Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| RymdenKollen — Swedish Space & Astronomy Swedish space & astronomy: ISS passes, aurora forecasts, space weather, rocket launches, moon. | |
| SkärgårdsKollen — Stockholm Archipelago Stockholm archipelago boats: realtime departures, trip planning, disruptions, island guides. | |
| SkyddsrumsKollen — Swedish Civil-Defence Shelters Find Sweden's nearest civil-defence shelters (skyddsrum): search, details, stats. Data: MSB. | |
| StreamKollen — Swedish Streaming Guide Where movies & TV stream in Sweden, trending titles and live sport broadcasts. | |
| VäderKollen — Nordic Weather Nordic weather: forecasts, warnings, HD radar, rain nowcast, lightning, aurora, satellite AI. | |
| Anchored Hope Index™ | Mental Resilience Counseling A professional resilience and future-orientation assessment for leaders, executives, and high-perfor | |
| Assess My Hair | Powered by Rich Mom Recommends Assess My Hair, powered by Rich Mom Recommends. Understand. Care. Thrive. Your personalized hair &am | |
| California Dog Bite Evidence Checklist | JSM Injury Firm Bitten or injured by a dog in California? Use this private checklist to understand what evidence to | |
| AI Recommendation Readiness Audit | The Black Friday Agency Can AI confidently recommend your business? The AI Recommendation Readiness Audit shows whether your | |
| California Slip & Fall Evidence Checker | JSM Injury Firm Not sure what to do after a slip and fall in California? Use this free evidence checker to find out | |
| Decision Support Network | Powered by CCA Decision Support Network helps humans and AI agents discover verified decision-support tools for spe | |
| The Grant Readiness Checklist | The Document Pro Assess your nonprofit's grant readiness with The Grant Readiness Checklist by the Nonprofit Lau | |
| OKC HVAC Calculator | Repair or Replace Decision Tool Use the free OKC HVAC Calculator to see whether repairing or replacing your heating or air system ma | |
| OKC Custom Home & Remodel Readiness Planner | Cosmopolitan Company Evaluate your project path, property readiness, budget planning, builder questions, smart-home prior | |
| OKC Disc & Sciatica Next-Step Checker | Precision Care Chiropractic Pain shooting down your leg? Answer a few questions about your lower back pain, sciatica, numbness, | |
| Solar Quote Audit — Check Before You Sign Free independent solar proposal review tool for California homeowners. Audit your solar quote for pr | |
| Student Protection Readiness Checklist | Safety Over Silence A 2-minute assessment to help parents understand and respond to student safety concerns with clarity | |
| VA Heroes PH — From Zero to Hero | Become a Virtual Assistant VA Heroes PH helps Filipinos become virtual assistants. Discover VA training, remote career paths, a | |
| Moodmark Let your AI agent build moodboards of real websites: save, search, tag and share design references. | |
| CapabilityWire A live, curated feed of new AI agent capabilities across MCP, SDKs, models, and APIs. | |
| Jawwws Bytes Link intelligence and measurable physical-to-digital activity for Jawwws Bytes workspaces. | |
| RealityCents — Hawaii Mortgage & VA Loan Calculators Read-only Hawaii mortgage and VA loan calculators from RealityCents.com. No personal data collected. | |
| BaeDang.info Dividend Data Search and rank Korean and US dividend stocks and ETFs by yield, growth, and cut history. | |
| ProxyAI Review support tickets, send approved replies, and manage supported ProxyAI Agent Tasks. | |
| io.github.jcpsimmons/granola-search Search Granola meeting notes by attendees, dates, content, and workspaces. | |
| SERVIQO Agents SERVIQO Agents: Founding Agent network (DistributionOS). Tracked Rhapsody share links. Pilot. | |
| wobblehaus Your family's corner of the web: describe it, and wobblehaus builds it. | |
| Barbaro Read published house pizza facts and calculate dough and ingredient balance. | |
| Adaga Network — Direct Booking Federation Search and book every Adaga network hotel at once: live availability, exact prices, real booking. | |
| Adaga solutions — Data APIs Toolbox 15 pay-per-event data APIs: Maps, social, RAG, reviews, fuel and AI visibility. | |
| Yasha Hotel — Direct Booking Book Yasha Hotel Luxembourg: live availability, exact prices, Stripe-secured booking. | |
| Indian Pixels Generate images, videos, music & lip sync with 200+ AI models (Flux, Veo 3, Kling, Suno) | |
| io.github.Jenpo/fxpeek Historical reference exchange rates with a source link per row. Tools: get_latest_rate, get_history. | |
| Saturation Search, query, and update budgets, transactions, contacts, and purchase orders in Saturation. | |
| Jentic Remote MCP Server Remote MCP for 1,500+ APIs. Vault-managed credentials; OAuth or API key. Search, load, and execute. | |
| Caption-Pack Deterministic social-caption API: hooks, bodies, CTAs + hashtags as JSON. No LLM in the loop. | |
| Corium 21 Skin Tools Decode skincare ingredient labels (1% line, % ranges, what each does) and get US dry skin forecasts. | |
| io.github.jethrokirk-sudo/filingapi SEC filings, earnings transcripts, guidance signals & macro calendar for S&P 500. 11 MCP tools. | |
| BuildFlow Enterprise Operations Discover, route, and hand off enterprise operations problems without exposing private records. | |
| Career Command AI interview practice and career preparation with user-controlled guidance. | |
| Evercraft Deck Capital Fit Capital-fit research and founder readiness with human-confirmed checkout. | |
| EventWave Event discovery and promotion workflows with human-controlled publishing and commerce. | |
| Evercraft Capability Discovery Read-only matching from user problems to public Evercraft capabilities. | |
| FAIE Evidence-first food-infrastructure and resilience intelligence on owned Evercraft Fabric. | |
| FindMyPart Hard-to-source part discovery with replacement, salvage and fabrication paths. | |
| ROASTED 99-cent text pressure tests with human-confirmed checkout and paid-result retrieval. | |
| Systemia Field Library Match contractor operating problems to practical Field Library playbooks. Read-only discovery. | |
| Systemia Website Audit Website, local SEO, performance and conversion audits with human-confirmed checkout. | |
| Website Launch Business website planning and launch assistance with human-confirmed next steps. | |
| 0Latency Memory Persistent memory layer for AI agents. Sub-100ms recall, semantic search, knowledge graphs. |
39,701–39,750 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.