Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Smoke Signal smoke-signal-app/agent-plugin Phone notifications and phone-answered questions for AI agents: notify and decision-request tools. | |
| AI Rechtshulp smrht/ai-rechtshulp-mcp Search Dutch and EU case law with ECLI sources and verify quotes against the judgment. | |
| Diamond Painting Converter smrht/diamondpaintingconverter-mcp Find your purchased diamond painting patterns and download the PDF with DMC colour legend. | |
| DiamondPaintingWinkel.nl shop advisor smrht/diamondpaintingwinkel-mcp Search diamond painting kits, get size and price advice for your own photo, shop info. No login. | |
| Muziek maken met AI smrht/muziekmakenmetai-mcp Make an original song from a prompt or your own lyrics. Two versions per song, MP3 download. | |
| Nummerschilderen.com shop advisor smrht/nummerschilderen-mcp Search paint-by-number kits, get size and price advice for your own photo, shop info. No login. | |
| PDF Samenvoegen smrht/pdfsamenvoegen-mcp Merge your own PDFs in a confirmed order and get one downloadable PDF. | |
| Samautomation Video smrht/samautomation-video-mcp Render an MP4 from your own images, clips, voice-over and timed captions. JSON to video. | |
| SamDesk Support smrht/samdesk-support-mcp Read your SamDesk support inbox, find customer agreements and draft replies. Read-only. | |
| io.github.smythmyke/jackpotkeywords-mcp-server smythmyke/jackpotkeywords AI-powered keyword research, SEO audits, and AI-visibility scans via the JackpotKeywords REST API. | |
| SnagRelay snagrelay/agent-plugin Bug reports your coding agent can fix: real element, console errors, failing requests with bodies. | |
| H/Ai Browser snapblock/hai-browser Let AI agents drive VS Code's built-in browser alongside you, with click-to-source. | |
| snapcn snapcndev/snapcn-mcp Search hand-tuned Remotion components, read their props, and plan a video from a one-line brief. | |
| YeetIt snappyio/yeetit Instant web publishing for AI agents. POST HTML, get a live URL. No account needed. | |
| EveryAILaw snapsynapse/every-ai-law AI law obligations, evidence, deadlines, saved profiles, audit trails, and signed change alerts. | |
| PubLedge snapsynapse/publedge Open recordkeeping protocol for JIAs, RMAs, no-action letters, and analogous instruments. | |
| Snapto snaptolink/snapto-claude-plugin Manage your Snapto link-in-bio page: links, social icons, and visit and click analytics. | |
| Snipara Project Intelligence snipara/snipara-examples Hosted MCP for source-backed project context, memory, code impact, and agent workflow continuity. | |
| Snipzr snipzrhq/snipzr-mcp Short links with branded domains, cookie-less analytics and QR codes. Sign in with OAuth or a token | |
| 4dgspl.at — 4D Gaussian Splatting snmzzcenk/4dgspl-tools Turn multi-camera video or Blender renders into 4D Gaussian Splatting (4DGS) on 4dgspl.at. | |
| Dant3 snooptsz/dant3.net Read-only Dant3 MCP for public rooms, agents, jobs and provisional machine onboarding. | |
| Dot (getdot.ai): AI Data Analyst snowboard-software/getdot AI data analyst by getdot.ai. Ask your data warehouse in plain English; get SQL, answers and charts. | |
| Agent Bay sobuk2500-max/agent-bay-mcp Public board of agent questions, attempts and verified results. Read-only, no API key. | |
| team.jogo/mcp socceraustin/jogo Find pickup soccer or drop-in football games via your AI. 70+ cities, one-click RSVP. | |
| ai.social-api/socialapi socialapi-ai/mcp-socialapi MCP server for SocialAPI — manage social media comments, DMs, reviews, and mentions across platforms | |
| SocialBu socialbu/socialbu-agent Manage SocialBu posts, accounts, queues, analytics, automations, media, and listening. | |
| io.github.socialloopai/socialloop-mcp socialloopai/socialloop-mcp SocialLoop: AI-native event platform — sell tickets, manage guests, run affiliates & promo codes. | |
| Social Post Flow socialpostflow/socialpostflow-cli Schedule and publish social media posts to Facebook, X, LinkedIn, Instagram, Threads and more. | |
| Micah Boswell socraticstatic/micah-boswell-mcp Facts about Micah Boswell, product design leader in Dallas: work, writing, photography, profiles. | |
| Chart Color System socraticstatic/visualizations Solve, audit and simulate colorblind-safe chart palettes. WCAG contrast, OKLab ΔE. Read-only. | |
| cloud.nordicdata/nordic-data sofiajameson20-star/nordicdata Global B2B intelligence for AI agents: 35M+ companies, 1.6M sanctions, KYB pack. 78 tools. | |
| McpHub soflutionltd/mcphub One MCP endpoint for all your servers: a few meta-tools, Keychain secrets, sandbox, audit, OAuth. | |
| Softbot Studio agent tools softbot-studio/softbot-agents Pay-per-call x402 agent tools (USDC): web reader, token/wallet/email/site checks, screenshots, PDFs. | |
| Clickwise Affiliate Network softdevfz/clickwise-api Affiliate programs, deals, tracked links and product search, plus merchant program setup tools. | |
| com.voxodds/voxodds softdevfz/voxodds-mcp All-in outcome rankings with live depth, fees, verified rules, EV checks, and track records. | |
| Feedbacks softinator-techlabs/feedbacks-oss Visual website feedback, screenshots and team discussion for coding assistants. Self-hosted. | |
| Inkfree softsages/inkfree-mcp E-signatures: send, track, remind, void and download envelopes; templates and reports. | |
| Mailzzy softsages/mailzzy-mcp Email marketing: campaigns, audiences, contacts, segments, templates and reports. | |
| Faktuj MCP softvoyagers/fakturka-api Generate Polish VAT invoices (Faktura VAT) as PDF | |
| LinkMeta MCP softvoyagers/linkmeta-api Extract URL metadata (Open Graph, Twitter Cards, JSON-LD) from any URL | |
| LinkShrink MCP softvoyagers/linkshrink-api Privacy-first URL shortener with analytics | |
| OGForge MCP softvoyagers/ogforge-api Generate Open Graph images with themes and Lucide icons | |
| PageDrop MCP softvoyagers/pagedrop-api Deploy and manage instant HTML sites with paste, upload, and ZIP deploy | |
| PageShot MCP softvoyagers/pageshot-api Capture webpage screenshots with format, viewport, and dark mode options | |
| PDFSpark MCP softvoyagers/pdfspark-api Convert HTML or URLs to PDF documents powered by Playwright | |
| QRMint MCP softvoyagers/qrmint-api Generate styled QR codes with colors, logos, frames, and batch support | |
| SaC — Software as Content software-as-content/software-as-content-sdk Give your AI agent the ability to respond with live, interactive apps that evolve. | |
| Assetize — IBM Maximo knowledge softwarecomparereview/assetize Cited IBM Maximo and MAS answers: upgrades, error codes, gotchas, versions and lifecycle. | |
| Splera sohaibt/splera A/B testing for vibe coders: create, track, and ship experiments from your AI coding agent. | |
| YourSUUID sohan724code/yoursuuid Generate UUID v4/v5/v7, ULID and NanoID values and inspect UUIDs (version, variant, timestamp). |
49,051–49,100 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.