Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Facebook Manage Facebook Pages, posts, comments, messages, and insights via the Facebook Graph API. Use this skill when users want to post content, read engagement metrics, moderate comments, or automate Facebook Page workflows from chat. | |
| Figma Read files, manage comments, extract design tokens, download images, and create webhooks in Figma via the Figma REST API. Use this skill when users want to i... | |
| Freshdesk Manage Freshdesk tickets, notes, watchers, conversations, and support workflows via the Freshdesk API. Use this skill when users want to search and inspect t... | |
| Freshservice Manage Freshservice tickets, requesters, agents, assets, changes, problems, and service catalog data via the Freshservice API. Use this skill when users want... | |
| GIPHY Search GIFs, stickers, emojis, trending media, and upload assets to GIPHY via the GIPHY API. Use this skill when users want to search for GIFs and stickers,... | |
| GitHub Work with GitHub repositories, issues, pull requests, commits, branches, releases, and workflows via the GitHub REST and GraphQL APIs. Use this skill when us... | |
| GitHub Scout GitHub research without a GitHub token. Trending repositories and developers (daily, weekly, monthly, by language), any repository's details, and any developer's profile, repositories, pull requests, recent activity, contributions and follo | |
| GitHub Triage Review GitHub repositories, group issues and pull requests by urgency, and take safe triage actions (add labels, comment, propose closure) after confirmation... | |
| GitLab Work with GitLab projects, issues, merge requests, commits, branches, pipelines, and groups via the GitLab API. Use this skill when users want to list projec... | |
| Gmail Read, search, draft, reply to, and organize Gmail from chat via the Gmail API. Use this skill when users want an inbox copilot — search and fetch messages, read by thread, list labels, create and send drafts, reply to threads, forward messa | |
| Google Admin Manage Google Workspace users, groups, domains, devices, and admin directory data via the Google Admin SDK API. Use this skill when users want to list and in... | |
| Google Ads Inspect Google Ads accounts and campaigns, run GAQL reports, and coordinate campaign or audience changes with confirmation via the Google Ads API. Use this s... | |
| Google Analytics Run GA4 reports, inspect properties, list audiences and data streams, and analyze traffic and conversion data via the Google Analytics Data API. Use this ski... | |
| Google Calendar Check Google Calendar calendars, find free time, schedule meetings, and update events via the Google Calendar API. Use this skill when users want help schedu... | |
| Google Chat Work with Google Chat spaces, members, messages, attachments, and threaded conversations via the Google Chat API. Use this skill when users want to list spac... | |
| Google Classroom Manage Google Classroom courses, coursework, students, teachers, submissions, and announcements via the Google Classroom API. Use this skill when users want... | |
| Google Contacts Google Contacts API integration with managed OAuth. Search, inspect, create, and update contacts and contact groups stored in Google People. Use this skill w... | |
| Google Docs Google Docs API integration with managed OAuth. Search, read, create, and update Google Docs documents. Use this skill when users want to read document text,... | |
| Google Drive Google Drive API integration with managed OAuth. Search Drive files, manage permissions, organize folders, upload and download files, and handle sharing chan... | |
| Google Forms Google Forms API integration with managed OAuth. Create forms, inspect structure, review responses, change publishing settings, and manage response notificat... | |
| Google Maps Google Maps and Places API integration. Search places, geocode addresses, calculate routes, get directions, and retrieve location data. Use this skill when u... | |
| Google Meet Google Meet API integration with managed OAuth. Create meeting spaces, inspect conference records, retrieve recordings and transcripts, and manage meeting pa... | |
| Google Photos Google Photos Library API integration with managed OAuth. Upload media, search photos, create and manage albums, and update media items. Use this skill when... | |
| Google Search Console Google Search Console API integration with managed OAuth. Query search performance analytics, inspect URL indexing status, review sitemaps, and manage verifi... | |
| Google Sheets Google Sheets API integration with managed OAuth. Create spreadsheets, read and write cell values, manage sheets, append rows, create charts, and automate da... | |
