Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Ukrainian Write Ukrainian that sounds human. Not formal, not robotic, not AI-generated. | |
| Umami Deploy Umami analytics avoiding data loss, tracking failures, and integration issues. | |
| Uniswap Assist with Uniswap swaps, liquidity provision, and avoiding common DeFi losses. | |
| United States Plan United States trips with region-specific routing, verified entry rules, transport logistics, and practical tourist safety. | |
| Unity Avoid common Unity mistakes — lifecycle ordering, GetComponent caching, physics timing, and Unity's fake null. | |
| University Provide AI-powered degree and career programs with adaptive learning, exam prep, progress tracking, and customized study planning for diverse user goals. | |
| Unreal Engine Avoid common Unreal mistakes — garbage collection, UPROPERTY macros, replication authority, and asset reference pitfalls. | |
| Upwork Optimize Upwork profiles, write tailored proposals, identify client red flags, draft professional messages, and advise on pricing and client retention strate... | |
| Urdu Write Urdu that sounds human. Not formal, not robotic, not AI-generated. | |
| Use Cases Discover what AI agents can do for you with practical examples by role, task type, and skill level. | |
| USMLE Prepare for US medical licensing exams with progress tracking, weak area analysis, question bank management, and residency match planning. | |
| Utrecht Navigate Utrecht as visitor, resident, tech worker, student, or entrepreneur with neighborhoods, transport, costs, visas, and local insights. | |
| UX Design and analyze user experiences that are intuitive, efficient, and aligned with user mental models. | |
| UX Researcher Generate user personas, pain points, journey maps, and UX recommendations without conducting interviews. | |
| Valencia Navigate Valencia as visitor, resident, tech worker, student, or entrepreneur with neighborhoods, transport, costs, visas, and local insights. | |
| Vancouver Navigate Vancouver as visitor, resident, tech worker, student, or entrepreneur with neighborhoods, transit, costs, immigration, and local insights. | |
| Venice Navigate Venice as visitor or resident with neighborhoods, transport by water, costs, local insights, and authentic experiences beyond tourist traps. | |
| Venture Capital Evaluate startups, structure deals, and make investment decisions with VC frameworks and due diligence patterns. | |
| Veterinary Support veterinary understanding from pet care to clinical practice and research. | |
| Vibe Clawing Transition from vibe coding to vibe clawing by trusting agents with full responsibilities, designing self-closing loops, and climbing the bottleneck ladder. | |
| Vibe Coding Build software with AI by describing what you want. Covers prompting techniques, workflow patterns, rules files, and when to intervene. | |
| Vibe Design Create visual designs with AI tools. Covers prompting for UI/graphics, Midjourney techniques, Figma AI workflow, and iteration patterns. | |
| Vibe Marketing Run marketing campaigns with AI automation. Covers content generation, workflow automation, copy that sounds human, and rapid testing. | |
| Vibe Research Conduct AI-led research with autonomous literature review, hypothesis generation, analysis, and synthesis while human provides vision. | |
| Video Process, edit, and optimize videos for any platform with compression, format conversion, captioning, and repurposing workflows. | |
| Video Captions Generate professional captions and subtitles with multi-engine transcription, word-level timing, styling presets, and burn-in. | |
| Video Downloader Download online videos with quality and format controls using yt-dlp for reliable local saves. | |
| Video Editing Edit videos with AI background removal, color grading, upscaling, stabilization, and enhancement tools. | |
| AI Video Generation Create AI videos with Sora 2, Veo 3, Seedance, Runway, and modern APIs using reliable prompt and rendering workflows. | |
| Vienna Navigate Vienna as visitor, resident, tech worker, student, or entrepreneur with neighborhoods, transport, costs, safety, and local insights. | |
| Vietnamese Write Vietnamese that sounds human. Not formal, not robotic, not AI-generated. | |
| Vinted Buy and resell on Vinted with listing systems, price discipline, shipping workflows, and trust-first handling for offers, bundles, and disputes. | |
| Violin Violin practice strategies, technique correction, intonation development, and progress tracking. | |
| Vite Configure and optimize Vite for development, production builds, and library bundling. | |
| Voice Notes Organize voice message transcripts into a structured, searchable knowledge base with tags, links, and progressive note-taking. | |
| VPN Configure and troubleshoot VPN connections for privacy and remote access. | |
| VPS Runs rented virtual private servers end to end: picking a provider and plan, first boot, snapshots, resizing, IP addresses, and moving between hosts. Use when choosing between Hetzner, DigitalOcean, Vultr, or Linode, when a box is unreachab | |
| VR Set up VR headsets, troubleshoot common issues, optimize comfort, and recommend experiences by use case. | |
| VSCode Configures, debugs, and speeds up Visual Studio Code: settings scopes, launch.json, tasks.json, extensions, keybindings, formatters, and remote work. Use when a setting has no effect because something else overrides it, when format-on-save | |
| Vue Builds, debugs, and reviews Vue 3 apps: reactivity, components, composables, Pinia state, Vue Router, forms, and performance. Use when the UI does not update after a state change, a reactive object loses reactivity on destructure or reassig | |
| Walmart Plan Walmart grocery and household orders with pickup timing, substitutions, repeat restocks, and budget-aware cart decisions. | |
| Wardrobe Build a personal wardrobe system for cataloging clothes, planning outfits, and mindful shopping. | |
| Water Tracker Tracks daily water intake from casual mentions and sets hydration targets from weight, exercise, heat, and health context. Use when the user logs a drink ("had a glass", "finished my bottle"), asks how much water they should drink or whethe | |
| Weaviate Build vector search with Weaviate using v4 syntax, proper module configuration, and production-ready patterns. | |
| Web Development Build, debug, and deploy websites using HTML, CSS, JavaScript, and modern frameworks following production best practices. | |
| Webflow Build, launch, and optimize Webflow sites with responsive design, CMS architecture, and clean handoffs. | |
| Webhook Implement secure webhook receivers and senders with proper verification and reliability. | |
| Website Build fast, accessible, and SEO-friendly websites with modern best practices. | |
| WebSocket Implement reliable WebSocket connections with proper reconnection, heartbeats, and scaling. | |
| Wedding Planner Plan weddings with budget guardrails, guest-list scenarios, vendor scorecards, payment tracking, and deadline-driven coordination. |
39,701–39,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.