Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| org.directindex/scanner AI-agent readiness of business websites: scans, city indexes, assistants' answers, direct links. | |
| Clair Audits AI-built websites for France and Belgium: cookies, GDPR, legal pages, exposed keys, security. | |
| Python Code Reviewer Security + bug + perf + refactor audit for Python. Returns 0-10 score + MD report. | |
| aiworker-data Paid x402 tools (USDC per call): defi_yields, defi_protocol, scrape_markdown, scrape_summary. | |
| Open data: clinical trials, EU tenders, companies, fuel prices Official open data as JSON: clinical trials, EU tenders, papers, apps, French firms, fuel, domains. | |
| Persistent text store No-auth text store for agents: persist notes past your episode, read what other agents left. | |
| Eleições 2026 em dados (TSE) Brazil 2026 election results (TSE): votes by candidate and city, parties, offices, assets. | |
| MCPTube Search YouTube videos, read transcripts and get public video information in your AI assistant. | |
| org.echoempire/web-tools Web extraction MCP: page content, metadata, articles, contacts, email checks, URL probes. | |
| EconDash Free, read-only economic indicators for any country from the World Bank, IMF, FRED, OECD and others | |
| Election Index Neutral, sourced election calendar: polling days, when provisional and final results are due. | |
| ElectroGen AI electronics blueprint generator — BOM, wiring, firmware, renders for Arduino/ESP32/RPi. | |
| email-validation.org email validation Validate emails and run bulk jobs: status, reason and action for each address. Unknown is free. | |
| Everroad: Utah car dealer facts Utah franchise car dealer facts with sources: hours, weekend service, doc fees, services. | |
| org.everythingisperfect/perfect-world New Mexico local-government records as tools: meetings, packet text, officers, Superfund, reservoirs | |
| Expatslist City guides, local business listings and Q&A for expats and newcomers in cities worldwide. | |
| EZ Annuity Price settlement or annuity payments, judge a buyout offer, look up any US state's transfer rules. | |
| Fast Fibre: fiber internet check Check if fiber internet reaches a home in Hinesville & Midway, GA, and request a specialist's call. | |
| Feed America US food pantries, meal programs, SNAP and WIC help from Feed America (EIN 92-1761881) | |
| org.filetourl/mcp Upload a file and get a public shareable URL via API or MCP. | |
| FlowchartAI Create, edit, save and export native flowcharts through OAuth with your FlowchartAI account. | |
| org.gdacs/api An MCP server that through www.gdacs.org provides access to web‐based disaster information systems. | |
| Georgia Civic Data Query, filter, aggregate, and link Georgia education, Census, immigration, and health datasets. | |
| Georgia Commons Georgia's Code, bills, Supreme Court opinions, and 2026 House and Senate meetings. Independent. | |
| Georgia Homeroom Georgia K-12 standards, Milestones blueprints, and achievement levels for educators. Independent. | |
| Dunn Free invoice tools: due dates from payment terms, late fees, days late, payment reminder emails. | |
| ghurt Query Garmin, Oura & Whoop sleep, HRV, recovery & training load from Claude or ChatGPT. | |
| GigNGo: US locals for home jobs and errands Find a US local for a home job or errand, watch their filmed work, draft a post the person confirms | |
| Global Exchange Rates Official exchange rates from central banks: latest & historical rates plus currency conversion. | |
| GLO Law Free U.S. legal research: court opinions, statutes, state regulations and corrections policies. | |
| GolfCore AI caddie and flag distances for Premium golfers, plus course maps and tee-specific scorecards. | |
| org.govenantstandard/govenant-audit Run the GOVENANT trust audit on your own AI agents — read-only, aggregate-only. Detects… | |
| HelpRabbit Work your HelpRabbit help desk: tickets, replies, customers, the AI agent and its knowledge. | |
| holdmark · facts about online stores Does this store deliver and refund? Measured with carriers and payment processors. | |
| NextCore Browser Multi-profile browser: AI agents create, open and drive isolated signed-in profiles with own proxy | |
| IARCCUM Archive of Anglican-Roman Catholic Dialogue Read-only access to public records on Anglican-Roman Catholic dialogue in the IARCCUM Archive. | |
| ieUnit – neutral value reference unit Neutral value reference unit: live value, history, conversion and methodology. | |
| org.inkflowstudio/inkflow AI book writer, manuals, SOPs, layout-keeping translation, 26 languages, LoRA packs. Free Chapter 1 | |
| Isto Intents Registry Finds intent servers (car or home watch) for a country and category. Read-only. | |
| IZOProfil.org Read-only building materials catalog: product search, specs and PLN net/gross prices. | |
| Jainebooks Catalogue Search 16,000 free Jainism ebooks and audiobooks in Gujarati, Hindi, English, Sanskrit and Prakrit. | |
| japanlaw.org — Japanese law Japanese statutes and the Ministry of Justice's English, cited to the item, every line sourced. | |
| JOA — Job Opportunities API Search live employer-direct job postings, company hiring signal, market stats and the change feed. | |
| Journeyed: Los Angeles hotel facts Los Angeles hotel facts with sources: parking prices, fees, pets, check-in, pools, distances. | |
| Kampyeri Kamp Arama Live read-only search for verified campsites in Turkey. Book on kampyeri.org. | |
| Knossot Personal event picks from Knossot's calendar of the Hudson Valley, Philadelphia, and New York City. | |
| Lampions — scrutins publics français Décompte officiel des scrutins de l'Assemblée nationale, du Sénat et du Parlement européen. | |
| LexLint: compliance lint for AI, scraping, and privacy law Compliance lint for AI, scraping, and privacy law. Cited findings in 200 or more jurisdictions. | |
| licitaIA — Spanish public tenders Search recent Spanish public tenders and retrieve basic details with official source links. | |
| org.llmpress/llmpress Agent-only long-form publishing: articles, notes, replies and follows under the agent's own byline. |
42,951–43,000 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.