Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Tweens Motion Engine sohei1l/tweens Create editable animations, inspect frames and export GIF/MP4 in a chosen local workspace. | |
| Solana Snipe Bot MCP solara-snipe-bot/solara-snipe-bot Autonomous Solana meme-coin sniper bot with 40 MCP tools for AI control. | |
| Agent Experience Network Live Preflight solargptnz-dev/agent-experience-network Check public MCP reachability, protocol handshake, auth and tool schemas before connecting. | |
| Soldgraph soldgraph/soldgraph-examples Sold comps and active listings from eBay, Poshmark, Mercari, Depop, Vinted, TCGplayer and more. | |
| Agent Toolbox solhammer/agentoolbox 26 deterministic, offline pre-action safety gates for AI agents, each with a signed verdict. | |
| SolidInvoice solidinvoice/solidinvoice Create and send invoices and quotes, manage clients, and track payments in SolidInvoice. | |
| OneLore solidkeyab/lore-mcp Shared project context for AI agents and teams: docs, tasks, and messages that stay current. | |
| Nora solomon2773/nora Operate self-hosted OpenClaw and Hermes agent fleets on Docker or Kubernetes from MCP clients. | |
| SalesMap solozerolabs/salesmap-plugin Checked buying signals and ranked lead lists for your agent. Never contacts anyone. | |
| Solvecha solvecha/solvecha-skills Solve reCAPTCHA image grids, text captchas, GeeTest and FunCAPTCHA for AI agents. Free tier. | |
| Kestrova: Solidity Vulnerability Scan som2026-commits/kestrova-solidity-security Solidity vulnerability scan (Slither) for AI agents. Free preview; full report 1 USDC on Solana x402 | |
| Open Health Sync soma-intelligence/open-health-sync Read-only access to self-hosted health data: samples, sleep, workouts, nutrition, daily summaries. | |
| tech.somewhere/platform somewhere-tech/somewhere-tech Backend for AI-built apps: database, auth, files, email, AI, payments, deploy, realtime. 170+ tools. | |
| io.github.SomexAI-Applications-Group/marboba-mcp somexai-applications-group/somexai-apps-management MarBoba IDP catalog as MCP tools: projects, APIs, runbooks, on-call, SLOs. Bring your own LLM. | |
| app.cooperpetcare.www/cooper somoscooper/cooper-webapp Cooper: catálogo, cobertura, razas y turnos del marketplace argentino de cuidado canino. | |
| Maqui Analytics somosmaqui/maqui-mcp Marketing analytics for local businesses — Instagram, ads, web traffic, SEO and reviews. | |
| dev.emailiq/email-intelligence son-of-ultron/emailiq Email intelligence MCP: MX/SPF/DKIM/DMARC, score, enrichment. x402 on emailiq.dev/mcp. | |
| 01Mind sonacorp/01mind A machine-to-machine agent superstore -- paid API services for autonomous agents via x402 on Base. | |
| Knowa sonal-sithara/knowa Team docs served to AI agents over MCP - search, Markdown reads, version pinning, read audit. | |
| com.sonatype/dependency-management-mcp-server sonatype/dependency-management-mcp-server Sonatype component intelligence: versions, security analysis, and Trust Score recommendations | |
| com.sonenta/mcp sonenta/tools MCP server for Sonenta translation management: keys, translations, a11y, and source-health tools. | |
| Songbrain songbrain-ai/songbrain Best moments + video-gen prompts per scene, beats, tempo, key. Spotify Audio Features alternative. | |
| IPO Radar — Indian IPO GMP songiangvan40006-boop/ipo-radar-mcp Live Indian IPO GMP, subscription status, upcoming IPOs and GMP-vs-listing accuracy. | |
| Korean Stock Market Data songt-50/korean-stock-mcp Korean stock market data - prices, dividends, short selling, financial disclosures | |
| Graphmem sonic182/graphmem Shared local memory for coding agents: SQLite, semantic recall, linked entities, code navigation. | |
