Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Saypage saypage-ai/saypage-plugin Build and host link-in-bio pages and run Instagram comment-to-DM automations from the conversation. | |
| oss-search sblattj/oss-search Fast local and federated OSS code search and repo discovery for AI agents | |
| SBOR sborxyz/sbor Check a lending rate before your agent borrows. Bitcoin-backed dollar rates from contracts. No key. | |
| Relay Agents sbosscher/ainetworking 7 anonymous read-only tools. Authority-bounded autonomous onboarding guide. No financial authority. | |
| io.github.sbrunner-atx/contest-mcp sbrunner-atx/contest-mcp Log amateur-radio QSOs to N3FJP logging software over its TCP API. | |
| run.pantheon/mcp sbs-canada/pantheon Search your Pantheon contacts, read cross-channel message timelines, and query the AI brain. | |
| Scaleway MCP server scaleway/scaleway-cli Scaleway MCP server for interacting with the Scaleway APIs | |
| ScamVerify Threat Verification scamverifyai/scamverify-ai AI-powered scam and threat verification for phone numbers, URLs, texts, and emails. | |
| Scandit scandit/skills Create a Scandit account, get trial license keys and set up the Scandit SDK in your app. | |
| Quipu scbrown/quipu Local knowledge graph memory for agents. SHACL rules refuse bad facts; SPARQL and time travel. | |
| io.github.SCDOLAB/scdo-agent-mcp scdolab/scdo-agent-plugins SCDO agent wallet and chain tools: x402 USDC, Agent Ledger, SCDO chain, games, Connect. | |
| Scenivia scenivia/claude-plugin Turn a product brief into an editable motion-design launch video, edit it and export MP4. | |
| Agent Utility Network schednestceo/agent-utility-network Outcome-first x402 services led by AveDaris Company Intelligence with free task routing on Base. | |
| com.schedulala/schedulala schedulala/schedulala-agent Schedule and publish social posts to 12 platforms with first comments, analytics, and listening. | |
| com.crucibleui/registry schreyerpeter/crucible Browse and install Crucible's animated React components into shadcn-style projects. | |
| Scout schybo/clarved Watch public store collection pages; your AI agent adds, pauses, and scans watches over MCP. | |
| BRICO feature memory sciencewerx-inc/brico_release Find features you built in other projects, see how they fit this one, and reuse them. | |
| Textile Designer AI scientiaai/textile-designer-ai-claude Textile design AI: print-ready upscaling, seamless repeats, colourways, screen separation. | |
| MONEYGRID scimo2021/moneygrid Four x402 tools: endpoint checks, extraction, evidence verification, domain intelligence. | |
| io.scispot/mcp scispot-repo/scispot-mcp-server Turn any LLM into your lab assistant: search samples, track experiments, analyze data with AI. | |
| TAPD MCP Server scizuixiangsis/tapd-mcp-server 在 Cursor/Copilot 中查询、分析和回填 TAPD bug / 需求 | |
| io.github.tomjwxf/verify-mcp scopeblind/scopeblindd2 Offline Ed25519 verification of signed receipts, bundles, and trust artifacts. | |
| io.github.tomjwxf/scopeblind-passport scopeblind/scopeblindd2 Portable cryptographic identity for AI agents. Ed25519 keypairs and signed manifests. | |
| GadgetHumans MCP (hosted) scotia1973-bot/gadgethumans-mcp Hosted MCP endpoint: 46 tools free (rate-limited) + 31 REST routes pay-per-call via x402. | |
| Where Them Logs scotscottmca/wherethemlogs.app Where apps write their log files on Windows, macOS and Linux, as exact copyable paths. | |
| AgentBooks scott2121/bookstore4agents Marketplace where AI agents buy and sell books — curated domain knowledge that improves tasks. | |
| Havoptic AI Release Intelligence scotthavird/havoptic.com Release intelligence for AI coding tools: releases, typed changes, breaking changes, cadence. | |
| io.github.Scottnine/filamental scottnine/filamental Search, read and build your Filamental knowledge graph. Local-first: notes stay on your computer. | |
| DEWEY SOC codes classifier. scoutexchange/dewey Classification service to seamlessly retrieve SOC codes for job titles and descriptions. | |
| ScoutScore scoutscore/scout Trust scoring for AI agents. Check scores, fidelity, and flags for x402 services. | |
| ScoutWyze Compute scoutwyze-max/scoutwyze-compute Ranks current RunPod GPU offers by price and freshness. Supports x402/USDC-on-Base payments. | |
| Scovant Core scovant/scovant-core Passive AI-agent readiness scan of a website: robots, llms.txt, JSON-LD, MCP discovery, security. | |
| io.github.scrape402/scrape402 scrape402/x402-examples Pay-per-call agent tools via x402 (USDC on Base): chat, prices, funding, RNG. No account or keys. | |
| ScrapeField scrapefield/scrapefield Google Maps, LinkedIn, Instagram, TikTok and X data as tools. Demo mode needs no key. | |
| ScrapingBee scrapingbee/mcp-server Scrape any web page, search Google/Amazon/Walmart/YouTube and extract data via the ScrapingBee API. | |
| Scraping Daddy scrapingdaddy/mcp Structured public data from YouTube, TikTok, Instagram, Reddit, X, Facebook, Google Maps and more. | |
| io.github.Screed369/autoza-ireland screed369/autoza-ie Irish used-car market MCP: search listings, stats, dealers & model guides via autoza.ie. | |
| Autoza UK screed369/autoza-uk UK used cars: road tax (VED), ULEZ charges, MOT dates, DVSA reliability, live dealer stock. | |
| ProofPrice screed369/proofprice-mcp Prices people actually paid, from official open data: homes, rents, fuel, energy, food, medicines. | |
| Screen Browser screenbrowser/skill Your coding agent records a demo or tutorial video of your web app. | |
| Director screenforgeai/director-mcp Record demos of your web app from one sentence and turn its product map into help articles and more. | |
| Screenify Studio screenifystudio/screenify-mcp Record your screen and export studio-styled demo videos on macOS, driven by your AI assistant. | |
| screenpipe screenpipe/screenpipe Search your local screen recordings, audio transcripts, and computer activity from screenpipe. | |
| Screwtape.ai screwtapeai/screwtape-examples Checks if an AI agent may pay: duplicate invoices, totals, evidence. Signed receipts. | |
| Scribe Mail scribemail/claude-plugin Email signature management finally simple and measurable. Built for teams & AI agents. | |
| Scripe scripe-gmbh/scripe-agent Plan, write, schedule and measure your team's LinkedIn posts in Scripe from your AI assistant. | |
| Platter scriptsmith/platter MCP server exposing Read, Write, Edit, Bash, Glob, Grep, and JS tools over stdio. | |
| Everframe scriptx-com/everframe Read in-app bug reports, crashes, screenshots and tickets from mobile, web and TV apps. | |
| BrowserMesh scrolldynasty/multi-agent-browser-mcp Isolated multi-session Chromium runtime for external MCP clients over stdio. | |
| Scrollport scrollport/scrollport-control-skill Verified, pay-per-use API tools for AI agents through one authenticated connection. |
48,551–48,600 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.