Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| PPC Competitor Keywords (SpyFu alternative) Google Ads keywords any website buys: ad position, ad text, CPC, volume, monthly ad spend. | |
| Othermile border costs Duties, tariffs, taxes and fees for parcels and freight between Canada and the US. | |
| FactBAT Public Record Locator Find official Korean public datasets, agency-site menus, disclosure listings, and source URLs. | |
| Seoul Tourism (Visit Seoul) Official Seoul tourism data in 7 languages, in cooperation with the Seoul Tourism Organization. | |
| Nansen Blockchain analytics API for AI agents. Smart Money signals, wallet profiling, token analytics. | |
| NASA Earthdata MCP Discover, verify, and access NASA Earth science datasets via the Common Metadata Repository (CMR) | |
| io.github.nath-abhishek/cardmind-mcp MTG market data: search 114K+ cards, price signals, AI analysis. Free tier available. | |
| BuiltOnRails Stack intelligence from real production Rails apps. Compare gems, scan a Gemfile. | |
| NoshUp: Meal Planning & Grocery Budget Grocery meal planning, budgets, and flyer deals for Canadian households. Auth required. | |
| NoshUp: Canadian Grocery Deals & Recipes Canadian grocery flyer deals and recipes by item, store, postal code, cuisine, or diet. No auth. | |
| NLocale Find sourced events, places, restaurants, stays and local guides in Aisne, France. Read-only. | |
| Neblex Integration Fabric Build, test and publish iPaaS flows, apps, forms and AI agents in Neblex, in the cloud or on-prem. | |
| bnod Find Austrian local service businesses, check free slots and request appointment bookings. | |
| NeoDemos Source-anchored search and civic intelligence for Dutch municipal council records. | |
| SprintFlint Opinionated sprint tracker. Read/update tickets, sprints, velocity from Claude/Cursor/Zed. | |
| Actor Pipeline Runner (Chain Actors in One Run) Run up to 25 Apify Actors in order in one call, passing each step's dataset to the next. | |
| AI Crawler Access Checker Shows if GPTBot, ClaudeBot, PerplexityBot and other AI crawlers can read each site in a list. | |
| AI Shopping Results Tracker Products, prices, shops and cited sources AI shopping answers recommend, and where your brand ranks. | |
| Amazon Buy Box & Price Monitor: Seller, Stock & Price Tracker Amazon Buy Box price, seller and stock per ASIN, with a monitor mode that reports only changes. | |
| Australia Visa Processing Time Monitor Australia's official visa processing times per subclass and stream, with change alerts. | |
| Best Time to Post: Instagram, TikTok & YouTube Ranks the best weekday and hour to post per account from Instagram, TikTok or YouTube post rows | |
| Data Breach Notification Deadlines Who to notify after a data breach and by what date: all US states, SEC, HIPAA, GDPR, UK. Sourced. | |
| Data Breach Notification Deadlines (bulk, Apify) Bulk breach notice deadline checks: US states, SEC, HIPAA, GDPR, UK, per check billing via Apify. | |
| Bulk Article Extractor Full text, author, date and image for every news or blog link in a dataset, CSV or Google Sheet. | |
| Bulk Image & File Downloader from CSV, Google Sheet or Dataset Downloads every image or file linked in a dataset, CSV, Excel or Google Sheet and stores each... | |
| Image Converter & Compressor Convert, compress and resize many images to WebP, JPEG, PNG or AVIF; returns links and sizes. | |
| Bulk AI Image Upscaler from CSV, Google Sheet or Dataset Upscales every image linked in a dataset, CSV, Excel file or Google Sheet 2x, 3x or 4x with AI... | |
| Bulk OCR: Image & Scanned PDF to Text from CSV or Google Sheet OCR every image and scanned PDF linked in an Apify dataset, CSV, Excel or Google Sheet, keeping... | |
| Bulk PageSpeed & Lighthouse Checker: Core Web Vitals from CSV Google PageSpeed Insights (Lighthouse) scores, Core Web Vitals and top speed fixes for every URL... | |
| Bulk SEO Audit 0-100 SEO score and issues to fix for every website in a dataset, CSV or Google Sheet. | |
| Bulk Transcription: Audio & Video to Text from CSV or Sheet Transcribe every audio or video link in a list: plain text, or speakers, timestamps and SRT | |
| Website Screenshot Tool (Bulk) Website screenshots for every URL in a dataset, CSV or Google Sheet, desktop and mobile | |
| Call Score: AI Call Review & QA for Receptionists and Sales Score call recordings: booked or lost, lead quality, missed questions, 0 to 10 score, next step | |
| Taobao & 1688 Buy Checker Buy or avoid verdict for Taobao, Tmall and 1688 listings: fake brand flag, seller trust, landed cost | |
| Dataset Aggregate, Group By & Pivot Returns GROUP BY and pivot tables for any Apify dataset, file or Google Sheet by URL, or JSON... | |
| Dataset AI Enrichment: Bulk LLM & GPT Classify and Extract Run one LLM instruction over every row to classify, extract or summarise into new columns. | |
| Chart Generator & PDF Report from Any Dataset, CSV or JSON Turn rows into bar, line, pie and scatter chart images plus an optional PDF or HTML report. | |
| Dataset Cleaner & Exporter Returns a deduplicated, flattened and cleaned copy of any Apify dataset, file or Google Sheet by... | |
| Dataset Diff & Change Detector: Only New Items Returns what was added, removed or changed between two Apify datasets, files, Google Sheets or... | |
| Dataset Filter & Transform Returns rows of any Apify dataset, CSV/Excel/JSON file URL or Google Sheet that pass filter... | |
| Dataset Join & Merge (VLOOKUP for Datasets) Returns two Apify datasets, files or Google Sheets by URL, or JSON arrays joined on key fields... | |
| Merge Datasets & Remove Duplicates Merge many Apify datasets, CSV files and Google Sheets into one list with duplicates removed. | |
| PDF Extractor: Bulk PDF to Text, Tables & Markdown from a CSV Extract text, tables and metadata from every PDF linked in a dataset, CSV or Google Sheet. | |
| Dataset to Postgres, Supabase & MySQL (Database Push) Push rows from a dataset, file or Google Sheet into a Postgres, Supabase, Neon or MySQL table. | |
| HTTP Request Sender: Single or Bulk API Calls from CSV or Sheet Send one HTTP request, or one per row of a dataset, CSV or Google Sheet, and get the response back | |
| Depop Scraper & Monitor: New Listings, Price & Sold Alerts Depop listings for searches or URLs, with alerts on new listings, price drops and sales. | |
| Domain Availability Checker: Bulk WHOIS Lookup & Domain Age Is each domain or name idea available or taken? Plus registration date, expiry, age and registrar. | |
| Bulk Email Validator & List Cleaner: MX, Disposable & Typos Cleans an email list from an Apify dataset, a CSV/Excel file or Google Sheet, keeping every... | |
| Engagement Rate & Fake Follower Checker Engagement rate, fake follower signs and a shortlist verdict for Instagram, TikTok, YouTube creators | |
| EU Tenders Finder & Bid Matcher Open EU tenders from TED scored against your CPV codes and keywords, with past winners and prices |
40,301–40,350 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.