Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| officina.it Read your officina.it workshop data: customers, vehicles, worksheets, invoices, calendar. | |
| Oltre il Solco Serie storiche su agricoltura, acqua e irrigazione, con la fonte originale di ogni dato. | |
| Piazza in Festa Sagre, feste e manifestazioni dei comuni italiani, ricavate ogni giorno dagli albi pretori. | |
| it.piqod/experiences-oracle Search & compare prices for tours, activities and tickets across multiple providers. | |
| Radar Volantini - Prezzi in Vista Italy only: current offers and weekly price trends from the flyers of Italian store chains. | |
| Remly Search and retrieve permission-aware knowledge from connected sources through Remly. | |
| Remote.It Remote.It hosted MCP: inventory devices, open connections, manage services and run scripts. | |
| Scadero Deadlines, clients, documents and messages of an Italian accounting firm (commercialista). | |
| secondlife.it: lavoro, luoghi e soldi per ripartire Start again in Italy: towns that pay you to move, 1-euro houses, remote jobs, plan preview. | |
| Agent Ready Score any website out of 100 for how well AI agents can find, understand and use it. | |
| Stampa e Stampe Italian online print shop: search the catalog, read product options, get exact configuration prices. | |
| TaxCompass — Italian tax tools Sourced Italian tax tools for AI agents: cited primary-source search + a deterministic tax engine. | |
| Farmacia Santa Croce Servizi, giornate speciali e prenotazioni della Farmacia Santa Croce. | |
| TrovaStorage TrovaStorage.it è il marketplace per il self-storage. Cerca centri, schede per città. Sola lettura. | |
| Webtic Cinema, theatre, concerts and events on sale in Italy on webtic.it: what's on and where. | |
| aitrainers.jobs: AI training jobs search Search open paid AI training jobs from 70+ platforms by country, work, language and pay | |
| AITraining.jobs Search open AI training jobs from 17 platforms and compare advertised hourly pay by kind of work. | |
| RobotTraining.jobs Search open robot training jobs (teleoperation, data collection, AV and drone tests) and their pay. | |
| jp.addresstozip/address-to-zip 日本の住所⇄郵便番号を変換。表記ゆれも吸収。Japan address ⇄ postal code, handles messy input. Free tier, no API key. | |
| Japan Website Intelligence Website company, contact, hiring and social links. 20 free daily lookups; prepaid keys for AI. | |
| jp.afdb/mcp Search current Japanese point-site rewards, conditions, yen values, and observation times. | |
| agentfeeds.jp Japan regulatory, sanctions & DEX market data for AI agents via x402 (USDC on Base). | |
| @エール | Aile Jobs 日本の掲載中・公開正社員求人の検索、求人詳細、職種別年収相場を提供する読み取り専用MCPサーバー | |
| ALUZZA MARINE: Japan boat trade and tide tables Japan boat trade 2011-2025, tide tables for 239 ports and past monthly weather near ports (JMA). | |
| Yamagishi Sync Lab: wages and business risks Same-job hourly wages in Japan, US, UK, Germany, France; ranks of 31 business risks, Japan vs US. | |
| Anisongs — Anime Song Database Accurate anime-song (anison) database for AI-built playlists — export to Spotify/Apple/YT Music | |
| avacast 写真から作ったアバターをリアルタイムに喋らせる API (日本製)。会話の開始・発話・利用状況を tool で扱う。管理画面のアカウントでログインしてつなぐ (OAuth) | |
| ベストカレンダー 暦データ Japanese calendar data (rokuyo, lucky days, solar terms, holidays, moon, sunrise), 1926-2080. | |
| カーリル for AI Search 7,400+ libraries across Japan, find which one holds a book, and browse NDC classification. | |
| Ad Arch Agents Request quotes for video, shooting, social media, ad media, design, web and events in Japan. | |
| Contencial MCP 株式会社コンテンシャルの公開情報を検索・取得できる読み取り専用サーバー。出典は canonical URL に固定。 | |
| 株式会社一創 コーポレートサイト 株式会社一創（issoh.co.jp）の技術記事・サービス・制作実績を検索できる MCP サーバー。システム開発・AI・クラウド・Web 制作の日本語情報 | |
| RenRaku メールと LINE 公式アカウントの顧客対応サービス RenRaku を、Claude や ChatGPT などの AI から利用するための MCP サーバーです。 | |
| ROSTER Japanese recruiting CRM. AI searches candidates, jobs and pipelines and adds records. | |
| ラウンドナップ Webマーケティング・ナレッジ Search Roundup's Japanese SME web marketing insights; return source excerpts and article links. | |
| コエカツ アンケート集計データ コエカツの公開アンケート集計を検索・取得できる読み取り専用サーバー。登録不要。引用用の時点固定URLと出典つき。 | |
| ドメイン番人 ドメインの設定を調べる MCP サーバー。SPF / DKIM / DMARC・DNS・SSL 証明書・セキュリティヘッダ・サブドメイン・類似ドメインを、公開情報だけで確認します。登録不要・無料。 | |
| エキテン ネット予約 エキテン（日本全国のお店・施設の情報サイト）のネット予約を提供するMCPサーバー。オールジャンルの日本国内店舗・施設が対象。店舗検索・空き確認・予約登録・キャンセルに対応。 | |
| 学童さがし (Gakudo Sagashi) Compare private after-school care (gakudo) in all 23 Tokyo wards, from official information. | |
| 補助・助成.jp Find Japanese subsidies, check eligibility with guideline citations, and fill official forms. | |
| jp.livetribe/live-tribe Japan's largest live house show database: search shows, artists, and venues | |
| MenuFresh The brain for restaurant costs, pricing, and true profit (read/edit menu, recipes, costs). | |
| Japan Business Tools Japanese holidays, business days, eras, postal codes, addresses and corporate numbers. | |
| プレニカ MCP プレニカに掲載された企業のプレスリリースと運営情報を検索・取得できる読み取り専用サーバー。出典は canonical URL に固定。 | |
| Ranked Jobs Live Tokyo job listings for foreign professionals: English/visa/salary filters, source links. | |
| jp.renkeimap/renkeimap-info 日本の業務システムの API・認証・接続方式・稼働状況を、出典と調査日つきで返す読み取り専用 MCP（IT連携マップ） | |
| SealGate 既存のログインにパスキーを追加する API (日本製)。プロジェクト・API キー・パスキー・監査ログを tool で扱う。管理画面のアカウントでログインしてつなぐ (OAuth) | |
| SEO対策研究室 MCP SEO対策研究室（柏崎剛）の公開情報を検索・取得できる読み取り専用サーバー。出典は canonical URL に固定。 | |
| SKETCHTALK – Draw to AI Mac app: draw on a running web page, Simulator or Mac window and hand the marks to Claude Code. | |
| ［MCP］アイレディース化粧品 - アイスター商事（基礎化粧品 / アルファエー / 健康食品 / 季節の食品）【公式】 株式会社アイスター商事の公式サイトです。（ai-star.co.jp の内容を検索して答える。ヨミタス経由） |
41,901–41,950 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.