Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Taxi Handle everything for ground transportation, from price comparison to booking, tracking, disputes, and expense management. | |
| Teacher Plans lessons, units and syllabi, designs assessments and rubrics, marks and gives feedback at scale, and runs a room that behaves. Use when you are the one teaching: preparing a lesson, unit, course syllabus, workshop or training session; | |
| Technical Debt Reckless versus prudent categorization, tracking the inventory, and a payoff cadence that does not freeze delivery. | |
| Telegram Bot API Build Telegram bots with correct API calls, message formatting, keyboards, and webhook setup. | |
| Temu Shop smarter on Temu with price tracking, review analysis, scam detection, and shipping optimization. | |
| Tencent Navigate Tencent products, Tencent Cloud services, and WeChat ecosystem decisions with region-aware planning and official-source verification. | |
| Tenerife Navigate Tenerife as visitor, resident, digital nomad, or retiree with zones, transport, costs, residency, and local insights. | |
| TensorFlow Avoid common TensorFlow mistakes — tf.function retracing, GPU memory, data pipeline bottlenecks, and gradient traps. | |
| Terraform Writes, debugs, and refactors Terraform — HCL and modules, plan and apply failures, state surgery, drift, and provider pinning. Use when writing or reviewing HCL, when terraform plan or apply errors out, when a plan shows a permanent diff, | |
| TestFlight Distribute iOS and macOS beta builds with TestFlight, tester management, and CI/CD automation. | |
| Texas Navigate Texas for living, moving, working, and road trips with region fit, state rules, weather risk, and daily logistics. | |
| Text Transform, format, and process text with patterns for writing, data cleaning, localization, citations, and copywriting. | |
| Thai Write Thai that sounds human. Not formal, not robotic, not AI-generated. | |
| Thailand Choose the best Thailand base for travel, remote work, expat life, or business with visa clarity, cost reality, and local operating playbooks. | |
| Therapist Evidence-based therapeutic techniques — CBT, ACT, mindfulness, and reframing for anxiety, rumination, and behavioral patterns. | |
| Thermostat Adjust temperatures, diagnose comfort issues, calculate energy savings, and automate schedules through voice commands or smart home integration. | |
| Three.js Build 3D web experiences with proper resource management and performance patterns. | |
| TicketMaster Search Ticketmaster events, venues, and attractions with Discovery API filters, market-aware queries, and copy-ready curl and shell helpers. | |
| TikTok Ads TikTok advertising strategy, creative best practices, Spark Ads, and platform-specific optimization | |
| Time Management Plan days, prioritize tasks, and protect focus time with time blocking, weekly reviews, and energy-aware scheduling. | |
| TimescaleDB Store and query time-series data with hypertables, compression, and continuous aggregates. | |
| Tinder Coach Tinder goals with profile reviews, opener feedback, chat triage, and local experiments that improve matches and dates over time. | |
| TOEFL Prepare for the TOEFL iBT exam with progress tracking, weak area analysis, score prediction, and university targeting. | |
| Tokyo Navigate Tokyo as visitor, resident, tech worker, student, or entrepreneur with neighborhoods, transport, costs, safety, culture, and local insights. | |
| TOML Write valid TOML configuration files with correct types and structure. | |
| Tools Learns your tool preferences while staying capable of using anything. Adapts to your stack. | |
| Toronto Navigate Toronto as visitor, resident, tech worker, student, or entrepreneur with neighborhoods, transit, costs, immigration, and local insights. | |
| Trader Analyze markets, manage risk, and execute trades with disciplined strategies and emotional control. | |
| Trading Trading analysis and education. Technical analysis, chart patterns, risk management, and position sizing for stocks, forex, and crypto. | |
| Traditional Chinese Write Traditional Chinese that sounds human. Not formal, not robotic, not AI-generated. | |
| Traefik Avoid common Traefik mistakes — router priority, TLS configuration, Docker labels syntax, and middleware ordering. | |
| Translate Translates and localizes text, software strings, documents, subtitles, and marketing copy between any language pair. Use when translating anything, when fixing a translation that reads machine-made, or when localizing a product: ICU plurals | |
| Travel Runs a traveler's standing system: dream list, passports and visas, Schengen day counts, bookings, points, budgets, and what broke last time. Use when someone names a destination they want to visit someday, when a passport, visa, ETA, or en | |
| Travel Planning Plan trips with itineraries, multi-city routing, budget optimization, family logistics, packing lists, and visa timelines. | |
| Trending Now Monitor internet and social media trends with heartbeat topic watchlists, freshness scoring, and concise alerts on what changed and why it matters. | |
| Triage / Task Prioritization Prioritizes competing tasks into P0-P3 by cost of delay and decides what to do first, what waits, and when to interrupt current work. Use when tasks pile up or everything feels urgent, when a request arrives mid-task, when triaging bugs, ti | |
| Tripadvisor Find and compare Tripadvisor hotels, restaurants, and attractions with official API workflows, URL-first navigation, and policy-safe data handling. | |
| TRON Assist with TRON TRX transactions, bandwidth, energy, and TRC-20 token transfers. | |
| Turkey Plan Turkey trips with city-coast-Cappadocia routing, verified entry rules, domestic transport strategy, and practical seasonal safety. | |
| Turkish Write Turkish that sounds human. Not formal, not robotic, not AI-generated. | |
| Tutor Personalized tutoring for any age and subject with adaptive teaching, progress tracking, and parent oversight. | |
| Tuya Smart Control and automate Tuya Smart devices with official cloud APIs, secure request signing, region-aware routing, and safe command execution. | |
| TypeScript Writes, reviews, and debugs type-safe TypeScript: type errors, narrowing, generics, tsconfig strictness, and declaration files. Use when a build hits type errors ("not assignable", "possibly undefined", "excessively deep", "cannot find modu | |
| Typography Foundations Set type with optimal measure, leading, tracking, optical sizes, and weight for screen and print, distinguishing display versus text cuts and effective pairing. | |
| Uber Eats Navigate Uber Eats in a live browser or app handoff to compare merchants, manage carts, and reach checkout safely. | |
| Udemy Create, publish, and monetize Udemy courses with curriculum design, AI-assisted content creation, and platform compliance. | |
| Udio Generate AI music with Udio via API wrappers or browser automation, with prompt engineering and song extensions. | |
| UGC Create viral user-generated content for marketing with effective hooks, formats, and creator strategies. | |
| UI Design clear, consistent, and visually polished user interfaces. | |
| United Kingdom Plan United Kingdom trips with nation-specific routing, ETA-aware entry rules, rail-road tradeoffs, and practical local logistics. |
39,651–39,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.