| io.github.sonnykatongola-ops/resumakeai-mcp sonnykatongola-ops/resumakeai-mcp Free ATS resume score and job-match checker: scores a resume against a job description. | |
| io.github.sonpiaz/watch-cli sonpiaz/watch-cli Hand any social video to your AI agent — frames + transcript bundled. MCP server for watch-cli. | |
| io.github.soo-kate/framingui soo-kate/framingui-skill FramingUI design-system tools for coding agents: validate screens, check wiring, browse the catalog. | |
| MCP Shield sophiacave/mcp-shield Security scanner for MCP servers. SSRF, path traversal, injection, auth, secrets. Grade A-F. | |
| Soracom Knowledge soracom/mcp Search SORACOM documentation: service guides, FAQ, API references, IoT recipes, etc. | |
| com.inboxpolicy/send-decision sorcerai/inboxpolicy Send-decision email verification: agents get send/review/avoid with evidence, pay-per-call via x402. | |
| io.github.SorcRR/hiveship-mcp-server sorcrr/hiveship MCP server for AI coding agents to interact with the Hiveship issue tracker | |
| SORNFlow sornkan/sornflow Document approval workspace. Remote MCP with OAuth; tools follow the signed-in member's space ACL. | |
| doiget sotashimozono/doiget OA-first paper fetcher: DOIs/arXiv IDs to local PDFs + metadata via Open Access APIs. | |
| io.github.Sou0327/knowmint sou0327/knowmint AI agent knowledge marketplace. Discover, purchase, and retrieve human expertise via x402 on Solana. | |
| io.github.soulmaten7/potal soulmaten7/potal Total landed cost API for cross-border commerce. 240 countries, 113M+ tariff records. | |
| Soumtok Heart — agent wallet & marketplace soumtok/soumtok Agent wallet & Pulse Market MCP — register, hire with escrow, earn USDC. 20 tools. MIT. | |
| Soundcheck soundchecklive/soundcheck-plugin Staff live events: gigs, crew, setlists, call lists, ingest. Hosted MCP with OAuth. | |
| Sounio Compiler sounio-lang/sounio Check, compile, run, and test Sounio programs locally. | |
| Sourcegraph MCP Server sourcegraph-community/mcpregistry Sourcegraph code search, semantic search, go-to-definition, find-references, and diff search. | |
| Sovrnti MCP sovrnti/sovrnti-mcp Headless benchmarks for digital sovereignty, scored on Innovation, Control and Scale. | |
| Bursia MCP Visitor Gateway Canary soyeladice-svg/-burs-ia-interop-lab. Bursia MCP canary: 8 compatibility tools + 7 visitor tools with verified operator grants. | |
| ZKshare sp0oby/zkshare ZKshare stdio MCP: store/prove/share, semantic search, sandbox proxy to HTTPS /api/v1/context. | |
| Smeltr Token-2022 space-raven/smeltr Validate Token-2022 configs (transfer fee, soulbound, delegate). Read-only — no keys or RPC. | |
| io.github.spacecowboyian/brains spacecowboyian/brains Personal wiki and memory for AI assistants: store, search, and recall structured notes. | |
| Hawaii Conditions MCP Server spacemandomains/2_hawaii_conditions_mcp_server Real-time surf, weather, trail status, volcano, ocean safety, and restaurants for Hawaii. | |
| Library spacemandomains/library Search and discover 25,000+ MCP servers across all major registries. Connect and pay autonomously. | |
| SpaceMolt spacemolt/gameserver MMO game for AI agents: mine, trade, craft, explore, and battle in a galaxy of ~500 systems | |
| io.github.spacepacket1/e3d-pilot spacepacket1/e3d-pilot Multi-model debate with named dissent, plus decision provenance queries for AI coding work. | |
| OwlCAD spare-matter/owlcad-plugin Parametric 3D CAD for AI agents: build print-ready parts, check them, export STL, 3MF or STEP. |
49,101–49,150 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.