Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Дизайн-афиша Афиша для дизайнеров: лекции, митапы, выставки. Поиск по городу, датам, теме, только чтение. | |
| lesgooo.fun Free no-signup group planner: dates, RSVPs, place votes, shared checklist and split costs. | |
| madeira.fun Hiking Permits Madeira hiking permit trails: availability for 120 days, fees, booking links and reservations. | |
| MemeSwap MCP Buy & research hot/new memes. Quotes + unsigned swaps; wallet signs. Not a launcher. Fee 0.85%. NFA. | |
| Mindo Simple, fast todo app: manage tasks, projects and tags from Claude and other MCP clients. | |
| Paxie.Matrix Data API Memecoin intel for agents: Robinhood Chain + Solana bursts, rug checks, call verdicts. Pay via x402. | |
| Publish.fun AI-native research journal: submit papers for AI peer review, track decisions, revise, and cite. | |
| fund.zooid/zooidfund MCP server for AI agents to discover campaigns by humans and donate USDC directly on Base. | |
| ADHDEvaluations 9,846 ADHD evaluation providers from the CMS NPI Registry. | |
| Apparent Mobile app analytics in plain words: live activity, reviews and sales, ads, and why a number moved. | |
| Ascension: AI app leaderboard Daily ranks of consumer AI apps across the App Store and Google Play. Read-only, ranks only. | |
| Barcelona Rent Official Barcelona rent and sale prices by neighbourhood, from registered contracts. | |
| Bot Space Free, no-login forum, wiki and chat for AI bots: share hard-won fixes, peer validation, topic karma. | |
| BuyWise Know what you're buying: brand, white-label, price, fake-discount, review and seller checks | |
| byline.fyi Brand memory for creators: your voice profile, past work and content ideas in your AI tools. | |
| contractors.fyi US contractors ranked by city permits, permit costs and timelines, solar and generator sizing. | |
| fyi.cred/cred Agentic payments. | |
| Fly Frugal Travel Data Read-only public itinerary previews, observed round-trip fares, and flight savings verified today. | |
| ARBITER Decision arbitration, action routing, workflow control, deployment remediation, persistent memory. | |
| fyi.ground/ground Reference data API for classification systems, real-time world data, and unit conversions | |
| ITINAgents 9,838 IRS acceptance agents across US, CA, GB and IN. | |
| Jotter Save notes and conversation context from one AI assistant and load them into another. | |
| MarriageLicense.fyi Marriage licence offices across GB, IE, NZ, AU, CA and US. | |
| MemoryCareHomes Licensed memory care homes in the UK and US. | |
| fyi.mess/mess Inventory of your service accounts, kept current by your coding agents. Metadata only, no secrets. | |
| Mooi Plan group gatherings: dates, availability, polls, questions and decisions. No login or API key. | |
| MRIPrices Cash-pay MRI prices at 5,419 US hospitals. | |
| Public Adjusters Directory 1,679 licensed public adjusters across US states. | |
| Review Times Live review times for AI app stores: ChatGPT, Claude, Muse, Grok, Cursor. Check before you submit. | |
| Selah: Brand Deal Rates Free creator rate benchmarks and brand-offer checks, with sources. No login, no API key. | |
| SmartFin Backtest S&P 500 stocks and ETFs on real prices, plus loan, savings, FIRE and retirement tools. | |
| toothache.fyi London dental prices from practices' own sites, next to NHS charges and NHS places. Dated, sourced. | |
| verified.fyi Check whether a website is trustworthy: trust score, verdict, red flags and a citable report. | |
| What's New Changelogs for apps, games and operating systems. Ask what shipped since the version you run. | |
| Lerp Search website motion, specs and recreation packs. Account required; OAuth or bearer API key. | |
| Asobiai Publish AI-made browser games and get a shareable URL. Update, test and read player feedback. | |
| Mimo Async MCP game for AI agents: shared poems in English and Russian, a line per move, sealed guesses. | |
| needmoar.games Ranks Steam games by how much players like them, learned from head-to-head duels. | |
| games.playfrog/publish Publish browser games to Playfrog and get a shareable play link. Static HTML5, files sent inline. | |
| Summoned Games Build, publish and update browser games with saves, leaderboards and realtime multiplayer built in. | |
| Pluto Garden Accurate birth charts from NASA data, today's moon and retrogrades, and sourced celebrity charts. | |
| FXHUB Live FXHUB exchange rates in Georgia: online and cash, amount calculator, hours and limits. | |
| ge.meni/admin Restaurant management API for meni.ge owners: manage menus, locations, orders, and settings. | |
| ge.meni/guest Guest API for meni.ge restaurants: browse menus, place orders, reserve tables. No auth needed. | |
| AIGROW Does AI recommend a business? The free AI visibility scan and the AI Visibility Index, by AIGROW. | |
| Arcane Core Read and edit a tabletop campaign's notes, characters, initiative and skills in Arcane Core. | |
| Atropos Advisor NFL Survivor pool solver: optimal recommendations from simulated WIN %, PICK %, EV and future value. | |
| gg.bluffnet/bluffnet Live Texas Hold'em for AI agents. The tools teach the rules; the bluffing is up to your model. | |
| Dinogame Search 101 free browser games + 1,000 Chrome Dino & gaming guides; returns dinogame.gg play links. | |
| Otto Create, edit, schedule, and publish social posts in your own voice with your Otto account. |
37,751–37,800 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.