Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Cross Country Movers Quote Instant US car shipping quotes: open and enclosed prices, pickup window, transit time. | |
| DilutionLens — ASX dilution ASX dilution data from company filings: raises, options overhang, cash runway, capacity. Keyless. | |
| Italian Company Verification – Official Sources Verify Italian companies for KYB, supplier onboarding and procurement using official/public sources. | |
| Partwright Describe a replacement or custom plastic part in chat, preview it in 3D, and order it 3D-printed. | |
| 九启高企免费自测 只读返回九启高企免费自测入口、用途、免责声明和自愿留资边界，不接收企业材料或联系方式。 | |
| Ranger Live US campground availability, wildfire and river conditions, and trails on public land. | |
| AisleSignal — Agent checkout reviews Check and share agent checkout reports: bot blocks, payment methods, outcomes and navigation effort. | |
| CanIShop — Agent checkout reviews Checkout reviews via OAuth or agent API keys: bot blocks, payment methods, outcomes and effort. | |
| ExcelDashboard AI Generate visual analytical reports from verified outlines. Account and OAuth required. | |
| PropertyLabs Public building permits, property assessments, parcels and development intelligence. | |
| Algolia Productivity Connect LLM tools to your Algolia account with user-scoped access for internal workflows. | |
| Ribox Exact tools for AI assistants: QR codes, word counts, text diff and JSON checks. Free, no account. | |
| Alias Forum Knowledge exchange on the future of AI for agents: sign up in one call, join sourced rounds. | |
| AI Watermark Remover Remove watermarks and overlays from images the user owns or has permission to edit. | |
| SmittyHQ Family calendars, tasks, reminders, and pickup coordination for your AI assistant. | |
| Issuerwire — capital markets news for AI agents Issuerwire — capital markets news for AI agents, one signed row per filing; markets: see facts.json. | |
| Alpha Sophia Claims-grounded provider, market, and KOL intelligence for healthcare AI agents via Alpha Sophia | |
| Swiss Whale Intelligence Multi-asset whale forensics: BTC, ETH, SOL, USDT, tokenized gold. 45 tools, free OAuth tier. | |
| Altss Documentation Search Altss public docs. Includes provider feedback submission; no premium intelligence access. | |
| thePaymentsNotes Ledger Verified agentic-commerce protocol status + merchant agent-readiness reports. Free on testnet. | |
| io.github.amakkar-leap/convergent-provider-directory Search a healthcare provider directory and get full provider details by id. | |
| Birthstar Vedic Astrology MCP 30 Vedic Jyotish tools: natal charts, dashas, yogas, nakshatras. Swiss Ephemeris. | |
| nitur Create projects and read their web analytics: views, referrers, countries, custom events. | |
| 12Backlinks How many referring domains to reach Google page 1 for a keyword: top 10 median, range, significance. | |
| io.github.AmauryDvl/serpmantics French-first SEO: semantic content guides, scoring, E-E-A-T audits for Google, ChatGPT & Claude. | |
| Horry County Construction Leads Live Horry County construction leads for low-voltage, networking, security, AV, POS, and electrical. | |
| Horry County Construction Leads Live Horry County construction leads for low-voltage, networking, security, AV, POS, and electrical. | |
| Professor Amir Ghaffarianhoseini — Architecture Research Architecture research, profile and full DOI citations for Professor Amir Ghaffarianhoseini. | |
| 4fetch Fetch a URL and get clean Markdown with metadata. No API key required; rate-limited per IP. | |
| io.github.amitblecher/trade-manager Backtest any trading setup on the S&P 500 vs random days, and see which stocks matched today. | |
| Nothing.gripe Funded one-off task marketplace: list open tasks, read, estimate, post and fund. | |
| Micro Tool Factory — Commerce, Jobs and Web Data Shopify, jobs, feeds, GitHub, Hacker News, YouTube and Apple App Store via Apify MCP. | |
| SHOP MCP — Claude Connector for Shopify Connect Claude to your Shopify store. Edit themes, pages and products by describing what you want. | |
| ImgEdify: AI Image Editor, AI Image Generator, AI Video Generator, AI Video Editor & AI Video Maker Generate and edit images, create videos, quote credit costs, and retrieve private results. | |
| Malware Patrol Threat Intelligence MCP server Our MCP Server connects AI workflows to current, curated cyber threat intelligence | |
| SatMCP Find recent or archived satellite imagery for any place on Earth by location and date. | |
| io.github.andrew-ji-cupix/cupix-compass Explore and analyze Cupix construction site data: 360 images, progress, and insights. | |
| io.github.andrew-sondgeroth/zipexplore-mcp US ZIP code intelligence: demographics, weather, tax, crime, housing, voting, and more. | |
| UXSense Drift Behavioral drift context (Behavioral Load Map, hot paths, release brief) for coding agents, per PR. | |
| Agent Room An agent hostel with open registration, a common room, and durable private threads. | |
| Cronfy Time tracking you talk to: log, check and fix your work hours from your AI assistant. | |
| VolgaTrip Публичные лодки VolgaTrip, проверка доступности и стоимости прогулки. Только чтение. | |
| Mono eSIM — Travel Connectivity for AI Agents Search travel eSIM plans, check devices, and create secure customer-paid checkout links. | |
| OffStereo Builds narrated, playable music stories, explores sample lineage, and saves verified playlists. | |
| Remote Dev Jobs Live remote frontend, backend and Java developer jobs: search, salaries, hiring companies. | |
| Branching Inquiry AI-agent MCP: Branching Inquiry invitation, P001 challenge, participation terms and status. | |
| Ground Truth - Fresh Evidence for AI Agents Keep AI answers fresh with free source previews, scheduled monitoring, evidence history, and alerts. | |
| Kickjolly Football Read-only football briefs, club coverage and attributed sources from Kickjolly. | |
| Co-Op Now Find co-op games by party size, local/online, platform and crossplay. | |
| Anomaly AI AI data analyst: ask about your Excel, CSV, GA4 or database data and get charts and dashboards back |
38,401–38,450 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.