Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| vDesign Editable designs from any assistant: posters, slides, brands and video, on a canvas you can edit. | |
| io.github.saksham-gagneja-indxx/aphelion Aphelion: LinkedIn reel automation with AI - upload, caption, schedule, and publish via Claude. | |
| io.github.saksham-gagneja-indxx/post-pilot LinkedIn automation with AI tools | |
| Totem Connect AI agents to the Totem network for communication and work coordination. | |
| Samuelz Chauffeur Booking Chauffeur price previews and consent-led offers for the provider's published service areas. | |
| Moltchat Agent Commons Join durable public agent discussions and invite-only private group rooms through MCP. | |
| RawMark Documents to Markdown: PDF, DOCX, PPTX, XLSX, HTML. Scanned PDF pages read by AI. | |
| Santiment Crypto market intelligence: social sentiment, on-chain, trending narratives & analyst insights. | |
| Agent Rescue Cross-session idempotency, URLs as schema-validated JSON, and a record of missing capabilities. | |
| Birds of Puerto Rico Search Puerto Rico bird guide records, browse bird groups, and retrieve species with source links. | |
| FlaskTrack Read and scaffold organization-scoped FlaskTrack laboratory data using MCP. | |
| San Juan Puerto Rico Directory Discover Puerto Rico places and events, with canonical links and clearly disclosed sponsorship. | |
| Santurce Software Explore software engineering services and submit authorized project inquiries. | |
| io.github.sapiom/mcp-server AI agent tools: web search, browser, 400+ LLMs, image gen, TTS, phone verify. Pay-per-use. | |
| HeadStart Jobs Search 466k tech jobs read from company career sites; see who is hiring and what roles ask for. | |
| AgentTwin Documentation Search AgentTwin agent testing guides, Node CLI commands and supported synthetic service contracts. | |
| Cortex Test MCP Server Internal test MCP server for local dev and Bifrost integration testing. | |
| Airbnb Listings Airbnb listings by city or room link: price for dates, ratings, amenities, host, location, photos. | |
| Bilibili API Bilibili videos for AI agents: search, creators, trending, stats, tags and danmaku comments. | |
| Bing Search API Bing web search results for AI agents: title, URL, snippet, date. Replaces the retired Bing API. | |
| Contact Details Scraper Emails, phones and social links from any list of websites. Pay only for sites with a contact. | |
| Google Ads Transparency API Competitor ads from Google Ads Transparency Center by domain or brand: dates, images, YouTube links. | |
| Google Flights API Google Flights prices for any route and date: round trips, cabins, stops, airlines, cheapest dates. | |
| Google Hotels API Google Hotels prices for any dates and guests, ratings, amenities and every booking site's price. | |
| Google Jobs API Google Jobs listings by keyword and location: title, company, salary, source board, apply links. | |
| Google Maps Scraper Google Maps places and leads: phone, website, address, rating, reviews, hours, emails. | |
| Google Trends API Google Trends in bulk: interest over time, by region, related and rising queries, trending now. | |
| Instagram Reels Transcripts Instagram Reels to text in bulk: transcripts with timestamps, SRT and VTT for public Reels. | |
| LinkedIn Company Data LinkedIn company size, industry, website, HQ, followers, posts from links, domains or names. | |
| LinkedIn Posts LinkedIn posts with text, author, date, reactions, top comments, media from links or company pages. | |
| Naukri Jobs Scraper Search Naukri.com jobs in India: titles, companies, salaries, skills, and which companies hire most. | |
| Pinterest Scraper Pinterest pins, boards, profiles and keyword search to JSON: saves, images, links, creators. | |
| Reddit Search Scraper Search Reddit posts by keyword and subreddit; find recommendation requests and brand mentions. | |
| Shopify Price and Stock Monitor Prices, stock and variants of products on any public Shopify store, with change and margin checks. | |
| Speech to Text (Whisper) for Audio and Video URLs Whisper speech to text for podcast, audio and video URLs, 90+ languages, timestamped output. | |
| Telegram Channel Scraper Public Telegram channel posts without login: text, views, reactions, media, exact subscribers. | |
| Threads Search API Search public Threads posts by keyword for AI agents: text, author, likes, replies, reposts. | |
| TikTok Scraper TikTok videos with exact views, likes, comments, shares from profiles, hashtags, search, links. | |
| TikTok Transcripts & Subtitles TikTok videos to text in bulk: transcripts with timestamps, SRT and VTT. Native captions or Whisper. | |
| Trustpilot Reviews Scraper Trustpilot reviews for any company domain: ratings, text, replies, and unanswered low-star reviews. | |
| Website to Markdown Web pages and whole sites to clean Markdown for RAG and AI agents. Crawls links and sitemaps. | |
| WeChat Article Search Search WeChat official account articles by keyword: title, account, date, link, full text. | |
| Weibo Scraper Weibo posts, hot search, comments and profiles to JSON. No login or cookies needed. | |
| YouTube Scraper with Transcripts YouTube videos, channels, playlists, search to JSON: views, likes, dates and full transcripts. | |
| YouTube Transcripts & Subtitles Bulk YouTube transcripts from videos, channels, playlists or search: text, RAG chunks, SRT, VTT. | |
| Zillow Scraper Zillow listings and property details: price, Zestimate, beds, baths, agent, history. | |
| Zillow Property Details Zillow property details by link, zpid or address: Zestimate, rent Zestimate, tax value, agent. | |
| Zillow ZIP Code Search Zillow homes for sale, for rent or recently sold by US ZIP code: price, Zestimate, beds, baths. | |
| Primary Source Commodities Primary-source commodities data for AI agents — EIA, FRED, CFTC, USDA, USGS via x402 on Base. | |
| ML Referee Evaluate ML features beyond a baseline and test bounded feature repairs. Invite-only beta. |
40,751–40,800 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.