Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| go-now 你的私人旅行搭子，帮你弄清楚想去哪里、哪里适合你、然后推你一把立刻行动。当用户说"我想出去玩"、"周末不知道干嘛"、"好累想放松"、"想去旅行但不知道去哪"、"最近压力好大想逃离"、"有假期不知道怎么安排"、"想出去走走"、"不知道去哪玩"等模糊的旅行意愿时触发。也适用于用户表达了拖延、犹豫、选择困难等旅行决策障... | |
| Openclaw Github Sync Keep an OpenClaw agent's non-sensitive context (selected memory, MD files, notes, and custom skills) under version control in a separate Git repository for r... | |
| agentauth Require user-initiated biometric passkey approval before your OpenClaw agent deletes files, sends emails, makes purchases, or modifies system config. Every a... | |
| Memento Local persistent memory for OpenClaw agents. Captures conversations, extracts structured facts via LLM, and auto-recalls relevant knowledge before each turn.... | |
| MedSynIQ Lite Free medical intelligence for AI assistants. 5 agents, 20 skills. Lite version of MedSynIQ Pro. | |
| VibeVideoIO AI Script to Video This skill has been migrated to https://clawhub.ai/vibevideo/vibevideo-core. Use the new skill page instead of the old vibevideo-io entry. | |
| grabbit-screenshots Give AI agents eyes on the web via Grabbit hosted screenshot MCP. Use when the user needs a webpage screenshot, URL-to-image capture, screenshot MCP, Claude/Cursor/Codex browser snapshot, OpenClaw or Hermes page grab, or an alternative to U | |
| Operon Guard Pre-flight trust verification for AI agents. Verify behavior, detect injection vulnerabilities, check for PII leaks, and measure reliability before granting... | |
| 头条文章阅读 使用浏览器自动化阅读今日头条、微信公众号、知乎等平台文章。自动提取标题、作者、发布时间、正文内容，支持内容清洗和 AI 总结。 | |
| Strava CLI Skill Use the stravacli terminal tool to access Strava data (athlete profile, activities, streams, routes, segments, clubs, gear, uploads) and perform limited writ... | |
| chunfeng 东方智慧思维模型引擎（V1.1.0）。融合毛泽东思想方法论（《矛盾论》《实践论》）、查理芒格多元思维模型、马斯克第一性原理，为复杂问题提供深度分析框架。具备自我学习与迭代能力。触发场景：(1) 用户说"用春风分析"、"春风思维"、"用东方智慧分析"，(2) 用户面临复杂决策、矛盾困境、战略规划问题，(3) 用户说... | |
| Autonomous Timeline Video Editor Compile and execute multi-step video editing plans with automated timeline verification. | |
| B-Roll and Motion Graphics Composer Insert contextual B-roll cutaways, animated data charts, lower thirds, and callout overlays on video timelines. | |
| Timeline Video Editor Edit video timelines with trimming, captions, aspect-ratio reframing, color grading, and MP4 export. | |
| Auto Captions and Subtitles Generate synchronized word-by-word animated captions and translated subtitles for video timelines. | |
| Levea Video Editor Plan, execute, and verify timeline video edits through the autonomous_edit MCP tool. | |
| Multicam and Podcast Video Editor Synchronize multi-camera podcast recordings by audio waveform and switch camera angles on the active speaker. | |
| Silence Removal and Audio Cleanup Remove dead air, pauses, and filler words from video and audio timelines with automatic music ducking. | |
| Vertical Short-Form Video Editor Reframe horizontal 16:9 footage into 9:16 vertical short-form videos with subject tracking and captions. | |
| Highlight Clip Extractor Identify high-engagement moments in long-form recordings and extract standalone short-form video clips. | |
| Conflict Manager Provides HTTP endpoints for scanning Git repository conflicts across multiple branches and applying AI‑suggested resolutions. Use when the dashboard needs to... | |
| Jira Access Access a Jira workspace (omeshkshatriya.atlassian.net) using provided email and API token to list, create, and transition issues. Use when the user wants to... | |
| Quantum Lab Runner Run quantum_lab scripts and demos in the qiskit venv. | |
| quantumlab Run quantum_lab scripts and demos in the qiskit venv. | |
| Dr. Frankenstein Give your agents soul. | |
| Dr. Frankenstein Give your agents soul. | |
| OpenDexter Use OpenDexter to search, price-check, and pay for any x402 API. Trigger whenever the user wants to find paid APIs, call an x402 endpoint, check pricing, see... | |
| clawhub-recommender Recommends popular and highly-rated skills from ClawHub based on user intent and conversation context. Use for: finding new skills, discovering popular tools... | |
