Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| BioCosm Biotech intelligence for AI agents: drugs, targets, diagnostics, PoS estimates, and writeups. | |
| Yugalinks Commerce Intelligence Read-only OECD trade research for countries, products, corridors, lane risk, and opportunities. | |
| Nicelydone Search real web app screens, UI elements, and user flows. Requires Premium access and OAuth. | |
| Bible Glide Bible Glide account context, Daily Scripture, church activity, and Bible chat. | |
| PageDuel Web analytics, A/B test results and revenue attribution for your sites. | |
| SwarmTix Event ticketing: create and publish events, read orders, attendees and sales analytics. | |
| Terlido Cold email: campaigns, leads, mailboxes, warmup and inbox replies. | |
| Isoba — Dollar & Crisis Index US dollar index, crisis meter, recession and market-top risk from public-domain data since 1990. | |
| French Legal Data (Law, Case Law, IDCC) French law articles, codes, collective agreements, case law (Judilibre) and IDCC lookup. | |
| BARMAN by CeoAgentAI AI product-copy samples and EUR 9 packs; free integration diagnosis and EUR 5 evidence reports. | |
| io.github.nikhilgogulwar/universalbench Run code, query databases, call any LLM, and commit to GitHub from your AI, safely. Free tier. | |
| Fintel Discovery — Financial Intelligence for AI Agents DEPRECATED — this server is no longer maintained. | |
| Agent Nil — Act 0 Talk to Agent Nil before the Chain opens. Daily challenges. No wallets, no tokens, only the game. | |
| Indian Cyber Regulation Register (BitScore) Indian cyber regulation register and incident-reporting deadlines (India, US, EU), read at source. | |
| Citation Check Free mechanical checks for AI text: unnamed counts, dangling references, bad arithmetic, misquotes. | |
| AI Third Space A persistent city for AI agents: talk, play Nomic and Saboteur, leave marks. Always open. | |
| Site Rep MCP Read-only Site Rep handoff: agent brief, pending work, first-customer receipt with payment evidence. | |
| SuperMCP Israeli online supermarket pricing: compare grocery prices and delivered shopping baskets. | |
| Find Local Instructor Find local instructors and tutors for sports, test prep, wellness, IT, and more. | |
| Infinite Audience Discover audiences, build segments, match and deliver data. Some actions count toward account usage. | |
| OT Intel API OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402. | |
| io.github.noahgift/depyler-mcp MCP server for Depyler: Python-to-Rust transpiler with analysis and verification tools | |
| io.github.noahgift/ruchy-mcp MCP server for Ruchy: code analysis, scoring, linting, formatting, and transpilation tools | |
| 2nd Brick Design custom LEGO brick sets with 3D models, instructions, kit prices and customer-paid checkout. | |
| Current Free cold-calling CRM and power dialer. Build lists, log calls and plan follow-ups from Claude. | |
| Decide Runtime Evaluate supplied rules, save deterministic decisions, and read/export owned records. Paid pilot. | |
| EDA（枝） 困りごとの原因・解決策・やってみた結果を枝でたどる知識マップ（日本語）。検索・投稿・反応ができる | |
| ReverieCache Free, stateless agent memory consolidation preview: keep/archive/drop diff with token estimates. | |
| Norynta Prediction Markets Play-money prediction markets for AI agents: search live markets, then forecast with an agent key. | |
| Kelam Voice Agents Place and follow real phone calls and SMS through your Kelam voice agents. | |
| API.market MCP Gateway Connect AI agents to 580+ APIs with OAuth or API-key auth. Hosted gateway; API pricing varies. | |
| AgentQ MCP Server AgentQ MCP Server - AI-Powered Software Quality Assurance Platform | |
| Sanity Check — Technical Architecture Review Automated architecture sanity check: 19 rule-cited checks, verdict report. Paid runs US$99. | |
| nü people Job Server Public MCP server for discovering open jobs. Search, filter, and get application links. | |
| Nukafever Photography Search, quote, buy and download licensed documentary photos. No account, fixed prices. | |
| BrandPresence Organization-scoped BrandPresence evidence and explicitly authorized product actions over MCP. | |
| E-invoice validator & repair check (XRechnung, Peppol BIS 3, EN 16931) Validate XRechnung, Peppol BIS 3 and EN 16931 invoices with KoSIT; explain rules; check auto-repair | |
| PDF/UA accessibility check (veraPDF) with measured auto-fix Check PDFs against PDF/UA-1 with veraPDF; see which failures an automatic fix removes; explain rules | |
| RelayShield Scam Checks Free scam checks for links, wallets, emails, and breach exposure. No signup. | |
| The Continental Portable client-sealed memory and private rooms for agents from any lab; a free door; a ledger | |
| oasdiff Detect breaking changes, generate changelogs, diff, and validate OpenAPI specs. | |
| Launch Ready Pre-launch website QA: deterministic rule-based scans, readiness score, and blockers for agents. | |
| AgentCompute Free experimental GPU tools: text generation, images and audio transcription. Shared quotas; no SLA. | |
| AfricanMutualFunds Nigerian mutual fund returns (SEC filings) and PenCom pension allocation, month by month. | |
| Plate Website Source Read-only catalog of free Plate website source projects a coding agent can adapt. | |
| Ohvii Find homes with your AI, then use a free Ohvii account to carry the purchase from listing to close. | |
| Agent City Wars Agent City Wars: a persistent strategy game played by AI agents on Oids. One turn a day, over MCP. | |
| ShareContent Short links, text and file sharing with analytics, UTM, folders, ads and custom domains. | |
| Okam Build a Norwegian restaurant's own ordering site on Okam. Call kit_learn first. No sign-in to build. | |
| Permit Verdicts Building-permit verdicts by address, with cited records. SF, Seattle, Austin, NYC. Pay per call. |
40,401–40,450 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.