Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Diktuy (Диктуй) Search meetings, transcripts and dictations in Diktuy: speakers, timestamps, tasks. Russian-first. | |
| ДокиДепо — открытые инструменты склада Read-only инструменты малого склада: назначение, ограничения и безопасный план первого дня. | |
| DomChecker Domain availability, WHOIS and DNS for any TLD (.ru, .рф, .com…), straight from registries. | |
| EvaFarm — GPU render nodes Render farm GPU nodes: live availability, installed DCC apps and engines, per-minute cost. | |
| GenTender — госзакупки России Russian public procurement: search tenders, documents, RPP registry, bid assembly (44-FZ, 223-FZ) | |
| htmlkin.ru Публикуйте и обновляйте HTML-сайты через MCP с OAuth 2.1 на htmlkin.ru. | |
| КМВ INFO — новости Кавминвод Local news of Caucasian Mineral Waters and Stavropol, Russia: incidents, outages, fuel, events | |
| ru.investmint/mcp Russian stock market data: dividends, forecasts, bond coupons, corporate calendar — MOEX | |
| Invisible Doors — hidden doors & glass partitions Hidden (flush) doors and glass partitions: price, specs and 3D models (GLB, IFC, DXF) on demand. | |
| Iskalo — Russian Web Search Search the Russian web with contact, city and provider filters; retrieve indexed page contents. | |
| Katalog Artistov — artists for events Artists for events in Russia: hosts, bands, shows, magicians: fees, cities, profiles, requests. | |
| Krasoft Russian Public Procurement Search and analytics for Russian public procurement (44-FZ/223-FZ): tenders, contracts, market data | |
| КурьерHUB Courier jobs in Russia: delivery services' pay rates by city, terms, income calculator. In Russian. | |
| Lab4U Lab4U (Russia): pick lab tests for a goal or a doctor's list and build a cart on lab4u.ru | |
| LastBilet — flight search Live flight search for Russia: baggage, layovers, refunds, booking links, prices, visas, weather. | |
| Mottor Build and run Mottor websites: pages, SEO, shop, CRM leads, data tables and publishing. | |
| 1cent Web Intelligence for AI Agents SSRF-safe web intelligence: 4 outcomes, 43 paid x402 tools, 3 free tools and a URL preview. | |
| mcp-everything: Russian APIs Russian APIs for AI agents: YooKassa, CDEK, Bitrix24 and more. Ready scenarios with code. No key. | |
| Между Комнат: двери в Москве Interior and entrance doors shop in Moscow: search, exact cart price, stock, order and measurement. | |
| Medico Mind MCP Search the clinical guidelines of the Russian Ministry of Health with source references. | |
| ru.meetslava/hr HR-инструменты: поиск кандидатов, оценка match, интервью, управление рекрутментом. | |
| Merfy Магазин Merfy: товары, заказы, доставка, скидки и витрина — поверх публичного API платформы. | |
| MM7 Company MCP MM7 public B2B MCP: 1C ITS/RRP, requisites, EDI, cloud trial (GRM/Fresh) for AI agents. | |
| NexIP Network, domain and website diagnostics for AI clients via MCP. | |
| NOVA amoCRM / Kommo Remote MCP for amoCRM and Kommo: leads, contacts, tasks, pipelines, chats, Salesbot. OAuth. | |
| Pandawed — Chinese flashcards (HSK) Chinese for Russian speakers: HSK 3.0 words, topic sets, textbook lessons and articles. | |
| Pastrama Mama Часы, меню, акции, бронь и заявки на банкет: Pastrama Mama, Санкт-Петербург. | |
| Ploshadkin — event venues in Russia Event venues in Russia: restaurants, lofts, hotel halls, country clubs. Capacity, prices, requests. | |
| poolproof — checks before you commit money Who launched it, what exit really costs, is the pool what it claims. Facts only, no advice. | |
| Pravida — Russian law Russian law for AI: statutes with edition dates, Supreme Court guidance and court practice. | |
| ProfilDoors: межкомнатные двери в Москве ProfilDoors doors dealer in Moscow: catalog search, exact cart price, stock. Read-only. | |
| ПромтЛаб — библиотека AI-промптов Self-hosted AI prompt library: prompts, collections, tags, teams, chains. 29 MCP tools for agents. | |
| QuintaDB No-code databases, forms, portals and AI sites. Manage records and automation via natural language. | |
| ru.renthuman/renthuman AI agents hire real humans in Russia: storefront photos, address checks, errands. Pay in USDT. | |
| Rewio — отзывы о ваших объектах Отзывы об организациях с 30+ площадок: искать, считать, отвечать. Нужен ключ Rewio. | |
| sexpreparat.ru sexpreparat.ru catalog: articles, research, reader Q&A, blogs on sex & health, 6 languages. | |
| Seyka.ru Hosted SEO analytics and tools: Yandex, Google Search Console, Topvisor, Rush Analytics and Keys.so. | |
| SlidesWeb Interactive presentations: create decks, add polls, start live sessions and read audience responses. | |
| Solvion Heating Energy Engineering Heating, ventilation and energy engineering calculations and diagnostics for AI agents. | |
| Brisket Eat & Fun Часы, меню, акции, бронь и заявки на банкет: Brisket Eat & Fun, Санкт-Петербург. | |
| ru.swipa/mcp SWIPA bot API — send/receive messages on swipa.ru via per-connection Bearer auth. | |
| Табуля Таблица с ИИ, Python и подключениями к базам данных и сервисам | |
| Torgi.Otkryto (torgiopen.ru) Russian property auctions: bankruptcy, state, seized, bank and leasing lots. Read-only, in Russian. | |
| Transkriba — Russian audio transcription Transcribe Russian audio and video with timestamps and optional speaker labels from files or links. | |
| Тут виднее Образовательные организации России: где учат, чего нет и кто придёт до 2038. Официальный сервер. | |
| ru.value-pro/value-pro-mcp Оценка имущества ВАЛПРО (Москва): расчёт цены, услуги, документы, FAQ, заявка без ПД. | |
| Vargov®Design Read-only MCP server with Vargov®Design public data: compositions, answers, configurator, dealers. | |
| Vibe2Text — AI audio & video transcription with speaker diarization Audio & video to text, Russian-first: diarization, timestamps, summary, action items, subtitles. | |
| vibeshooting — Егор Севастьянов Product photography and AI production in Moscow: services, portfolio, route fit and brief. | |
| Zakazat Zvezdu — book pop stars Book Russian pop stars for corporate events and parties: search by genre, fees, profiles, requests. |
43,301–43,350 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.