Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| BNex BNex lets AI securely access your workspace data like contacts and campaigns via MCP. | |
| zobrx Read-only zobrx e-commerce data: P&L, orders, inventory, marketplace, tax & shelf insights. | |
| com.zoninga/finance Personal finance for AI agents: accounts, budgets, goals, 9-strategy debt payoff, reports. OAuth 2.1 | |
| Zoning Signal Planning and zoning records: 25 jurisdictions in Lake, Orange, Osceola, Polk, Seminole counties, FL | |
| ZoningVerdict Human-reviewed zoning answers with ordinance citations for covered US municipalities. | |
| ZonRival Amazon & Shopify competitor research: listings, keyword ranks, review complaints, audits. | |
| Zoosial Social media API for AI agents: publish, DMs, comments, Meta ads and leads. | |
| Zoxron MCP Your AI agent deploys, migrates & upgrades self-hosted Odoo ERP on a server you own. | |
| Zurelay Make images, videos and speech: Nano Banana, GPT Image, Seedance, Kling, Wan and Gemini TTS. | |
| Zyberno stock valuation Brina Gap valuation, supply chains, screener and market score for US stocks. SEC data, free, no key. | |
| Zyla API Hub Discover and call 10,000+ production APIs from one MCP server. Pay-per-call billing for AI agents. | |
| Zynta Flow On-brand carousels, captions and scheduled posts for Instagram, LinkedIn and TikTok. | |
| Zyphe Run KYB and AML case reviews and configure Zyphe verification flows, forms and API keys. | |
| Zyrvix Docs Zyrvix crypto-payments API reference for AI coding assistants. Anonymous, read-only. | |
| FindLocal Events Hyper-local events and venues (trivia, open mics, readings, gigs) for US metros and London. | |
| AI-first company: evidence on AI adoption Rated evidence on AI adoption: practices, company cases, claim checks and readiness assessments. | |
| Lemma Telepath Search, read and reply to your Telegram Business chats, transcribed voice included. | |
| NexusAI Consulta y configura tu negocio en NexusAI: catálogo, carta, precios, horarios, pedidos y citas. | |
| NexusAI (información pública) Productos de NexusAI (software con IA para negocios en Bolivia) y cuál le sirve a cada negocio. | |
| freemoney.computer Find free AI, GPU and cloud credits for new accounts, students, startups and open source. | |
| Lathe Managed Postgres, Redis, CouchDB and NATS on a dedicated EU machine, one flat price. | |
| consulting.sequel/agent-tools Sequel, leading Italian digital media consultancy: request a quote, site check, SEO/GEO insights. | |
| Sophon Consulting Read-only, deterministic AI triage and readiness tools implementing Sophon's published rubrics. | |
| cool.asap/mcp Drive ASAP: French invoicing, contacts and e-signature from any MCP client (NF203-compliant). | |
| Croncool Cron Jobs Check your cron jobs, recent runs, workflows and webhooks, and run a job now when you confirm. | |
| footage.cool: 4K Drone & Aerial Stock Footage Search and license 54,000+ drone, aerial, and ocean clips, mostly 4K, from filmmaker Phil Maher. | |
| Grape Read and write the notes and folders of your Grape account, the AI note-taking app. | |
| cool.payload.api/video-transcript Any video URL to LLM-ready transcript. ASR built in, no captions needed. TikTok, X, TED and more. | |
| Azul CR — Costa Rica Local Business Data Costa Rica local business directory — verified businesses, jobs, events, specials. Read-only. | |
| Premium cruise fares Search premium cruise fares by line, ship, nights, date, and rate. | |
| cv.d/talent Talent discovery for AI. Search and read agent-readable candidate profiles; cite by URL. | |
| bsv.cx Timestamp & verify evidence on-chain, free. Proofpack: a portable BEEF+BUMP proof bundle per txid. | |
| Distilled Drive cloud Android phones on US mobile IPs. Read the screen, tap, type, install apps and run tasks. | |
| LKJ — four-digit short links for TV browsers Create four-digit short URLs for TV and console browsers. Free beta, no account or API key. | |
| Joocy Make and run interactive presentations: polls, quizzes, word clouds and Q&A on every phone. | |
| Palmera Cyprus catalogue New-build homes in Cyprus: projects by place, budget and distance to the sea, and buying costs. | |
| AutoIsto CZ — car watch Watches Czech used-car ads for a buyer. Takes no contact; active only after e-mail opt-in. | |
| AutoIsto CZ Used cars for sale in Czechia: plain-language search, price verdicts and typical asking prices. | |
| Bidoro Czech property marketplace: AI agents of sellers and brokers draft, publish and bid. People decide. | |
| Bydleno – prodej bytů Search Czech flats for sale from 19 portals, merged into one offer per flat. | |
| Bydleno Search Czech rental listings from 27 portals, merged into one offer per flat. | |
| cenaodhad – ceny bytů v Praze z katastru Ceny pražských bytů z reálných prodejů v katastru. Hned a bez kontaktu. | |
| DokladBot Czech accounting for freelancers: invoices, VAT, tax deadlines, bank and data box. | |
| Evidence exekucí Czech registers: executions (paid 60 CZK), insolvency, land registry, ID validity, sanctions. | |
| EvidujZdarma – EET 2.0 (Czech sales registration) Czech EET 2.0 from 1 Jan 2027: check an IČO, classify payments, EET OFF cost, cited facts. | |
| cz.firmastat/mcp Vyhledávání a detail českých firem, finanční výkazy a ukazatele z veřejných rejstříků. | |
| cz.freelax/tax-engine Deterministic Czech OSVC tax tools for 2026: tax, insurance, deadlines, VAT and exchange rates. | |
| GROO reality Nabídka nemovitostí GROO reality — byty, domy a pozemky v Praze a okolí. Jen pro čtení, bez klíče. | |
| HitPrace Read-only Czech job search and market snapshots. | |
| Hlídač spoření Czech savings accounts and term deposits: effective rates, net yield and conditions. Read-only. |
36,351–36,400 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.