Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Word Document Composer Create real DOCX documents with headings, paragraphs, bullets and tables, and inspect document text structure. Use for Word Document Composer. | |
| Multi-account Email Desk Connect IMAP/SMTP/POP3 accounts, sync and search mail, extract attachments, prepare and send messages, and track new-mail notifications. Use for Multi-account Email Desk. | |
| Entity Relationship Memory Store source-linked entities and relationships, traverse their connections and export a local graph. Use for Entity Relationship Memory. | |
| Expense Tracker and Budgets Import CSV transactions with deduplication, calculate exact totals and budgets, and export ledgers. Use for Expense Tracker and Budgets. | |
| RSS Subscription and Reading Hub Subscribe to RSS/Atom, import and export OPML, retain read state, search saved entries and queue new-content notifications. Use for RSS Subscription and Reading Hub. | |
| File Organization Plan and Duplicate Report Create a read-only file classification plan and SHA256 duplicate report for an explicitly named local folder. Use for file organization, reviewing Downloads, or finding duplicate files before deciding how to organize them. It does not move | |
| Form Review and Submission Plan Map requested values to an observed form, identify missing required fields and separate review from final submission. | |
| Git Project Review and Snapshots Inspect a selected Git project and commit history, distinguish staged changes and create verified private working snapshots. Use for Git Project Review and Snapshots. | |
| GitHub Issue Triage Desk Triage a single repository’s exported issues or PRs for unassigned, stale and similar-title items without remote changes. Use for GitHub Issue Triage Desk. | |
| Batch Image Processing Batch resize, crop, pad, compress, convert and watermark images, with contact sheets and downloadable results. Use for Batch Image Processing. | |
| Important Dates and Holidays Track Gregorian and lunar birthdays, anniversaries and sourced annual holidays, with advance alerts, time zones, leap-day policies and calendar export. Use for Important Dates and Holidays. | |
| Inventory and Reorder Desk Track SKUs and warehouse movements, calculate stock and moving-average cost, and export reorder reports by currency. Use for Inventory and Reorder Desk. | |
| Local Knowledge Desk Incrementally index local documents, search Chinese and English text, and return source snippets with file hashes. Use for Local Knowledge Desk. | |
| Study Cards with Source References Create evidence-backed Chinese or English flashcards from supplied local text, verify exact source quotes, and export safe Markdown, Anki TSV and a manual review checklist. Use for Study Cards with Source References or note-to-question prac | |
| Website Link and Content Audit Crawl a bounded same-origin site and report broken links, missing fragments, duplicate titles and image alt omissions. Use for Website Link and Content Audit. | |
| Log Diagnostics Toolbox Analyze access, JSONL application and GZIP logs for errors, HTTP status, popular routes and time patterns. Use for Log Diagnostics Toolbox. | |
| Meal Planner and Grocery List Save dietary exclusions and pantry stock, scale servings and export menus and groceries. Use for Meal Planner and Grocery List. | |
| Audio and Video Workbench Inspect media, extract audio, cut clips and frames, and export SRT/VTT subtitles locally, with optional local speech recognition and resumable chunk caches. Use for Audio and Video Workbench. | |
| Meeting Minutes and Action Items Turn user-provided meeting text into evidence-cited minutes and action items using the current model, validate the structured JSON against exact quotes, then save local Markdown and task CSV. Use for meeting minutes and follow-up lists; not | |
| Provenance Memory Review Identify conflicting and expired user-selected facts before proposing changes to an agent memory file. | |
| Model API Cost Desk Estimate model API costs from exported token usage and supplied rates, separating cached input, output and currencies. Use for Model API Cost Desk. | |
| Notion Export Desk Index an existing Notion Markdown/CSV export with page references, table counts and source hashes. Use for Notion Export Desk. | |
| Obsidian Vault Link Map Map Markdown wikilinks, backlinks, orphan notes and broken or ambiguous targets without changing the vault. Use for Obsidian Vault Link Map. | |
| PDF Toolbox Merge, split, select, reorder, rotate and compress PDFs; convert images, render previews and inspect blank pages. Use for PDF Toolbox. | |
