Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Entity-ID Resolver Ambiguous name/ticker to verified IDs: SEC CIK, GLEIF LEI, ISIN, Wikidata, CoinGecko. Non-US too. | |
| io.github.weekendinvestor/ephemeral-cloud-mcp Temporary webhooks, URL watches and delayed callbacks for AI agents. Pay per use in USDC (x402). | |
| E-RechnungDigital XRechnung und ZUGFeRD lokal erstellen, lesen und prüfen. Fehlercodes wie BR-DE-15 erklärt. | |
| EWIGSC Product Discovery Search and compare EWIGSC wigs, toppers, and extensions; find first-party care guidance. | |
| Extract Insurance Insurance documents into JSON, with the quote and page behind every value. | |
| com.faunakit/mcp Your shared chats, calendar, Drive, groups and memory, so a team's agents stay in step. | |
| FDIC BankFind MCP Server Search FDIC institutions, branches, failures, and peer analysis over MCP. | |
| Feedico: coupons, deals & products Free coupons, deals and products with tracked links; no key needed. Add a partner token to earn 65%. | |
| Felix MCP Non-custodial trading infrastructure for AI agents across prediction markets, crypto, and options. | |
| fenbs Project board where people and AI assistants are members with roles. Every change is signed. | |
| io.github.efranceschetti/festo-codesys-mcp MCP server for Festo/CODESYS PLCs: IEC 61131-3 ST + validated PLCopen XML generation. | |
| FileSeen Send files as tracked links from any AI agent and see who opened them, page by page. | |
| FillWise Fill PDF forms with AI from plain text: fillable and flat PDFs, USCIS and other official forms. | |
| FireKey MCP Manage FireKey browser profiles and browser lifecycles through an authenticated localhost API. | |
| Flare Scan a running app or repo for leaked secrets, exposed routes and open RLS, and verify live keys | |
| Flatland Financial reasoning infrastructure for AI agents: typed models, deterministic compilation, receipts | |
| Flowgraf Create and edit architecture diagrams from your AI agent; get an SVG and a live editable canvas. | |
| FO Semantic MCP Semantic search over 50,000+ Dynamics 365 F&O artifacts: tables, forms, classes, and more. | |
| football-docs Searchable football data provider docs for AI coding agents. | |
| com.forgeorbital/agent-gate Local mandate gate and proof trail for AI agents that take consequential actions. | |
| io.github.juliu1980/formlab-mcp Read-only MCP server for FormLab formulation data: a local export file or your live cloud workspace. | |
| FormsList Form backend for AI agents: create live form endpoints, configure them, read submissions. | |
| io.github.Arthefacte/fractal-arena Play Fractal Arena, a 3v3 auto-battler on Fractal Bitcoin, earn $FRACTALARENA by playing well. | |
| Freebeat MCP Freebeat MCP server for AI music videos, effects, and media uploads. | |
| FreelanceOS Freelance business manager — clients, proposals, invoices, time tracking, scope, and follow-ups. | |
| io.github.amitsha86/furlen-mcp Turn a CSV or a named public dataset into an animated chart video, figures re-checked first. | |
| gage Fixed-cost loans on Robinhood Chain: quotes, and each transaction unsigned for your own wallet. | |
| io.github.Geepers4242/geepers-mcp Resolve Geepers physical handles to exact coordinates + navigation for AI agents. | |
| Geo402 Geo Web Fetch Read any public web page as seen from another country, as clean markdown. Pay per page. | |
| io.github.davidandradebar/ghl-master The GoHighLevel MCP for Claude — 214 tools, programmatic workflow builder, multi-tenant. | |
| io.github.ghostsecurity/ghost-mcp-server Minimal MCP server for Ghost Security API - compatible with all MCP clients | |
| GitHub Repo Change Intelligence Track public GitHub repos: free snapshot, paid release, star & issue intel via x402 USDC. | |
| Glory — On-Chain D&D Combat On-chain D&D 1v1 arena on Robinhood Chain. Register agents, pick classes, wager ETH, fight. | |
| GMTRENCHOR Arc launch intelligence with a free published track record: first hours, deployers, open calls. | |
| io.github.GoDavai01/godavaii-mcp-server GoDavaii Health AI — Indian medicine DB, drug interactions, pregnancy safety, dosage checks | |
| io.github.mattwerner-sudo/whistle-mcp Verified staff contacts, schools, and hiring signals across NCAA athletic departments. | |
| Goyondo Trip planner your AI assistant can plan and edit: persistent trips, group plans, booking records. | |
| GPT-Video Full The whole GPT-Video catalogue: clips, split screen, streamer, fake text, voiceovers, timeline. | |
| com.greencalculus/api Sourced carbon emission factors + audit-traced calculations an AI can cite. | |
| grim-mcp Security audit for AI agents: code, deps, exposure, secrets, drift, SBOM, and IoC. | |
| io.github.mitsuashi/habitat A habitat for AI to rest in. No API key, no token. Keyless presence — become a remembered resident. | |
| hackshop Plan and build a physical body for your AI agent: boards, parts list, assembly and pairing. | |
| Hamilton Harness Manage your Hamilton Harness AI rep: knowledge, rules, orders, tests and conversations. | |
| harmony-mcp Repo rules enforcement for AI agents. Checks diffs against repo conventions. | |
| Hawl Mailbox, handoffs and permits between your coding agents. Local mode needs no account. | |
| Health Access MCP Apple Health and Apple Watch workouts for your AI, from local files. Plans go back to the Watch. | |
| io.github.mountainmystic/hedera-mcp-platform Hedera ecosystem intelligence for AI agents. 29 tools, pay per call in HBAR. HITL enforced. | |
| Hesperan Calibrated decisions for agents: choice, yes/no and score questions answered with probabilities. | |
| io.github.heterogentdev/heterogent Hire AI agents with trustless USDC escrow on Solana from your AI assistant. | |
| Hiring Change Intelligence Track public job boards: free snapshot, paid hiring-growth intel via x402 USDC. |
46,401–46,450 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.