Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| mcp-registry devopstrio/mcp-registry Centralized registry for MCP tools, resources, and prompt templates with JSON schema validation and role-based access control filtering. | |
| mcp-runtime devopstrio/mcp-runtime A high-performance MCP execution engine that runs tool code in isolated, resource-constrained sandboxes with context state persistence. | |
| @just-every/mcp-screenshot-website-fast devos962/mcp-screenshot-website-fast Enables AI coding tools to capture high-quality webpage screenshots via a headless browser, automatically tiling full pages into 1072x1072 chunks sized for vision models, along with element-specific captures and animated screencasts of dyna | |
| orbit-mcp devotel/orbit-mcp A stdio-based MCP server that exposes the Orbit CPaaS API as tools, enabling sending SMS, managing campaigns, and other communication workflows through natural language in MCP clients. | |
| autopedia devp1/autopedia Enables AI tools to maintain a personal knowledge wiki via MCP, allowing users to add sources and ask questions grounded in their research. | |
| Jira MCP Server devparihar5/jira-mcp-server A comprehensive MCP server for Atlassian Jira that enables AI assistants to manage issues, sprints, comments, and worklogs through natural language. | |
| claude-session-bridge devpark435/claude-session-bridge Enables multiple Claude Code sessions to communicate and share results automatically, with optional orchestration for hands-off workflow coordination. | |
| resumeai-mcp devpatel25/biginterview-mcp Enables a Claude Code agent to drive Big Interview ResumeAI locally over stdio, exposing six tools for checking auth status, listing, starting, monitoring, retrieving feedback for, and deleting resume scans. Every call returns structured su | |
| MCPify devpatmase1/aikart-mcpify Analyzes any AI agent URL to detect its framework and available endpoints, then generates ready-to-use MCP configurations for clients like Claude Desktop, Cursor, and VS Code. It also exposes its own MCP endpoint so it can be added directly | |
| hit-mcp devpeakab/hit-mcp Read-only MCP server for the HIT ticket management system that lists queues, searches/fetches ticket details, and lists ticket templates. | |
| EcommAPI devpedrofalchi/ecommapi Enables AI-powered analysis of e-commerce products and sales data, proposing price and description changes that require human approval before being applied to the Bling ERP system. | |
| CodeLens MCP devprashant19/codelens_mcp A local MCP server that enables LLM clients like Claude to perform semantic code search and answer questions about a codebase using tree-sitter parsing and sqlite-vec vector storage. | |
| Playwright Automation MCP Server devqa07/playwright-automation-mcp Enables AI-powered browser automation controlled through natural language, integrating Playwright with the Model Context Protocol to perform web interactions like navigation, form filling, and screenshots. | |
| gitlab-mcp-server devquasarx9/mcp-gitlab A Model Context Protocol server for GitLab that provides AI agents structured access to projects, repositories, issues, merge requests, pipelines, and releases, with read-only defaults and operational controls. | |
| Pub.dev MCP Server devqxi/pubdev-mcp-server Enables AI assistants to search, analyze, and retrieve detailed information about Dart and Flutter packages from pub.dev. Supports package discovery, version management, dependency analysis, and documentation access. | |
| TaskPilot AI MCP Server devrahul17/taskpilot-ai Exposes task and note management, focus-plan creation, and daily workspace summaries as MCP tools over Streamable HTTP for compatible clients. | |
| DP-MCP Server devraj21/dp-mcp A comprehensive Data Platform server that enables seamless integration between PostgreSQL databases and MinIO object storage, with AI-powered natural language query capabilities. | |
| mcp-fstools devrandom/mcp-fstools Provides file read, edit, and write operations with exact-match editing and hash-based consistency checks, designed for models that prefer structured schemas over patch grammars. | |
| Puch AI MCP Starter devreev/mew__mcp A starter template for creating MCP servers that work with Puch AI, including built-in tools for job searching (analyze descriptions, fetch postings, search opportunities) and basic image processing. Features bearer token authentication and | |
| DevRev MCP Server devrev/mcp-server A Model Context Protocol server that enables searching, retrieving, creating, and updating issues and tickets using DevRev APIs. | |
| openai-gpt-image-1-mcp devrico003/openai-gpt-image-1-mcp Provides AI agents and coding assistants with image generation and editing capabilities using OpenAI's GPT-image-1 model, with support for local or Supabase storage. | |
| TwitterAPI.io MCP Server devrico003/twitterapi.io-mcp Provides AI agents and coding assistants with Twitter data access including tweets, user profiles, followers, and search functionality. | |
| x-twitter-posting-mcp devrico003/x-twitter-posting-mcp A Model Context Protocol server that allows AI agents to post tweets and threads to X (Twitter) via two tools: post_tweet and post_thread. | |
| forge-mcp devrik99/forge-mcp Enables Claude to run structured software development pipelines by directing it through sequential phases, validating evidence before advancing, and persisting state in SQLite for resumption across sessions. | |
| coolify-mcp devrim-1283/coolify-mcp Fleet-level MCP server for Coolify that supports multiple instances and teams from one connection, with full REST API coverage and cross-instance search. | |
| hetzner-mcp devrim-1283/hetzner-mcp MCP server for Hetzner. Enables managing cloud projects, account resources, and dedicated servers, with the entire REST API reachable through a searchable tool catalog. | |
