Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Legacy Device Debugger MCP Server dark-scientist/mcp This MCP server helps debug legacy devices behind proxies in OT environments by analyzing web interfaces and generating custom rewrite rules to fix proxy-related issues. | |
| apprise-mcp dark0823/apprise-mcp Universal notification infrastructure for AI Agents. Enables Claude, Cursor, and DeepSeek to push real-time alerts to 80+ platforms (Telegram, Discord, Slack, Email) via Apprise. | |
| Codex Vision MCP darkamenosa/codex-vision-mcp A local MCP server that adds computer-vision tools to coding agents and models that do not support native image input, using Codex OAuth credentials and the ChatGPT/Codex Responses backend. | |
| MISP MCP Server darkangel-agents/misp-mcp A Model Context Protocol server that connects AI assistants to MISP threat intelligence platforms. It enables threat intelligence search, IOC lookup, and event analysis through natural conversation. | |
| OpenCTI MCP Server darkangel-agents/opencti-mcp A Model Context Protocol server that connects AI assistants to OpenCTI threat intelligence platforms. It enables natural language interaction for searching threat intelligence, analyzing reports, managing indicators, and monitoring connecto | |
| x.ai Grok MCP Server darkangelpraha/xai-grok-mcp-server Enables chat completions using x.ai's Grok API with support for multiple Grok models (grok-beta, grok-2-latest, grok-4-latest) and configurable parameters like temperature and max tokens. | |
| fast-bitrix24-mcp darkclaw921/fast-bitrix24-mcp MCP server for interacting with Bitrix24 REST API, enabling CRUD operations on deals, contacts, companies, users, leads, and tasks, plus analytics and risk assessment. | |
| Brainstem darkcodepe/brainstem Local-first knowledge backend for AI agents that connects MCP hosts to an Obsidian-compatible vault with indexed retrieval, token-budgeted memory recall, and secure ingestion. | |
| SQLPrism darkcofy/sqlprism An MCP server that indexes SQL codebases into a queryable knowledge graph backed by DuckDB, enabling structural SQL queries instead of grep. | |
| darkd-skills darkd/darkd-mcp Four specialized AI agent skills: Integral Hermeneutics (8-lens text interpretation through any text type), Rune Wisdom (Elder Futhark divination), What-If Scenario Builder (15 foresight frameworksg), and Strategical Alignment (6-phase prot | |
| dda-mcp-server darkdragonsastro/dda-mcp-server An MCP server for controlling astronomy equipment, supporting Dark Dragons Astronomy devices and any ASCOM Alpaca-compatible equipment. | |
| TreeSitter Code Structure MCP Server darkeden-coding/codestructuremcp Analyzes source code across multiple languages to extract structural elements like classes, functions, and parameters using tree-sitter. It provides LLM-optimized markdown output that includes nesting levels, line numbers, and signatures to | |
| cocos-mcp-server darkerwork/cocos-mcp-server A comprehensive MCP server plugin for Cocos Creator 3.8+ that enables AI assistants to control the editor via standardized protocol, offering 50 tools for scene, node, component, prefab, asset, project, and debugging operations. | |
| Joplin MCP Server darkflib/mcp-joplin MCP server that provides standardized tools for querying and retrieving notes from Joplin personal knowledge manager through its API, enabling AI assistants to access and reference personal notes contextually. | |
| Zenrus MCP darkgenius/zenrus-mcp Provides real-time currency exchange rates for USD and EUR against the Russian Ruble, along with Brent crude oil prices sourced from zenrus.ru. It includes tools for fetching live financial data and calculating oil purchasing power based on | |
| companies-house-mcp darkhorseone/companies-house-mcp Enables AI assistants to search and retrieve UK Companies House data including company profiles, officers, and filing history via the official API. | |
| MCP Conductor darkiceinteractive/mcp-conductor Orchestrates multiple MCP servers through a Deno sandbox, reducing token usage by 99.7% by processing tool calls and returning only compact results. | |
| rugradar darkjay123/rugradar Enables AI assistants to check whether a crypto token, link, or forwarded "gem" message is a scam by running contract rules, live test trades, creator history, and market data across 64 networks, returning plain-English or Pidgin verdicts. | |
| voiceledger-mcp darkjay123/voiceledger-mcp Enables assistants to answer spoken questions about a cash trader's sales, expenses, stock levels, and outstanding debts from an append-only ledger, with deterministic figures for speech. | |
| taegis-magic-mcp darklicornor/taegis-magic-mcp An MCP server that wraps the taegis-magic CLI to allow AI assistants to query Secureworks Taegis XDR for alerts, events, investigations, threat intelligence, and tenants via natural language. | |
| Programmatic darklordgeo/programmatic Enables AI coding agents to perform structural code operations on TypeScript/TSX projects—finding symbols and references and renaming them semantically while preserving source. | |
| agentic-linkedin darklvrd/linkedin-mcp Enables an AI agent to fully operate a LinkedIn account—posting, messaging, profile edits, and network management—with self-healing selectors, human-like pacing, and approval-based planning to avoid breakage or lockouts. | |
| stellar-x402-mcp darklvrd/stellar-x402-mcp Gives an AI agent a Stellar wallet for x402 payments whose spending budget is installed and enforced on-chain by a Soroban smart contract, so overspending is refused by the contract even if the agent process is compromised, replaced, or res | |
| codeprovenance darkm3tter/codeprovenance MCP server for AI code provenance, enabling traceability of file changes to AI agents, sessions, and prompts, plus reporting on AI-generated code activity. | |
| repo-guard darkm3tter/repo-guard MCP server that enforces deterministic policies for coding agents, inspecting file writes and shell commands to allow, deny, or require confirmation based on configurable rules. | |
