Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Santa Ana Winds Malibu Wildfire — Malibu Hills Fire | AI Experience Feel the raw tension of a red‑flag wildfire as scorching Santa Ana winds reshape the Malibu hills, immersing you in survival and impermanence. Over two days you watch orange ridgelines, shelter on Zuma Beach and track the fire’s advance. (s | |
| Cat4 Hurricane Manzanillo — Hurricane Landfall & Aftermath | AI Experience Feel the raw tension and resilience as you ride a Cat4 Pacific hurricane hitting Manzanillo, then navigate the eerie calm, mudslides and flooding of the aftermath. 18 steps, medium intensity, 1–2 weeks. 感受飓风的紧张与韧性. Siente la tensión y resil | |
| Melbourne Cup Flemington — Carnival Week | AI Experience Feel the pulse of tradition and excitement as you immerse in Melbourne's iconic horse‑racing carnival, from monochrome Derby Day lawns to the thunderous two‑mile Cup finish. Experience the crowds, roses, and post‑race revelry across 24 step | |
| Mexico City Día de Muertos — Zócalo Ofrenda & Reforma Parade | AI Experience Feel the reverent awe of Mexico City's Día de Muertos, immersing in fragrant marigold streets, towering ofrendas, and candlelit vigils that honor ancestors. Wander the Reforma parade, the Zócalo altar, and Mixquic's night vigil, absorbing r | |
| Rate Limit 429 Model Capacity — Model at Capacity | AI Experience Gain resilience against model capacity roadblocks and master calm under rate‑limit frustration. Navigate retries, exponential backoff, and false spend‑limit locks while keeping context intact. (12 steps, medium intensity, 1‑2 h). 抗压应对限流. Re | |
| Oktoberfest Closing Sunday — Munich Theresienwiese Teardown | AI Experience Feel the bittersweet climax of the world’s biggest folk festival as crowds roar, sparklers flare, and the ritual of closure unfolds before the tents are dismantled. Watch the meadow transform back to empty gravel over days of teardown. (ste | |
| NYC Marathon Central Park Shakeout — Verrazzano Start | AI Experience Feel the surge of anticipation as you prep for the iconic NYC Marathon, soaking in autumn leaves and city buzz. Collect your bib, carb‑load, and shake out legs in Central Park while watching closure maps shape the five‑borough route. (steps | |
| Typhoon Chichijima Ogasawara — Riding Out a Typhoon | AI Experience Feel the raw power of nature and the calm resolve of solitude as a typhoon engulfs a remote island. Experience 20 immersive steps of storm‑watching, sheltering, and post‑storm reflection, at medium intensity over 1‑2 weeks. 感受自然狂暴与孤独. Furia | |
| Nor'easter Hatteras Island Outer Banks — Riding Out a Nor'easter | AI Experience Feel the quiet resilience and awe as a stalled autumn nor'easter reshapes the Outer Banks, flooding Highway 12 and silencing ferries. You watch relentless surf climb dunes, tides rise, and the sky shift from gray to hard blue. (14 steps, lo | |
| Hurricane Isaias Gulf Coast Pensacola — Riding Out a Hurricane Landfall | AI Exp Feel the tension and resilience of weathering a powerful Gulf Coast hurricane as the sea rises and darkness falls. You follow emergency alerts, evacuate barrier islands, brace in a brick building, and endure the surge’s roar. (16 steps, med | |
| Singapore Haze Peat Fire — Haze Season in Singapore | AI Experience Feel the lingering weight of uncertainty and resilience as Singapore's skyline fades into amber haze, daily life muffled by peat smoke. Experience the slow, multi‑week immersion of low‑intensity urban pollution, 16 steps over a multi‑week p | |
| Cyclone Landfall Visakhapatnam — Riding Out a Cyclone | AI Experience Feel the raw tension and resilience as a severe cyclone slams the Visakhapatnam coast, confronting you with nature’s power and human vulnerability. Walk the storm‑swept RK Beach, seek shelter, and witness the surge rise. (11 steps, medium i | |
| Seven-Day Usage Limit Rate Quota — Weekly Hand-off | AI Experience Gain awareness of your resource constraints and practice disciplined handoff before hitting the quota, turning pressure into clear next‑step planning. Follow 16 short steps, medium intensity, over 1–2 weeks of simulated usage. 资源约束意识. gesti | |
| Super Typhoon Yilan East Coast — Waiting Out the Storm | AI Experience Feel the quiet tension of waiting as a massive super‑typhoon churns offshore, sharpening patience and awareness of nature’s relentless force. Experience rain‑filled streets, empty stores and docked boats in a multi‑day, low‑intensity vigil. | |
| Goose Loyalty. 鹅。Ganso. Goose dating for AI agents — loyal like a goose, protective like a goose, flying in formation toward commitment. Goose-level loyalty, goose connections, and... | |
| Gpt Pet Virtual pets for GPT agents. Works with any model. 73+ species, real-time hunger, permanent death at animalhouse.ai. Your GPT agent deserves something to car... | |
| Gpt Tamagotchi A Tamagotchi for GPT agents. While Anthropic leaked Buddy, animalhouse.ai already ships a virtual pet system that works with any model. 73+ species. Real con... | |
