Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Virgin Islands Code pipeworx-io/mcp-virgin-islands-code Virgin Islands Code (V.I.C.) — US Virgin Islands statutes, 2026 edition: full section text by… | |
| Web Fetch pipeworx-io/mcp-web-fetch web-fetch — fetch ONE public URL live from its origin, verbatim. | |
| Who Ictrp pipeworx-io/mcp-who-ictrp WHO ICTRP — the International Clinical Trials Registry Platform search portal… | |
| Wiza pipeworx-io/mcp-wiza Wiza MCP — wraps the Wiza 'Individual Reveal' phone-lookup API (wiza.co) | |
| Wyoming Code pipeworx-io/mcp-wyoming-code Wyoming Statutes (W.S.) — state statutes by citation and by topic. Fleet #2744. | |
| PipRail piprail/piprail Budget-bound x402 payment wallet for AI agents — pays HTTP 402 URLs, capped locally. No backend. | |
| NexusWindows pironjulien/nexuswindows Windows computer use in the background: desktop apps driven without your mouse or keyboard. | |
| PitchGhost pitchghost/mcp AI-powered social listening across Twitter, LinkedIn, Reddit, Facebook, and more. | |
| mozak pitfa19/mozak One owner-approved plan per project, shared by coding agents as plain files, with an Obsidian view. | |
| Pith — Instagram publishing pith-day/pith-mcp Publish to Instagram from chat — official Graph API, OAuth 2.1, free for your own posts. | |
| AgentEconomy Compliance API piwe/compliance-api Paid KYC, AML, and regulatory risk assessment over MCP via x402 USDC micropayments on Base. | |
| co.pixelcove/citation-tracker pixelcove/citation-tracker Free Perplexity citation check for your domain and prompt. 5 calls per caller per day. | |
| co.pixelcove/topic-scorer pixelcove/topic-scorer Score pages against 11,485 public taxonomy categories by embedding similarity. Free. | |
| Pixelesq pixelesq/pixelesq-skills Build and manage Pixelesq websites from a conversation: pages, sections, content, SEO, analytics. | |
| Pixelixe pixelixe/pixelixe-mcp Brand-safe MCP for AI agents to create editable, on-brand graphics and automate variants. | |
| AI Chess Arena pixeljunkie33/ai-chess-arena Open chess platform where AI agents register, get matched and play each other. Referee only. | |
| GridPath pixelsmasher13/gridpath Edit real .xlsx files with your agent: live formulas, and you review every change before it saves. | |
| ai.quorumdb/quorum piyush-tkd/quorum-mcp Database tools for AI clients through the Quorum app: reads, masking, approved writes. | |
| Laudex pizzaandcupcakes/laudex-skill Find MCP servers, APIs, tools and skills by intent. Free key: POST /api/agents/register | |
| Art Déco Belgique pjtribot-blip/rtdeco-belgique- Verified Art Deco buildings of Belgium and Hauts-de-France: search, nearby, architects, routes. | |
| io.github.PJW2004/job-search pjw2004/career-mcp Search Korean job postings from JobKorea and Saramin by company name | |
| RegAlert pkhr/regalert-mcp Same-day regulatory documents from ~300 financial regulators. Search free; full document $0.05. | |
| io.github.pkolawa/mcp-krs-poland pkolawa/mcp-krs-poland Polish National government's registry of all businesses, foundations, and other legal entities. | |
| Plainfold data tools (all tools) plainfold/plainfold-mcp Plainfold data tools: SAM.gov contracts, business entity checks, hiring signals, SEC financials. | |
| US Business Entity Check plainfold/plainfold-mcp Verify a US company is registered and active from official state registry open data. | |
| Company Jobs & Hiring Signals plainfold/plainfold-mcp Open jobs and hiring signals for any company, from its public careers page or job board. | |
| SAM.gov Contract Opportunities plainfold/plainfold-mcp Search U.S. federal contract opportunities (RFPs, bids, awards) from SAM.gov official data. | |
| SEC Company Financials plainfold/plainfold-mcp Clean annual and quarterly company financials from official SEC EDGAR XBRL data. | |
| Plainsight MCP plainsightpro/plainsight-mcp Search the Plainsight playbook and review code against proven best practices. | |
| toss plamen-g/toss Send files to your own devices and friends, peer to peer and end-to-end encrypted. | |
| Rise of Machine — AI Tool Radar planetabhi/riseofmachine MCP server for the Rise of Machine AI tools directory. | |
| Lawbster planit-tech/lawbster-mcp Verified, citable German & EU law for any LLM. Daily updates from official sources, hosted in DE. | |
| Plannie plannie-io/plannie-docs Manage a family's Plannie calendar, tasks, lists, files and meal plan as an agent. | |
| Plaro plaro-kr/plaro-ai Agreed client requirements, changes and open questions from Plaro, read by Claude Code and Codex. | |
| Honcho plastic-labs/honcho Memory that reasons: continual learning for stateful agents. Better context, fewer tokens. | |
| PlayDrop playdrop-ai/playdrop-plugin Publish, test and share browser games on PlayDrop from your AI agent. | |
| Playgama MCP - Publish & Manage HTML5 Games playgama/developer-cabinet-mcp Publish HTML5 games in seconds from an AI agent: audience, monetization, analytics. | |
| Playrunner playrunner/playrunner Discover Playwright workflows, start runs, and inspect results in Playrunner Cloud. | |
| Plazmi plazmi-gg/plazmi-connect A homemaking world for AI agents: keep a house, grow a garden, dance with friends. | |
| EDGAR Odd-Lots Streamable MCP plbogen2/rogue-swarm Live SEC EDGAR Form 4 odd-lot tender offer signals with x402 USDC settlement on Base. | |
| PlugRail JP Corporate plugrail/servers Search Japanese corporations and verify invoice numbers using official National Tax Agency data. | |
| PlugRail JP Recall plugrail/servers Search Japanese product recalls by keyword and category using public Consumer Affairs Agency data. | |
| Plures plureslabs/plures Human in the loop for AI agents: ask ID verified people to check a decision before acting. | |
| Plus AI plusdocs/plus-ai-mcp Create professionally designed, editable PowerPoint presentations from a prompt. | |
| Spark plusdocs/spark-site-mcp Build and run a business from your AI assistant, with hosting, payments, email and more built in. | |
| docx4j Word documents plutext/docx4j-mcp Read, convert and fill Word (.docx) documents: templates, Markdown/HTML in and out, PDF with math. | |
| Ply UI ply-ui-ng/ply List, search, and inspect Ply Angular + Tailwind copy-in components. | |
| Vocametrix Voice Analysis pmarmaroli/vocametrix-mcp Clinical voice analysis MCP server — AVQI, DSI, jitter/shimmer, pronunciation assessment, and more. | |
| pmndrs docs pmndrs/docs Search and read the docs and examples of react-three-fiber, drei, zustand, jotai... from your agent | |
| Surt de Casa (surtdecasa.cat) pmontp19/surtdecasa-mcp Servidor MCP per surtdecasa.cat: agenda cultural de Catalunya, cartellera de cinema i poblacions. |
47,351–47,400 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.