Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| expo-assets-mcp elber-code/expo-assets-mcp Generates and transforms Expo assets (icons, splash, adaptive icons) from source images. Also includes image transformation and SVG conversion tools. | |
| DevDocs MCP Server elblanco2/devdocs-mcp-server Provides access to 600+ documentation libraries from DevDocs.io including Python, JavaScript, React, Django, and more. Enables searching, browsing, and retrieving documentation content directly through Claude Desktop. | |
| HostBridge MCP Server elblanco2/hostbridge-mcp An MCP server that helps novice developers deploy web applications through conversational interfaces, bridging the gap between LLMs and various hosting environments. | |
| Last.fm MCP Server elcachorrohumano/lastfm-mcp-server Enables interaction with Last.fm music data including searching for artists, albums, and tracks, accessing user listening history, and managing music preferences. Supports both read-only operations and authenticated write operations like sc | |
| mcp-ai-agent-server elcaiseri/mcp-ai-agent-server A dual-mode MCP server and CLI agent for AI-powered tasks including weather, news, file management, web scraping, and data processing via LangChain. | |
| newsapi-ai-mcp elcamino/newsapi-ai-mcp Enables MCP clients such as Claude, Codex, Cursor, and OpenCode to search and retrieve news articles and clustered real-world events from roughly 150,000 sources worldwide, with tools for keyword/concept/location/date filtering, full-text l | |
| Countermap elchacal801/countermap Enables cross-framework queries over MITRE ATT&CK, D3FEND, ATLAS and F3 with provenance on every link, plus coverage and gap analysis against a technique list, actor or detection rules. Also renders validated D3FEND CAD, Attack Flow, ATT&CK | |
| skool-mcp-kit elchamoluso/skool-mcp-kit MCP server to read and operate your Skool community (calendar, feed, posts, members) and publish posts/comments with confirmation, using your own authenticated session. | |
| AWS Pricing Calculator MCP Server elchanio-76/aws-pricing-calculator-mcp MCP server that provides tools for automating AWS Pricing Calculator estimate generation. | |
| CocoaPods Package README MCP Server elchika-inc/cocoapods-package-readme-mcp-server Enables retrieval of README files, package information, and metadata from CocoaPods registry with GitHub integration. Supports searching packages, fetching dependencies, and extracting usage examples for Swift and Objective-C libraries. | |
| Composer Package README MCP Server elchika-inc/composer-package-readme-mcp-server Enables AI assistants to fetch README content, package metadata, dependencies, and search Composer/PHP packages from Packagist with smart caching and GitHub integration. | |
| Maven Package README MCP Server elchika-inc/maven-package-readme-mcp-server Enables AI assistants to fetch comprehensive information about Maven packages from Maven Central, including README content, package metadata, dependencies, and search functionality with GitHub integration. | |
| Open Crawler MCP Server elchika-inc/open-crawler-mcp-server Enables web crawling and content extraction from web pages, supporting multiple output formats like text, markdown, XML, and JSON, with robots.txt compliance and rate limiting. | |
| Package README Core MCP Server elchika-inc/package-readme-core-mcp-server Intelligently detects package managers and provides unified access to documentation and information across 15+ package ecosystems including npm, PyPI, and others. Automatically routes requests to appropriate package-specific MCP servers for | |
| RSS Feed MCP Server elchika-inc/rss-feed-mcp-server Enables Claude to fetch, parse, and manage RSS/Atom feeds through the Model Context Protocol. It supports feed registration and retrieval, allowing users to access article summaries and full content from multiple sources via natural languag | |
| ts-review-graph elchika-inc/ts-review-graph Enables Claude Code to query a TypeScript dependency graph and retrieve the minimal set of files needed for code review, implementation, or debugging. | |
| vcpkg Package README MCP Server elchika-inc/vcpkg-package-readme-mcp-server Enables AI assistants to fetch comprehensive information about vcpkg C++ packages from the vcpkg registry, including README content, package metadata, dependencies, and search functionality with smart caching and GitHub integration. | |
| TrustDesk MCP Server elchinoo/trustdesk Exposes search, passage retrieval, and document listing tools over streamable HTTP so MCP clients can query a security-questionnaire knowledge base and receive results with document, version, and heading provenance. | |
| scern-mcp elcoryel/scern-mcp Product evaluation MCP server for US packaged food. Health scores, ingredient safety, regulatory flags, recall history, corporate ownership. | |
| creator-kit elct9620/creator-mcp Enables generating images from prompts and synthesizing speech from text using Cloudflare Workers AI, returning outputs through short-lived presigned links. | |
| noon-sight elct9620/noon-sight Aggregates site analytics and published content from Google Analytics, Search Console, Cloudflare, and Buffer into MCP tools for traffic, search, request, and content reports. | |
| Perplexity Ask OpenRouter elct9620/perplexity-ask-openrouter An MCP server that connects to OpenRouter's API to provide Perplexity's models (Sonar, Sonar Deep Research, Sonar Reasoning) for use with any MCP-compatible client. | |
| bank-mcp elcukro/bank-mcp Provides AI assistants with secure, read-only access to over 15,000 financial institutions across the US and Europe via the Model Context Protocol. It enables users to query account balances, transactions, and spending breakdowns through na | |
| Qubicl eldanring/qubicl Enables AI agents to operate a real, private, local Docker-based computer with durable files, terminal access, web research, and a persistent browser or desktop. It supports multiple agent clients via MCP or OpenAPI, with live viewing and h | |
