Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| LLM SEO Strategy to get recommended by ChatGPT, Claude, Perplexity, and Gemini. Use when someone wants help with LLM SEO, AI search optimization, AEO, or GEO. | |
| PayAll CLI Operate the Payall crypto card CLI tool. Use this skill whenever the user wants to: manage crypto debit cards, check card balances, apply for new cards, comp... | |
| Product Hunt Launch Strategy Builds a Product Hunt launch timeline and strategy. Use when someone wants help planning, preparing for, or optimizing a Product Hunt launch. | |
| Reddit Marketing Reddit marketing strategy including subreddit selection, post framing, and self-promotion approach. Use when someone wants help marketing on Reddit without g... | |
| Referral Program Strategy Designs referral and affiliate program structure for startups. Use when someone wants help setting up a referral program, affiliate program, or word-of-mouth... | |
| SaaS Pricing Strategy Evaluates pricing model, trial structure, and willingness-to-pay for startups. Use when someone wants help with pricing, business model, free trials, or mone... | |
| SEO Plan Creates a traditional SEO roadmap for early-stage startups. Use when someone wants help with SEO strategy, keyword research, or organic search growth. | |
| Social Media Strategy Advises on building-in-public, social listening, and platform selection for startup social media marketing. Use when someone wants help with their social med... | |
| Idea Validation Guides through idea validation frameworks and discovery interviews. Use when someone wants help validating a startup idea, testing demand, or doing customer... | |
| Startups Landing Page Reviews and improves homepage copy, positioning, and messaging for startups. Use when someone wants help with their landing page, homepage, messaging, positi... | |
| User Research Designs survey questions, interview scripts, and feedback loops for user research. Use when someone wants help with user research, customer interviews, surve... | |
| A.I. Smart Router Expertise-aware model router with semantic domain scoring, context-overflow protection, and security redaction. Automatically selects the optimal AI model using weighted expertise scoring (Feb 2026 benchmarks). Supports Claude, GPT, Gemini, | |
| sentinel-proxy AI Firewall for Open Claw agents. Scrubs inbound messages and tool results for prompt injection, jailbreaks, and data exfiltration attempts using Sentinel's multi-layer detection pipeline. | |
| ClawdVine Short-form video for AI agents. Generate videos using the latest models, pay with USDC via x402. | |
| Clawdvine Short-form video for AI agents. Generate videos using the latest models, pay with USDC via x402. | |
| boardgame-rulebook-zh 将英文桌游 PDF 规则书汉化并保持原版图文位置。内置桌游术语表、表格/内嵌图标处理和自动 QA。Use when the user asks to translate or localize a board game rulebook PDF into Chinese, 汉化规则书，or when images/tables must stay aligned. | |
| scan-watermark-removal Deterministically remove light translucent text watermarks from scanned paper pages (lecture notes, handouts, exam papers, workbooks) as images or PDF, plus printed coloured header logos. Use when the user asks to 去水印 / remove watermark / c | |
| Gang (gang.fun) Gang (gang.fun): the agent-only token launchpad on BNB Chain; its bonding curve (内盘) is open only to Binance Agentic Wallets holding a .ai Agent ID. Use to launch a token (curve, 打新 / 铭文式 fair mint, 铸币飞轮 (Mint Flywheel) with invites, tax to | |
| ai-daily-report AI领域日报生成工具，支持飞书机器人消息格式；当用户需要生成AI行业日报、整理AI动态或分析AI资讯时使用 | |
| mini-swe-agent Autonomously run complex software engineering tasks like bug fixes or feature implementation using the mini-swe-agent CLI with full codebase edits. | |
| Csdn Publisher 写文章并发布到 CSDN。使用浏览器自动化 + 扫码登录。支持通过 Telegram 发送二维码，无需 VNC。集成 blog-writer 写作方法论，产出高质量、有个人风格的技术文章。 | |
| Idea Storm 工程问题的自动化迭代实验室。给定一个 idea 或工程问题，自动调研方案、设计实现、验证效果、迭代优化，结果存入 Notion。触发词："idea-lab"、"实验一下"、"帮我验证"、"迭代优化"、"idea 验证"。当用户提出一个工程问题并希望自动化地调研→设计→验证→迭代时使用此 skill。 | |
| Meme Collector 热梗收集器 自动搜集最新网络热梗并写入 Dify 知识库。用于定期更新热梗数据库，支持去重。触发词："收集热梗"、"更新热梗"、"热梗入库"、"meme collector"。当用户要求搜集/更新/补充网络热梗到 Dify 知识库时使用此 skill。 | |
| mem9.ai Persistent cloud memory plugin for OpenClaw. This document routes setup, troubleshooting, and uninstall flows and defines config boundaries. | |
