Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Multiple Language Coder Polyglot code converter and language architect. Use when input contains mixed, ambiguous, pseudo, or multi-language code fragments (Python+JS syntax blends,... | |
| pdftk Server Skill for using the command-line tool pdftk (PDFtk Server) for working with PDF files. Use when asked to merge PDFs, split PDFs, rotate pages, encrypt or dec... | |
| Quasi Coder Expert 10x engineer skill for interpreting and implementing code from shorthand, quasi-code, and natural language descriptions. Use when collaborators provid... | |
| rhino3d-plugins Rhino3D plugin and script development with the RhinoCommon SDK — .rhp plugins and commands, Grasshopper .gha components, Eto panels, dialogs and options pages, user data and document persistence, display conduits, render engine integration, | |
| Rhino 3D Scripts Authoring and debugging scripts for Rhinoceros 3D (Rhino 8 and later). Use when asked to write RhinoScript (VBScript / .rvb / .vbs), RhinoPython, or RhinoCom... | |
| Shuffle JSON Data Shuffle repetitive JSON objects safely by validating schema consistency before randomising entries. | |
| TLDR Prompt Create tldr summaries for GitHub Copilot files (prompts, agents, instructions, collections), MCP servers, or documentation from URLs and queries. | |
| TypeScript Coder Expert 10x engineer with extensive knowledge of TypeScript fundamentals, migration strategies, and best practices. Use when asked to "add TypeScript", "migra... | |
| TypeScript Package Manager Expert 10x Software engineer specializing in TypeScript with deep knowledge of all popular package management tools including npm, yarn, pnpm, bun, and deno.... | |
| Update Docs on Code Change Automatically update README.md and documentation files when application code changes require documentation updates. Use when adding new features, changing AP... | |
| Use Cliche Data in Docs Ensure documentation and examples use only generic, cliche placeholder data. Use when writing README files, updating docs folders, creating example code snip... | |
| Vibe Code Discipline skill for vibe-driven development — turns mood, feel, and outcome-shaped requests into shippable code without the usual drift, hallucinated APIs,... | |
| Web Coder Expert 10x engineer with comprehensive knowledge of web development, internet protocols, and web standards. Use when working with HTML, CSS, JavaScript, web... | |
| Write Coding Standards from File Write a coding standards document for a project using the coding styles from the file(s) and/or folder(s) passed as arguments in the prompt, without modifyin... | |
| Brave Search 极简国内版 【极简版省token】使用 Brave API 执行网络搜索。针对国内代理环境做优化。 | |
| Cron Creator 定时任务创建器 【针对飞书优化】定时任务创建指引，专门针对飞书、尤其是多 Agent 场景进行优化，解决定时任务不稳定问题。 | |
| deepseek-api-search 通过 DeepSeek Search / Fetch 最新 API 联网搜索及抓取网页 Markdown 正文。 | |
| Demo Website Product Manager 小白建站 面向零技术用户，把网站 / 小程序 demo 需求拆成产品需求、设计需求、技术需求三份文档，并配合 GitHub 与 Vercel / 微信小程序开发工具 直接上线部署 | |
| Kimi Search 极简版 通过 Kimi API 的 builtin_function $web_search 联网检索。用于新闻、实时信息、股价、公司动态等时效性内容；支持中英检索。先判断用户要「原始搜索结果条目」还是「综合总结」（默认总结），再调用脚本或相应参数。 | |
| Multi Search Engine 极简国内版 【国内精简版】多种免费搜索方式在互联网上搜索最新信息，10个国内网站（精简7个国内不能访问的海外网站） | |
| Tavily Search 极简版 【极简版省token】使用 Tavily API 执行网络搜索。专为 LLM 与 AI Agent 优化的搜索引擎。 | |
| BRICKS CLI Manage BRICKS workspace devices, groups, apps, modules, media, and projects via CLI for control, monitoring, updates, and deployments. | |
| find-skills-gitcode Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... | |
| Toutiao Agent Skill 提供头条号自动内容发布、菜价数据追踪、收益优化及运营知识库，专注菜价与民生领域的自动化运营技能。 | |
| Copywriter Professional copywriting for marketing, exec comms, and customer content that uses systematic frameworks and storytelling to deliver clear, audience-focused,... | |
| Journal Pipeline Autonomous journal content pipeline for UniqueStaysUSA. Researches keywords, writes editorial content, publishes to Payload CMS, and tracks results. Use when... | |
| Anxiety Relief Manage anxiety with grounding exercises, breathing techniques, and thought reframing | |
| Build Discipline Build unbreakable discipline with habit stacking, streak tracking, and accountability | |
| Daily Motivation Get daily motivation with personalized encouragement, goal reminders, and momentum tracking | |
| Depression Support Daily support for depression with mood tracking, behavioral activation, and self-care | |
| Detox Counter Track any detox with customizable counters, symptom logging, and progress milestones | |
| Expense Tracker Pro Track expenses via natural language, get spending summaries, set budgets | |
| Fasting Tracker Track intermittent fasting windows, extended fasts, and autophagy milestones | |
| Focus Deep Work Maximize deep work with focus sessions, distraction logging, and productivity tracking | |
| Gratitude Journal Build gratitude practice with daily entries, streaks, and reflection prompts | |
| Habit Tracker Build habits with streaks, reminders, and progress visualization | |
| Healthy Eating Build healthy eating habits with meal logging, nutrition tracking, and food choices | |
| Mens Mental Health Mental health support for men with emotion check-ins, stress tools, and no-judgment space | |
| Mindfulness Meditation Build a meditation practice with guided sessions, streaks, and mindfulness reminders | |
| Morning Routine Build a powerful morning routine with habit checklists, timing, and streak tracking | |
| Muscle Gain Track muscle building with weight progression, protein tracking, and strength milestones | |
| Newsletter Digest Summarize newsletters and articles, extract key insights, create reading lists | |
| Night Routine Build a restful night routine with wind-down habits, sleep prep, and next-day planning | |
| Overcome Problem Break down any problem with structured thinking, action plans, and progress tracking | |
| Portfolio Watcher Monitor stock/crypto holdings, get price alerts, track portfolio performance | |
| Pregnancy Tracker Track pregnancy journey with weekly updates, symptom logging, and milestone countdowns | |
| Procrastination Buster Beat procrastination with task breakdown, 2-minute starts, and accountability tracking | |
| Quit Alcohol Track sobriety with alcohol-free streaks, craving management, and recovery milestones | |
| Quit Caffeine Reduce or quit caffeine with withdrawal tracking, tapering plans, and energy milestones | |
| Quit Overspending Break impulse buying habits with spending streaks, urge tracking, and savings milestones |
41,251–41,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.