| souschef eldarjobs/souschef Delegates test writing to a headless second coding agent in an isolated git worktree, then builds, runs the tests, verifies that only test paths changed, and returns a compact report plus optionally applies the verified tests to your checko | |
| cursor-yougpu-mcp eldarknz/cursor-yougpu-mcp MCP server for YouGPU REST API that enables GPU catalog browsing, instance lifecycle management (create, stop, start, delete), and balance checking. | |
| LinkedIn MCP eldasoky1/linkedin-mcp MCP server for programmable LinkedIn automation via Playwright, offering 20 tools for profile management, messaging, feed interaction, and job searching through real browser automation. | |
| GenomeMCP eldergenix/genomemcp Enables AI agents to query clinical genomics databases, retrieve supporting literature, analyze population genetics, and visualize biological pathways. | |
| Subaru STARLINK MCP for Grok Bot elderibeiro/subaru-starlink-mcp-grokbot Enables a local Grok Bot to talk to the unofficial MySubaru API over stdio, supporting vehicle status, locate, tire pressure, fuel, odometer, climate presets, and explicit lock/unlock/remote start actions without exposing secrets. | |
| Eldermind Astro Engine API eldermindai/eldermind-astro-api MCP server exposing eight esoteric calculation systems (Western/Vedic astrology, Human Design, Gene Keys, and more) through 14 tools, with deterministic profiles, partial success, and OAuth integration. | |
| MCP-Vetting eldiegolar/mcp-vet Trust-scan gate for MCP servers: evidence-backed verdicts before you install. | |
| TypeScript MCP Server Boilerplate eldimire/mcp-server-251215 A boilerplate project for quickly developing Model Context Protocol (MCP) servers using TypeScript SDK, with example implementations of calculator tools, greeting functions, and resource management. | |
| Activepieces MCP Server eldoonreval/activepieces An open source automation platform that converts over 280+ integrations into MCP servers, enabling LLMs to interact with various services through Claude Desktop, Cursor, or Windsurf. | |
| Eldora UI MCP Server eldorauiofficial/mcp Enables integration with Eldora UI component library, providing access to UI components including animations, text effects, buttons, backgrounds, and device mockups through natural language requests. | |
| codememory eldrexdelosreyesbula/codememory Enables AI agents to locally search, query, and understand codebases with token-efficient context, dependency graphs, history, architecture diagrams, and metrics through MCP. | |
| email eleanorreem/mcp-server-email A Model Context Protocol (MCP) server that enables Claude Desktop to manage emails via SMTP and IMAP. Send emails, fetch unread messages, and create draft replies directly from conversations. | |
| costwright eleata/costwright-mcp Static worst-case token-budget analysis for LLM-agent workflows using AST analysis to identify certifiable, default-dependent, non-certifiable, and runaway units, with optional signed budget certificates. | |
| eleata e-invoice MCP server eleata/eleata-einvoice-mcp Validates EU electronic invoices (Peppol, XRechnung, FatturaPA, etc.) and explains validation error codes, enabling AI coding agents to check invoice validity and get fixes before rejection. | |
| eleata-verify-mcp eleata/eleata-verify-mcp MCP server for verifying claims against evidence using natural language inference, providing verdicts like Supports, Refutes, or Not Enough Evidence. | |
| Eleion Scanner MCP eleata/eleion-scanner-mcp Enables AI agents to register domains, prove ownership, queue security scans (headers, TLS, DNS, ports, tech-fingerprint), and retrieve findings with severity and CVE details via the Eleion Scanner API. | |
| Android Source Explorer MCP Server elebedev5947/android-source-explorer-mcp Enables AI tools to retrieve precise, on-demand AOSP and AndroidX source code, inspect classes and methods, and optionally perform cross-file navigation via LSP. | |
| MCP Jibun Server elecmonkey/mcp-jibun Enables AI agents to read and retrieve the latest posts from Jibun and Ech0 instances. It allows users to list configured sources and fetch content with support for pagination and source selection. | |
| Telegram Bridge MCP electrified-cortex/telegram-bridge-mcp Bridges AI assistants to a Telegram bot to enable two-way messaging, interactive confirmations, and live status updates. It supports automatic voice transcription via local Whisper models and provides secure, single-user communication for M | |
| MCP OpenAPI Proxy electrocucaracha/mcp-openapi-proxy A tool that accelerates MCP protocol adoption by automatically generating MCP-compatible server components from OpenAPI specifications, enabling seamless integration with existing services as a sidecar. | |
| MCP Website Fetcher electrocucaracha/mcp-website-fetcher A lightweight MCP server implementation that provides a simple tool for fetching website content, demonstrating how tools can be exposed and interacted with using the MCP protocol. | |
| ElectroHire MCP Server electrohire/electrohire-agents Enables MCP clients to connect to a remote endpoint and call read-only search tools for the electronics engineering marketplace; the initial scaffold exposes a site-search tool that returns clearly marked placeholders. | |
| eleeth-x402-mcp eleeths/eleeth-x402-mcp MCP server wrapping x402.eleeth.com — 35 pay-per-call tools for AI agents (x402 v2, USDC on Base) | |
| Skill Hub elefant-coder/skill-hub Enables organizations to centrally manage and distribute Claude Code skills, allowing members to connect and use the latest skill instructions via a single command. | |
| emptysock-mcp eleferrets/emptysock-mcp Enables AI agents and Claude to interact with the EmptySock game engine, exposing NavMesh, Physics, Scene, Save, and Actor systems as MCP tools. | |
| Lift-Spares Parts Finder elegant-lift-sweden-ab/lift-spares-parts-finder-mcp Enables finding elevator and lift spare parts in the Lift-Spares catalog by part number, description, make, model, or part type in any language, and retrieving a part's full identification details or requesting parts that are not on the web |
47,451–47,500 of 115,409
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.