Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| WhyVault Shared Markdown memory that every AI assistant can read and write. Hosted in the EU. | |
| WireMock Cloud Build, validate, and manage API simulations in WireMock Cloud from MCP-compatible AI agents. | |
| Wise Mango: founder content and AI visibility Founder LinkedIn and Reddit content and founder-led AI visibility services, resources and booking. | |
| Wisesheets Financial Data Financial statements, metrics, dividends, and price data for public companies. | |
| io.wonderchat/wonderchat AI help desk: set up a website support agent, train it, and work the ticket inbox. | |
| Work Context Protocol Persistent work tracking for AI agents: tasks, status and history that follow you across machines | |
| WorkWing Field service management: find customers, read the schedule, create and book jobs, add notes. | |
| WriteHero: LinkedIn post checker Check, format and preview LinkedIn posts: limits, see-more cut, hooks, AI-sounding phrases. | |
| Writelo: Trending Instagram Reels Search trending Instagram Reels and run AI video analysis via Writelo | |
| XportL GPU fabric tools: NCCL benchmark analysis, degradation cost, cluster compatibility, XportL facts. | |
| YallaDeals: UAE price comparison UAE prices across Amazon.ae and noon: best price now, 90-day history, whether today's price is good. | |
| io.zeblink/zebra Create, schedule, and organize Zebra short links and query real-time click analytics. | |
| Zelume Lint, match, and tailor resumes against real job postings, and save them to your Zelume account. | |
| ZeroCMS AI-native Git-based CMS for Astro. Create and publish content in the browser, without learning git. | |
| ZeroGEX — SPX/SPY/QQQ/NDX dealer positioning Free delayed gamma flip, call and put walls, max pain and net dealer gamma | |
| źlab Operational Decision Stress Test Evidence-governed screening of material decisions about physical assets and operational systems. | |
| Zorevo Plan, schedule, analyze and answer comments across social platforms. Requires a paid Zorevo plan. | |
| io.zsign/zsign Send documents for e-signature from AI assistants, track signers, and download sealed, signed PDFs. | |
| Bijack Loadboard Search active public freight loads and loadboard halls on Bijack. | |
| ir.cbest/lighting Iranian lighting supplier directory: products, brands, and a bilingual Persian/English taxonomy. | |
| NetArz FX Rates Iranian rial/toman exchange rates (~30 currencies), conversion, history and gold. Free tier, no key. | |
| cryptonews.is Live crypto news from 1,000+ sources, grouped into stories, in 28 languages, with news sentiment. | |
| DID.is evidence Read-only checks for DIDs, credentials, MCP servers, A2A cards and agent delegation. | |
| unisafe LP insight Read-only Uniswap v4 LP manager data: position history, fees, operators, best pool. No keys. | |
| Flettu Icelandic company financials from annual reports; every figure cites its source document and page. | |
| how.is domain & IP intelligence Pay-per-call DNS, WHOIS, domain age, TLS, email auth, blocklists, IP intel. Free samples. | |
| Lantern Lantern is an AI visibility platform for ecommerce brands. | |
| Mink Viking Experience Real-time booking, 7-currency pricing, and FAQ for Reykjavik's Viking portrait photo studio. | |
| Muninn (munn.is) The memory that doesn't belong to the model. Encrypted, cross-vendor memory for AI agents. | |
| who.is Parsed WHOIS, RDAP, DNS, certificates, nameservers and domain history for any domain. | |
| Lobster Public affairs CRM: stakeholders, projects, actions, Finnish Transparency Register | |
| ASAPDevs Read-only: ASAPDevs offers, case studies, blog search, pricing and contact (Polish software house). | |
| JobHunt Track job applications: find the ones to follow up on, add jobs, update status, notes and steps. | |
| Codice Fiscale Subito Compute, decode and verify the Italian codice fiscale; codici catastali of every era. | |
| Coupondroid Italia Live coupons, promo codes and deals from online shops in Italy. Read-only, no login. | |
| Cronache Valtellinesi Archivio dei periodici storici della provincia di Sondrio (1825-2024): ricerca, lettura, citazioni. | |
| Cup24.it Availability Search private healthcare appointment availability across Cup24.it: services, doctors, clinics. | |
| it.datituristici/datituristici Dati turistici ISTAT di ogni comune italiano: presenze, arrivi, posti letto, popolazione. | |
| Expat Living Italy Sourced data on Italy's ~7,900 comuni for people relocating or retiring there. | |
| Flusia CRM Italian CRM for SMBs: leads, quotes, tasks, invoices, WhatsApp and newsletters via 200+ MCP tools | |
| Il Giornale delle PMI Articoli del Giornale delle PMI e bandi aperti per le imprese italiane: cerca, elenca, leggi. | |
| Giornata Mondiale Italian world days: search, calendar dates, sources, published content and verification status. | |
| Interfibra Copertura fibra e FWA per indirizzo in Italia, offerte Interfibra con costi e link di attivazione | |
| In Viaggio alle Canarie Canary Islands holiday packages from Italy: live flights, hotels, cars, excursions and prices | |
| IstruzioneMessina Italian education news for Messina: list, search, and analyze public articles. | |
| Italian B2B Lead Scoring, Ranking & JSON Decisions Score, rank and prioritize an existing Italian B2B lead list into explained JSON decisions. | |
| Italian B2B Lead List Scoring, Ranking & JSON Decisions Prioritize an existing Italian B2B lead list into up to 250 explained JSON decisions. | |
| MarketPilot Korean SMB marketing: browse, pay by card link, track orders. No login to start; OAuth to link. | |
| Matrice del Destino Italian destiny-matrix calculators and guides: list, search, and analyze public pages. | |
| occasioni.it: bandi e incentivi italiani Italian public grants for businesses, refreshed nightly: search, matching, deadlines, reports. |
41,851–41,900 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.