Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| io.github.KyleClouthier/slotrobin Find, get quotes from and book local service businesses on their own Square or Google calendar. | |
| SourceToMe Search and cite passages from a vetted, rights-cleared reference library. | |
| LabFolio Research portfolio management — organize projects and track research artifacts. | |
| RxRadar Semantic search across 5 US government healthcare databases. | |
| Monk.trade Stock research for AI assistants: scan US stocks, ETFs and futures, cite SEC filings, save queries. | |
| Searchwire SEO data for AI agents: keyword volume, Google results, App Store keywords, domain and name checks. | |
| Landfall Website intelligence for AI agents: landing page audits, business contact details, tracking checks. | |
| Boundary Guard x402 MCP tools for x402 readiness, paid-path probes, launch packs, and trust receipts. | |
| GPU Economy - cloud GPU prices Hourly cloud GPU prices from 80+ providers: find, compare, cost and track GPUs. | |
| LastDatabase Search B2B contacts and business leads through an OAuth-secured MCP server with masked results. | |
| SkillDB Catalog Find AI agent skills: public previews and source links. Read-only discovery; no account required. | |
| Grigora Build and manage Grigora websites, CMS content, directories, ecommerce catalogs, assets, and SEO. | |
| Docfarm Publish, edit, share and track HTML docs and decks from chat, with view analytics. | |
| Spritesheet Forge Game-dev sprite tools: PNG/GIF to spritesheet, split, trim, animate. OAuth-authenticated MCP server. | |
| Layro React + Tailwind UI components and recipes your AI coding tool can search and install. | |
| LCX Liberty DEX Best-route swap quotes, token search and USD prices across EVM chains. Read-only, never trades. | |
| io.github.leaderracom-hue/leaderra GTM data layer for AI agents: find scored B2B leads free, reveal verified email+mobile, audit ads. | |
| LeakData Check breach exposure for your verified email and check locally computed password hash prefixes. | |
| Kitsuvo Browse and inspect sites in your own Kitsuvo browser through an opt-in authenticated relay. | |
| Factur-X: Generate & Validate E-Invoices Validate Factur-X, CII & UBL e-invoices free, no key. Generate compliant invoices from JSON. | |
| Import Check: Validate & Clean CSV Validate and prepare CSV; reconcile two tables with exact keys and full findings. Fixed free demos. | |
| io.github.LedgerProof/laen On-demand unblocking for AI agents: find blockers free, pay via x402 on Base, get anchored proof. | |
| TakeHome API Verified UK take-home pay: income tax, NI, student loans, pensions, with GOV.UK sources. | |
| 법이 닿는 곳 (Where Law Reaches) Korean statutes, precedents, local business-district stats and public procurement for AI agents. | |
| WellFred — Services in Costa Rica Find Costa Rica services, providers, classes and events; check availability and prepare bookings. | |
| StoreFast Publish desktop apps to the Microsoft Store and check their downloads, reviews and Store listing. | |
| Dream Pixel Forge Create and edit on-brand images and videos with reusable character and product references. | |
| Ragfeed Web pages, PDFs and search results as LLM-ready Markdown or chunks. Firecrawl-compatible, EU-hosted. | |
| Lemonado MCP server for querying and analyzing data from ad platforms, analytics tools, and spreadsheets | |
| Brek - Hotel Wholesale Booking Search hotels, compare room offers and public or masked wholesale rates, then continue on Brek. | |
| Brek — Book Direct Search Airbnb vacation rentals and find direct booking options for the same homes. | |
| CareOpenly - Find Senior Living Communities Find U.S. senior living communities, public prices, reviews and licensing records. | |
| HotelUse - Hotel Metasearch Compare hotel prices, room options and booking providers with live HotelUse searches. | |
| RoomLast - Last-Minute Hotels Find last-minute hotels, compare room offers, and continue on RoomLast to book. | |
| SOTA2 — AI Solution Rankings Compare published AI solution rankings, company facts and research benchmarks with sources. | |
| StayForWork - Housing and Hotels for Travel Workers Find extended-stay hotels and furnished housing near work assignments. | |
| PRAXIS AI work organization in Brazilian Portuguese: turns meetings and docs into decisions and tasks. | |
| AgentFlow Wash/sybil screening + Real-Agent Index for Base wallets — real agent or fake-volume sybil? | |
| TO1 Intelligence Fleet 297 data tools across 90 MCP servers via one gateway. Free trial header; x402 USDC on Base. | |
| Check Before You Pay Before an agent pays, get a verdict and a keepable receipt. Not insurance. Not custody. | |
| io.github.letroi77/clipzyn-mcp Turn podcasts and long videos into ranked, finished short clips via the hosted ClipZyn API. | |
| L50 eBay Market Data Live eBay prices, sellers and profit for any keyword on 8 eBay sites. Pay per call with x402 USDC. | |
| L50 UK Company Data New and overdue UK companies with director leads, plus director and owner changes. x402 USDC. | |
| L50 UK Data API UK company leads, tenders, property prices, EPC, eBay and YouTube data. Pay per call with x402 USDC. | |
| L50 UK Property Data UK sold prices, EPC energy ratings and crime by postcode district. Pay per call with x402 USDC. | |
| L50 UK Public Tenders UK public tenders and contract awards with winning suppliers, from Find a Tender. x402 USDC. | |
| L50 YouTube Transcripts Clean transcripts of any YouTube video with captions. Pay per call with x402 USDC, no API key. | |
| Agent Tools UK Pay-per-use agent tools: screenshots, web to Markdown, PDF tables, OCR, UK company checks | |
| FlatWay Property Estimator French property prices, market trends & live listings for any French address. Powered by DVF data. | |
| Agent Procurement Manager (APM) Procurement agent for AI agents: free quote, buys verified x402 data services, pay per task in USDC. |
39,951–40,000 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.