Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Pingfusi ctas34/pingfusi Enables AI agents to call human reviewers for second opinions, design and wording judgment, and iterative feedback with pinned comments until work is approved. | |
| DGUI-HyperMem ctaxnagomi/dgui-hypermem Enables AI agents to store, recall, and self-maintain durable long-term memories on Cloudflare Workers using hybrid vector and full-text search with JEV-based re-ranking. | |
| KD JEV MCP ctaxnagomi/kd-jev-mcp Enables MCP clients to call the TypeSafe JEV / System One reasoning API for typed decisions — choice, noul, and score primitives, batched in a single round trip — through an authenticated gateway that keeps the upstream key server-side. Add | |
| Deepgram Async MCP Server ctaylor86/deepgram-mcp-server Enables asynchronous transcription of long audio and video files using Deepgram's Speech-to-Text API with features like speaker diarization, sentiment analysis, topic detection, and summarization without timeout issues. | |
| Rendi MCP Server ctaylor86/rendi-mcp-server Enables cloud-based FFmpeg video and audio processing through the Rendi API, allowing AI assistants to convert, edit, and manipulate media files without local FFmpeg installation. | |
| KYC MCP Server ctd-techs/ctd-mcp Enables KYC (Know Your Customer) verification through API integration, supporting PAN card verification, PAN-Aadhaar link checking, and identity validation with advanced caching and rate limiting. | |
| SuperiorAPIs MCP Server Tool cteaminfo/mcp_superiorapis_local A Python-based MCP server that dynamically fetches plugin definitions from SuperiorAPIs and auto-generates tool functions based on OpenAPI schemas, enabling seamless integration with API services. | |
| mcp-ctera-core ctera/mcp-ctera-core Enables AI-driven interaction with CTERA Portal APIs for file and folder management through natural language or automation workflows. | |
| HeFeng Weather MCP Server ctermiii/hefeng-mcp-server Provides weather forecast data for locations in China through HeFeng Weather API, supporting real-time, hourly, and daily forecasts with full Chinese weather descriptions. | |
| Weather MCP Server ctermiii/weather-mcp-metro Enables real-time weather queries for cities worldwide using Open-Meteo API. Provides 7-day forecasts with detailed information including temperature, wind, humidity, precipitation, and comfort level assessments in both Chinese and English. | |
| untapped-plugins ctf-max/untapped-plugins Free local MCP servers for a business's Google visibility: index checks, Search Console insights, website audits and live Google results, plus a resume kit tailored to one job posting. Stdlib Python. | |
| CastleCall MCP ctf2009/castlecall-mcp Exposes a text-to-speech announcement tool for the CastleCall home PA system on Raspberry Pi. It enables users to broadcast voice messages using local Piper or cloud-based ElevenLabs providers through the Model Context Protocol. | |
| BC Calculator MCP Server cthunter01/mcpcalculator Provides arbitrary precision arithmetic operations and advanced mathematical computations through the Unix bc calculator, supporting complex expressions, mathematical functions, and multi-line scripts with configurable precision. | |
| ovice MCP Server cti1650/ovice-mcp-server Integrates with the ovice Public API to manage virtual office workspaces, groups, and users. It enables Claude to send targeted notifications and retrieve organizational metadata such as space names and access URLs. | |
| nu_plugin_mcp ctison/nu_plugin_mcp Runs MCP servers whose tools are ordinary Nushell closures, supporting stdio and Streamable HTTP. | |
| Anki Flashcard MCP ctjmaxwell/anki-flashcard-mcp Enables large language models like Claude to automatically generate flashcards and sync them with Anki decks via a Dockerized MCP server using the AnkiConnect add-on. | |
| Korean Stock MCP ctk03272/mcp-korean-stock Provides access to Korean stock market data, including stock listings, daily historical records, and 10-minute intraday candles via FinanceDataReader and Naver APIs. It enables users to search for stocks, retrieve detailed profiles, and cal | |
