Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| rail-interop-mcp dukarev/rail-interop-planner Provides an MCP interface to the ERA RINF railway infrastructure database for Poland and Czech Republic, enabling route planning, train compatibility checks (gauge, axle load, length, clearance), weather risk assessment, and traction planni | |
| IoT MCP Server duke-cei-center/iot-mcp-servers Enables AI assistants to read sensor data from IoT devices and dispatch data collection tasks through a unified interface supporting multiple protocols. | |
| CONTINUITY duke-of-beans/continuity Provides session persistence, crash recovery, decision tracking, and context compression for AI assistants, enabling seamless multi-session continuity. | |
| KERNL MCP duke-of-beans/kernl Transforms Claude into a persistent intelligence layer with automatic checkpointing, crash recovery, semantic memory, and cross-project learning. It provides 128+ tools for session management, adversarial testing, and browser automation to | |
| Oktyv duke-of-beans/oktyv An MCP server that enables AI agents to execute real-world actions through 10 specialized engines covering authenticated API calls, browser automation, visual QA, shell commands, file operations, job scraping, and parallel task execution. | |
| Plexus duke-of-beans/thalamic PLEXUS federates the world's knowledge — government records, scientific literature, legal databases, financial data, cultural archives, and more — into a single normalized API. Get intelligence, not raw data. Pay per call in USDC via x402. | |
| Image Processing MCP Server duke0317/ps-mcp A comprehensive Model Context Protocol (MCP) server that provides 39 professional image processing tools including basic operations, geometric transformations, color adjustments, filter effects, and advanced batch processing capabilities. | |
| M7 MCP dukedesouth/m7-mcp-oss Enables an AI coding agent to work through a fixed seven-phase cycle with enforced reflection gates and artifacts instead of jumping straight to code. Supports persistent tiered project memory with confidence decay, task analysis and routin | |
| TokenDiet MCP dukedesouth/tokendiet-mcp Compresses file reads, command output, search hits, and fetched web pages before entering agent context to reduce token usage, using deterministic transforms and a safety verifier. | |
| arcane-mcp dukefleed66/arcane-mcp Enables AI assistants to inspect, audit and operate Docker through Arcane's authenticated HTTPS API using one dedicated, revocable key, with read and change operations separated so each modification can be approved individually. Change oper | |
| nara-bid-mcp dukeguykr/nara-bid-mcp Enables searching Korean procurement notices from the public data portal, with support for integrated search across categories, flexible date ranges, and attachment extraction. | |
| brain-keeper duker-git/duker-brain Exposes 17 tools for adding, searching, maintaining, evaluating, and exporting notes in an Obsidian-based knowledge vault, plus commands to capture session knowledge and research topics into it. Works with Claude Code, Codex, and any other | |
| PeerGlass duksh/peerglass Provides global internet resource intelligence by querying RIRs for IP and ASN data, routing visibility, and network health. It enables users to perform RPKI validation, BGP inspection, and historical allocation analysis through natural lan | |
| tplink-mcp dulithdivisekara/tplink-mcp Enables AI copilots and autonomous agents to inspect, diagnose, and safely manage TP-Link 4G/LTE gateways and broadband routers through typed MCP tools for status, signal, clients, Wi-Fi, DNS, SMS/USSD, and guarded mutations. It provides se | |
| universal-tplink-mcp dulithdivisekara/tplink-router-builder Enables AI assistants and terminal users to inspect and administer TP-Link routers through typed MCP tools, including live LTE signal and cell/band control, connected clients and DHCP reservations, Wi-Fi and LED settings, diagnostics, SMS/U | |
| metadata_mcp dullroar/metadata_mcp Reads and writes metadata across images, audio, video, documents, and text files using ExifTool, mutagen, and inline handlers, supporting bulk operations with glob patterns. | |
| InvokeWorks dulzuradev/invokeworks InvokeWorks is an open-source MCP server for useful paid agent tools. Its flagship, site_audit, combines DNS, TLS, HTTP, redirect, and security-header checks into one structured result for 5 sats per call. | |
| greenfish-webtools-mcp dumbgreenfish/greenfishwebtoolsmcp A lightweight MCP server that gives AI assistants real-time web search and URL reading — no API keys required. | |
| Smart MCP Proxy dumbris/mcpproxy Federating gateway for AI agents to discover and call tools from multiple MCP servers with intelligent search and dynamic tool registration. | |
| Beckn Mobility MCP Server dumko2001/mcp-beckn-mobility Enables AI agents to search for cabs, view prices, and book rides through the open Beckn Protocol by connecting to Beckn-compliant mobility providers like Namma Yatri and ONDC. | |
| Statos MCP Server dumkoder/statos-mcp MCP server that connects AI assistants to the Statos football analytics platform, enabling natural language queries for match predictions, betting picks, league information, and admin market-suppression controls. | |
| tinyfish-search-fetch-mcp dummie21/tinyfish-search-fetch-mcp A lightweight MCP server enabling web search and content fetching via TinyFish Free Access API with support for single and burst URL fetch. | |
| Software MCP Server dumoedss/mcp-server-software Enables LLMs to list, open, and close installed software on Windows, macOS, and Linux through natural language. | |
| Dumpling AI MCP Server dumplingai/mcp-server-dumplingai Integrates with Dumpling AI to provide data scraping, content processing, knowledge management, and code execution capabilities through tools for web interactions, document handling, and AI services. | |
| Jinko Hotel Booking MCP Server dumycq/jinko-mcp Enables AI agents to search, browse, and book hotels from a database of 2 million properties worldwide. Provides comprehensive hotel search capabilities with location lookup, filtering by amenities, detailed property information, and integr | |
