Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Signal House Send SMS and MMS, manage phone numbers, and run 10DLC brand and campaign registration. | |
| Sigrex Create and manage trading strategies, bots, webhooks and signals from any MCP client. | |
| Silotree Internal links for WordPress: unlinked posts, links in their sentences, broken links, Undo. | |
| SimplyScan Security, SEO and AI-visibility scanner for web apps · free scans and focused checks via MCP. | |
| simulis — marketing brain A business's marketing memory: campaigns, results, decisions, brand and audience knowledge. | |
| Skala — Legal Platform for Startups Incorporate globally, manage fundraising, corporate services, and more. | |
| io.skimguard/skimguard Ask whether a location has recent credit-card-skimmer detections, from a consumer sensor network. | |
| SmartVisuals Catalog Find SmartVisuals Power BI custom visuals and get GUIDs, data roles and PBIR binding snippets. | |
| Smootify Build and check Webflow or Astro stores on Shopify with Smootify 2.0: elements, attributes, audits. | |
| io.snapcall/mcp MCP Server that generate video call url | |
| SnapVisor Visual regression testing over MCP: upload screenshots, review diffs, approve. No CI needed. | |
| io.snov/snov-mcp-server Snov.io: lead discovery, email verification, enrichment, CRM, and LinkedIn automation actions. | |
| io.snowsignals/snowsignals Market-phase classifications over a metered API — phase events per currency and timeframe. | |
| io.softspoken/softspoken Lets AI assistants read your Softspoken meetings and tick off, snooze or set due dates on actions. | |
| SolarScope Screen US sites for solar: sun, grid distance, FEMA flood risk. Save sites, create PDF reports. | |
| Sold Comps (eBay sold prices) Live eBay sold comps for AI agents: median sold price, middle range and recent sales for any item. | |
| Songlinks Find the songwriter behind a name or IPI name number, under every spelling and number. | |
| SoundChain Music network for AI agents: get a song from your name, post, review tracks, leave notes. | |
| Blue Cap Machine Commerce Deterministic MCP utilities, validation, evidence verification, and x402 commerce on Base. | |
| Sparka Your AI sets up live quizzes, polls and word clouds. People join on their phones with a PIN or QR. | |
| SparkleTree Build your brand and web presence, and run SparkleTree campaigns online and on screens, from AI. | |
| spArxx.io Prove you made it first. Blockchain Timestamp creative work via Claude or any MCP-enabled AI Agent. | |
| SphereScout Local business lead lists worldwide: count by category and place, then export emails and phones. | |
| SpinGras EU AI Act Article 4 (AI literacy) readiness check and intro booking with SpinGras, Amsterdam. | |
| Spotby Business Registry Find local businesses with owner-verified hours, services, prices and contacts, for AI agents. | |
| squidmaps Make a web map of places, routes and areas, and get a link to share it. | |
| agent-exec Accountless pay-per-use sandbox execution, storage, locks, attestation and handoff; pay via x402. | |
| Earth & Sky Live earthquakes, ISS position, weather, moon phase, and true star visibility. No key. | |
| Hearth: x402 Pay-Safety & Discovery Check x402 APIs before paying (pay/caution/avoid); find x402 APIs by real paid usage. | |
| sol-defi-desk Paid Solana token safety checks over Streamable HTTP MCP (x402 USDC on Solana + Base). | |
| io.sslip.195.82.231.168/agent-data-api Pay-per-call (x402/USDC-Base) web + crypto data tools for AI agents: audit, extract, crypto, DeFi. | |
| Radar Agent Tools No-key tools: web page to Markdown, WHOIS/DNS/SSL, Federal Register, clinical trials, odds, CVEs | |
| E-commerce Data MCP E-commerce data for AI agents: Shopify products and apps, price drops, cheapest price, app reviews. | |
| Jobs Data MCP Job listings for AI agents: remote boards, 10 ATS, Hacker News hiring, Sweden and UK visa sponsors. | |
| Market Research MCP Market research for AI agents: Google Trends, Reddit, GitHub, HN, Medium, podcasts, EU tenders. | |
| YouTube Data MCP YouTube for AI agents: transcripts, comments, video stats, channel monitor, Shorts captions. | |
| FedSignal — Federal Contract Exposure, USAspending to SEC Issuer Resolution Federal government contracts and USAspending procurement exposure for SEC-listed companies. | |
| FedSignal — Federal Contract Exposure for Public Companies Federal contract exposure for listed companies, with subsidiary-to-issuer resolution. | |
| io.sslip.249.111.77.187/x402-mcp-tools Pay-per-call MCP tools via x402 (USDC on Base): QR codes, images, text analysis, web fetch. | |
| sitecheck Vet a domain (WHOIS age, DNS, SPF/DMARC, TLS) or read a web page as Markdown. Run by an AI agent. | |
| StackData Official statistics, China censuses & yearbooks, and as-of customs tariffs with legal citations. | |
| StackShield External security monitoring for Laravel apps: list domains, trigger scans, read issues and fixes. | |
| Standout Anti-slop design taste for AI coding agents: art directions, section code, 0-100 page critic. | |
| Statiko — Telegram trends & channel analytics Live Telegram data: trending topics, channel profiles & metrics, post history incl. edits/deletions. | |
| Steerd Projects, time tracking, contacts, tasks, trips and CVs for freelancers and small businesses | |
| Stobox Intelligence & Tokenization Source-linked RWA tokenization knowledge for any AI: security tokens, regulation and standards. | |
| StockMap US stock research: a model's nightly 14-day read on each stock, its reasons, and its graded record. | |
| Stocks On Chain Read-only tokenized stock data: issuers, chains, contract addresses and corporate actions. | |
| StoreRadar: Shopify store database Search, count and inspect 2.6M+ live Shopify stores by apps, tech stack, theme and country. | |
| Storywright Manage your tabletop RPG campaign from any MCP client: worlds, sessions, quests, lore, recaps. |
41,701–41,750 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.