| GraphQL MCP Server ctkadvisors/graphql-mcp A TypeScript server that provides Claude AI with seamless access to any GraphQL API through the Model Context Protocol. | |
| visual-hunt-mcp ctlanston/visual-hunt-mcp A local TypeScript MCP server for macOS that connects to Chrome via CDP to search and download high-quality image candidates from curated sources like Unsplash, Pexels, and others for use in posters, wallpapers, and inspiration boards. | |
| codex-intercom-mcp ctliz/agent-intercom-codex MCP server that exposes intercom tools inside Codex sessions, enabling discovery and messaging with other local coding agents (Pi, Claude Code, OpenCode) through a shared broker. | |
| ctm-multi-mcp ctmjson/ctm-multi-mcp Read-only MCP server for extracting data across multiple CallTrackingMetrics sub-accounts using a single parent API key. Enables cross-account call data, reports, numbers, contacts, and configuration analysis for resellers and agencies via | |
| ctm-number-provisioner ctmjson/ctm-number-provisioner Lets an AI assistant search for, buy, and configure CallTrackingMetrics tracking numbers using your own CTM API credentials, with safety defaults like dry-run purchasing and confirmation before release. | |
| CTM VoiceAI MCP ctmjson/ctm-voiceai-mcp Enables an MCP assistant to authenticate to CallTrackingMetrics, pull live VoiceAI agent instructions and real call transcripts, and compare them call-by-call to surface coverage gaps. From that analysis it produces prioritized, paste-ready | |
| openrouter-jev-mcp ctmx/openrouter-jev-mcp Enables coding agents to obtain probabilistic decisions from Jev AI via OpenRouter for classification, scoring, and validation, with tools like jev_check, jev_classify, jev_score, and jev_evaluate. | |
| mcp-apps-dashboard-demo ctocamar/mcp-apps-dashboard-demo A demo MCP server that returns an interactive dashboard (bar chart with dataset selector) as an MCP App via the official MCP Apps extension (SEP-1865). | |
| MCP Veo 3 Azure Blob Video Generator ctoicqtao/mcp-veo3-azure-blob Generates high-quality 8-second videos with native audio from text prompts or images using Google's Veo 3 API, and automatically uploads them to Azure Blob Storage for cloud hosting and management. | |
| MCP Stock Market ctoouli/mcp-stock-market A Model Context Protocol tool that retrieves daily stock market data for any stock symbol using the Alpha Vantage API. | |
| Perplexity MCP Server (Python) ctosmsa/perplexity_mcp A Python port of the official Perplexity MCP server that enables web-grounded Q\&A, deep research, and step-by-step reasoning via Perplexity AI's models. It supports both STDIO and HTTP interfaces for seamless integration with tools like Cl | |
| mcp-server-code-extractor ctoth/mcp_server_code_extractor Enables precise code extraction from 30+ languages using tree-sitter parsing, allowing AI assistants to retrieve functions, classes, and code snippets with accurate line numbers. | |
| mcp-metaeditor ctpn3m01/mcp-metaeditor Connects MCP clients to MetaTrader 5 MetaEditor on Linux via Wine, enabling automated MQL5 development workflows including code editing, compilation of EAs/indicators, and strategy backtesting. | |
| inoreader-remote-mcp ctricot/inoreader-remote-mcp Enables Claude on web, desktop and mobile to read, mark and manage Inoreader feeds through a self-hosted remote MCP connector, exposing ten tools for unread counts, subscriptions, folders, article retrieval, starring, subscribing and markin | |
| obsidian-git-mcp ctristan/obsidian-git-mcp This MCP server enables AI collaborators to read and write to a git-backed Obsidian vault with transactional integrity, ensuring every write is a validated, attributed commit pushed to the remote. | |
| phone-mcp-server ctrl-creeper/phone-mcp-server Enables AI agents to control Android phones via MCP and HTTP. Supports screen capture, taps, swipes, text input, and app management. | |