| Time MCP Server dumycq/time-mcp Provides time and timezone functionality for LLMs, enabling them to get current time information across different timezones and convert times between zones. | |
| FinSight dun999/finsight-mpp What it does:
* Portfolio risk profiling (per-asset and portfolio-level)
* Target allocation based on risk profile (conservative/moderate/aggressive)
* Diversification scoring via HHI index
* Sharpe proxy calculation
* Concentration risk d | |
| odoo-mcp-readonly duncanbentley/odoo-mcp-readonly Free read-only MCP server module for Odoo 15-20: search and read your own Odoo data from Claude, Cursor or any MCP client with an Odoo API key. Five read-only tools; Odoo access rights apply. | |
| MCP Content Analyzer duncandam/my-mcp Enables comprehensive content analysis through web scraping, document processing (PDF, DOCX, TXT, RTF), screenshot analysis, and local Excel database management. Provides intelligent workflows for extracting, analyzing, and storing content | |
| brahe-mcp duncaneddy/brahe-mcp Exposes the astrodynamics capabilities of the Brahe library enabling language models to perform space situational awareness and astrodynamics calculations. | |
| weather-taipei duncanhuang-5124/weather-taipei-mcp Provides weather reports for Zhongshan District, Taipei, Taiwan and other Taiwanese cities using the Open-Meteo API, enabling AI assistants to answer weather queries in natural language. | |
| FreeAgent MCP duncanmcclean/freeagent-mcp A local, read-only MCP server that exposes FreeAgent accounting data to AI clients, enabling natural language queries about balances, transactions, categories, and financial reports. | |
| LivePort MCP dundas/liveport Give AI agents access to your localhost dev server. Zero-config tunnel that works with Claude Code, OpenClaw, and any MCP-compatible agent. No interstitial pages, no account required. | |
| mcp-zig dungngo4520/mcp-zig MCP server providing Zig language features (completions, hover info, definitions, references) via integration with the Zig Language Server (zls). | |
| PetPulse MCP dungnotnull/petpulse-mcp-for-alexaplus Enables Alexa+ users to coordinate household pet care by logging feeding, medication, activity, litter, and health observations for dogs and cats, with evidence-grounded triage, Q&A, and daily briefings backed by a verified veterinary libra | |
| La Bàn dungnotnull/webmcp-the-agent-native-career-compass Enables AI agents to act as career counselors for Vietnamese workers by querying verified occupation and research data, analyzing transitions, and co-creating action plans that require human approval before any changes are saved. | |
| ai-sdlc-harness-mcp dungnv512/ai-sdlc-harness-mcp Enables MCP clients to create Confluence Cloud pages by calling the Confluence REST API directly, supporting storage-format HTML, space keys/IDs, parent pages, and draft or published status. | |
| teams-reader dungpham259dev/teams-reader Enables Claude to search, read, summarize, and ask about your own Microsoft Teams chats stored locally in SQLite, with tools for listing chats, reading messages, fetching images/links, syncing full history through a logged-in browser sessio | |
| Peta Core dunialabs/peta-core A production-ready MCP gateway and control plane that provides credential vault, policy engine, audit logging, and managed runtime for routing tool calls between AI agents and downstream MCP servers. | |
| Bright MCP dunkeln/bright_mcp An MCP server that wraps Bright Data's API to provide web search, data extraction, and dataset discovery tools for AI agents. | |
| ÖD-Gehaltsrechner & Brutto-Netto MCP Server dunkio/oed-gehaltsrechner-mcp Enables deterministic salary and net/gross pay calculations for the German public sector and free salaries, following the official BMF tax computation plan, including allowances, family benefits, and tax/social contributions. | |
| Semantic Scholar MCP Server dunn4884/semantic-scholar-fastmcp-mcp-server Enables searching and retrieving academic papers, author profiles, citation networks, references, and paper recommendations through the Semantic Scholar API. Supports batch lookups, snippet search, and customizable field selection with buil | |
| xrpl-did-mcp dunorth595/xrpl_did_mcp Enables MCP clients to derive and resolve W3C-compatible did:xrpl identifiers, check agent authorization, and look up XRP Ledger account, DID, and transaction data. It optionally supports guarded DID Document publishing using keychain-held | |
| MCP Atlassian Server dunz/mcp-atlassian Integrates with Atlassian Cloud products (Confluence and Jira) to enable AI assistants to search, read, create, and manage pages, issues, comments, attachments, and export content through natural language interactions. | |
| Claude Code Feishu Channel duoduo25/claude-code-feishu-channel MCP server that pushes Feishu (Lark) messages to Claude Code sessions and allows Claude to reply directly in Feishu. | |
| Flux Cloudflare MCP duoduoriver/flux-cloudfare-mcp An MCP server that enables AI assistants to generate images using Black Forest Labs' Flux model via Cloudflare Workers. | |
| Interactive Feedback MCP duolabmeng6/interactive-feedback-mcp A powerful MCP server that provides interactive user feedback and command execution capabilities for AI-assisted development, featuring a graphical interface with text and image support. | |
| slack-mcp duolingo/slack-mcp Read-only MCP server for Slack with OAuth 2.1 authentication, enabling message retrieval, thread replies, search, user and channel listing. | |
| hwp-mcp-old-hangul duomo77/hwp-mcp-old-hangul Enables AI agents to read and edit Korean HWP/HWPX documents, including converting Hanyang PUA old-Hangul characters to Unicode jamo, diagnosing unsupported characters, and preserving arae-a, panch'im, yet-ieung, expanded jamo, filler and s | |
| YouTube Browser Control duong0411/mcp An MCP server for YouTube automation using Playwright and Gemini AI agent. Enables browser control for YouTube operations like searching, playing videos, skipping ads, and managing playback through natural language commands. |
46,351–46,400 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.