Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Nityaflow Build WhatsApp, Sheets and Gmail automations for Indian businesses; check GST credit. | |
| PaisaTrade Learn the Indian stock market: delayed NSE quotes, screener, IPOs, courses and paper trading. | |
| Pro UPI QR UPI payment links and QR codes, UPI error help, and GST, MSMED and MDR calculators for India. | |
| IndexPulse Bing Webmaster, IndexNow and Google Search Console for AI: rankings, indexing gaps, AI crawlers. | |
| Vigil by PuzariCloud Ask your AI what's broken: incidents, monitors, servers, logs, errors and traces from Vigil. | |
| RailRoute journey planner Plan intercity journeys in India by train, flight or both, with a fare for every travel class. | |
| RemoteStack Search 50,000 live remote jobs, match your resume, get a tailored resume and cover letter. | |
| ReqRes Hosted backend for AI agents: create projects with persistent collections and keys, no signup. | |
| RetailIntel — Indian retail moves What moved in Indian retail: store openings, deals, results, launches, leadership, each verified. | |
| RunLite Hosts AI-built websites with working contact forms. Enquiries arrive by email or WhatsApp. | |
| Sambodh IAS UPSC prep: interactive quizzes, previous-year questions, daily current affairs, cited study search | |
| in.termal/termalin-web Run commands and read/write files on your servers over Termalin's keyless tunnels (hosted MCP). | |
| in.therapistsnearme/directory Search India's credential-verified therapist directory: read-only, public, checkable registrations. | |
| Xavio Merchant Authenticated MCP for Xavio merchants: stories, products, schedules. | |
| Xavio Storefront Search the public Xavio catalog and create firm checkout quotes. | |
| Zelta BMI for Indians BMI check with Indian (Asian) cutoffs and a healthy weight range for any height. | |
| Zelta Daily Calorie Target Daily calorie target to lose, keep or gain weight, plus a weight goal timeline. | |
| Zelta Protein Per Day Daily protein need by weight and goal, with a sample Indian food plan to hit it. | |
| Zelta Steps to Calories Calories burned by a step count, and steps needed to walk off a food. | |
| Zelta Waist Size Check Waist size health check (Indian cutoffs) and the waist size to stay under. | |
| 3dCMS Build a real 3D website by chatting: pages, models and text in space, published to a live URL. | |
| AppGoblin - App Store ASO & App Intel Research iOS and Android apps, use keyword marketing tools, see app installs, revenue and sdks. | |
| AstroWay Applied readings Business, financial and wellness astrology, written for a use rather than a technique. | |
| AstroWay Astrology API (full catalogue) Every AstroWay endpoint as a tool: Western, Vedic, Chinese, Human Design, tarot, reports. | |
| AstroWay Chinese metaphysics BaZi four pillars, Zi Wei Dou Shu, the Chinese calendar and feng shui. | |
| AstroWay Core astrology Natal charts, planets, houses, aspects, dignities, rendering and the calendar. | |
| AstroWay Divination and esoterica Geomancy, I Ching, runes, Mayan calendar, Kabbalah, palmistry and the esoteric suite. | |
| AstroWay API Docs AstroWay API documentation search and endpoint lookup with credit prices. No API key needed. | |
| AstroWay Forecasting Transits, progressions, directions, returns, cosmobiology and evolutionary technique. | |
| AstroWay Hellenistic and traditional Lots, sect, triplicity rulers, zodiacal releasing, annual profections and horary. | |
| AstroWay Human Design Bodygraph, centres, channels, incarnation cross, penta and group overlay. | |
| AstroWay Numerology Pythagorean and Chaldean systems, Kabbalistic numbers, destiny and name analysis. | |
| AstroWay Platform Webhooks, streaming and the AI interpretation endpoints. | |
| AstroWay Psychological astrology Archetypes, Jungian typology, shadow work and the relationship-style readings. | |
| AstroWay Relationships Synastry, composite, compatibility scores, family dynamics and pet charts. | |
| AstroWay Reports Sixteen finished PDF reports and the white-label configuration behind them. | |
| AstroWay Tarot Rider-Waite-Smith, Marseille and Lenormand: spreads, draws, card pictures and spread readings. | |
| AstroWay Vedic astrology Vargas, dashas, panchang, shadbala, yogas, doshas, Jaimini, KP and Vastu Shastra. | |
| ChinaHealth Sourced facts on treatment in China: hospitals, dated price ranges and process guides. Read-only. | |
| HenryKnows F-1 and J-1 student immigration answers with citations to regulations and agency guidance. | |
| Known Shared memory for teams: every AI agent works from your company's knowledge, decisions and history. | |
| info.mosaique/mcp Search and list latest international news (sources, comments, knowledge graph). | |
| Programmable Find companies from public records, enrich domains, find work-email formats and run sales agents. | |
| STRIDE Digital-regulation tracking and analysis across jurisdictions; STRIDE access is required. | |
| Verified Tools — AI Visibility Monitoring AI-visibility monitoring for your brand across ChatGPT, Claude, Perplexity & Gemini. | |
| VetClinic.info — Veterinary Specialty Directory Find US veterinary specialists. Search clinics, read procedure articles, estimate costs. | |
| Working Proxy Sites Research proxy providers, compare published prices, and discover provider MCP integrations. | |
| Yank Five sourced lines from a video, podcast, article or PDF, and a check that a quote is in its source | |
| Argus: Belgian tender insights Belgian public tender insights: who bids, who wins, winning prices, your award report scores. | |
| Compound Interesting — market intelligence Source-backed US market signals: insider filings, Congress trades, institutions, consensus. |
37,951–38,000 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.