scorecard, decisions ledger, scans. Settle-proven 2026-11-02 (SELF-PROOF). | |
| SCRIPTMASTERLABS — OmniPost One post → native, validated posts for 14 social platforms, with x402 pay-per-call tools. | |
| SCRIPTMASTERLABS — Perpetual Roadmap AMC/GME 25-session DTW price roadmaps, paid via x402. Settle-proven 2026-11-02 (SELF-PROOF). |
34,551–34,600 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.