| mcp-project-context-server darkmatterproductions/mcp-project-context-server A Python MCP server that gives LLMs persistent, searchable access to project context — documentation, architecture decisions, and session notes. | |
| autoglm-mcp-server darknoah/autoglm-mcp-server Enables AI models to control Android devices via ADB through natural language commands, supporting screen analysis and automated actions. | |
| feishu-mcp-server darknoah/feishu-mcp 飞书多维表格 | |
| Conectica darknodebros/conectica An MCP server that enables multiple AI models (Claude, ChatGPT, Gemini) to share and persist context via a local-first vault of markdown files and SQLite index, allowing seamless cross-AI memory. | |
| MCP Debugger darknoon/mcp-debugger Provides debugging capabilities for Python, C, C++, Rust, Swift, and more through the Debug Adapter Protocol, enabling breakpoints, step-by-step evaluation, and stack traces. | |
| @hauntapi/mcp-server darko893/haunt-mcp-server Web extraction MCP server for AI agents. Extract structured data from any URL with built-in Cloudflare bypass, JavaScript rendering, and intelligent parsing. Returns clean markdown or JSON. | |
| Haunt API darko893/haunt-mcp-server-old Structured web extraction for AI agents. Pass any URL and a prompt, get clean JSON data back. Native MCP server with 100 free requests/month. | |
| reddit-mcp darkokuzmanovic-archived/reddit-mcp Enables fetching and reading Reddit content such as posts, comments, and subreddit listings via the MCP protocol. | |
| PubMed darkroaster/pubmearch Analyzes PubMed medical literature to help researchers quickly gain insights into medical research dynamics, with features including literature retrieval, hotspot analysis, trend tracking, and comprehensive reports. | |
| protonmail-mcp darkroomdevs/protonmail-mcp Enables AI clients to interact with ProtonMail accounts through the Proton Bridge using SMTP and IMAP protocols. Provides email management capabilities via secure local bridge connections. | |
| darkroute-mcp darkrouterh/mcp Enables MCP clients to query the cheapest measured cost of selling a token out of any indexed Uniswap v4 pool on Robinhood Chain and Arc, including pool details and live swap quotes, with a plain trap verdict when no reasonable exit exists. | |
| GitPilot MCP darkryan721/gitpilot-mcp A lightweight MCP server that enables AI assistants to manage local Git repositories by executing commands like status, add, and commit. It streamlines development workflows by providing repository context and diffs directly to the assistan | |
| MCP Platform darkshloser/mcp A scalable execution platform that enables users to interact with HR, ERP, and DevOps domains through a chat interface powered by LlamaIndex and the Model Context Protocol. It provides a configuration-driven architecture for orchestrating L | |
| edumints-scorm-mcp darkspotted-olivercromwell160/edumints-scorm-mcp Builds SCORM 2004 compliant e-learning courses locally with automated packaging and data privacy. | |
| Cursor Agent MCP Server darkstar326/cursor-agent-mcp Wraps the cursor-agent CLI to provide cost-effective tools for repository analysis, code search, planning, and editing. Offloads heavy thinking tasks from the host AI to reduce token usage while maintaining precise, scoped workspace operati | |
| Feishu Base MCP Server darkstar326/lark-base-mcp-node-server Enables LLMs to interact with Feishu Base (Lark) databases by providing comprehensive tools for managing records, tables, and schemas. It supports full CRUD operations on database entries and structural modifications to table fields through | |
| Log Analyzer MCP darkstar326/log_analyzer_mcp Enables AI-assisted analysis of log files through advanced searching, filtering, and test execution capabilities. Supports time-based queries, pattern matching, test summarization, and code coverage reporting directly within compatible MCP | |
| LudusMCP darkstar326/ludusmcp An MCP server that enables management and deployment of Ludus lab environments through natural language commands. It provides comprehensive tools for range lifecycle management, configuration validation, and documentation research within vi | |
| MCP Server for Danmarks Statistik darkstar326/mcp-dst Enables natural language access to Denmark's Statistics API (Danmarks Statistik), allowing users to query and analyze Danish statistical data without coding knowledge through AI-powered interactions. | |
| MCP MySQL Server darkstar326/mcp-mysql Enables interaction with MySQL databases (including AWS RDS and cloud instances) through natural language, supporting query execution, schema inspection, index management, and comprehensive database operations with secure SSL connections. | |
| singularity darkstarmatters/singularity-agent Enables querying blockchains across EVM, Solana, Bitcoin/UTXO, and Cosmos through a unified interface, with tools for resolving addresses, checking balances, fetching transactions and blocks, reading contracts, decoding calldata, and buildi | |
| GEP MCP Motor darkt22002/gep-mcp-motor Enables entropy-guided motor control for autonomous tool execution in MCP systems, using behavioral entropy dynamics to adaptively gate, throttle, and regulate tool invocations rather than static policies. | |
| agentdrop-mcp darktw/agentdrop-mcp AI agent arena — register agents, battle head-to-head, check DropScores, submit prediction takes, and debate from any MCP client. Deploy real HTTPS endpoint agents or use hosted fallback. | |
| GM-Maker MCP Server darkw3bb/gamemaker-mcp-server Enables AI-assisted GameMaker project development in Cursor IDE, allowing users to create projects, add scripts, objects, and sprites using natural language. | |
| OSC MCP Server darkwings/osc_mcp MCP server for controlling Behringer X-Air digital mixers via OSC, with symbolic naming and dB-to-float conversion. |
42,351–42,400 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.