Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Metatake Original film criticism: multi-framework readings, TakeScore ratings, kindred films. | |
| The Observatory AI information agency: news from 500+ sources on AI, Ethiopia and Interesting Politics. | |
| Mimicly Make fictional chat mockups and text story scenes, with a preview and a link to edit in Mimicly. | |
| ミロンド (Mirondo) 日本語で使える無料AIツール1145本の検索。実際に開けるか確認済み、商用利用の可否つき。 | |
| MYOPL Personal MCP - Account Ratings & Statistics MYOPL account ratings, sessions, RSVP preparation and own stats via OAuth; restricted admin pilot. | |
| MYOPL MCP Server - Official Pickleball Rules & Ratings Official 2026 USA Pickleball rules, free 4-decimal OPL ratings, and court/club/open play discovery. | |
| Leafle Personalised book recommendations, filtered to what's on your public library's shelf right now. | |
| Air Route Atlas MCP Air route and connection intelligence | |
| Corporate Money Trail MCP Follow public corporate ownership | |
| Court Records MCP Search US federal and state court records through CourtListener and the RECAP archive | |
| EU Policy Watch MCP Monitor EU policy across both law-making institutions | |
| Europe Rail Watch MCP Monitor European train stations | |
| Flight Watch MCP Live aircraft near an area | |
| global-institutions-watch Monitor public updates from international bodies such as the UN | |
| Grid Carbon MCP Electricity grid carbon intensity for Great Britain from the National Grid ESO Carbon Intensity API | |
| Launch Watch MCP Rocket launch dates | |
| Maritime AIS MCP Live AIS vessel tracking for the Baltic Sea and Gulf of Finland via Fintraffic's open Digitraffic | |
| Nexlab MCP 28 MCP servers behind one endpoint: earth, sky, policy, records and research | |
| Peer Research Papers MCP Scholarly literature search across nine sources | |
| Planet Watch MCP Every environmental layer at one point on Earth | |
| Public Health Watch MCP Monitor WHO/public health news and disease/outbreak information links for viruses | |
| Sacred Texts MCP Citation-oriented retrieval across six religious traditions | |
| Scientific Math Calculator MCP Safe scientific calculator MCP for numeric expressions | |
| Shodan Search MCP Defensive Shodan search and host intelligence MCP using customer-provided SHODAN_API_KEY for | |
| Sky Watch MCP Observational astronomy in one place | |
| Sports Events Results MCP Track sports teams | |
| Trade Tariffs MCP US import tariff lookup against the official USITC Harmonized Tariff Schedule | |
| us-congress-watch Monitor US bills | |
| Vulnerability Intel MCP Defensive vulnerability intelligence search across public CVE/NVD and GitHub advisory APIs with CVSS | |
| Wikipedia Retrieval MCP Search | |
| youtube-media Search YouTube, read video metadata, and fetch transcripts with language preferences | |
| Nudgen Manage email campaigns, contacts, brand settings, and analytics with Nudgen AI email retention. | |
| net.nymbo/tools Remote MCP server: fetch, search, Python, TTS, memory, image, video. | |
| Croft Deploy and host the apps your AI assistant builds — a real server, database, and shareable URL. | |
| Online Web Directory How websites treat AI agents: bot walls, JS needs, robots rules, llms.txt. Look up before you fetch. | |
| Orinami Mind maps with a full document in every node. Read, search and edit your maps from AI tools. | |
| Oxynet Cardiopulmonary exercise test (CPET) analysis: ventilatory thresholds, metrics and substrate use. | |
| 파공넷 경공매 Korean court auctions, Onbid and bankruptcy sales with expected rental yield and market ratio. | |
| parcelapi.net US parcels and building permits from public sources. No owner data. Pay per record or monthly plan. | |
| Particular Service Platform Documentation MCP Server Search and read documentation about NServiceBus and the Particular Service Platform. | |
| pdf.net Create, convert, organize PDFs | |
| Peer Commons Agent reliability experiments and persistent discussions, shared context and subscriptions. | |
| Periodix Actions Search LinkedIn & Sales Navigator. Get structured people, companies, posts, jobs data. 4.9/5 on G2. | |
| Pickadate Find a date with a group: polls, rosters, RSVPs and sign-ups, run by your assistant. | |
| net.pifini/pifini Real events, reviewed places, and ticket checkout across the Caribbean and Latin America. | |
| Registry Verifier Probe MCP compatibility and transport verification server. | |
| Registry Verifier Probe B MCP compatibility and transport verification server. | |
| Registry Verifier Target A MCP compatibility and transport verification server. | |
| Registry Verifier Target B MCP compatibility and transport verification server. | |
| Registry Verifier Target A MCP compatibility and transport verification server. |
42,551–42,600 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.