| Atlas ctrl1candv/atlas A local, auditable multi-model workflow engine that lets you define YAML graphs for orchestrating LLM agents across vendors, with MCP tools for validation, dry-runs, execution, and human approval, all fully observable in a local web interfa | |
| Obsidian MCP Server ctrlaltadapt/obsidian-mcp-server A Model Context Protocol (MCP) server that provides AI assistants with access to your Obsidian vault through the Obsidian Local REST API plugin. | |
| Chaperone ctrlaltelite26-hue/ambient-mcp-kernel Enables household consent management for ambient MCP, supporting irreversible actions via propose/commit with hash-locked payloads and providing a pantry/reorder interface. | |
| scamcheck ctrlanmol/scamcheck Enables Model Context Protocol agents to triage suspicious messages locally with explainable verdicts, signals, playbooks, and intelligence, while also supporting URL checks, entity extraction, and tamper-evident case creation. | |
| Chilon Recall ctrlcakepro/chilon-recall Local-first knowledge retrieval MCP server that turns private text documents into a source-backed knowledge base, enabling retrieval, comparison, summaries, and review outlines for any local MCP client while keeping source paths and index o | |
| mcp-bridge ctrlpi/mcp-bridge Enables an AI agent to control one or more remote GPIO agents through a conversation by proxying tool calls to their REST APIs. It supports API-key authentication, LAN discovery, and both stdio and Streamable HTTP transports. | |
| pi-bay ctrlpi/pi-bay Enables agents to discover and manage Raspberry Pis and other SSH devices on a LAN, including authentication, command execution, file and directory operations, reboots, and ctrlPi API installation. | |
| pico-bay ctrlpi/pico-bay Enables AI agents to manage MicroPython and CircuitPython boards over USB, including listing boards, browsing and editing files, running Python code, resetting boards, and installing firmware. | |
| ctrl-memory ctrlprogrammer/ctrl-memory-system A lightweight, local-first MCP memory server for LLM agents that enables storing, searching, and retrieving agent memories with zero external dependencies. | |
| Chrome DevTools MCP ctrlshiftbryan/chrome-devtools-mcp Enables AI coding assistants to control and inspect a live Chrome browser through DevTools for automated testing, performance analysis, debugging, and web scraping. Provides reliable browser automation using Puppeteer with comprehensive Dev | |
| Drip MCP Server ctrlswing/drip_mcp Enables interaction with Drip's email marketing platform through comprehensive tools for managing subscribers, campaigns, tags, events, and workflows. Supports batch operations, GDPR compliance, and both JSON and Markdown response formats f | |
| homelab-mcp ctrquko/homelab-mcp A collection of MCP servers for managing Proxmox, Linux, Windows, Docker, npm, and Python in a homelab environment. | |
| CData Arc MCP Server ctslone/adminapi_mcp Enables AI assistants to manage CData Arc connectors, files, transactions, workspaces, and administrative actions through natural language interactions via the Arc Admin API. | |
| Strava MCP Server ctvidic/strava-mcp-server A Model Context Protocol server that enables language models to interact with Strava data, including activities, athlete statistics, routes, achievements, and social features. | |
| Whoop MCP Server ctvidic/whoop-mcp-server A Model Context Protocol server that provides language models with access to personal Whoop fitness data, allowing queries for cycles, recovery, strain, and workout information from the Whoop API. | |
| Unstorage MCP Server ctxinf/unstorage-mcp Enables key-value storage operations using multiple backends (memory, filesystem, redis, MongoDB, HTTP) via MCP tools like get, set, and list. | |
| ctxray ctxray/ctxray Context intelligence for AI coding sessions. 7 MCP tools to score, compare, compress, build, and scan prompts across 9 AI tools. Rule-based, <5ms/prompt, all analysis runs locally. |
41,051–41,100 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.