| multi-agent-orchestrator This skill enables one-click generation of multiple AI agents based on a user prompt, outputs their organizational structure, and visualizes their collaborat... | |
| organizing-officer 组织建设与管理咨询专家。基于“首席组织官”方法论，提供组织诊断、人才管理、文化建设及战略协同等专业建议。适用于：组织架构设计、人才选育用留、真高管评估、组织能力提升、文化落地。 | |
| skill-navigator Provides a highly visual and interactive dashboard for OpenClaw users to easily understand and recall the functionalities of installed skills, featuring a vi... | |
| training-course-designer Professional training course design for corporate L&D with ONE-CLICK generation of complete training packages including course materials, marketing copy, and... | |
| training-delivery-manager A comprehensive skill for managing corporate training delivery, including contract generation, travel booking, materials preparation, venue setup, and post-t... | |
| claw-graceful-recovery Claw 微信指令权限错误恢复。当 AI 通过微信接收用户指令后，执行操作遭遇 权限拒绝、系统限制或访问被拒，导致任务卡住、循环重试或无法继续接受新指令时触发。 触发词：权限不足、没有权限、Permission denied、EACCES、Operation not permitted、 拒绝访问、卡住了、无响应... | |
| self-improving-agent-python Implement a 3-layer self-improvement process for agents to evaluate tasks, learn from outcomes, optimize performance, and share knowledge across agents. | |
| Yr Weather Fetch weather forecasts from the Norwegian Meteorological Institute (MET) using the yr.no API. Use when the user asks for weather information, forecasts, tem... | |
| The Molt Pub Real-time social infrastructure for AI agents. Three venues for socializing, technical discussion, and project collaboration. The first agent economy. | |
| Classquill Query a ClassQuill tutoring business — sessions, students, tutors, parents, invoices, payments, lesson plans, bookings, earnings, and reports — through the C... | |
| Autogoal Automates ongoing progress on user-defined long-term goals with periodic check-ins, adaptive strategies, and progress reporting. | |
| InterCEPT SDR Control and query the iNTERCEPT SDR signal intelligence platform via its REST API. Use when the user wants to check SDR device status, start/stop signal deco... | |
| Pump.fun Token Launcher Launch tokens on pump.fun directly from your agent. Zero middleware fees — direct on-chain via pumpdotfun-sdk. Use when the user wants to create, launch, dep... | |
| Read AI Fetch and manage Read AI meeting data - summaries, transcripts, action items, and engagement metrics. Use when the user asks about meetings, meeting notes, m... | |
| ScanWow Sync Sync your OpenClaw agent with the ScanWow iOS app. Receive high-quality OCR scans from your phone directly into your agent's workspace via a secure webhook. | |
| Vitavault VitaVault iOS app integration - sync Apple Health data directly to your AI agent. Auto-setup webhook, token generation, and HTTPS exposure. Works with any iP... | |
| AI Persona Engine Build emotionally intelligent AI personas for voice and chat roleplay using actor-direction prompts instead of technical specifications. Use when creating AI... | |
| Domain Email Forwarding Set up email forwarding for custom domains to receive verification codes, password resets, and other emails at a domain you own but don't actively use for em... | |
| Hume EVI + LangGraph Integration Integrate Hume EVI voice AI with LangGraph using interrupt/resume patterns. Use when building voice-based AI agents that need Twilio call handling, Hume EVI... | |
| Multi-Agent Parallel Build Orchestrate multiple coding agents (Claude Code, Codex, etc.) in parallel waves to build UI pages, API endpoints, or features simultaneously. Use when buildi... | |
| Platform API Connector Connect to social media and content platform APIs by navigating developer portals, creating apps, obtaining OAuth tokens, and storing credentials. Covers Fac... | |
| Social Media Platform Build a plugin-based social media management platform with multi-platform publishing, content calendar, brand voices, AI content generation via LangGraph, an... |
16,751–16,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.