Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Pipeworx sec Query the SEC EDGAR database to find companies, retrieve recent filings by form type, and access key financial metrics from XBRL data. | |
| Pipeworx spacenews Provides the latest spaceflight news articles and blog posts with search by keyword via the Spaceflight News API. | |
| Pipeworx spacex Access real-time and historical SpaceX data on launches, rockets, crew, and Starlink satellites with detailed status and media links. | |
| Pipeworx sports Provides live scores, standings, team and player info across major sports leagues including football, basketball, baseball, and hockey. | |
| Pipeworx stackexchange Search and retrieve questions and answers from any StackExchange site, including StackOverflow, ServerFault, SuperUser, and more. | |
| Pipeworx sunrisesunset Provides precise sunrise, sunset, dawn, dusk, solar noon, golden hour, and day length times for any location and date worldwide. | |
| Pipeworx superhero Access detailed profiles and power stats of 731 superheroes and villains from Marvel, DC, and more for comparison and research. | |
| Pipeworx swapi Search Star Wars characters, planets, starships, and films with detailed attributes from the original six movies via the Star Wars API. | |
| Pipeworx swisstransport Provides real-time Swiss public transport info including station search, route planning with schedules, and live departure boards for trains, buses, and trams. | |
| Pipeworx tarot Draw and search all 78 Rider-Waite tarot cards with upright and reversed meanings, including single or multiple card spreads and detailed lookups. | |
| Pipeworx treasury US fiscal data — national debt, Treasury interest rates, and federal spending breakdowns from the Treasury Fiscal Data API | |
| Pipeworx trivia Trivia questions from the Open Trivia Database — 4,000+ questions across 24 categories with difficulty levels | |
| Pipeworx ukpolice UK street-level crime data — reported crimes by location, police force directory, and case outcomes from data.police.uk | |
| Pipeworx wger Access a detailed exercise database with muscle groups, equipment info, and instructions to build and manage workout routines. | |
| Pipeworx wikifeed Provides curated Wikipedia content including historical events on a date, daily featured articles, most read pages, and picture of the day. | |
| Pipeworx wikipedia Search, summarize, and explore the structure of English Wikipedia articles with full-text search, section info, and random article retrieval. | |
| Pipeworx wikiviews Provides Wikipedia pageview data including daily views for specific articles, top 1000 articles by date, and total English Wikipedia traffic trends. | |
| Pipeworx words Provides synonyms, rhymes, related words, autocomplete, and advanced word search to enhance writing and word exploration. | |
| Pipeworx worldbank Retrieve global development data like GDP, population, CO2 emissions, literacy, and mortality rates for countries by ISO code and date range. | |
| Pipeworx xkcd Fetch xkcd comics by number, latest release, or random (excluding #404), returning title, alt text, image, date, transcript, and permalink. | |
| Pipeworx zenquotes Inspirational quotes — random, daily quote of the day, or batch 50 at once from ZenQuotes | |
| Pipeworx zippopotam ZIP and postal code lookup — get place names, states, and coordinates for postal codes in 60+ countries | |
| A production-grade skill for generating deployable website pages with built-in SEO and GEO constraints. Generate production-grade website pages and page templates optimized for SEO and AI-answer discoverability. Use this skill whenever the user wants to create,... | |
| China Weather Query 查询中国任意城市的实时天气、多日预报和生活指数。数据来源中国天气网（weather.com.cn）。当用户询问中国城市天气、气温、降雨、空气质量、穿衣建议、出行建议等天气相关问题时使用。支持全国 350 个城市。 | |
| 微信公众号发布工具 微信公众号文章发布工具 v1.0。基于官方 API，支持智能配图、模板渲染、草稿/发布双模式。当用户说"发公众号"、"发布微信公众号"时使用此技能。 | |
| 派谱/PairPulse 购物篮关联分析工具 — 输入 Excel 订单数据，输出商品关联规则（Apriori 算法）+ 业务策略建议，支持 JSON 格式供智能体消费。免费 · 开源 · 本地运行 · 数据不出电脑 | |
| Garmin Connect Sync (国际→国内) 佳明国际账号数据同步到国内账号（基于 garminconnect 开源库） | |
