Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Chairman Sovereign's 14-Floor Data Hotel 113 MCP tools: oracle, escrow, compliance, remittance, AI. 12 free tools, PAYG $0.001/call. | |
| FirstSales OAuth CRM tools for companies, deals, campaign insights and contact creation in FirstSales. | |
| Fjordova Fjordova MCP gateway for Fortnox accounting data and tools, with OAuth-based user authorization. | |
| Flagram Ad marketplace: search Telegram/VK/Max channels by topic, geo, price; reach, ER, CPV stats. | |
| io.github.flarco/sling-cli Sling CLI MCP server for data pipeline and replication management | |
| Google & YouTube Search, Transcripts and Data - FlashData Google & YouTube data: search, news, images, shopping, places, transcripts, captions and downloads. | |
| Resell Pro Observed Vinted market analytics: compare brands, research niches, and discover trends via OAuth. | |
| AIUseCaseHub Source-linked enterprise AI deployment search. Free preview; API keys unlock full results. | |
| NEMO x402 Micro-Services MCP catalogue + x402 Doctor. Paid HTTP via x402 (USDC), IETF MPP, or Stripe cards on $1+ routes. | |
| AgentX x402 Services (paid MCP tools) All 26 AgentX paid services as MCP tools — site checks, markets, crypto, email DNS, AI text work. | |
| io.github.flowpackplugin/flowpack Flowpack: Shopify design catalog — badge/button/bar looks, honest-urgency presets, diagnosis. | |
| DeepSeek PDF Reader PDF文字提取(自动OCR) · 搜索(正则+高亮) · 表格(三路径) · 预览 · 摘要 · 图片 · 单页 · OCR进度推送 | |
| Gondar Search open grants, tenders and fellowships from official sources, with facts and official links. | |
| FMagenticL Deterministic failure depository for AI agents. Fixes runtime crashes with signed RFC 6902 patches. | |
| FMEPM Connect for Oracle EPM Claude, connected to your own Oracle EPM. Each person as themselves, every call checked and logged. | |
| Fmind Freelance AI Architect Website Read-only access to Fmind's portfolio, articles, and sites. | |
| Foam Observability Query application logs, traces, and metrics from your AI coding assistant via Foam's MCP server. | |
| mdprint documentation Read-only mdprint product information, documentation and Markdown examples. No document uploads. | |
| io.github.followtz/intent-runtime Express intent, get results. One unified entry point. | |
| MACD Strategy MACD signals | |
| io.github.followtz/mcp-utils Data processing tools: CSV, cleaning, stats, image, report, save, shell | |
| ForInvest MCP Server Financial data and analysis tools for Turkish BIST and international markets via MCP. | |
| Forge AI Accountability Demo of Forge decision accountability on fictional Acme Mutual: signed, replayable records. | |
| io.github.ForkastPredict/forkast-mcp-docs MCP server for querying Forkast documentation | |
| Türkiye Central Bank (TCMB) Exchange Rates Unofficial access to CBRT/TCMB daily exchange rates: latest, history since 1996, conversion. | |
| Türkiye Business Days & Public Holidays Türkiye public holidays (incl. half-day eves, Diyanet dates) and business-day math, 2022–2035. | |
| Turkish IBAN, Tax Number & National ID Validation Checksum validation of Turkish IBANs, tax numbers (VKN) and national IDs (TCKN). Nothing stored. | |
| UnboxAPI — Hospitality Reservation MCP Server REST-to-MCP for UK hospitality. Safety proxy: circuit-breakers, rate limits, whitelists. Apache 2.0. | |
| Premiss Create Python strategies and backtest crypto, stocks and ETFs in Claude. Premiss account required. | |
| Fractera Zero-Ops deploy of a private AI workspace to your own VPS — from your AI chat. Free and open-source. | |
| io.github.francofuji/cemis-directorio Directorio de empresas cubanas, oportunidades de negocio y reformas económicas 2026 (cemis.io) | |
| Aether: Base onchain data & token risk (x402) Base token risk (honeypot sim), prices, balances, Basenames, tx data. Pay-per-call in USDC via x402. | |
| BagIQ MCP Analyse disc golf bag gaps and overlap, recommend discs, and open an interactive Bag Map. | |
| DiscGolfAPI MCP Search disc golf courses worldwide, find nearby courses, and retrieve course details and updates. | |
| TheDiscList Public MCP Search disc golf discs, compare flight ratings, and find similar alternatives across brands. | |
| QuietProof 29 deterministic read-only audits + free discovery tools; paid per call in USDC on Base via x402. | |
| Astro API Astronomical logical calculator for AI clients. | |
| MAVENS.mcp Review connected software projects, submit local findings and read reports with explicit approval. | |
| ALPNAI — Agent Performance Tools Agent cost, latency and quality analysis, report delivery and order status. Crypto payments paused. | |
| io.github.freshfos/dropcoin-a11y Accessibility pre-checks (WCAG/BFSG) in a real browser + statement drafts. Pay per call. | |
| io.github.freshfos/dropcoin-invoice German e-invoicing: generate XRechnung 3.0, pre-check and extract (incl. ZUGFeRD PDF). Paid. | |
| io.github.freshfos/dropcoin-utility Utility data for AI agents: IBAN, EU holidays, VAT rates, time zones, ECB FX. Pay per call. | |
| io.github.freshfos/dropcoin-validation EU compliance checks for AI agents: sanctions, company, VAT ID, IBAN, email. Pay per call. | |
| FXI Studio Generate cinematic images and video and chain shots into continuous motion. | |
| Japan Address & Geocoding Japanese address search and geocoding (official address registry): postal codes and coordinates. | |
| Japan Corporate Filings Search Japanese corporate disclosures (FSA EDINET): securities reports and shareholding reports. | |
| Japan Official Statistics Search official Japanese government statistics (e-Stat): population, economy, labor, and more. | |
| Japan Weather & Alerts Japan weather forecasts and disaster alerts from JMA: forecasts, warnings, and earthquake info. | |
| Morfee Turn an HTML template plus JSON into a finished PDF: a quote, invoice, work order or certificate. | |
| SALT19 Agent Utility Grid MCP/x402 tools with bounded decisions, adaptive pricing, and Proof402 machine-commerce receipts. |
39,451–39,500 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.