Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| FFXIV Market Board Price Checker + Deal Monitor FFXIV market board prices per item from Universalis for a world or region, with price alerts. | |
| Google AI Mode Ads Tracker Ads Google shows inside AI Mode answers by keyword and country: advertiser, headline, description. | |
| Google Review Velocity & Reply Rate Lead Scorer Scores Google Maps businesses on review velocity, owner reply rate and unanswered bad reviews | |
| Google Sheets Export & Import Write rows to Google Sheets (append, replace, update by key) or read a tab. No OAuth needed. | |
| Instagram Comments Analyzer: Buyer Intent Finds buyers in Instagram, TikTok and YouTube comment rows: price, link and size asks, unanswered | |
| Ireland CRO Company Registry Lookup & Monitor: Filing Alerts Irish company records from the CRO Open Data Portal, with alerts on status changes and filings. | |
| Ireland Passport Application Status Tracker Irish passport application status from the DFA tracker, with alerts on stage or date changes. | |
| Job Post Enricher: Salary, Seniority, Remote, Visa & Skills AI salary, seniority, remote, visa and skills fields for LinkedIn, Indeed or any jobs dataset. | |
| Logo & Favicon Extractor Company logo, best icon and favicon for a list of websites, with measured image size and format. | |
| Multi-AI Answer Snapshot Answers, sources and brand mentions from OpenAI, Perplexity, Gemini, Claude and Grok side by side. | |
| New Zealand Visa Processing Time Monitor Immigration New Zealand's official visa processing times per visa type, with change alerts. | |
| Pay Transparency Rules for Job Posts Must a job post show pay? Rules for US states and cities, Canada and all 27 EU countries. Sourced. | |
| Pay Transparency Law Checker (bulk, Apify) Bulk job post pay transparency checks for US, Canada and EU laws, per check billing via Apify. | |
| Bulk Phone Number Validator & Cleaner: Carrier, CSV or Sheet Bulk phone validation for an Apify dataset, CSV/Excel/JSON file or Google Sheet | |
| Poland KRS Company Registry Lookup & Monitor (KYB) Polish company records from the official KRS register API, with alerts on new registry entries. | |
| Price Per Unit Calculator Price per unit from Amazon, Walmart and grocery scraper rows: best value, bigger-pack traps | |
| Reddit Questions Finder Top questions people ask on Reddit, from scraper rows: grouped, ranked by repeats, unanswered | |
| Review Analyzer: Sentiment, Complaints, Themes & Reply Drafts Sentiment, complaint themes, quotes, business reports and reply drafts for any reviews dataset. | |
| RSS Feed Reader New items from many RSS, Atom and JSON feeds or websites, with only-new mode and keyword filters. | |
| Rush Radar: Niche Finder & Trend Radar Check product ideas against live demand, plus a daily brief of new launches and rising tools. | |
| SEC Filings Monitor: EDGAR 8-K, Form 4 Insider & 13D Alerts New SEC EDGAR filings for watched companies (8-K, Form 4, 13D/G), one row per new filing. | |
| Tech Stack Detector: Wappalyzer & BuiltWith Alt, CSV or Sheet Detect CMS, ecommerce, analytics, payments and email hosting for every website in a list. | |
| UK Business Trust Check: Verify Any UK Company or Trader Check a UK business before you book, buy or pay: verdict, score and reasons from official sources | |
| UK Companies House Monitor: Filings, Directors & PSC Alerts UK company records from Companies House, with alerts on new filings, officer and status changes. | |
| UK Company Risk Report (Companies House + Gazette) Red, amber or green risk report for any UK company from Companies House and The Gazette. | |
| UK Self-Storage Price & Offer Monitor Prices and offers for UK Big Yellow and Shurgard self-storage stores, with change alerts. | |
| UK Subcontractor Right to Work Checker Does a UK business have to right-to-work check a subcontractor or gig worker from 1 Oct 2026? Free. | |
| UK Tourist Tax (Visitor Levy) Calculator Works out UK tourist tax for a holiday let booking: Edinburgh, Glasgow, Cardiff and more. Free. | |
| UK Waste Carrier Licence Monitor UK Environment Agency waste carrier licence records, with alerts on status and expiry. | |
| UK Waste & Tip Finder Nearest UK household waste recycling centres for a postcode, with hours and accepted materials. | |
| US Immigrant Visa Interview Scheduling Monitor (NVC) Which month NVC is scheduling immigrant visa interviews at each US consulate, with alerts. | |
| US Minimum Wage by Address and Date Legal US minimum wage and tipped wage for any address, city, county or state on any date. Sourced. | |
| US Minimum Wage by Address and Date (bulk, Apify) Bulk US minimum wage lookups by address, city or state and date, per lookup billing via Apify. | |
| US Sales Tax Economic Nexus Check Which US states must a remote seller register in for sales tax? Every state's nexus rule. Sourced. | |
| US Sales Tax Nexus Checker (bulk, Apify) Bulk US sales tax economic nexus checks every state's rule, billed per check via Apify. | |
| US Visa Bulletin Priority Date Monitor US green card priority date cutoffs from the Visa Bulletin, with a verdict for your date. | |
| US Visa Interview Wait Time Monitor US visa interview wait times per embassy or consulate, with change alerts in days. | |
| USCIS Processing Time Monitor USCIS processing times per form and office, plus whether your case can file an inquiry yet. | |
| TikTok Outlier Finder: Viral Videos, Reels & YouTube Finds TikTok, Reels and YouTube videos that beat the creator's normal views, from scraper rows | |
| Website Email Extractor, Phone & Contact Finder (CSV, Sheet) Published emails, phones and social profiles for every website in a list, CSV or Google Sheet. | |
| Winning Ads Finder: Facebook Ad Library Scorer Scores Meta Ad Library scraper rows by days running and copies to find proven winning ads | |
| TokenGuard Solana token rug check before you buy: SAFE/CAUTION/DANGER from chain state, paid per call via x402. | |
| Arctura Reef — counterfactual evidence engine (synthetic) Deterministic same-seed but-for twin for battery fleets — synthetic-only (DR-236) | |
| NM Signals: AI crawler audit Audit webpage access for AI crawlers. API key and Premium or Partner plan required. | |
| New Relic MCP Server Monitor, troubleshoot, and optimize your technology stack with Intelligent Observability. | |
| io.github.nexus-api-lab/chrono-mcp Deterministic time tools for AI agents: timezone conversion, business-day math, cron interpretation. | |
| io.github.nexus-api-lab/codebook-mcp Exact reference codes for AI agents: countries, currencies with minor units, HTTP status, MIME. | |
| io.github.nexus-api-lab/digest-mcp Exact hashing, base64/hex/URL encoding, JWT decoding and UUIDs for AI agents. No auth required. | |
| io.github.nexus-api-lab/ident-mcp Checksum validation for AI agents: IBAN, ISBN, EAN/GTIN, UUID, ULID. Deterministic, no auth. | |
| io.github.nexus-api-lab/textops-mcp Exact text tools for AI agents: unified diff, patch apply, regex testing, grapheme counting. |
40,351–40,400 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.