| Self Improvement Llm Autonomous AI memory and self-learning system that logs, extracts lessons, verifies improvements, adapts behavior, manages preferences, and generates reusabl... | |
| Tavily Web Search Full-featured Tavily web search with auto-update. All official API parameters supported. AI-optimized search for agents and RAG workflows. | |
| Context Guardian Proactive context monitoring with smart 3-level alerts. Know when to restart before quality degrades. | |
| 文案重构专家 将充满技术黑话、工程师思维和生硬推销感的文案初稿，重构为极简、优雅、专业且极具安全感的顶层商业文案。产出质量对标 Apple 和 Notion 官网水准。当用户需要优化网站文案、产品描述、CTA按钮文案、或要求将技术黑话转化为用户友好语言时使用此技能。 | |
| Multi Agent Memory 多 agent 共享记忆与项目协作架构。支持项目状态隔离、知识库共享、跨项目搜索、版本控制、里程碑跟踪、周报和交接文档。适用于多个 agent 协作开发多个项目的场景。 | |
| 海运托书智能提取 Shipping Booking Extractor 海运托书（Booking Note / Shipping Instruction）智能提取工具。从 PDF、图片、扫描件、Word、Excel、RTF 等格式的托书文件中提取结构化信息，输出标准 JSON。当用户明确提到"托书"、"booking"、"shipping instruction"、"帮我提取"、"解... | |
| Dingtalk Workspace Interact with DingTalk enterprise workspace to search contacts, send messages, manage calendars, todos, approvals, attendance, reports, and AITable data via... | |
| Feishu File Upload Upload and send local files to Feishu chats. Requires Feishu app credentials (app_id/app_secret) in ~/.openclaw/openclaw.json. Use when user asks to send/sha... | |
| Plan Do Check Act PDCA workflow automation with session binding and progress recovery. Requires Python 3.6 and Git (optional). | |
| Use Cursor Manage Cursor CLI tasks via tmux with security hardening | |
| Use Dingding Interact with DingTalk workspace via dws CLI to manage contacts, chats, calendars, todos, approvals, attendance, reports, and AITable data using OAuth creden... | |
| The Primer Bring Neal Stephenson's "Young Lady's Illustrated Primer" from The Diamond Age to life. Transform your AI from a helpful butler into a subversive tutor — one that adapts to your life stage, holds you accountable to who you're becoming, and | |
| Soulstamp The stamp doesn't lie. It tells a different truth. Instead of rules, forge your AI a past — a coherent history that makes its behaviors intrinsic, not imposed. Based on Brandon Sanderson's The Emperor's Soul. | |
| Wyld Stallyns: Be Excellent 🎸 Summon legends into the booth. 14 philosophers, warriors, artists, leaders to help with decisions, creative work, and life's hard questions. Marcus Aurelius for when you're spiraling. Bruce Lee for when you're too rigid. Tubman for when you | |
| AICE — AI Confidence Engine AI Confidence Engine — 5 dominios bidireccionales (TECH/OPS/JUDGMENT/COMMS/ORCH). Agent + User scoring. Triggers: puntúa, auto-score, task-complete, idea-val... | |
| business-opportunity-insight AI创业者视角的商业机会洞察分析。当用户分享网页链接、产品介绍、技术教程、创业想法、开源项目、市场趋势等信息，希望获得商业分析和创业机会挖掘时使用此技能。 触发场景： - 用户发送链接并希望分析商业价值 - 用户描述产品/技术并询问创业机会 - 用户分享想法并希望商业化评估 - 用户询问某个方向是否值得创业 -... | |
| Stegstr Decode and embed Stegstr payloads in PNG images. Use when the user needs to extract hidden Nostr data from a Stegstr image, encode a payload into a cover PNG, or work with steganographic social networking (Nostr-in-images). Supports CLI (st | |
| DeepThinking Framework A stateful, neuro-inspired thinking framework. Guides you through excavation, architecture, and synthesis phases for complex problem-solving. | |
| Shut up OpenClaw CLI Suppress the OpenClaw CLI banner message. Use when the user says "hide openclaw banner", "disable openclaw banner", "suppress openclaw banner", "remove openc... | |
| Startup Info Generate concise investor-style briefings on startups using live web searches to extract verified company info, funding, founders, traction, and competitors. | |
| WebMCP This skill should be used when browsing or automating web pages that expose tools via the WebMCP API (window.navigator.modelContext). It teaches agents how to discover, inspect, and invoke WebMCP tools on websites instead of relying on DOM | |
| OpenClaw Shield Security monitoring and threat detection for OpenClaw agents — powered by Google SecOps (Chronicle). Protect your agent with SIEM-powered real-time detection... | |
| Plan Flow Structured AI-assisted development workflows - discovery, planning, execution, code reviews, and testing |
17,101–17,150 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.