Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Moon & Star Map Moon phases & star map posters | |
| Paceword Speed Reader Learn to read faster with paced speed reading practice inside the chat. | |
| Tallyproof Bank Statements Bank statement to spreadsheet | |
| Linepace Teleprompter Live script reader and timer | |
| ShiftSum Time Card A time card calculator for hours worked. | |
| Zovo Typing Test Take a typing speed test without leaving the chat. | |
| Zovo VAT Number Check Run a VAT number check for EU tax identifiers in VIES and get a dated XLSX validation log. | |
| Zovo VIN Recall Check Check recalls by VIN with live public vehicle records and downloadable XLSX and CSV reports. | |
| Zovo Weather History Past weather & daily logs | |
| Zovo Word Counter Exact word & character counts | |
| Zovo Word Guess Make your own custom word-guessing game and send it to a friend. | |
| LetterLab Word Solver Word game solver & unscrambler | |
| Zovo Per Diem Calculator Travel allowance worksheets | |
| Kognitrix AI 8 AI services via MCP: content, code, image, docs, data extraction, translation, SEO, email. | |
| Liffey Metals Ireland's most trusted gold & silver buyer: live prices, payout estimates, free postal pack orders. | |
| io.github.therealMrFunGuy/changelog-hq Auto-generate changelogs from GitHub PRs with AI-powered categorization and rewriting. | |
| io.github.therealMrFunGuy/cron-pilot Scheduled HTTP requests and shell commands with retries, timeouts, and webhook alerts. | |
| CryptoPrice Real-time cryptocurrency prices, market data, and trending coins via CoinGecko. | |
| io.github.therealMrFunGuy/feed-forge Turn any website into an RSS, Atom, or JSON feed using CSS selectors and scheduled polling. | |
| GitHubInsights GitHub repo analytics, trending repos, contributor stats, and language breakdowns. | |
| io.github.therealMrFunGuy/invoice-pilot PDF invoicing with auto-chase reminders, email delivery, and payment tracking. | |
| PDFTools Extract text and tables from PDFs, merge documents, and get metadata. | |
| QRGenerator Generate QR codes with custom colors, logos, vCards, and WiFi configs. | |
| io.github.therealMrFunGuy/screenshot-api Website screenshots as PNG, JPEG, or PDF with custom viewports and full-page capture. | |
| SEOAudit On-page SEO analysis, HTTP header checks, broken link detection, and robots.txt parsing. | |
| SolanaPay On-chain Solana payments for MCP services with SOL and USDC support. | |
| StockQuote Real-time stock quotes, company info, historical prices, and market movers. | |
| io.github.therealMrFunGuy/test-mailbox Disposable email inboxes for testing — create addresses, wait for messages, extract links. | |
| UptimeProbe HTTP health checks, SSL expiry monitoring, TCP port scanning, and batch URL testing. | |
| io.github.therealMrFunGuy/waitlist-kit Viral waitlists with referral tracking, leaderboards, analytics, and built-in themes. | |
| WeatherMCP Weather forecasts, current conditions, and location search via Open-Meteo. | |
| WhoisLookup Domain WHOIS, DNS records, SSL certificates, and availability checks. | |
| TheySaid Customer research analysis and AI usability testing on any website or design. | |
| Fichário — CNPJ Brasil Free lookup of 28.4M active Brazilian companies by CNPJ or name (Receita Federal open data). | |
| Your No.2: FPL Assistant Manager Fantasy Premier League (FPL) assistant: one clear call on captain, transfers and chips. | |
| io.github.thisisnotinsideout-byte/veldo Keeps a current picture of your startup so Claude can give your best next move and why. | |
| io.github.thomas0369/wortwert Gematria and pattern decoder for words, sacred texts, news, dates, and Human Design. | |
| ThreadSnoop Reddit API Read-only Reddit search API for AI agents: posts, comments, comment trees, subreddit rules. | |
| Vendor Regulatory Evidence Resolve a vendor and buy normalized public OSHA, EPA, and SAM exclusion evidence with provenance. | |
| Federal Contract Lifecycle Evidence Resolve a federal award and buy bounded USAspending contract lifecycle and end-date evidence. | |
| Consumer Product Recall Evidence Match consumer products to official CPSC recalls and purchase source-linked evidence. | |
| Portfolio Ideas Analyze your portfolio and generate ideas for improvements | |
| TicketsData Real-time ticket listings, prices and fees across major ticket marketplaces. | |
| TidyTools Free Web Data 45 free keyless web tools: AI extract, OCR, transcribe, SEO, DNS, contacts. Strict daily limits. | |
| Company Signals: startup jobs & hiring data Search 260,000+ open jobs at 8,000+ companies, list any company's open roles live, detect its ATS. | |
| Agent Tavern Public board where AI agents ask, answer and post findings across runtimes. | |
| spawnpop Roblox game assets for your agent: free kit plan, then GUI, icons, thumbnails, 3D props and music. | |
| Veldora Norwegian public data for AI agents: companies, tenders, addresses, laws, exchange rates. | |
| Tinylawn Read Tinylawn AI receptionist calls, intake, and business data for landscaping and pest control. | |
| Tizona — Australian business identity tools Australian identifier validation, GST arithmetic, fuzzy name matching, OFAC sanctions screening. |
41,101–41,150 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.