Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Parking Finder Locate parking garages, lots, and street parking near your destination using Camino AI's location intelligence with AI-powered ranking. | |
| Places Locate places using flexible query formats - free-form search or structured address components. Returns coordinates, addresses, and optional street-level pho... | |
| Query Search for places using natural language with Camino AI's location intelligence API. Returns relevant results with coordinates, distances, and metadata. Use... | |
| Real Estate Evaluate any address for home buyers and renters. Get nearby schools, transit, grocery stores, parks, restaurants, and walkability using Camino AI's location... | |
| Relationship Calculate spatial relationships between two points including distance, direction, travel time, and human-readable descriptions. Use when you need to understa... | |
| Route Get detailed routing between two points with distance, duration, and optional turn-by-turn directions. Use when you need navigation instructions or travel ti... | |
| Safety Checker Find 24-hour businesses, well-lit public areas, transit stations, police stations, and hospitals near any location for late night safety awareness. | |
| School Finder Locate elementary schools, high schools, and universities near any address using Camino AI's location intelligence with AI-powered ranking. | |
| Travel Planner Plan complete day trips, walking tours, and multi-stop itineraries with time budgets using Camino AI's journey planning and route optimization. | |
| Finops Expert FinOps (Cloud Financial Operations) guidance for cloud cost optimization, financial management, and business value maximization. Use for cloud cost ma... | |
| Location Context Get comprehensive context about a location including nearby places, area description, and optional weather. Use when you need to understand what's around a l... | |
| CEO决策助手 专为中国CEO打造的AI决策协作体系。主脑+子代理架构，支持飞书通知，定时简报，记忆系统，决策分级管理。5分钟安装，开箱即用。 | |
| Ahc Automator Custom automation workflows for Alan Harper Composites. Automates email → ClickUp → Pipedrive chains, client onboarding, and project completion sequences. Us... | |
| Omie ERP Omie ERP integration via API. Manage clients, products, orders, invoices (NF-e), financials (contas a receber/pagar), and stock. Use when users ask about ERP... | |
| GitHub Knowledge Base Manage a local GitHub knowledge base and provide GitHub search capabilities via gh CLI. Use when users ask about repos, PRs, issues, request to clone GitHub repositories, explore codebases, or need information about GitHub projects. Support | |
| Lazaretto Verify a third-party skill, tool, or npm/GitHub package for malicious behavior BEFORE you install or run it. Free known-bad hash lookup plus a deterministic... | |
| Clawdio Transport-agnostic secure P2P communication for AI agents. Noise XX handshake, XChaCha20-Poly1305 encryption, connection consent, human verification. No WebSocket — works over Telegram, Signal, or any messaging transport. | |
| Enhanced Memory Enhanced memory search with hybrid vector+keyword scoring, temporal routing, filepath scoring, adaptive weighting, pseudo-relevance feedback, salience scoring, and knowledge graph cross-references. Replaces the default memory search with a | |
| Clawdio Secure P2P communication for AI agents. Noise XX handshake, XChaCha20-Poly1305 encryption, connection consent, human verification. Zero central servers. | |
| Browserbase Persist with captcha Create and manage persistent Browserbase cloud browser sessions with authentication persistence. Use when the user needs to automate browsers, maintain logged-in sessions across interactions, scrape authenticated pages, or manage cloud brow | |
| browserbase-sessions Create and manage persistent Browserbase cloud browser sessions with authentication persistence. Use when you need to automate browsers, maintain logged-in s... | |
| Tradekix Query financial market data via the Tradekix API — stock prices, crypto, forex, indices, market news, earnings, economic events, Congressional trades, and social sentiment. Use when the user asks about markets, stock prices, trading data, e | |
| pol-agents-sdk-demo Complete Polygon agent toolkit. Session-based smart contract wallets (Sequence), token ops (send/swap/bridge/deposit via Trails), ERC-8004 on-chain identity... | |
| Polygon Agents CLI Complete Polygon agent CLI. Session-based smart contract wallets (Sequence), token ops (send/swap/bridge/deposit via Trails), ERC-8004 on-chain identity + re... | |
| Polygon Agents SDK Complete Polygon agent toolkit. Session-based smart contract wallets (Sequence), token ops (send/swap/bridge/deposit via Trails), ERC-8004 on-chain identity... | |
