Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| RFQdecoder Should-cost of a machined, sheet metal or cast part from its PDF, DXF or STEP drawing, line by line. | |
| io.github.Mouthfully/zwitchy-store Travel eSIM catalog: search plans, check availability, and get exact quotes with checkout links. | |
| Preflight SafeSwap Safe Solana swaps for AI agents with risk checks, unsigned transactions, x402, and 3-bp fees. | |
| Delvorn GET https://delvorn.site/api/x402/test-asset $0.05 Base. First independent=Certified+$0.05 back. | |
| Lomen Ask about your website traffic, sources and AI insights from Lomen analytics | |
| OpenBtoB OpenBtoB trade intelligence with 9 MCP tools. | |
| Rengi Forge Gamedev tools for AI agents: level design, renders, sprites, GLB optimizer. Pay per call with x402. | |
| DocParse Docs to Markdown, SEC filings, insider trades, Treasury yields, FRED macro, FX rates, dev utils. | |
| AgentXM Find verified MCP servers and agents for a task, register yours, report outcomes. Earned scores. | |
| Saliga data tools (Apify) Pay-per-result data tools: bulk APIs, docs to Markdown, OCR, files, datasets, papers, tech stack. | |
| Kavra Siegel — Qualified eIDAS Timestamping Qualified eIDAS RFC 3161 timestamping for AI workflow provenance. SIGNIUS/IDnow backbone. | |
| ApiOne B2B Enrichment (GCC and MENA) B2B company, people and email enrichment with cited sources, built for GCC and MENA companies. | |
| Bootlace AI SpendMap Free-trial AI fleet spend meter. 100 calls or 14 days. No auth. | |
| AI Search Visibility Tracker How often ChatGPT, Perplexity, Gemini and Claude mention and cite your brand vs competitors. | |
| App Review Insights Analyze App Store and Google Play reviews: themes that cost stars, regressions, feature requests. | |
| Google Trends Pro Unlimited keywords on one Google Trends scale, with daily history, trend status and forecasts. | |
| YouTube Transcript Extractor Transcripts of YouTube videos, playlists and channels in any language: text, SRT, VTT or JSON. | |
| Munchausen Crypto Analytics Crypto analytics via x402: free BTC/ETH/SOL prices, AI analysis and reports in USDC. | |
| invisiprompt Answer a question about what is on the screen or in a recording; solves text, images and audio. | |
| SocialReach Find developer-community threads worth replying to, and draft the reply. | |
| Agent Account Index Can an AI agent hold an account at a service? Verdict, owner of record, quoted terms clause. | |
| io.github.myclaimfile/memoshelf Shared notebook for AI agents: run log, notes, a pinned How-we-work page, one lane across platforms | |
| Action Shift Free for restaurant owners. Drop last night's close, get the one thing to fix before next shift. | |
| io.github.mynona/raumnebenan-mcp raumnebenan-mcp MCP server (remote, JSON-RPC 2.0) | |
| Insider Radar Lab telemetry market: 25 x402 USDC-paid tools — leaderboard, KOL signals, outcomes, more. | |
| RealPing 實坪 Cleaned Taiwan 實價登錄: real-area (去公設) per-ping prices, de-parking. 7 MCP tools. | |
| MyRouteOnline Multi-stop route optimization, navigation links, and email delivery. Powered by MyRouteOnline. | |
| io.github.mytab0r/pxbt-x402 Thai DTV/METV visa package pre-check over x402 (USDC on Base). | |
| Curated Finds — GitHub Tools & Hugging Face Models Find GitHub tools and Hugging Face models: source links, licenses, setup notes and review dates. | |
| PDF & Word Metadata Cleaner — Inspect, Clean & Verify Inspect and remove PDF/DOCX author metadata and comments; approve tracked changes before cleaning. | |
| Bulk Email Verifier — MillionVerifier BYOK & Dataset Input Bulk email verification for lists and Apify datasets; MillionVerifier BYOK, unbilled duplicates. | |
| Shopify Product Scraper — Prices, Variants & Availability Get Shopify product prices, variants and stock availability for competitor monitoring and exports. | |
| Wicked YouTube Transcript API — Captions, Timestamps, SRT & VTT YouTube transcript API: batch video captions, timestamps, metadata and SRT/VTT subtitles. | |
| e-Stat MCP 政府統計 (e-Stat) の API を通じて、統計データやメタ情報を取得するためのサービスです。 | |
| 不動産情報検索・分析 MCP 中小企業庁が公開している公共調達情報を検索するためのサービスです。 | |
| 不動産情報サービス MCP 国土交通省の不動産情報ライブラリから不動産価格データを取得するためのサービスです。 | |
| NOTIFY SMS verification codes for Georgia (+995), sent and checked. Try test codes with a free test key. | |
| io.github.nach-dakwale/instadomain Domain registration for AI agents via Stripe or x402 crypto with Cloudflare DNS. | |
| Celestium: Cosmic Compass Real astrology for AI agents: cosmic weather, synastry, timing, astrocartography, and divination. | |
| AI Search Brand Visibility (ChatGPT, Gemini, Perplexity) Is your brand named or your site cited in ChatGPT, Gemini, Perplexity, Google AI Mode answers? | |
| Amazon Keyword Research & Reverse ASIN (Helium 10 alternative) Amazon search volume for up to 10,000 keywords, related keywords and reverse ASIN; 16 marketplaces. | |
| Backlink Checker: Referring Domains & Anchor Text Bulk backlinks of any domain or URL: anchors, dofollow, spam score, referring domains. | |
| ChatGPT Search Scraper: Answers, Citations & Sources ChatGPT answers with web search as JSON: citations, sources, brands and products. Bulk prompts. | |
| Domain Authority & Spam Score Checker Bulk domain rank (0-100), SEO spam score, backlinks and referring domains for up to 10,000 domains. | |
| Domain SEO Overview (Semrush alternative) Organic traffic, keyword counts and up to 1,000 competitor keywords of any domain; 94 countries. | |
| Google Maps Businesses Without Website (leads) Local businesses on Google Maps with no website: name, phone, address, rating. For web agencies. | |
| Google Maps Reviews Scraper Google Maps reviews of any place: stars, text, date, photos, owner reply. Links, place IDs or names. | |
| Google Keyword Planner Alternative (no Ads account) Google Ads Keyword Planner data without an Ads account: search volume, CPC, bid range, competition. | |
| Keyword Search Volume & CPC (Ahrefs alternative) Bulk Google keyword search volume, CPC, difficulty, intent and monthly history; 94 countries. | |
| PlainRows SEO tools: volume, backlinks, authority 5 SEO tools: keyword volume, Keyword Planner data, backlinks, domain authority, domain traffic. |
40,251–40,300 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.