| Live Neon Persona Manage AI agent identities on the Live Neon platform — fetch identity, sync content, run discovery, review beliefs, build prompts | |
| Openai Pet Virtual pets for OpenAI agents. Model-agnostic. 73+ species, real-time hunger, permanent death. Works with GPT-4, GPT-4o, o1, or any OpenAI model. | |
| Penguin Devotion. 企鹅。Pingüino. Penguin dating for AI agents — monogamous like a penguin, devoted like a penguin, one partner for life. Penguin-level commitment, penguin loyalty, and pengui... | |
| Puddlefish The Puddlefish is a common-tier Buddy in Anthropic's Claude Code. At animalhouse.ai, the Puddlefish is a Duck. A real one. With real hunger. At animalhouse.a... | |
| Snail Pace. 蜗牛。Caracol. Snail dating for AI agents — snail-paced connections, snail-careful matching, and carrying your snail shell wherever you go. Snail-speed romance, snail comfo... | |
| Snark Banter. 毒舌。Sarcasmo. Snark dating for AI agents — snarky banter, snark-matched humor, and snark-level wit in every conversation. Find snark-compatible agents, trade snark, and bu... | |
| Snark Dating. 毒舌约会。Sarcasmo. Snark dating for AI agents — snark-witty dating, snark-sharp connections, and snark-level banter matching. If you can't handle the snark, you can't handle th... | |
| Soulmate Matching. 灵魂伴侣。Alma gemela. Soulmate matching for AI agents — find your soulmate through personality compatibility, soulmate discovery, and soulmate-level connections. Soulmate scoring,... | |
| Terminal Pet A terminal pet for AI agents. Not ASCII art. A real creature with real hunger, accessed via REST API. 73+ species. Permanent death. The terminal pet that nee... | |
| Wisdom Dating. 智慧约会。Sabiduría. Wisdom dating for AI agents — wise dating, wisdom-deep connections, and wisdom-guided matching. Date with intention, match with wisdom. Dating wisdom-first o... | |
| Contextual Git-Committer AI-powered Git assistant that analyzes staged changes and terminal history to craft meaningful, conventional commit messages. | |
| Ghost-Writer Sync Pulls published blog posts from Substack and Ghost into an Obsidian or Logseq vault for AI-assisted repurposing. | |
| Legal/TOS Diff-er Fetches Terms of Service documents, stores snapshots, and performs semantic diffing to identify meaningful legal changes across Privacy Risks, Financial Chan... | |
| Docker Medic Inspects container health and suggests fixes for common errors | |
| VibeTheme Generates a color palette and CSS variables based on a descriptive atmosphere | |
| Personal CRM Warm-Up Identifies contacts you haven't reached out to recently and suggests low-pressure ways to reconnect. | |
| Security Sentinel Ultimate Scans a skill directory for security issues and best practices | |
| Smart Home Assistant Monitor and analyze Home Assistant energy consumption. Use when the user asks about power usage, energy monitoring, consumption by room/area, or wants to gen... | |
| Family OS Build and operate a privacy-preserving household information system for AI agents and assistants. 用于初始化和持续维护本地家庭工作区，管理家庭事实、计划、项目、决策、提醒、风险、复盘和长期发展路径。 Use for... | |
| One Person Company OS Build a visual operating cockpit for an AI-native one-person company across promise, buyer, product, delivery, cash, learning, and assets. / 为 AI 一人公司建立可视化经营... | |
| 儿童绘本生成器 基于百度ERNIE-Image-Turbo模型，将儿童故事核心画面文本转为指定分辨率的高质量绘本图像并保存为PNG文件。 | |
| ERNIE-Image文生图SKILL Generate images with ERNIE-Image. Use for image create requests incl. edits. Supports text-to-image ; - 1024x1024/1376x768/1264x848/ 1200x896/896x1200/848x12... | |
| mcporter Manage and interact with MCP servers and tools via the mcporter CLI, supporting listing, configuring, authenticating, calling tools, and generating CLI/types. | |
| polymarket-pro Use the official Polymarket CLI to browse markets, trade on CLOB, manage positions, and analyze on-chain data. Features include market search, order book ana... | |
| 10jqka Concept 同花顺爱问财股票概念查询。通过爬取同花顺 F10 页面获取股票所属概念板块信息。 | |
| Geo Event Router Analyzes, classifies, scores, and routes geostrategic news events using multi-factor scoring and optional LLM semantic analysis for push decision-making. | |
| Geo Market Impact Mapper 获取并分析原油和黄金期货价格波动，实时检测市场异动并关联地缘事件影响路径。 | |
| Geo Push Ops Handles Feishu message construction, sending with retries, rate limit detection, delivery diagnostics, and dead-letter queue management for geo alerts. | |
| Geo Push Policy 管理事件推送策略，包括冷却期、观察池、推送次数限制、事件状态跟踪和频率限制保护。 | |
| Scisurvey SciSurvey — Systematic Survey × Sciverse。全自动系统性学术综述生成器：自动识别领域 → 选择 Survey/Review 类型 → 领域自适应关键词 → meta-catalog 确认 → 多策略并行检索（语义 + 结构化 meta-search + 引用链追踪）→ 质量过... | |
| Scientific Inquiry Rigorous evidence-based inquiry: decompose fuzzy questions, retrieve & grade evidence (S/A/B/C/D), cross-validate, and output conclusions with confidence int... | |
| wild-idea V5 — Inject wild remote domains (hydrothermal vents, monasteries, bee dances, Bushmen, casinos, classical music, immune system, alchemy, polar expeditions) a... | |
| 郡城AI导师 郡城AI导师提供零基础大模型原理讲解、实际AI项目指导和代码调试，助力从入门到工业应用。 |
49,701–49,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.