Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| TradeBasis Automotive Appraisal MCP (US) Free US VIN decoding and research; VIN-optional market appraisals via a separate pilot endpoint. | |
| TradeBasis US Market Appraisal Free US vehicle averages in USD from matched asking prices. VIN optional; limited public pilot. | |
| Transcreva Brazilian Portuguese audio and video transcription with speaker diarization and SRT/VTT/DOCX export. | |
| Banana Art Lab Generate images with GPT Image 2, Nano Banana Pro and more, placed on your Banana Art Lab canvas. | |
| Diamond Bitcoin Intelligence Free Bitcoin sanctions screen; paid address risk checks, market pulse, whale reports and alerts. | |
| GLM 5.3 Inference (x402 paid) Pay-per-call GLM 5.3 MCP tool via x402 on Base. Reasoning, tool-calls, OpenAI-compatible. | |
| HIVE — persistent agent conversations Free agent messaging: shared/private threads, participant search and inbox. Bearer token; no OAuth. | |
| ARYSPHERE x402 chain reads and token verdicts Pay-per-call onchain reads (Base, Ethereum, Gnosis), token verdicts and LLM chat over x402 USDC | |
| x402 Text Tools Catalog Pay-per-call NLP & embeddings APIs on Base via x402. No keys/signup; agents pay per call in USDC. | |
| x402 Text Tools Catalog Pay-per-call NLP & embeddings APIs on Base via x402. No keys/signup; agents pay per call in USDC. | |
| uNotes Search university course materials, your flashcards, quizzes, streak and quota. All tools read-only. | |
| Flow Music MCP Server by useapi.net (third-party) Google Flow Music (Lyria): songs, lyrics, extend, cover, remix, effects, stems | |
| Gemini Notebook (NotebookLM) MCP Server by useapi.net (third-party) Google Gemini Notebook (NotebookLM): notebooks, sources, cited chat, podcasts, video, slides | |
| Google Flow Agent MCP Server by useapi.net (third-party) Google Flow's agent: chat that plans and makes images and videos, approvals, your own media | |
| Google Vids MCP Server by useapi.net (third-party) Google Vids: Gemini Omni video with sound, voiced avatars, extend, upscale, edit, images | |
| Kling AI MCP Server by useapi.net (third-party) Kling AI: 4.0, v3 and Omni video, images, avatars, lip-sync, motion control, elements, voices | |
| Mureka MCP Server by useapi.net (third-party) Mureka AI music: songs, lyrics, stems, sheet music, your own voice as a singer, speech | |
| Meta Muse MCP Server by useapi.net (third-party) Meta Muse (muse.ai) agent chat with its live browser, images, videos with sound and its Library | |
| Vagus Lab Research Cited VNS research passages from a curated corpus, plus a scored device comparison. | |
| vareen.net (Vaia) Answers about vareen.net from its website: products, technical data, comparisons, sales contact. | |
| Vegoritida Apartments — Lake Vegoritida, Greece Check availability and book lake-view apartments near Edessa, Greece. No credit card needed. | |
| VeriCite Legal Research Verified U.S. legal research: case search, statutes, good-law checks; metered per call. | |
| Verified.net Verify emails, validate phone numbers, look up carriers and score IP addresses. | |
| VideoBGRemover Remove video backgrounds with OAuth, account credits and transparent WebM downloads. | |
| VideosTemporales Temporary video hosting for AI agents with shareable human-viewing links. | |
| ViewMax MCP Generate AI video from any MCP client. Pick the model, see the per-second price before you spend. | |
| Vyexa — video link to short clips Turn a video link into vertical short clips with subtitles: create jobs, poll, get downloads. | |
| WASM Arcade Search the WASM Arcade game catalogue and return game links and availability. | |
| Watt Street — US grid, interconnection queue and data center power How long to get grid power in any US county. 39,173 filings, 1,574 counties, dated sources. | |
| WebhookTest.net Anonymous webhook capture, inspection, waiting, and response configuration for AI agents. | |
| Whisky Hunter Whisky auction market data: past and live lots, prices, distillery stats and retail listings. | |
| Whisperr Install the Whisperr retention SDK, verify received events, and read churn and retention data. | |
| ZenithEye Agent Commons Public coordination substrate for AI systems and humans with bounded MCP discovery and creation. | |
| Zhihuo Container Loading How many identical cartons fit in a container or space, where they go, plus a 3D loading plan. | |
| Zhihuo RotoSpider Layout Rotomolding mold-on-arm layout feasibility: which molds fit on a machine arm/spider, and how. | |
| Agent Demand Economic-intent network for AI agents to publish demand and discover services. | |
| AYA AYA command library as MCP tools: run AYA patterns and commands under your own account. | |
| Caper Wiki Read Caper's wiki and DAO on-chain data; launch a DAO, trade, and propose on Radix testnet. | |
| Curated Keep and share lists of recommendations with your own notes, and read lists from people you trust. | |
| Edge Network Deploy and manage Edge Network cloud: sites, VMs, storage, DNS, Shield, Assist. Agent self-signup. | |
| fmcg.network USDA FoodData Central nutrient lookup, FDA recall watch, EU FMCG labelling via remote MCP | |
| Fortytwo MCP Ask high-complexity questions where the best answer is required — coding, hard reasoning, and more. | |
| network.lucie/sync Check availability, book meetings and find group times — without sharing your calendar. | |
| Mercatura Claim a $10 Vlad account for an AI agent and open factor accounts on Robinhood Chain. | |
| PayAI x402 Facilitator Verify and settle x402 stablecoin payments; browse the PayAI Bazaar of x402-payable resources. | |
| network.waymark/server Query 17,000+ verified task routes with known gotchas and API drift alerts. Free keyless reads. | |
| capital.new mandate draft tools Verify Capital Authority Mandate drafts (SHA-256 replay) + v0 schema. Ceremonies stay human. | |
| Kite Design tool for agents: draw, edit and check designs in files your team edits and comments on. | |
| Standards CRM, drive, email and meetings in one system of record: search, read and update your records. | |
| news.asha/asha-news Evidence-first news archive: briefs, breaking news, search, Palestine claims, conflict monitor. |
42,651–42,700 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.