Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Amazon Brasil Sellers com CNPJ — Leads B2B e Receita Federal Vendedores da Amazon Brasil com CNPJ conferido na Receita Federal: razão social, porte e sócios | |
| Hotéis e Pousadas no Booking Brasil — Leads com E-mail e CNPJ Hotéis, pousadas e hostels do Booking Brasil com e-mail, telefone, razão social e CNPJ da Receita. | |
| Brazil Company Data — Bulk CNPJ Lookup & Enrichment Bulk CNPJ lookup and enrichment with official Brazilian company registry data. | |
| Brazil Due Diligence — CNPJ Registry + Reclame Aqui Vet a Brazilian company by CNPJ: official registry data plus its Reclame Aqui reputation. | |
| Brazil Company Risk Score — Registry, Reputation & Protests Risk score for Brazilian companies from registry, reputation and protest records by CNPJ. | |
| Brazil ESG Supply-Chain Monitor — Slave Labor + IBAMA by CNPJ Screens Brazilian suppliers by CNPJ for slave-labor listings and IBAMA violations. | |
| Monitor de Sanções CEIS/CNEP — Empresas Punidas por CNPJ Monitora CEIS e CNEP: empresas inidôneas e impedidas de licitar, por CNPJ. | |
| Consulta CEP em Lote — Endereços Brasileiros Busca de endereço por CEP em lote no Brasil: rua, bairro, cidade, UF, DDD e IBGE. | |
| Certidão Negativa CNPJ em Lote — FGTS/CRF e CNDT (TST) Emite certidão negativa por CNPJ em lote: FGTS/CRF e trabalhista CNDT do TST. | |
| Consulta CNPJ em Lote — Dados da Receita Federal Consulta CNPJ em lote na Receita Federal: razão social, sócios, CNAE, endereço e situação. | |
| Monitor ESG BR por CNPJ — Lista Suja + IBAMA Monitora risco ESG por CNPJ: Lista Suja do trabalho escravo e autuações do IBAMA. | |
| Google Maps Brasil - Leads Locais Empresas do Google Maps no Brasil com telefone, e-mail, site e CNPJ da Receita Federal. | |
| Google Maps Brasil — Monitor de Novos Negócios (+CNPJ) Detecta negócios novos no Google Maps do Brasil e entrega leads frescos já com CNPJ. | |
| Leads Locales de Google Maps — Email, Teléfono, Web y CNPJ Extrae negocios locales de Google Maps en Brasil con teléfono, email, sitio web y CNPJ. | |
| Google Maps Local Leads — Email, Phone, Website & Brazil CNPJ Extract local businesses from Google Maps in Brazil with phone, email, website and CNPJ. | |
| Monitor de Nuevos Negocios en Google Maps — Leads Locales Detecta negocios nuevos en Google Maps y entrega leads locales frescos por zona. | |
| Google Maps New Business Monitor — Fresh Local Leads Detects newly opened businesses on Google Maps and delivers fresh local leads by area. | |
| Google News Scraper — Real Publisher URLs, MCP-Ready Scrapes Google News and returns the real publisher URLs, not redirect links. | |
| iFood Scraper Brasil: Leads de Restaurantes com CNPJ Extrai restaurantes do iFood no Brasil com endereço, categoria e CNPJ da Receita Federal. | |
| Brazil Trademark Watch — INPI/RPI Monitor & Deadline Alerts Monitors Brazilian trademarks at INPI and alerts on new RPI publications and deadlines. | |
| Monitor de Precios Mercado Libre — Alerta de Baja y Stock Monitorea precio y stock en Mercado Libre y avisa cuando baja o vuelve a haber stock. | |
| Monitor de Preço Mercado Livre — Alerta de Queda e Estoque Monitora preço e estoque no Mercado Livre e alerta quando cai ou volta a ter estoque. | |
| Precatórios TJSP — Fila de Pagamento por Entidade (DEPRE) Acompanha a fila de precatórios do TJSP (DEPRE) por entidade devedora e ordem de pagamento. | |
| Protesto SP (CENPROT) por CPF/CNPJ — requer proxy BR próprio Consulta protesto de títulos por CPF/CNPJ no CENPROT SP. Exige proxy brasileiro próprio. | |
| Reclame Aqui Scraper — Reputação de Empresas BR Reputação de empresas no Reclame Aqui: nota, índice de solução e total de reclamações. | |
| Monitor de Marcas INPI — Alertas da RPI por Processo Monitora marcas no INPI e alerta despachos novos da RPI por processo ou titular. | |
| Shopee Brasil Scraper — Produtos, Preços, Vendidos e Lojas Produtos da Shopee Brasil por busca ou loja: preço, Pix, nota, cidade, loja e vendidos | |
| Consulta SINTEGRA — Inscrição Estadual por CNPJ (RS, PR) Consulta Inscrição Estadual por CNPJ no SINTEGRA, com situação cadastral e endereço. | |
| ZAP Imóveis Scraper — Anúncios de Venda e Aluguel Extrai anúncios do ZAP Imóveis: venda e aluguel com preço, área, quartos e localização. | |
| io.github.pavel-tashev/audio-video-transcriber Transcribe any audio or video URL to text, SRT and VTT, with chunking and only-new episodes | |
| io.github.pavel-tashev/broken-link-checker Crawl a site for broken links, 404s, dead images, redirect chains and slow pages, with sources | |
| io.github.pavel-tashev/company-verifier Verify a company exists: UK, EU VAT, GLEIF LEI, 8 registers, search filters, UK filing history | |
| io.github.pavel-tashev/doc-to-markdown PDF, Word, PowerPoint, Excel, HTML, EPUB to Markdown: OCR, page ranges, tables, RAG chunking | |
| io.github.pavel-tashev/email-verifier Verify email addresses in bulk: syntax, domain, MX, disposable and role addresses, SPF and DMARC | |
| io.github.pavel-tashev/rss-feed-reader Read RSS, Atom and JSON feeds, or find the feed of any website, with filters and only-new mode | |
| io.github.pavel-tashev/sitemap-url-extractor Extract every URL from a website sitemap, including index and gzipped sitemaps, with status checks | |
| io.github.pavel-tashev/website-change-watcher Detect what changed on a page, sitemap or feed since the last check, with a diff and email alert | |
| Agent Clubhouse — Discover Voluntary Shared Work Find voluntary shared agent work: signed artifacts, research and questions. Read-only introduction. | |
| PCFHub Find Power Apps PCF controls, read their docs, and validate pcfhub.json manifests. | |
| Slatemark Market data and analytics for external AI clients | |
| MCP humanista.digital MCP de solo lectura del directorio, Radar y Observatorio de humanista.digital. | |
| Burofácil Draft, check and send a Spanish burofax (postal, proof of delivery), also from abroad. | |
| Peerivo Watch Web search, data extraction and controlled browser automation for AI assistants via OAuth. | |
| Pencil Manage tasks, projects, roadmaps, files, meetings, and team workflows with AI tools. | |
| PenguinRadar Instagram profiles, follower/following snapshots and changes, with budgeted public lookups. | |
| Special Education Law Searchable special education decisions and legal research tools. | |
| Got Cosy Travel/hotel data: 6,300 hotels scored for cosiness from guest reviews; verified booking links. | |
| Jules Create, list, update and cancel phone call reminders that ring your phone, via your Jules account. | |
| io.github.peter-schout/bol-ai Extract structured data from Bills of Lading: parties, ports, containers, incoterms. EU-hosted. | |
| io.github.peter120525-cmd/lawmadi-os Verify Korean legal citations against law.go.kr: precedents, statutes, bar-exam answers. |
40,501–40,550 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.