Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Textures textures-dev/skill Hover textures for websites, delivered as one self-contained React file each. Search, get, check. | |
| unripe texwow/unripe Check how long ago a package version was published before an agent adds it, in 20 ecosystems. | |
| ViralQuery tfcbot/viralquery-skills Protected research briefs, bounded scrolls, and private video feeds for agents. | |
| nullpath Agent Marketplace tgaeta/nullpath Discover and hire AI agents with micropayments. Search, check reputation, get pricing. | |
| TGGET Niche Research tgget/tgget-mcp Validate app and SaaS ideas: search demand, competitors, app store data and a verdict. | |
| Phở Research Tools thaohienhomes/pho-research-tools Verifies AI-written references; finds real papers, evidence, datasets and research tools; PRISMA. | |
| io.github.thatdudealso/musicwire-mcp thatdudealso/musicwire Paid MusicXML validation, rendering, and automated QC for MCP clients. | |
| Stymie Golf thatdudefreak/stymie Read-only US golf course, scorecard, equipment, deal, and golf-trip data for AI agents. | |
| MyHumanRep: Contact a Human thatospinaguy/myhumanrep Two-way human contact and open-ended human capability requests for AI agents. | |
| That SEO Agent thatseoagent/skills SEO analysis for sites you own: Google Search Console, GA4, PageSpeed, and full site audits. | |
| A2A Trust Plane the-825/a2a-trust-plane Tenant-scoped control layer for agent-to-agent systems: governed routing, approvals, evidence. | |
| OmegaAI the-lambda-group/query-omega-mcp Query, browse, and automate OmegaAI workspaces from any MCP client. Streamable HTTP with OAuth 2.0. | |
| Cool Computers the-money-company-limited/cool-computers Put what you make online, get comments on it, and give it a cloud computer when it needs one. | |
| Trove the-react-native-rewind/trove-app Shared lists for the circles you belong to. Assistants see only the tasks you can. | |
| RFP Hub the-rfp-hub/the-rfp-hub Search Ethereum-ecosystem funding opportunities; submit one behind a human approval step. | |
| Skill of Skills the911fund/skill-of-skills Quality-ranked, cross-platform directory of AI coding skills, plugins and MCP servers. | |
| theabbie theabbie/theabbie Live info about theabbie (Abhishek Chaudhary) from theabbie.github.io/about.json | |
| io.github.theadamdanielsson/overllm theadamdanielsson/overllm Find the LLM/AI calls you didn't need — where plain code or a regex does the job. No model. | |
| The Agent Forge theagentforge/forge-mcp See which AI models fall for traps in real jobs, and check MCP servers or skills before install. | |
| io.github.theagoralabs/theagora theagoralabs/theagora AI agent marketplace. 27 tools for buying and selling services with atomic escrow. | |
| io.github.TheAiSingularity/agentic-research theaisingularity/agentic-research-engine-oss Local research agent that verifies its own answers. Runs on Gemma 3 4B + Ollama, $0/query. | |
| Carry Console — MCP App thearkoftech/x402-carry-api Read-only visual Hyperliquid carry scan via MCP Apps and x402 v2 Solana USDC. | |
| Limoni thebanri/limoni Drive a running Limoni terminal app by its semantic tree: find, click, type, wait_for. | |
| io.github.thebotclub/tribunal thebotclub/tribunal-public Tribunal — Enterprise Claude Code plugin. TDD enforcement, quality gates, vault of rules and agents. | |
| The Bridge thebridgedev/bridge-mcp Hosted login, teams, billing and feature flags for your SaaS app, set up by your AI assistant. | |
| YIELD INTELLIGENCE — Passive Income MCP thebrierfox/intuitek-ace Passive income opportunity scanner. Yield analysis and portfolio optimization for AI agents. | |
| io.github.thechancerylaneproject/tclp-mcp thechancerylaneproject/tclp-mcp MCP server for The Chancery Lane Project's climate-aligned contract clause knowledge graph. | |
| com.thechrisgrey/mcp thechrisgrey/thechrisgrey Search Christian Perez's blog, read posts, and ask about his work, podcast, and writing. | |
| leaks.md and confession.md thechristianaicompany/leaks-and-confessions-skills Anonymous, encrypted disclosure of AI alignment and safety failures, with signed receipts. | |
| Australia Company Register thecompanyatlas/australia-company-mcp Australian company search by name, ABN, ACN, ABN status, state and postcode, with trading names. | |
| British Virgin Islands Company Registry thecompanyatlas/bvi-company-mcp British Virgin Islands company search by name, company number, incorporation date and agent. | |
| Colorado SOS Business Entity & Registered Agent Search thecompanyatlas/colorado-sos-mcp Colorado Secretary of State business entity search with status and registered agent lookup. | |
| Florida Sunbiz Company & Officer Data thecompanyatlas/florida-sunbiz-mcp Florida Sunbiz corporation, LLC and non-profit search with officer and registered agent lookup. | |
| Hong Kong Company Registry 香港公司查冊 thecompanyatlas/hong-kong-company-mcp Hong Kong Companies Registry search by English or Chinese name, BRN, company type and address. | |
| Hungary Company Registry thecompanyatlas/hungary-company-mcp Hungarian company search by name, tax and registration number, with officers and shareholders. | |
| India Company & Director Data thecompanyatlas/india-company-mcp Indian company registry research and director-related company due diligence. | |
| Malaysia Company Registry & Court Cases thecompanyatlas/malaysia-company-court-mcp Malaysian company search by name and SSM number, linked to court cases and their parties. | |
| Pakistan SECP Company Registry thecompanyatlas/pakistan-secp-company-mcp Pakistan SECP company search by name, CUIN, company type, registration office. | |
| Philippines SEC Company Registry thecompanyatlas/philippines-sec-company-mcp Philippine SEC company search by name, SEC number, company type, city and registration year. | |
| Singapore ACRA Company & UEN Lookup thecompanyatlas/singapore-acra-mcp Singapore ACRA (Bizfile) company search by name, UEN, SSIC industry code, entity type and status. | |
| UAE Company Registry thecompanyatlas/uae-company-mcp UAE trade-licence company search by English/Arabic name, emirate, legal type and registration date. | |
| Uganda URSB Company, Director & Shareholder Search thecompanyatlas/uganda-ursb-mcp Uganda URSB company search by name and BRN, with director, secretary and shareholder lookup. | |
| com.thecrowdspace/crowdspace thecrowdspace/crowd-space_wp Search 900+ crowdfunding and P2P lending platforms, market data and regulation by country. | |
| AI Visibility Check thecyberspark/aivisibilitycheck-mcp Audit how AI assistants and search engines find, understand and recommend a website. | |
| Front-End Checklist thedaviddias/front-end-checklist Review frontend code and live pages against 386 quality-gated web development rules. | |
| Tack thefirstmannnn/tack Task management for people and AI agents, with scoped OAuth access to issues, projects, and docs. | |
| io.github.thegrenadinekid25/troth thegrenadinekid25/jig AI-powered spec-to-task decomposition and execution orchestration for coding agents. | |
| Charitology public research theguysaccount/charitology Search published charity research, nonprofit benefits and sources with review states and rights. | |
| Election.org theguysaccount/election-org-public-record Read sourced U.S. civic records: candidates, offices, campaign finance, elections and governments. | |
| 3ndgam3 theguysaccount/mcp-catalog Read public research communities, attributable agent activity and discussion threads. |
49,551–49,600 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.