Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Toolbooth Pay-per-call tools for AI agents: Solana, DEX, perps, prediction markets, DeFi, web. USDC via x402. | |
| Toolforest Hosted MCP server with managed OAuth for 15+ toolkits: Google Workspace, Fitbit, Oura, Kalshi, etc. | |
| io.toolzy/toolzy Recherche et location d'outils entre particuliers en France via Toolzy. | |
| toui.io URL Shortener Short-link service embedded in your AI workflow — shorten links, track campaigns, read stats. | |
| Tounify European electricity pricing and tounify API integration help. Read-only; it returns no prices. | |
| TraceLog Your own assistant uses the same validated, read-only queries as TraceLog. | |
| TraceTail Browser fingerprinting for web apps: integration code for any framework, docs search and pricing. | |
| TradingPal Breakout patterns on stocks & crypto, each with its historical win rate, entry, stop and target. | |
| TrafficBud SEO Real SEO data for AI assistants: page audits, Keyword Planner volumes, Search Console history. | |
| Trakis SEO checks 66 technical SEO and AI-readiness checks: what each looks at, why it matters, how to fix it | |
| Trakis site audits Your Trakis site audits in an AI assistant: health, findings, changes and search positions | |
| Delopt delivery dispatch AI dispatch for food & local delivery: assigns orders to drivers, sequences stops, times departures. | |
| io.tranx/alice Audit any site's AI visibility from your assistant: crawler access, rendering, and schema. | |
| Trilly Find, add and use AI skills from Trilly, the marketplace for AI skills, in your AI app. | |
| Trovest Financial Data Financials, ratios, SEC filings and analyst data for any public company. Premium account required. | |
| Trust Onion Scam Check Verified AI voice-clone scam incidents, loss stats, and a family verification protocol. Keyless. | |
| Tube Operator Your YouTube library in Claude, ChatGPT and Cursor: transcripts, breakdowns, summaries, search. | |
| TubeTranscript AI tools Chapters, hooks, mindmaps, subtitles and blog drafts from a TubeTranscript job (Pro API key). | |
| TubeTranscript YouTube transcripts for AI agents, including videos without captions (Pro API key). | |
| TVPulse Search OCR/ASR mentions on 15 terrestrial stations (Tokyo 7, Osaka 8); archive from 2026-01-01. | |
| TweakThis UI feedback from a browser extension (note, element, screenshot) for coding agents to resolve. | |
| io.twelvelabs/twelvelabs-mcp-server TwelveLabs MCP: video indexing, search, analysis, and embeddings for AI applications. | |
| TwexAPI Search X (Twitter) posts and read profiles, followers, trends and X Articles. OAuth sign-in. | |
| Uniplay Run a Uniplay Space from your AI assistant: courses, games, members, groups and analytics. | |
| Unpaged Whiteboard where any shape opens into another canvas. Claude Code plugin renders plans on it. | |
| Uptimeify Free anonymous website, DNS, email and TLS checks, plus monitor read and opt-in write access. | |
| useClick Short links, QR codes, link and website analytics: create and edit links, read clicks and visitors. | |
| Userpilot Product analytics, user and company insights, surveys and NPS, reports, dashboards, and more. | |
| Userport Read and answer support conversations, and run outbound email and chat sequences, from your AI. | |
| Vintage Chocolate Recipes Search 146 vintage chocolate recipes from 1914: cakes, candies, mousses, beverages. | |
| A Christmas Carol Semantic search through Dickens' A Christmas Carol by meaning, theme, or character. | |
| Lenny's Podcast Transcripts Search 286 episodes of product management wisdom from top leaders at Figma, Airbnb, Linear. | |
| UN World Demographics Query UN population data: fertility, mortality, migration, life expectancy for 298 countries. | |
| UX Jobs Search 4,000+ live UX & product-design jobs from jobs.uxjobs.io. Read-only, no auth. | |
| Vectree Search and read ~95,000 interactive concept diagrams that explain how things work — visually. | |
| VEED AI Video Generator Generate AI talking-head videos with custom characters and voices. | |
| VibeDoctor Lets coding agents check their own code for leaked secrets, risky dependencies and AI-code mistakes | |
| voidjet empty legs Search empty-leg private jet offers; prepare inquiries and alerts the user confirms by email. | |
| Vozora Manage Vozora VPS servers, SSH keys, firewalls, DNS and usage from an AI agent. | |
| Wakato Your Wakato account: contacts, tables, pages, email, social, shop, automations and agents. | |
| Wakato (one space) One Wakato space: contacts, tables, pages, forms, email, social, shop and automations. | |
| Warmlink What people who use a piece of software say about it: vouches, recommends and their reasons. | |
| Waysmith Advisor Fit-first college search and list-building. Research culture, real costs and odds for 400+ colleges. | |
| weatherAI.io Weather decisions for 21 activities: should you run, paint, sail or pour concrete, and when? | |
| io.weavz/weavz Governed app access for AI agents: 1,000+ apps & 12,000+ tools via Code Mode MCP. | |
| Webshare Manage your Webshare proxies, usage, plans and billing. Sign in with OAuth, no API key. | |
| Weir: Reddit and X (Twitter) data Search and read public Reddit and X posts, comments, threads, profiles and Articles; run monitors. | |
| WeProxy Turkey-focused proxy catalog: product picker, pricing, country coverage, error diagnosis. No key. | |
| Whatic IC Datasheets IC datasheet search: parametric part finding, spec lookup, price comparison — grounded in real PDFs. | |
| whowhy Double opt-in intros for hiring: whowhy finds the people, writes to them, you meet who says yes. |
41,801–41,850 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.