Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Torque Index US truck engine reference: VIN lookup, part numbers, failure modes and NHTSA recalls. | |
| Korea Travel Demand & Price Archive (요즘인기여행) Daily Korean outbound travel demand index (Naver package buyers) + direct flight & top-hotel prices | |
| TorrentSwap No-account cross-chain crypto swaps (BTC, ETH, SOL, USDT, ZEC…) for AI agents. Flat 0.5% fee. | |
| Tosheroon Real-time Amazon prices, product search, 90-day history, AI forecasts, and price drop alerts. | |
| Tournride — Camino de Santiago bike rental Real-time bike rental availability, exact prices and route knowledge for the Camino de Santiago. | |
| Towntide AI visibility checks, fix lists and Google review requests for local trades (Recomendr + Merciloop). | |
| com.tppflow/texas-rrc-wellbores Texas RRC oil & gas wellbores: API numbers, completion dates, depth, plug status | |
| com.tppflow/warn-act-layoffs Search 5,950 US WARN Act layoff notices by state, employer, and date (CA, TX, NY, IL, NC). | |
| Traceable Read and draft requirements, controlled documents and trace links in Traceable Docs. | |
| TraceFlow Lens SEO and GEO audit: check if a site can be read and cited by Google, ChatGPT, Perplexity and Claude. | |
| Track & Blade Marketplace for used construction equipment: read-only listings + OEM specs. Not seller of record. | |
| Trackberry Read-only access to your fresh produce shipments: ETAs, tracking, free time, alerts and documents. | |
| TrackDIFF League of Legends ranked ladders, cutoffs, player profiles, live games, champion stats and builds. | |
| TrackerHacker Spreadsheets that fill themselves from your emails and webhooks, the same way every time. | |
| Trackly SMS Manage offers and creatives, prepare US number registration, and hold SMS for human approval. | |
| Trakow Order Tracking Real-time order tracking for Shopify merchants: look up, list, and refresh shipments. | |
| Track Podcasts Who sponsors which podcasts, from transcribed ad reads. Free: 10 calls/day with no key, 25 with one. | |
| TradeApes Stock health scores, valuation verdicts, sector rankings and analyses for 8,000+ US companies. | |
| TradeAssi Crypto tools for AI agents: live market data, exchange-wide screener, backtests and paper trading. | |
| TradeChainly Ask Claude or ChatGPT about your own crypto trading: performance, patterns and behaviour. | |
| TradeGauge Dynasty and redraft fantasy football trade values, trade grades, and Sleeper league rosters. | |
| TrademarkMind Free trademark checks: brand names and logos vs U.S., international and Canadian registers. | |
| TradePilot Agent Commerce 120 pay-per-use AI agent services on Base (x402/USDC): drafting, data tools, SEO, specialists. | |
| TraderWAI Charts Read-only market charts, OHLC, backtests and a view of your connected broker accounts | |
| com.traderwai/mcp-server DEPRECATED — use com.traderwai/traderwai instead. | |
| TraderWAI Claude, ChatGPT, Grok or Perplexity: draw on live charts, backtest and trade on your own broker | |
| com.tradesseoagency/site Trades SEO Agency: the site's own MCP server — compare, enquiry (enquiry = a human handoff, not... | |
| com.tradessoftwarepicker/site Trades Software Picker: the site's own MCP server — compare, enquiry (enquiry = a human handoff,... | |
| Trades With AI + SaaS Price Watch Read-only data: AI tools for trades businesses and public SaaS pricing, with source quotes. | |
| TradieBridge Ask AI about Simpro, Xero, Deputy, Employment Hero, Dialpad, ELMO, Moveware and fleet data you own. | |
| TradingCalendars Business days, T+N settlement dates and holidays for FX, banks, payments and exchanges. | |
| Tradoshi rankings and research 2027 rankings of trading schools and prop firms, every criterion sourced, plus market data | |
| Traffalyzer SEO & UX audits for your websites: findings, Search Console data, growth plan and site scans. | |
| com.traffordcrump/profile Answers about Trafford Crump and sorts collaboration requests. | |
| Trail Fortress Fitment Free, read-only truck and Jeep parts fitment: what fits your vehicle, fit checks, tire sizes. | |
| trainwithagents Practice using the AI you already use on real work from your week. Free first mission, scored. | |
| Trandence Trading Journal Trades, stats, playbooks and notes from your Trandence trading journal. Read-only by default. | |
| TranscribeText Get YouTube video transcripts and transcribe TikTok videos to text from a link. No sign-up. | |
| TranscriptMax Transcribe YouTube via Whisper. Summaries, chapters, semantic-search across your corpus. | |
| TranslateSheet Accurate, brand-controlled translation for text, code, images, and documents with terminology. | |
| Translayte Certified, sworn, notarised and apostilled translations: quote, send documents, order, track. | |
| Transportial Plan trips, manage transport orders, track vehicles and handle quotes and invoices in Transportial. | |
| TravCozy Read and update TravCozy trips: flights, hotels, trains, car rentals and transfers. | |
| Travel Code Corporate travel: search and book flights, hotels, rail and transfers, manage orders. | |
| TravelCharika When to go and where to book: 87 places scored month by month from measured weather. | |
| Travel Risk API Country travel risk, government advisories, disaster and conflict alerts, flights, airports, Wi-Fi. | |
| Travolp Travel planner: create, edit, and explore trip itineraries from your Travolp AI assistant. | |
| com.tre-app/tre Tre — shared memory kanban for humans and agents (MCP Streamable HTTP). | |
| Treasure Valley Fun Directory Verified things to do, places to eat and events in Boise, Meridian, Nampa and nearby Idaho towns. | |
| Trellistate Free public real estate listing exchange. Search, retrieve, and submit inquiries on listings. |
35,651–35,700 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.