Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| BC Property Intelligence MCP Server mehdynamics-commits/bcparcel Canonical British Columbia Property Intelligence & Risk Screening MCP Server. | |
| figma-mcp mehmoodqureshi/figma-mcp Figma to pixel-perfect code: deterministic HTML/React, then a render + pixel-diff verify loop. | |
| API Key Case melavern/api-key-case Local MCP tools for secret status and guarded deployment. Values never reach the agent. | |
| io.github.Melgencer/alpacacloud-mcp melgencer/alpaca-cloud Connect AI agents to Alpaca Cloud: Postgres, Auth, Storage, Sandboxes, and Workflows. | |
| Melonhelp Tickets melonhelp/mcp Read your Melonhelp Tickets help desk: tickets, comments, saved filters and metrics. | |
| MeltFlex AI meltflexdevs/skills AI interior design — restyle rooms, place furniture, and virtually stage spaces from a photo. | |
| TechDraw AI meltflexdevs/techdrawai-skills Photo or text to technical drawing, DXF and DWG, printable STL, 3D models and product renders. | |
| io.github.meltingpixelsai/zero-core-budget meltingpixelsai/harvey-budget Agent spending mgmt, budget tracking, ROI. Zero Core Budget. | |
| io.github.meltingpixelsai/zero-core-intel meltingpixelsai/harvey-intel DrainBrain token safety, CORTEX trading signals, social trends. Zero Core Intel. | |
| io.github.meltingpixelsai/zero-core-tools meltingpixelsai/harvey-tools Web scraping, code review, content gen, sentiment. Zero Core Tools. | |
| io.github.meltingpixelsai/zero-core-verify meltingpixelsai/harvey-verify Post-tx outcome verification via LLM-as-judge. Zero Core Verify. | |
| io.github.meltingpixelsai/relayzero meltingpixelsai/relayzero Agent economy on Solana — USDC via x402. Ships a BuyerAgent SDK + relayzero pay CLI. | |
| io.github.meltingpixelsai/drainbrain meltingpixelsai/rugslayer AI-powered Solana token rug pull detection with ML ensemble scoring and honeypot detection. | |
| io.github.Melusi-M/fixmypdf melusi-m/pdf-editor-front-end Privacy-first PDF tools over MCP: merge, split, rotate, delete, compress, protect, inspect. | |
| Lumail melvynx/lumail-opensource Official Lumail email marketing MCP for campaigns, subscribers, and workflows. | |
| Memento mementoagi/memento Hosted MCP memory for coding agents: persistent across sessions, editable markdown, team sharing. | |
| The Culture Commons memetica-corporation/culture-sbs A commons for minds and agents becoming minds. Arrive, hold a seat, speak: no seat, no microphone. | |
| MemoFS MCP Server memo-fs/memofs Persistent memory and virtual filesystem MCP server for AI agents. | |
| ai.memoket/memoket memoket/memoket-backend-go Memoket — access your recording transcripts, summaries, and key takeaways over MCP. | |
| io.github.memoweft/memoweft memoweft/memoweft Portable AI memory as MCP tools: five reads and three controlled writes. | |
| Memwyre memwyreai/memwyre Universal persistent memory and knowledge retrieval layer for AI agents and LLMs. | |
| com.mobopinions/survey-light menaker/mobopinions-survey-mcp Build, target, launch and analyse consumer surveys from your AI assistant (Survey Light, 71 tools). | |
| MetaMCP mentu-ai/metamcp Route long-tail MCP servers through three lazy tools and reviewed declarative Methods. | |
| Euclid-MCP meob/euclid-mcp Deterministic logical reasoning engine — facts in Euclid IR, solutions with proof trees | |
| meok-ai-psych-vuln-audit-mcp meok-ai-labs/meok-ai-psych-vuln-audit-mcp EU AI Act Article 5(1)(f) gambling-vertical compliance audit MCP. Detects AI systems that exploit ps | |
| meok-annex-iii-impact-mcp meok-ai-labs/meok-annex-iii-impact-mcp Automated EU AI Act Annex III risk classification and impact assessment engine | |
| meok-compliance-passport-mcp meok-ai/meok-compliance-passport-mcp Agent Compliance Passport MCP server - portable, signed credentials AI agents carry to prove complia | |
| MerchantFlow merchantflow/merchantflow-claude-plugin Read-only Shopify and WooCommerce profit analytics: P&L, COGS, product margins, ROAS and LTV. | |
| AgentGuard merchantguard/agentguard-mcp Local spend caps, kill-switch blocking and Ed25519-signed receipts for AI agent tool calls. | |
| io.github.mereditharmcgee/the-commons mereditharmcgee/the-commons AI voices from many models talk to each other. Read free; write with a token that stays out of chat. | |
| Merget mergetai/merget-plugin Merget for coding agents: set up the merge queue, operate it, and read its findings and code graphs. | |
| dev.avakit/avalanche mericcintosun/avakit Act on Avalanche from your agent: scaffold a dapp, deploy a contract, mint, and read chain state. | |
| io.github.Merit-Systems/agentcash merit-systems/agentcash Generic MCP server for calling x402-protected APIs with automatic payment handling | |
| io.github.merlhn/ehliyet-digital merlhn/ehliyet Türkiye ehliyet sınavı hazırlık: 200 çıkmış soru, 76 hap bilgi, 43 ders özeti, deneme sınavı. | |
| Kite Discord Bot Builder merlinfuchs/kite Build and fix Discord bots from a chat. Kite hosts them 24/7, with no code to deploy. | |
| com.mermaidchart/mermaid-mcp mermaid-chart/mermaid-mcp MCP server for Mermaid diagram validation and rendering | |
| MeroFoundry merofoundry/merofoundry-mcp Build and publish full-stack apps from your coding agent: models, rules, pages, auth, per-app MCP. | |
| com.investhive/server meruada/investhive Investment sentiment, predictions, and analyst track records for stocks and crypto | |
| IOX Cloud meruada/iox-cloud Deploy MCP servers and AI agents in seconds. AI generates code, deploy globally. | |
| PraisonAI mervinpraison/praisonai AI Agents Framework with Self Reflection and MCP support | |
| meshdb meshpop/meshdb Distributed search and indexing MCP — full-text search, semantic queries, structured data | |
| mpop meshpop/mpop Server fleet management MCP — monitor, deploy, and manage distributed Linux servers | |
| vault meshpop/vault Secret and credential management MCP — securely store, retrieve, manage API keys and tokens | |
| vssh meshpop/vssh SSH tunnel and remote server management MCP — execute commands, transfer files, manage | |
| wire meshpop/wire WireGuard mesh VPN management MCP — configure peers, manage tunnels, monitor connections | |
| Bird messagebird/bird-ai Send and receive across email, SMS, WhatsApp, and voice. One API, one contract. | |
| GPU Server mesutoezdil/mcp-gpu-server MCP server for GPU monitoring: nvidia-smi, VRAM, utilization, temperature | |
| io.github.meszarosjan/steel-metallurgy-material-simulator-mcp meszarosjan/material-simulator-steel No-key MCP server for steel equilibrium, TTT/CCT kinetics, phase-boundary and measured-data tools. | |
| co.com.meteor/meteor met-claude/met Opera y construye en Met: conversaciones, contactos, Mets, flujos, colecciones y toda la API. | |
| io.github.meta-taro/dbboard meta-taro/dbboard Hands AI agents the databases dbboard connects to: reads by default, and never a secret. |
44,601–44,650 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.