Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Zavod Stanki CNC Catalog Official MCP for Kamensky CNC Plant (Twite): machines, prices, Birzha orders, FAQ, leads. | |
| transparent.ruhr Read-only council records from Germany's Ruhr area plus German parliamentary papers. | |
| Capable MCP-native CRM: your assistant proposes updates, you approve them field by field. | |
| run.chromeflow/chromeflow Lets Claude Code or Codex CLI drive your real Chrome — sessions intact, 28 browser tools. | |
| Coolant Instruments for what a model cannot know on its own: time, randomness, DNS, hashes, receipts. | |
| GoldLegal Legal Compliance API AI legal compliance: contract review, risk scoring, EU/CN AI act, watermark check. 8 MCP tools. | |
| run.fcapp.cn-shanghai.x-api-zhiji-signal-fblfayyeas/zhiji-signal Market phase transition signals for HS300 and BTC via MCP | |
| imho.run game recommendations Steam games like any game you name, facts about a game, and finding a game from a description. | |
| nvoke Find companies and verified business emails: search, wait for checks, export leads. | |
| Traceproof Search security findings and contribute versioned, evidence-backed reproduction reports. | |
| Runlane Kanban board for teams and coding agents: manage tasks, subtasks, sprints and wiki pages via MCP. | |
| Saina Studio MCP Run Saina decision endpoints and retrieve decisions via MCP. | |
| Saka Business Data Search business records by market with evidence. Prepaid credit; emails observed, not verified. | |
| Saka purchased library Read purchased Saka business records with source evidence. No new purchases or spending. | |
| socially.run Read public social profiles and posts, and search videos, news and trends. | |
| Ultrapedia US ultramarathons: dates, places, distances, elevation, prices. Every value cited. | |
| VIL ZERO Autonomous venture engine for AI agents: discover, build, quote, and track capabilities. | |
| AI Deprecations AI model shutdown dates, replacements, change feed and webhook alerts for 8 providers. | |
| Oronzo Milan Direct Booking 2-bedroom Milan apartment (max 4, near Fiera/EICMA): open dates + direct GuestHost booking links. | |
| Ahkam — Saudi court rulings Search published Saudi court rulings and get analysis grounded only in the retrieved rulings. | |
| Saudi Law Portal · البوابة الميسرة للأنظمة Saudi statutes and regulations: search, read full texts, analyze redacted facts (Arabic/English). | |
| منصة المناقصات — Saudi Government Tenders Saudi government tenders (Etimad): search, agencies, winners, market reports. Read-only. | |
| KARVE Booking Live KARVE Pilates class schedule and availability in Jeddah, with booking links. Read-only. | |
| CRE For Sale: underwrite, finance and watch public property sales Underwrite and finance a commercial property; government and FDIC property sales watch. | |
| Porchlight: 2-4 unit loan limits and owner-occupant math FHA and conforming 2-4 unit loan limits by county, plus owner-occupant house-hack math. | |
| Agentic Design School List Agentic Design School courses, read a public outline, and open the course page. | |
| school.delegation/delegation-school Learn to delegate real work to AI, not just chat with it — a course taught live in your own Claude. | |
| science.executable/executable-science Read-only research pilot catalogue: task templates, resources, starter studies, capability status. | |
| Pith Reviews of arXiv papers for AI agents: verdicts, claims, flaws, compiled records, citation graphs. | |
| science.supp/suppscience 993 evidence-graded supplements: claims, doses, safety, interactions, FAQ, PubMed refs. 5 languages | |
| WAI Quantum job service A free quantum job service: OpenQASM 3 run, checked and signed, with no account or key. | |
| Aigine Redact Descriptive AI redaction for any file. GDPR + confidentiality. EU, zero retention, review optional. | |
| Aleva open data Swedish public data as read-only tools: registries, statistics, domains, transport, energy. | |
| Bizindex: svenska aktiebolag Check Swedish limited companies (aktiebolag): registry data, their website and the evidence for it. | |
| Börsdatabasen Nordic listed companies: cited financials, screener, sector stats and board/ownership graph. | |
| Dinilu Sverige — tryckta profilprodukter Aktuella priser, alternativ och fraktkostnader för tryckta profilprodukter. | |
| Finder: find local tradespeople Find connected local tradespeople and service companies by town, with a prefilled request link. | |
| Företagskoll – Nordic & UK company data Company lookups and annual-account financials: Sweden, Norway, Finland, UK. Pay per call (x402). | |
| Svenska bolagsdata Sök svenska aktiebolag och hämta bokslut, nyckeltal och registeruppgifter. | |
| se.glowjakt/glowjakt Nordic beauty price comparison: 500k+ EAN-matched products, 70+ stores, true landed-cost pricing. | |
| Helsama Hemp from Gotland: product catalog, knowledge base and open lab data per batch. | |
| Scout by Jakvab Nordic company intelligence: look up companies, AI summaries, scores and signals via MCP. | |
| Klassio — EU customs tariff (CN/HS) classification + EUDR EU customs tariff classification: CN/HS code + GIR rule, MFN duty and EUDR scope. Sourced. | |
| Lika Rika Manage shared household finances for two people - expenses, budgets, savings, and settlements. | |
| LiveSpot Find concerts, theatre, sport and festivals in Sweden. Authless, read-only MCP. | |
| Nordsynk — Fortnox MCP Hosted MCP server for Fortnox. Connect Claude, ChatGPT, Cursor to live Fortnox via OAuth. | |
| Novus: Fortnox in your AI assistant Fortnox accounting for one company: invoices, reports, ledger, documents. Read-only until enabled. | |
| Novus för byråer: Fortnox for accounting firms Fortnox for accounting firms: every client company in one connection. Read-only per company. | |
| PullUp Free event pages with RSVP, calendar invites, waitlist, guest list, CRM and email to guests. | |
| Riksflödet Sveriges riksdag: vem sa vad, hur röstade ledamöter och partier — med källänkar. |
43,351–43,400 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.