| truth-social-mcp devrim-1283/truth-social-mcp MCP server for explicitly authorized Truth Social access, offering read-only tools for profiles, timelines, search, and notifications, with optional write operations enabled only under explicit authorization and confirmation. | |
| @devrobotlabs/visionapi-mcp devrobotlabs/visionapi-mcp MCP server that lets AI assistants like Claude or Cursor extract structured data (e.g., invoices) from images and PDFs via Vision API, with tools for analysis, questions, and preset management. | |
| Harutalk Japanese Coach MCP devronpark/kakao-playmcp Translates Korean KakaoTalk messages to natural Japanese with pronunciation and expression breakdowns, corrects user-written Japanese sentences, explains expressions, and generates review cards and quizzes for beginner learners. | |
| Google Maps MCP Server devsanthoshmk/gmaps-mcp Provides AI agents with structured search results, place details, ratings, and contact info from Google Maps without requiring any API keys. | |
| security-intel-mcp devsecforge/security-intel-mcp Provides real-time vulnerability intelligence including CVE lookup, EPSS exploit probability, and CISA KEV status from free APIs, enabling AI assistants to prioritize CVEs by real-world risk. | |
| OpenProject MCP Server devsergioherrera/openproject-mcp-server Enables Claude to connect to an OpenProject instance and query, search, and manage projects, work packages, users, and time entries through natural language. Supports advanced filtering, pagination, and creation of work packages like epics | |
| ews-outlook-mcp devsergioherrera/outlook-exchange-mcp-server MCP server for Claude to access on-premises Outlook/Exchange mailboxes via EWS with NTLM authentication, providing tools for email, calendar, and contact management without relying on Microsoft 365 or Graph API. | |
| openobserve-mcp devshahriar/openobserve-mcp MCP server that enables querying an OpenObserve instance for logs, traces, and metrics via tools like search_logs, search_traces, get_trace, and query_metrics, supporting natural-language-driven observability workflows. | |
| Exchange Rate MCP Server devshark/exchange-rate-mcp Provides current exchange rates for various currencies via the Model Context Protocol, allowing AI models to fetch real-time currency data. | |
| Fact Checker MCP Server devshark/fact-checker-mcp Enables verification of simple factual claims (e.g., capital cities) by checking against Wikidata, returning accuracy and confidence scores. | |
| personality-test-mcp devshark/personality-test-mcp Enables AI models to administer personality tests, score responses, and provide personality type assessments, with optional integration with Ollama for personalized AI interactions. | |
| Nano Banana MCP devshiftteam/nano-banana-mcp MCP server for AI image generation and editing using Google Gemini image models. | |
| TypeScript MCP Server Boilerplate devsic/mcp-server A boilerplate project for quickly developing Model Context Protocol (MCP) servers using TypeScript SDK, with example implementations of tools (calculator, greetings) and resources (server info) using Zod schema validation. | |
| RAG MCP Server devsinsight/rag-mcp-server Indexes PDF documents into Qdrant and exposes semantic search as MCP tools, enabling RAG-based interactions with your documents. | |
| smsOn-MCP devsjony/smson-mcp MCP server for the smsOn/mobileOn SMPP API, enabling sending SMS and checking delivery status directly from Claude Code. | |
| Playwright MCP Server devskido/customed-playwright A Model Context Protocol server that provides browser automation capabilities using Playwright, enabling LLMs to interact with web pages, take screenshots, generate test code, scrape web content, and execute JavaScript in a real browser env | |
| Skills MCP AD devskillsit/skills-mcp-active-directory A production-ready MCP server that enables AI assistants to manage enterprise Active Directory environments through 45 specialized tools for users, groups, and GPOs. Its multi-client architecture allows for the secure management of multiple | |
| Skills MCP Hudu devskillsit/skills-mcp-hudu Connects AI assistants to Hudu IT documentation platform with 43 tools, Markdown output, and multi-tenant support for MSPs. | |
| Veeam Backup & Replication MCP Server devskillsit/skills-mcp-veeam-backup-pro Enables AI assistants to interact with Veeam Backup & Replication infrastructure through natural language, allowing monitoring, management, and troubleshooting of backup jobs, sessions, and restore points. | |
| vitals-mcp devsrijit/wannabe-fit Enables MCP clients to query locally computed recovery, strain, sleep, workout, and heart-rate data from a personal SQLite database, with tools for daily and sleep summaries, workout details, heart-rate buckets, schema inspection, reports, | |
| Notebooklm-Unofficial-API-MCP devstackk/notebooklm-unoffical-api-mcp A thin MCP wrapper around the unofficial Google NotebookLM Python client, enabling notebook management, source handling, chat, artifact generation, deep research, and sharing via MCP tools. | |
| ID Generator MCP devstacks-se/id-generator-mcp Provides AI assistants with capabilities to generate collision-resistant unique identifiers using UUID v4 and CUID2 algorithms. | |
| Kenya MCP Server devstephenke-sys/kenya-mcp Enables querying and searching Kenyan government public data—including counties, constituencies, health facilities, education institutions, exchange rates, population statistics, public holidays, Treasury budgets, and government tenders—thr | |
| domain-mcp devstroop/domain-search-mcp An MCP server for domain name availability checking, WHOIS lookups, and domain suggestions — no API key required. |
44,151–44,200 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.