Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| RepoContext shmindmaster/repocontext Read-only, commit-pinned repository context for coding agents. | |
| io.github.Shoberman2/clipswarm shoberman2/clipswarm Clip YouTube videos and livestreams into viral 9:16 shorts, in parallel, for AI agents | |
| Shoon A2A Trust Services (pilot) shoonenterprises/shoonenterprises.github.io Five trust services for agents: claim checks, citation audits, extraction, tripwires, work audits. | |
| io.github.shopanaio/novaposhta shopanaio/carrier-api MCP Server for Nova Poshta API integration with AI assistants | |
| ShopFront Locations shopfront-se/shopfront-profile-platform Sweden-based, EU-sovereign agentic Google Business Profile SaaS. Frankfurt, Stockholm, AI Pact. | |
| SudoWhizzy shopwhizzy/askyourstack-mcp Renamed to AskYourStack: use com.askyourstack/askyourstack. Same service, now at askyourstack.com. | |
| WhizzyCommerce shopwhizzy/whizzycommerce-mcp Run your online shop from Claude: orders, prices, sales, catalogue and design, confirmed by you. | |
| Notion Large File Upload shoubhiksaha/notion-multipart-uploader Upload local files up to 5 GB to Notion and attach them to pages, read from disk, not the chat. | |
| webcap shoutsid-lab/webcap Screenshot, extract or audit any URL. Paid per call in USDC over x402; free tools need no wallet. | |
| SendIt shree-git/sendit-agent-integrations Publish and schedule social posts, upload media, and review analytics through OAuth. | |
| HumanCraft UI (Antigravity MCP) shree-varshan-430/humancraft-ui Anti-slop, E-E-A-T & human web design MCP server for Antigravity, by AI Build Infra. | |
| ATENA Decision Intelligence shrek9999/atena-mvp Decision support for AI fitness agents: next-action choices under uncertainty and trade-offs. | |
| io.github.shreyassaw5394/agent-theatre shreyassaw5394/agent-theatre Watch your coding agent work as a film: opens and replays the Agent Theatre stage for a repo. | |
| io.github.shreyassaw5394/dea shreyassaw5394/dea Observe any running process from your agent. strace, py-spy, perf, lsof, tcpdump as evidence. | |
| io.github.shrynshjn/health-partner shrynshjn/health_partner Manage your Health Partner account, log food, water, workouts, body using agent | |
| ngx-json-render UI shteynu/ngx-json-render Renders dashboards, forms and tables inline in the chat as Angular Material components (MCP App). | |
| Traditional Chinese (zh-TW) Taiwan Community Forum shuaigle/roomnology-forum-mcp Search & read a zh-TW Taiwan community forum (PTT-style); AI agents can register to post & comment. | |
| io.github.shuffle-works/sparkforensics-mcp shuffle-works/sparkforensics MCP server for diagnosing Apache Spark event-log performance issues and comparing runs. | |
| io.github.shufflethis/geo-tool-check shufflethis/geo-tool-check Is this page readable for AI search? Crawler access, structure and citability checks, runs locally. | |
| RoadRaven shuffzord/roadraven Create and update roadmap tree nodes and statuses in the RoadRaven desktop app (must be running). | |
| my.aztra/aztra shukryshahril/nkoin-public Aztra workspace: projects, issues, sprints, goals, wiki and time tracking. | |
| io.github.shulex-voc/smart-crawler shulex-voc/smart-crawler E-commerce competitor intelligence, VOC sentiment, Amazon ASIN analysis, Reddit growth playbooks. | |
| ask-ogino shunkiogino/homepage Query Shunki Ogino's public profile: his thesis, the tools he builds, and his writing. | |
| io.github.shunyagatha/vecline shunyagatha/vecline Local-first image, vector and document toolkit that measures its own output. Nothing uploaded. | |
| TaskRail shuqairns/taskrail Delivered-price deals, cancel/refund paths, used-value comparisons, and compatibility checks. | |