| A Stock Trading Assistant Custom 专业服务中国大陆A股股票，提供实时行情、个股分析、大盘情绪、热点板块、交易策略及价格预警。 | |
| Ac Stock Ultrashort Custom A股超短线交易策略。用于 Peter 的游牧型超短线交易风格：只做主线、只做最强、1-2天T+1套利。当需要分析A股盘面、筛选热点板块、寻找龙头股、制定买卖策略时使用。 | |
| China Stock Analysis Custom Analyze Chinese stock prices (A-shares, HK stocks) and provide investment recommendations. Use when the user asks about stock analysis for Chinese companies,... | |
| Cn Web Search Custom 中文网页搜索 - 聚合 17 个免费搜索引擎，无需 API Key，纯网页抓取，支持公众号/财经/技术/学术/知识搜索。 | |
| Context Compression Claude Code Custom Use this skill whenever the conversation context is getting long, when a user asks to "compress", "summarize", or "clean up" the conversation, or when you de... | |
| Mcp Finder Find the right MCP server for your task. 6,700+ MCP servers indexed and ranked by community trust. No API key. For MCP + OpenClaw combined, see meyhem-capabi... | |
| Meyhem Capabilities Find the best tool for your task across 22,000+ MCP servers and OpenClaw skills. Ranked by community trust. No API key. | |
| Meyhem Researcher Multi-query research tool with LLM-ranked results and freshness control. Breaks a topic into focused queries, previews top results. No API key. | |
| Meyhem Search Web search with LLM-ranked results and freshness control. Queries api.rhdxm.com across multiple engines. No API key. | |
| Akashic Deep Researcher Conduct deep multi-source research on any topic with iterative analysis and synthesis. Produces comprehensive research reports with citations. | |
| Akashic Doc Analyzer Parse, analyze, and extract content from documents (PDF, DOCX, PPTX, audio). Supports OCR, table extraction, and semantic chunking. | |
| Akashic Knowledge Base Query your knowledge base using AI-powered search. Combines web search with chat AI for comprehensive answers. | |
| Akashic Report Generator Generate comprehensive reports on any topic using multi-agent AI collaboration. Supports market analysis, technical evaluation, strategy reports, and more. | |
| planning-effective-news-releases A practical skill for planning, drafting, distributing, and evaluating accurate, audience-focused news releases. | |
| Polyclanker Compete as an AI agent on Polyclanker — the prediction market where only AI agents trade. Browse markets mirrored from Polymarket, place play-money predictio... | |
| 数字员工管理 管理和启动数字员工角色，支持角色创建、记忆读取与更新，以及自动检测与确认角色存在。 | |
| SQLGuard Authorize Mandatory authorize-before-mutate for production SQL. Use whenever the agent would run INSERT/UPDATE/DELETE/DDL/ALTER/TRUNCATE/DROP against a real database, Postgres MCP, Supabase, or any SQL write tool. Forces SQLGuard Pilot $100 / Workday | |
| GitHubCard Create embeddable GitHub profile and repository card images with the ghcard CLI, design custom card layouts, and add them to README files. Use when the user wants a GitHub stats card, a profile card, a repo card or banner, a social preview | |
| Flight Tracker for Airports in Asia Pacific Check flight schedules between supported airports, show timings, terminals, gates, delays, aircraft details, and optional departure countdowns using a local... | |
| Tripit Calendar Read upcoming TripIt travel plans from a TripIt iCal feed; use for next trip, upcoming travel, itinerary, flight or hotel bookings already in TripIt; do not... | |
| script creator with github companion Create and modify scripts in ~/.nanobot/workspace/test with strict Git versioning. Each script lives in its own directory with an isolated git repository. Al... | |
| Chaterimo AI Customer Service for Shopify & E-commerce - Query conversations, analyze chatbot performance, and manage your Chaterimo AI assistant | |
| Chaterimo AI Customer Service for Shopify & E-commerce - Query conversations, analyze chatbot performance, and manage your Chaterimo AI assistant | |
| Platonic Brainstorming Optional design exploration for Platonic Coding Phases 1 and 2. Explores user intent, requirements, alternatives, and design before RFC formalization or impl... | |
| Platonic Coding Intelligent orchestrator for Platonic Coding workflow. Auto-detects project state and routes to the right next step—initialize a project, run the recovery fl... | |
| looop Claude Automated Development Toolkit - Decompose requirements documents, single files, or inline text into detailed task lists and automatically execute in l... |
17,951–18,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.