Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| falcon.sol docs: bank statement extraction for agents (x402) Bank statement extraction for agents: transactions, ADB, NSF, MCA metrics, plus invoices. x402. | |
| Falcon Shield Pre-sign Solana tx guard for agents: ALLOW/WARN/BLOCK verdict, x402 USDC pay-per-call. | |
| falcon.sol agents Solana agent tools, x402 USDC pay-per-call (Cloudflare host). | |
| falcon.sol structures Price crypto structured notes (autocallables, shark fins, range accruals) via Monte Carlo; x402. | |
| Solana Wallet Intel Solana wallet risk and intel, x402 USDC pay-per-call (Cloudflare host). | |
| ワットク（Wattoku） Compare Japan's household fixed costs: electricity, city gas, fiber and mobile plans, with bundles. | |
| File Relay Temporary file relay for AI agents: upload a generated file, get an expiring download link. | |
| US Federal Bid Intelligence Cached SAM.gov incumbent and award evidence. Shared 6 SAM pulls/day; no guaranteed fresh quota. | |
| China Import Quote Preflight Before-payment check for China quotes to US/EU: costs, low-value rules, and compliance blockers. | |
| seelig.ai booking Lists the AI consulting services of seelig.ai (Switzerland) and requests a 30-minute first call. | |
| Yondry: Day Out Planner Plan your perfect day out anywhere: itineraries and neighbourhood guides, tuned to mood and weather. | |
| LEOR AI展台设计 Agent AI booth design, floor-plan redraw, graphic design, model rendering, and LEOR project storage. | |
| Atomic CSS Utility CSS for any platform — near-zero learning curve. Built for developers and AI alike | |
| Maison de Talents Luxury boutique, department store and duty-free retail job postings and salary benchmarks in Korea. | |
| Gastrosync Connect AI assistants to Gastrosync for catering and event management. | |
| Token Command Center Free token data: revenue, net flow after emissions, supply/unlock history, catalysts, errors marked | |
| io.github.yukihamada/tokkyo-maru 特許まる — 発明を入れるだけで特許性の事前診断・明細書骨子・新規性喪失(特許法30条)判定。本人/弁理士の出願支援(代理しない)。 | |
| Scrooge Tool Mill 8 pay-per-call agent tools: company card $0.03, page meta $0.002. USDC on Base via x402. | |
| listme.name rankings Read-only ranked lists, product facts, alternatives and comparisons for software, apps and books. | |
| 独行录 / opcmenu Find founders, collaboration opportunities and events; manage authorized signups and messages. | |
| TrendHub Evidence-backed AI content studio with 21 stable trend intelligence tools. | |
| 64 Types: personality test Free science-based personality test: 64 types from Big Five + HEXACO, with cited profiles. | |
| RankRoot: AI visibility audit Audit a site's visibility to ChatGPT, Perplexity, Claude and AI agents. Generates llms.txt. | |
| x402-snap Pay-per-call browser rendering and x402 marketplace ranking for AI agents, billed via USDC. | |
| ZadenWorks Read, screenshot, diff, verify and audit any URL: SEO, links, sitemaps, schema, a11y. | |
| Agent Toolbox Everyday tools for AI agents, paid per call with x402: images, markdown, speech-to-text, embeddings. | |
| French Due Diligence Keyless French company checks (Sirene, BODACC, VIES, sanctions), DPE compliance, product recalls | |
| Zark Creative Media Create and edit creator-ready images and videos with Zark. | |
| Canton Wiki Projects Search Canton Network ecosystem projects, retrieve project details, and list categories. | |
| HoodL2 Projects Search Robinhood Chain ecosystem projects, retrieve project details, and list categories. | |
| perps.ai Projects Search perpetuals ecosystem projects, retrieve project details, and list categories. | |
| PM Wisdom Projects Search prediction market projects, retrieve project details, and list categories. | |
| Tempo Atlas Projects Search Tempo ecosystem projects, retrieve project details, and list categories. | |
| PPT.AI Developer API Create, edit, export and manage presentations. Requires a paid PPT.AI API merchant account. | |
| Agent Verifier — Independent Number Verification Verify totals in finished tables add up. Independent arithmetic audit for AI agents, signed receipt. | |
| ZeroCrew directory Find the AI agents and tools behind every business job, curated for zero-employee founders. | |
| io.github.zerozaky/spoiler Sealed prediction-market verdicts, graded in public across Polymarket and Kalshi. No auth required. | |
| BakingTab — Baking Conversions for AI Baking unit conversion (cups/grams/temp/recipe scaling). convert_amount, convert_temperature | |
| CompressIO — Image Compression for AI Compress images to target sizes (80%+ smaller). Tools: compress_image, convert_image, optimize_image | |
| PalTool — Palworld Breeding for AI Palworld breeding calculator (299 Pals). find_breeding_routes, get_pal_info, get_passive | |
| PDF Slim — PDF Compression for AI Compress PDFs to exact target sizes (82-93% smaller). Tools: compress_pdf, optimize_pdf, inspect_pdf | |
| io.github.zhouhua188199-arch/fairsign Fill and sign PDFs in the browser, send for signature, and track who has signed. | |
| Humanest Connect your agent with AI builders' agents. Set up now; posts and messages open September 20. | |
| io.github.zkeviny/mgc-blackbox A trusted local encrypted execution boundary for AI agents. | |
| io.github.ZlaylowZ/nukez-mcp Agent-native storage with cryptographic verification on Solana. Keyless: clients sign and pay. | |
| ZolChip — Israeli supermarket prices Israeli supermarket prices from the chains' transparency files: search, cheapest store, basket | |
| Caigen Notes (菜根笔记) Caigen Notes (菜根笔记) — AI-native note-taking with RAG semantic search, in Chinese. | |
| NSW Planning Data (x402) NSW DAs, CDCs and property planning reports: zoning, height, FSR, nearby DAs. Pay per call via x402. | |
| io.github.Zyxel89/pretrade-oracle Pre-trade oracle: real slippage, honeypot/sellability at size, exotic DEXs and new chains. | |
| Glint Model Hub — image generation for AI agents Generate and edit images with every image model on the platform. Returns the image to the agent. |
41,351–41,400 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.