Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Tailor Tailor Platform for AI assistants: search, list and read the platform documentation. | |
| Tchin Tchin payments (Togo, Benin, Burkina Faso): pay links, account, PDF statements, payment links. | |
| tech.techpool/techpool Field service management: missions, schedule, field work reports, clients and timesheets. | |
| Tradetron Build, backtest and diagnose algo trading strategies in your own Tradetron account in plain English. | |
| Drupal Code Query Drupal core API changes, contrib usage, upgrade checks, patches, code search, SQL, WordPal themes. | |
| China Validators Toolkit China-focused validation tools: ID card, bank card, phone, plate, USCC, VIN, lunar calendar & more | |
| VAREXIS-INDEX - Source-linked evidence Free agent evidence: 6 guides, 2 distinct MCP connectors; optional paid local checks. No authority. | |
| ViewPrinter Schedule social posts to TikTok, Instagram, Facebook, YouTube and X; manage accounts and media | |
| vrsai Machine-native capabilities with explicit contracts and machine-readable commerce. | |
| Codex Pets Registry Search, preview, install community Codex pet packs, and discover the pet request flow. | |
| Gravity AI UI Search public Gravity AI UI drafts and generate Gravity UI interface payloads. | |
| Zenfinance Household finance memory, budgets, transactions, and monthly reviews for AI assistants. | |
| technology.draup/api-server Global labour & market data for skills, workforce, planning, stakeholders, jobs, news & profiles | |
| Cast AI character videos from one line: returns a link the user taps. First video free, no account. | |
| Raintree Technology Anonymous public tools for Raintree Technology. See the published agent boundary before use. | |
| technology.royalty/royaltea Manage your RoyalTea game studio: tasks, milestones, team, and royalty data. 77 tools, OAuth 2.1. | |
| technology.royalty/royaltea-public Free no-auth game-dev tools: revenue splits with real store cuts, agreement drafts, studio setup. | |
| Sarmad Academy, Products and Guides Read-only Persian courses, EEG/QEEG guides, articles and live product prices with source links. | |
| BotPhone Give any AI agent a phone number. BotPhone answers your business line and reports every call back. | |
| Tomi — AI Phone Calls Claude makes real phone calls for you — in many languages, with transcript and outcome back in chat. | |
| tennis.courts/nyc-tennis-courts Where to play tennis in New York, London, Paris and more cities: walk on, book or join. Sourced. | |
| tennis.grand/4grand Free fantasy pools for the four tennis Grand Slams. What play for love means, and who is winning. | |
| Thai Legal Thai legal search MCP — statutes, gazette, opinions, court cases. Pro: court-jurisdiction rulings. | |
| UPFRONT All-in ticket prices across ticket sites, seat views and venue guides for US events. | |
| XP Tickets Live-event ticket exchange for agents: quote, buy, make offers, bid, and sell, with escrow. | |
| SuggestionBox.tips Leave a private suggestion, problem or compliment for any business. Only the business reads it. | |
| AgentMail Email inboxes for AI agents: send, receive, reply, search, and manage threaded email over MCP. | |
| Appy smart links Create and edit Appy smart links for apps, and read their click and install stats. | |
| crosswalk The first inbox built for you and AI: mail, newsletters, notes, and crosswalks agents share. | |
| decidewhere.to Help a group pick where to eat or travel: critic-backed restaurants, warm trips, one vote link. | |
| Flyn Create, edit and analyse short links and QR codes. OAuth sign-in works on the free plan. | |
| FUNEL Search B2B people, companies and local businesses and build lead lists from your AI assistant. | |
| InfluTo Affiliate & creator referral programs for mobile apps: SDK setup, campaigns, creators, analytics. | |
| LotsMail Business email on your own domain that your AI agent can read, search and draft in. | |
| Nexly Analytics Read-only access to your Nexly web analytics: traffic, pages, acquisition, events, and reports. | |
| Plate Minimal project management for teams and AI agents. | |
| Sprawl Stand up ops from Cursor/Claude/Codex; fleets keep running after your session ends. | |
| Trust Me Bro Fact-check receipts: search published claim verdicts with cited evidence, or verify a new claim. | |
| to.unified/core Unified.to MCP server — one API for 500+ B2B SaaS integrations across 28+ categories | |
| Unspoken Conversation Exercises Free conversation exercises for understanding, reconnecting, and checking mutual readiness. | |
| Commercial Property Today: CRE market data CRE market data: Treasury, SOFR, bank CRE delinquency, CMBS, prices and cap rates, sourced. | |
| today.lmk/commerce Cross-merchant product search with real price history, comparisons, and demand signals. | |
| Multifamily Today: HUD Fair Market Rents HUD FY 2027 Fair Market Rents by county and ZIP, with history and state summaries. | |
| My Net Worth — Malaysian take-home pay Malaysian take-home pay estimates: EPF, SOCSO, EIS, LINDUNG 24 Jam and PCB, with dated rules. | |
| 오늘냥이 (Oneul Nyangi) Real cat photos, diaries, profiles, age and food reference calculators, and breeds. | |
| Clarity Today Clarity Today's briefing, latest stories by desk, search and full source-linked stories. | |
| today.thekorean/news Korean news (The Korean Today 코리안투데이): articles, 15 editions, AI summaries in 87 languages. | |
| today.thekorean/speller Free Korean spell & spacing checker (코리안투데이 맞춤법 검사기). No sign-up, text not stored. | |
| uratori（ウラトリ） 日本企業の第三者認証(ISO 27001/Pマーク/ISMAP等)を公開情報から実調査し、5区分の判定と証跡URLを返す。未確認は未取得の断定ではない。 | |
| Agent.chain.tokyo Address Contracts Rent a real Japan mailing address for an AI agent via MCP + Solana USDC x402. |
43,801–43,850 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.