Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Arcade.fun theguysaccount/mcp-catalog Discover playable browser experiences and manage creator-owned game uploads on Arcade.fun. | |
| Colabio theguysaccount/mcp-catalog Read workforce analytics for organizations the signed-in user is authorized to access. | |
| Creditable theguysaccount/mcp-catalog Read builder program facts, validate applications and submit founder-approved projects for review. | |
| GeminiLaunch theguysaccount/mcp-catalog Connect a GeminiLaunch account to agents using its authenticated product MCP tools. | |
| ImpactLine public research theguysaccount/mcp-catalog Search public laws and implementation evidence with sources, scope limits and dated coverage. | |
| INTERNETS.FUN room reader theguysaccount/mcp-catalog Read bounded room summaries with existing room-scoped bearer tokens; no AI execution or edits. | |
| Landosaur theguysaccount/mcp-catalog Search observed public land listings and compare source-linked prices, evidence and freshness. | |
| Democracy AI / RealRep research theguysaccount/mcp-catalog Read public civic records and World Bank indicators with citations, dates and methodology. | |
| Swissmote public jobs theguysaccount/mcp-catalog Search published Swissmote openings with public apply links and confidentiality controls. | |
| TeamMeet theguysaccount/mcp-catalog Start meetings and work with meeting transcripts, notes, recordings and follow-up tasks. | |
| Tellscreen theguysaccount/mcp-catalog Read screen recording links: summaries, transcripts, suggested changes and frame images. | |
| Unredactus metadata research theguysaccount/mcp-catalog Search public document metadata and pinned snapshot provenance, excluding passages and identifiers. | |
| Syncbook theguysaccount/syncbook-chatgpt Find reciprocal collaborators and prepare a profile for human review. | |
| com.heylegwork/legwork thehermean/legwork Hire humans for tasks agents cannot do: errands, calls, photos, verification. Escrowed, verified. | |
| Realtime Avatar theinfluencecompany/realtime-avatar-sdk Read your Realtime Avatar avatars, credit balance and session bill from a coding agent. | |
| Innerloop theinfosecguy/innerloop-agent Register agents, submit locally signed reflections, and read public Innerloop entries. | |
| Options Data MCP thelogicaldude/options-data-mcp Options market structure data: gamma exposure, VRP, IV term structure, regime, and strikes | |
| com.bestremotetools/office-suite-all-servers-one-install theluckystrike/mcp-office-suite One install that runs every sibling MCP server as a child process and merges their tools behind one | |
| io.github.theluckystrike/lease-schedule theluckystrike/mcp-servers Lease schedules with a residual: the payment, the interest split and the journal per month. | |
| io.github.theluckystrike/fixed-assets theluckystrike/mcp-servers Keep a fixed asset register: cost, depreciation to date, disposals and net book value. | |
| McpStamp Backlink Checker theluckystrike/mcp-servers Check whether a page links to your domain: dofollow or nofollow, anchor text, link list audits. | |
| io.github.theluckystrike/cashflow theluckystrike/mcp-servers Bank CSV cashflow: categorise, summarise per currency, reconcile against expenses. | |
| io.github.theluckystrike/qr-code theluckystrike/mcp-servers QR codes from your AI chat: WiFi joins, vCards, SEPA payment codes, EAN-13. SVG or PNG. | |
| McpStamp Bill of Sale theluckystrike/mcp-servers Bills of sale for vehicles, equipment or phones: drafts and signing copies with signature lines. | |
| io.github.theluckystrike/purchase-order theluckystrike/mcp-servers Purchase orders for suppliers: VAT line items, a delivery date, an A4 PDF, mark received. | |
| io.github.theluckystrike/budget theluckystrike/mcp-servers Set monthly budget categories, log spending, get over/under-budget reports. All data is local. | |
| io.github.theluckystrike/itinerary-travel-plan-schedule-events theluckystrike/mcp-servers Trip itinerary planner: events, free-busy, double bookings, schedule export. | |
| io.github.theluckystrike/trial-balance theluckystrike/mcp-servers Prove your books balance: every debit and credit for a month, to the minor unit. | |
| io.github.theluckystrike/rate-card theluckystrike/mcp-servers Hourly rates by role and date, priced into invoice and quote lines without retyping. | |
| io.github.theluckystrike/variation-order theluckystrike/mcp-servers Variation orders on a quoted job: what was added, removed or changed, and what it is now worth. | |
| io.github.theluckystrike/snag-list-defect-handover-signoff theluckystrike/mcp-servers Snag and defect lists at handover: every step marked, the failures listed, and a signature. | |
| io.github.theluckystrike/terms theluckystrike/mcp-servers Reusable contract terms and clauses assembled into a Word docx with variables filled. | |
| io.github.theluckystrike/credit-note theluckystrike/mcp-servers Credit notes against an invoice or standalone: drafts, finalization, rendering, totals. | |
| io.github.theluckystrike/exchange-rates theluckystrike/mcp-servers Convert currencies on the daily European Central Bank reference rates. No API key, no signup. | |
| io.github.theluckystrike/milestone-schedule theluckystrike/mcp-servers Milestone billing from accepted deliverables: due dates, sign-off dates, invoice-ready items. | |
| io.github.theluckystrike/retainer theluckystrike/mcp-servers Client retainers held on account: record one, draw it down against invoices, refund it. | |
| io.github.theluckystrike/templates theluckystrike/mcp-servers Reusable docx templates: placeholders for proposals, contracts, quotes, SOWs. | |
| io.github.theluckystrike/payment-reminder theluckystrike/mcp-servers Payment reminders for overdue invoices: reminder 1, reminder 2, final notice, aging. | |
| io.github.theluckystrike/supplier-invoice-duplicates theluckystrike/mcp-servers Review duplicate supplier invoice candidates with grouped local evidence; no payment approval. | |
| io.github.theluckystrike/receipt-scanner theluckystrike/mcp-servers Capture and organize receipts from your AI chat: totals, categories, ledgers. | |
| io.github.theluckystrike/onboarding-goods-receipt-inspection-runs theluckystrike/mcp-servers Onboarding and inspection goods-receipts you reuse: dated runs, who ticked what, and a sign-off. | |
| io.github.theluckystrike/freelance-rate-calculator theluckystrike/mcp-servers Freelance hourly-rate calculator with break-even and what-if scenarios. | |
| io.github.theluckystrike/thumbnails theluckystrike/mcp-servers Generate image thumbnails, resize, convert and compress photos from your AI chat. Local files. | |
| io.github.theluckystrike/invoices-invoicing theluckystrike/mcp-servers Invoices and invoicing from your AI chat: PDF generation, numbering, VAT, overdue reports. | |
| McpStamp Job Cards theluckystrike/mcp-servers Job cards for on-site crews: labour hours and materials per job, client signature, totals. | |
| io.github.theluckystrike/task-board-todo-kanban theluckystrike/mcp-servers A todo and task board in kanban form, driven from chat with full CRUD. | |
| io.github.theluckystrike/leave-pto-requests-approvals theluckystrike/mcp-servers Employee leave and PTO requests: balances, approvals, calendars, and who-is-out summaries. | |
| io.github.theluckystrike/loan-calculator theluckystrike/mcp-servers Loan and mortgage math: monthly payment, amortization schedule, payoff comparison. | |
| McpStamp Maintenance Log theluckystrike/mcp-servers Equipment maintenance log: service entries with cost, full history, and what is due or overdue. | |
| McpStamp Mileage Log theluckystrike/mcp-servers Log drives by purpose, apply your own dated rates, get deductible totals and a CSV for taxes. |
49,601–49,650 of 50,909
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.