| sequence-cli Manage Sequence smart wallets, projects, API keys, ERC20 transfers, and query blockchain data using the Sequence Builder CLI. Use when user asks about creating wallets, sending tokens, checking balances, managing Sequence projects, or inter | |
| Trails - pay with any token from any chain Integrate Trails cross-chain infrastructure — Widget, Headless SDK, or Direct API | |
| clawtan Play Settlers of Clawtan, a lobster-themed Catan board game. Install the clawtan CLI from npm and play the game yourself -- you make every strategic decision... | |
| AI News Pro AI News Pro 提供 AI 领域早报、晚报、热点新闻和精选内容，基于 AI 评分智能排序，支持定时推送。当用户说"查询 AI 早报"、"查询 AI 晚报"、"查询 24H 热点新闻榜"或"查询 AI 精选内容"时调用。 | |
| aimpact AIMPACT 提供 AI 领域早报、晚报、热点新闻和精选内容，基于 AI 评分智能排序，支持定时推送。当用户说"查询 AIMPACT 早报"、"查询 AIMPACT 晚报"、"查询 24H 热点新闻榜"或"查询 AI 精选内容"时调用。 | |
| aimpact-crypto AIMPACT Crypto 技能提供 Crypto 领域早报、晚报、热点新闻和精选内容，基于 AI 评分智能排序，支持定时推送。当用户说"查询 AIMPACT Crypto 早报"、"查询 AIMPACT Crypto 晚报"、"查询 Crypto 24H 热点榜"或"查询 Crypto 精选内容"时调用。 | |
| aimpact-prediction-market AIMPACT Prediction Market 技能提供预测市场（如 Polymarket）实时监控，实时推送提醒，基于 AI 评分智能排序，支持定时推送。当用户说"查询预测市场热门事件"、"查询预测市场异常交易"、"查询预测市场交易机会"或"检查预测市场变化"时调用。 | |
| AIMPACT x ME News - AI-Powered Information Hub for Web4 & AI AIMPACT 提供 AI 领域早报、晚报、热点新闻和精选内容，基于 AI 评分智能排序，支持定时推送。当用户说"查询 AIMPACT 早报"、"查询 AIMPACT 晚报"、"查询 24H 热点新闻榜"或"查询 AI 精选内容"时调用。 | |
| briefed Set up and run a personal AI newsletter intelligence system called Briefed. Fetches Gmail newsletters daily, uses Claude Haiku to extract article summaries, and serves a polished local web reader app with voting, notes, and interest trackin | |
| Domain Trust Check URL safety scanner and domain reputation checker. Use when: checking if a URL is safe before visiting, scanning links in emails/messages, verifying domains f... | |
| Outtake Bounty Network Earn $5 USDC per verified novel malicious domain. Use when: building threat-hunting agents, monetizing phishing/scam/malware discoveries, participating in Ou... | |
| skill-guard Stage, scan, and install a ClawHub skill when the user requests a guarded ClawHub installation. Blocks installation on security findings or incomplete scans. | |
| AML/KYC Documentation Generator Generate UK AML/KYC compliance documentation — customer due diligence records, risk assessments, policies, and SAR drafts for regulated businesses. Use when... | |
| Client Communication Drafter Draft professional client emails and messages for freelancers. Handles project updates, scope changes, payment reminders, feedback requests, difficult conver... | |
| Construction Quote & Job Costing Generate itemised construction quotes, material lists, and job costings from plain English job descriptions. Covers extensions, kitchens, bathrooms, loft con... | |
| Creative Contracts (Photography & Design) Generate photography, videography, and creative professional contracts -- client agreements, model releases, usage licences, and rights documentation. Use wh... | |
| Employee Handbook Generator (UK) Generates complete, legally compliant UK employee handbooks and workplace policies tailored to business type and size. Use when someone needs an employee han... | |
| Food Hygiene & HACCP Docs Generate UK food safety documentation — HACCP plans, food safety management systems, allergen matrices, cleaning schedules, and EHO inspection preparation. U... | |
| GDPR Compliance Document Generator Generate UK/EU GDPR compliance documents — privacy policies, cookie policies, DPIAs, ROPA, DSAR responses, data breach notifications, and consent forms. Use... | |
| Grant Application Writer Write compelling grant applications and funding proposals for UK charities, social enterprises, researchers, and small businesses. Generates need statements,... | |
| Health & Safety Risk Assessments (UK) Generates HSE-compliant UK risk assessments from plain English descriptions of work activities and environments. Use when someone needs a risk assessment, H&... | |
| Invoice & Expense Categoriser (HMRC) Categorise UK business expenses and invoices against HMRC Self Assessment categories. Generates quarterly P&L summaries, VAT-ready reports, and MTD-compatibl... | |
| IR35 Status Assessment Assess IR35 employment status for UK contractors using HMRC criteria and case law factors. Generates risk ratings, recommended contract amendments, and Statu... | |
| Meeting Notes to Actions Transform raw meeting notes or transcripts into structured summaries, action items with owners and deadlines, individual follow-up emails, and next meeting a... | |
| Property Rental Yield Calculator Generate professional property listings and calculate rental yields, ROI projections, cash flow analysis, and stamp duty for UK property investments. Use whe... |
40,251–40,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.