| Privacy Redaction Desk Scan and redact email, Chinese mobile numbers, IPs and secret fields in text, CSV and JSON, keeping originals intact. Use for Privacy Redaction Desk. | |
| Project and Milestone Board Manage project tasks, dependencies, owners, deadlines and effort, then export board reports, overdue tasks and calendar dates. Use for Project and Milestone Board. | |
| Quick Notes and Tasks Edit and search notes and tasks, filter tags and due dates, and export Markdown and CSV. Use for Quick Notes and Tasks. | |
| Release Evidence Gate Check a release manifest for valid versions, checksums and recorded passing tests before a human publication decision. | |
| Reminders and Scheduled Tasks Audit scheduler jobs, record real delivery receipts and export calendar events. Use for Reminders and Scheduled Tasks. | |
| Reply Drafts Draft replies from messages and verified notes, with evidence and a follow-up checklist. | |
| Research Evidence Dossier Connect research claims to supplied sources, verify quoted text and flag unverified claims and duplicate URLs. Use for Research Evidence Dossier. | |
| Search Query Planner Build focused queries with exact phrases and source domains before researching a question. | |
| Excel Business Analysis Studio Combine XLSX/CSV sources, clean mapped fields, deduplicate, reconcile sales, refunds and expenses, and export currency-separated monthly reports with source rows. Use for Excel Business Analysis Studio. | |
| Shopping Comparison Calculate purchase costs, compare saved price snapshots, preserve referral URLs and export reports. Use for Shopping Comparison. | |
| Website Availability and Basic SEO Check Check selected pages once for status, redirects, timing and basic SEO fields. | |
| Skill Package Inspector Inspect a Skill ZIP without executing it: archive boundaries, executable/network indicators and per-file hashes. Use for Skill Package Inspector. | |
| HTML Slide Storyboard Build self-contained HTML slides with bilingual text, navigation, speaker notes, print styles and a Markdown outline. Use for HTML Slide Storyboard. | |
| Source Freshness Review Compare explicitly dated sources with a research cutoff and flag stale, undated or future-dated records. | |
| SQLite Query and Export Desk Inspect SQLite schemas, run bounded read-only queries, export CSV/JSON and import CSV into a fresh database. Use for SQLite Query and Export Desk. | |
| Study Coach and Mistake Review Import question decks, retain attempts and review dates, summarize practice and export answer-hidden queues. Use for Study Coach and Mistake Review. | |
| Subscription and Renewal Desk Track software, memberships and service renewals, calculate cancellation deadlines, forecast costs by currency and queue due notices. Use for Subscription and Renewal Desk. | |
| Task Checkpoint and Handoff Save task checkpoints and file hashes, then resume with a clear next-step list and stale-file warnings. Use for Task Checkpoint and Handoff. | |
| Translation and Proofreading Translate or polish user-provided text with the current model, then check bilingual segment alignment, required terminology, numbers and links and export a comparison with review issues. Use for Translation and Proofreading, translation rev | |
| UI Accessibility Checklist Audit local HTML labels, alt text, duplicate IDs and heading order, and calculate explicit colour-pair contrast. Use for UI Accessibility Checklist. | |
| Weather and Outing Desk Fetch a coordinate-based forecast or inspect saved Open-Meteo data for temperature, rain probability and wind. Use for Weather and Outing Desk. | |
| Web Research Notes Turn one to three explicitly supplied public HTTPS pages into source-backed Chinese or English research notes saved locally. Use for Web Research Notes, comparing a few linked articles, or a first cited reading note; not crawling, paywalls, | |
| Web Change Subscriptions Watch selected webpage regions, retain baselines, filter noise, record differences and connect scheduled checks with chat delivery. Use for Web Change Subscriptions. | |
| Webhook Fixture Builder Deduplicate selected webhook events by event ID and export replay fixtures without sending network requests. | |
| Daily and Weekly Work Reports Import work records, update status with revision history, and export dated reports and evidence. Use for Daily and Weekly Work Reports. | |
| Automation Dependency Blueprint Validate a workflow dependency graph, detect cycles and separate read-only steps from external mutations. |
37,451–37,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.