| Google Slides Google Slides API integration with managed OAuth. Inspect presentations, create or update slide content, manage layouts, and coordinate presentation workflow... | |
| Google Super Unified Google services API integration with managed OAuth. Manage Gmail, Google Calendar, Drive, Docs, Sheets, Slides, Meet, Tasks, Photos, Maps, Google Ana... | |
| Google Tasks Google Tasks API integration with managed OAuth. Manage task lists, tasks, due dates, notes, and completion state in Google Tasks. Use this skill when users... | |
| Grafana Grafana HTTP API integration. Inspect dashboards, folders, data sources, alert rules, and teams. Use this skill when users want to query observability data,... | |
| Hostinger Hostinger API integration via managed credentials. Inspect domains, DNS records, VPS instances, websites, subscriptions, and hosting account data. Use this s... | |
| HubSpot HubSpot CRM API integration with managed OAuth. Manage contacts, companies, deals, pipelines, tickets, products, line items, marketing emails, and workflows.... | |
| insta-scout Instagram research without logging in or an API key. Search accounts and reels, browse hashtags, read any public profile, its posts, reels, stories and highlights, followers and following, similar accounts, tagged posts, post comments and l | |
| Instagram Manage Instagram Business and Creator accounts via the Instagram Graph API. Publish posts and carousels, retrieve media and insights, moderate comments, send DMs, and manage story content. Use this skill when users want to manage Instagram | |
| Instantly Run scalable cold email campaigns via Instantly.ai. Manage email accounts, build lead lists, create and activate multi-step outreach sequences, track analyti... | |
| Intercom Manage Intercom workspaces for customer support. Handle conversations, contacts, companies, tickets, and help center content. Automate replies, assign conver... | |
| Jotform Manage Jotform forms, submissions, labels, and user accounts. Create and clone forms, retrieve submissions and reports, manage form labels, and monitor accou... | |
| keyword-miner Keyword research for Google and Amazon with no SEO tool subscription or API key. Search volume, CPC, keyword difficulty and intent for Google keywords, keyword ideas and related searches, live Google, Bing and YouTube results, autocomplete, | |
| Kibana Manage Elastic Kibana for observability and security operations. Query data views, manage alerting rules and detection engine rules, handle Fleet agent polic... | |
| Kit Run email marketing campaigns via Kit (formerly ConvertKit). Manage subscribers, create broadcasts and sequences, handle tags and segments, track email stats... | |
| Lemlist Run personalized email outreach campaigns via Lemlist. Manage campaigns, sequences, and tasks, track lead engagement, search people and company databases, an... | |
| LinkedIn Prospector LinkedIn lead research and prospecting with no LinkedIn account or API key. Search companies and people, read company pages and member profiles (experience, education, skills), list a company's employees, find the LinkedIn company for a dom | |
| LinkedIn Manage LinkedIn presence via the LinkedIn API. Create posts and articles, manage comments, handle media uploads, search ad targeting entities, and retrieve user profile and image data. | |
| LinkHut LinkHut bookmark management API integration with managed OAuth. Save, organize, search, and manage bookmarks with tags, notes, and privacy settings. Use this... | |
| Mailchimp Manage Mailchimp audiences, campaigns, automations, e-commerce, and analytics. Create and send email campaigns, manage subscribers, configure automations, ha... | |
| MailerLite Manage MailerLite email marketing campaigns, automations, subscribers, and e-commerce stores. Create campaigns, manage groups and segments, handle subscriber... | |
| Make Manage Make.com organizations, users, teams, scenarios, and billing. Configure organization settings, manage team members, retrieve usage analytics, and acce... | |
| marketplace-finder Search Facebook Marketplace without a Facebook account or API key. Find listings by keyword near any location, filter by price, condition and date, open a listing for its photos, description and seller details, and look up Marketplace locat | |
| Microsoft Excel Microsoft Excel API integration with managed OAuth. Read and write Excel workbooks, worksheets, ranges, tables, and charts stored in OneDrive. Use this skill... | |
| Monday Manage Monday.com workspaces, boards, items, teams, and documents. Create projects, manage tasks and columns, handle team permissions, automate workflows wit... | |
| Motion Manage projects, tasks, schedules, custom fields, and team collaboration in Motion. Create projects, manage recurring tasks, configure workspaces, track stat... |
35,951–36,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.