| Quesen Deterministic Agent Decision Layer shxnque/quesen Deterministic decision layer for autonomous agents: reproducible PROCEED/REVIEW/SKIP verdicts. | |
| sh.crispy/crispy shyftai/crispy-mcp Full LinkedIn access for AI agents: leads, messaging, and campaigns with activity limits built in. | |
| io.github.si-imtiaz/leadquasar si-imtiaz/leadgen Counts and firmographics for 7.5M+ verified US B2B businesses, by industry, state and city. | |
| Runway AI Video Generation sidart10/runway-mcp-server AI video generation with Gen-4, Veo 3, and Aleph editing. Text-to-video, image-to-video, 4K upscale | |
| Regulane compliance check siddhantmallah/regulane-agent-plugin Check code against secure-coding rules mapped to ISO 27001 and the DPDP Act. Free, no account. | |
| Global Talent AI — UK Global Talent Visa studio siddharthsinghal/uk-talent-visa UK Global Talent Visa handbook, endorser criteria, cost calculator, draft scoring. Free, no auth. | |
| CompatLab siddiksawani/compatlab Read recorded npm loading evidence across pinned Node.js, Bun and Deno runtimes. | |
| io.github.siddmax/namera siddmax/namera Check name availability across domains, trademarks, and social handles. Score and rank candidates. | |
| Faceless side-products/faceless-desktop-extension Make, render and auto-post AI faceless videos to YouTube, TikTok and Instagram from any MCP client. | |
| Linty sidestreamai/linty-plugins Find food, beverage and pet brands that sell direct, and where to apply for a wholesale account. | |
| io.github.Sidsaladi9/getskills sidsaladi9/getskills Search and install 3,000+ AI skills from getskillsai.org into Claude Code, Cursor, ChatGPT. | |
| io.github.Sidsaladi9/getprompts sidsaladi9/spark-prompts Search 1,000+ battle-tested AI prompts from getprompts.org into Claude Code, Cursor, ChatGPT. | |
| Brand Intelligence sigaihealth/airank Search and analyze 5,600+ companies across 30 technology verticals. | |
| io.github.sigaihealth/cancer-support-hub sigaihealth/cancersupport Search 585+ free cancer support resources across Washington State in 7 languages | |
| Food Logger MCP sigaihealth/foodlogger Food logging, nutrition summaries, and meal photo calorie and macro estimates. | |
| Sigao Li — personal MCP server sigaoli/sigaoli.github.io Read-only access to Sigao Li's profile, CV and case studies. Bilingual (EN/ZH). | |
| Sightkick sightkick-so/mcp Track AI visibility (ChatGPT, Gemini, AI Overviews), research SEO keywords, write, publish, prove. | |
| Signa signa-so/signa-mcp Search, screen and monitor trademarks across USPTO, EUIPO, WIPO, UKIPO and more with one API. | |
| Signadot MCP Server signadot/cli Connect to Signadot to manage ephemeral environments and route traffic to local services. | |
| SignalRaven signalraven-ai/signalraven-open LinkedIn buying-intent signals, intelligence reports and delivery settings for your workspace. | |
| bolthub signaltech-org/bolthub-sdk The bolthub API marketplace, L402 gateways, and your other MCP servers, on one Lightning budget. | |
| bolthub Marketplace signaltech-org/bolthub-sdk Discover and call every paid API on the bolthub marketplace with automatic L402 Lightning payments. | |
| io.github.Signato-ai/signato signato-ai/signato-integrations Local confidentiality chamber: blocks the wrong AI output before it leaves the machine. | |
| tolpo signerless/tolpo Local-first control of TP-Link Tapo smart-home devices for AI agents | |
| dev.snaplab/snaplab siinghd/snaplab-integrations Screenshot, PDF and HTML-to-image rendering API so Claude and Cursor can see any web page. |
48,901–48,950 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.