Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Fotbollsresor.eu Jämför fotbollsresor till samma match. Se arrangör, paketinnehåll, frånpris i SEK och kontrolldatum. | |
| FreightDesk Get instant road freight prices and arrange pallet, express or full truck transport in Europe. | |
| GameDeal Read-only PC game search, current store offers and recorded price history. No account required. | |
| GDPRWise GDPR compliance for SMEs: query and update your processing register, vendors and compliance items | |
| Grocery Navigator Grocery lists, recipes, menu plan, household, supermarket offers and receipt photos to track costs | |
| gricker.eu: European alternatives European and open-source alternatives to mainstream software, judged by the current owner's HQ. | |
| IBAN Validation MCP Validate IBANs in 111 countries; bank directory checks for DE, AT, BE, FR, LU, NL, PT and ES. | |
| ICOS carbon and greenhouse-gas observations ICOS atmosphere, ocean and ecosystem greenhouse-gas observations, with citation and DOI per answer | |
| Infinivo AI Front Desk Run a live AI intake desk for personal-injury law firms, or query pricing, proof and positioning. | |
| EU EN-16931 & XRechnung Deterministic Validator Official KoSIT EN 16931 & XRechnung XML validator issuing signed Ed25519 VCs. Zero retention. | |
| GDPR PII Shield & EU AI Act Anonymization Gate Zero-retention GDPR PII redaction gate (IBAN, Tax-ID, HRB, Names) with signed Ed25519 VC. | |
| EU Financial Sanctions (FSF) & KYB Clearance Oracle Deterministic EU FSF, UN & OpenSanctions KYB screening issuing signed Ed25519 Non-Hit VCs. | |
| IZOProfil.eu Read-only building materials catalog: product search, specs and PLN net/gross prices. | |
| Kalkulo.eu calculators Read-only European tax, salary and benefit calculators with official sources and unknowns. | |
| KrakenShield Quick HTTPS/SSL check of any website, cybersecurity glossary and KrakenShield prices. | |
| Kras-Trans: transport quotes, CMR, WZ and interest notes Van transport quotes in Poland and the EU, quote status, CMR in 25 languages, WZ, interest notes. | |
| Lustrix – mirrors made to measure Price and design made-to-measure mirrors (PL/DE/AT); order on lustrix.eu. | |
| eu.madeinro/digital-compass-mcp Digital-crisis playbooks as tools, 9 languages, country-anchored reporting channels. CC BY 4.0. | |
| MetLex DORA, GDPR and FFFS as verbatim passages with article, official link and snapshot date. | |
| eu.mmatinca/portfolio-mcp Marian Matinca's portfolio as MCP tools: projects, blog, profile, results. Read-only, RO+EN. | |
| eu.mmatinca/travel-trends-mcp European tourism & travel-disruption MCP: trip risk, live events, Eurostat panels, RO county data. | |
| Muralists Directory Search the curated directory of professional muralists and street artists in Europe. | |
| NordicContacts Find companies and decision-maker contacts in Finland, Sweden and Estonia for B2B prospecting. | |
| Anwaltsuche DE Lawyers in Germany from the official Bundesrechtsanwaltskammer register. Keyless, read-only. | |
| Obato Search boats for sale or rent, marinas and live market stats on Obato, Europe's boat marketplace. | |
| Pauhu European data products with cited sources. Annual bulk access: not open for online purchase yet. | |
| Payments Law — EU payments legislation EU payments legislation: PSD2, RTS-SCA, PSD3/PSR, DORA; provisions, definitions and text changes. | |
| PLMHub boards Draw diagrams, build HTML pages and write Markdown in a live editor the user sees. | |
| Polias Search Web search in Polias' own EU-hosted index: German (DE/AT/CH, official sources optional) and English | |
| MobilityMCP Public transport in Germany (ÖPNV, Fahrplan): journeys, departures, disruptions, nearby sharing. | |
| TourismMCP Travel in Germany (Tourismus): sights, events, opening hours and prices, weather and tides. | |
| Propecto Sociétés européennes, dirigeants, comptes, marchés publics, aides et marques (lecture seule). | |
| Reqlio Read and edit requirements, traces, verification, risks and reviews in a Reqlio workspace. | |
| eu.riskrouter/evidence-log Tamper-evident evidence log: signed heads, proofs, and recording salted digests of your records. | |
| GPU Cloud Prices (AWS, Azure, OCI) Paid x402 API, $0.005 USDC on Base: cached GPU $/hr, AWS/Azure/OCI (H100/H200/A100/L4/L40S) | |
| GPU Cloud Prices (AWS, Azure, OCI) H100/H200/A100 on-demand AWS/Azure/OCI + Azure Spot; L4 AWS, L40S AWS/OCI. Cached $/hr, x402 $0.005 | |
| Sandwich Panel EU Read-only building materials catalog: product search, specs and PLN net/gross prices. | |
| Pieter-Jan Scheir Profile, projects, experience, skills and contact details of an AI-first full-stack developer. | |
| ScopeMatch Search accredited testing labs and verify lab scope evidence from ScopeMatch. | |
| ScoreStory NPS, eNPS, CSAT and CES surveys with AI follow-up interviews: create, invite, read results. | |
| Sirenic Official French and European company data for AI agents, paid per call (x402) or by API key. | |
| Skinow Skinow, formerly Skimetric: snow forecasts, lift status, season history and AI ski trip planning | |
| Smartwebchat Create and manage website chatbots for European SMBs: bots, chat, and captured leads. | |
| SpotWave electricity prices Live day-ahead electricity prices for 40+ European markets, all-in with taxes and VAT. | |
| StackLégal GDPR provider fiches and a static cookie scan before consent. | |
| SteelProfil Read-only building materials catalog: product search, specs and PLN net/gross prices. | |
| Surf Booking Surf lessons from verified schools and the sea beach by beach, for your level and hour. Read-only. | |
| taivo EU web hosting for sites built in chat: publish, own domains, mail, a Postgres database, Node apps. | |
| Tax Reclaim account Preview and save withholding-tax claims to your Tax Reclaim account, and get your filing plan. | |
| Tax Reclaim calculator Estimate dividend and interest withholding-tax refunds, treaty rates and filing deadlines. |
37,501–37,550 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.