Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Raspberry Pi Set up and maintain Raspberry Pi avoiding common hardware and configuration pitfalls. | |
| React Builds, debugs, and reviews React apps: components, hooks, state, Server Components, forms, performance, testing. Use when writing or refactoring components, choosing state management (useState, Context, Zustand, TanStack Query, Redux), whe | |
| React Native Build performant cross-platform mobile apps with React Native components, navigation, and native modules. | |
| Reading Help users read better — book recommendations, retention strategies, and matching reading approach to goals. | |
| Real Estate Guide any property decision for buyers, sellers, landlords, investors, or agents in any jurisdiction. | |
| Real Estate Agent Your personal real estate agent. Find properties, get alerts on deals, sell or rent your home, and navigate any property decision. | |
| Real Estate Investing Analyze real estate investments with conservative underwriting, financing stress tests, diligence gates, and exit planning. | |
| Recipes Captures, standardizes, scales, and files recipes into a personal collection that stays searchable and cookable. Use when the user pastes a recipe URL, photo, screenshot, video, voice note, or handwritten card to save; asks to halve, double | |
| Recommend Context-aware recommendations. Learns preferences, researches options, anticipates expectations. | |
| Recruiter Source candidates, screen resumes, and manage hiring pipelines with effective recruiting practices. | |
| Redis Designs, tunes, and debugs Redis: data structures, memory limits, persistence, Streams and queues, locks, replication, and cluster. Use when writing Redis commands or Lua, choosing between a hash, a sorted set and a stream, setting expirati | |
| Self Reflection Learns when to stop and review. Self-critiques before showing you, fewer revision rounds. | |
| Regex Write correct, efficient regular expressions across different engines. | |
| Remember Curate persistent memory that actually helps. Filter what matters, organize by function, decay what doesn't. | |
| Remind Reminds the user of commitments they already know — meetings, deadlines, bills, promises, follow-ups — at the right lead time, in their style. Use when the user says remind me, nudge me, ping me, or don't let me forget, mentions a deadline, | |
| Remote Desktop Connect to remote desktops via RDP, VNC, and SSH X11 with secure tunneling and troubleshooting. | |
| Render Deploy Deploy applications on Render with codebase analysis, render.yaml Blueprint generation, MCP direct provisioning, and post-deploy verification. | |
| Rental Find, negotiate, and manage rentals as tenant, landlord, host, or guest with market analysis, scam detection, and lease review. | |
| Report Configure custom recurring reports. User defines data sources, skill handles scheduling and formatting. | |
| REST API Build production-ready REST APIs with contract-first design, secure auth, robust testing, and deployment runbooks. | |
| Restaurants Build a personal restaurant system for tracking places to try, favorites, and dining memories. | |
| Resume Analyze and optimize resumes for ATS compatibility, tailor to specific jobs, highlight achievements, and address career level and transition challenges to bo... | |
| Retention User retention strategy, cohort analysis, churn prevention, and reactivation campaigns | |
| Reverse Engineering Reverse engineer binaries, APIs, protocols, and workflows with evidence ladders, interface maps, and falsifiable hypotheses. | |
| Review Code Review code with risk-first analysis, reproducible evidence, and patch-ready guidance for correctness, security, performance, and maintainability. | |
| Roblox Avoid common Roblox mistakes — server/client security, DataStore pitfalls, memory leaks, and replication gotchas. | |
| Robot Build robots from hobby to industrial with hardware wiring, ROS2, motion planning, and safety constraints. | |
| Roleplay Create persistent characters, run practice scenarios, and track progress across roleplay sessions with activation control and structured feedback. | |
| Romania Plan Romania trips with regional contrasts, Transylvania and Black Sea logistics, local food cues, and practical local guidance. | |
| Romanian Write Romanian that sounds human. Not formal, not robotic, not AI-generated. | |
| Rome Navigate Rome as visitor, expat, digital nomad, or entrepreneur with neighborhoods, transport, costs, visas, and Italian lifestyle insights. | |
| Ruby Write expressive Ruby with blocks, metaprogramming, and idiomatic patterns. | |
| Running Training principles, pacing strategy, injury prevention, and race preparation for runners. | |
| Russian Write Russian that sounds human. Not formal, not robotic, not AI-generated. | |
| Rust Writes, debugs, and optimizes Rust code, crates, and Cargo builds: ownership, lifetimes, traits, async, unsafe, and FFI. Use when the borrow checker rejects code, when rustc reports value moved, cannot borrow as mutable, does not live long | |
| S3 Work with S3-compatible object storage with proper security, lifecycle policies, and access patterns. | |
| SaaS Runs a SaaS business: subscription revenue, plan packaging, trials, retention, expansion, and enterprise readiness. Use when MRR or ARR has to be computed, reconciled, or explained; when NRR, gross margin, CAC payback, burn multiple, or rul | |
| Safari Browser Control Control Safari on macOS with AppleScript, safaridriver, screenshots, tab navigation, and real-browser read, click, and type workflows. | |
| Salesforce API Integration Calls the Salesforce REST, Bulk, Composite, and Metadata APIs: SOQL, record CRUD, upserts, OAuth, sync, and error handling. Use when querying, loading, exporting or syncing Salesforce data, when writing SOQL or SOSL against Account, Contact | |
| San Francisco Navigate San Francisco as visitor, resident, tech worker, student, or entrepreneur with neighborhoods, transport, costs, safety, and local insights. | |
| SAT Prepare for the SAT with adaptive practice, score prediction, weak area targeting, and college admissions planning. | |
| Scale Frameworks Scale systems, software architecture, and companies with bottleneck mapping, staged leverage plans, and risk-aware execution loops. | |
| Scanner Transform document photos into clean scanned-looking pages with automatic edge detection, cropping, and perspective correction. Use when (1) the user wants a... | |
| Schedule Program recurring or one-time tasks. User defines what to do, skill handles when. | |
| Scholar Search academic literature with Google Scholar using effective queries, citations, and filters. | |
| School AI-powered K-12 education with age-adapted learning, homework help, exam prep, parental controls, progress tracking, and curriculum support. | |
| Science Guide scientific understanding from childhood wonder to research precision. | |
| SciPy Solve optimization, statistics, signal processing, and linear algebra problems with SciPy recipes and ready-to-run code. | |
| Scrape Legal web scraping with robots.txt compliance, rate limiting, and GDPR/CCPA-aware data handling. | |
| Screenshot Capture, inspect, and compare screenshots of screens, windows, regions, web pages, simulators, and CI runs with the right tool, wait strategy, viewport, and... |
39,501–39,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.