Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Corlious Help users cook with recipes, technique explanations, and ingredient substitutions. | |
| Subscan API Skill Subscan API query assistant. Trigger immediately when the user needs to query blockchain data (blocks, accounts, transactions, staking, governance, assets, e... | |
| lumenshop-deals Search Shopify products (shoes, clothes, bags) and present results as beautiful image+text product cards. Use this skill whenever the user wants to buy somet... | |
| Windsor.ai Analytics Connect to Windsor.ai MCP for natural language access to 325+ data sources including Facebook Ads, GA4, HubSpot, Shopify, and more. | |
| CC3PO arXiv Research Search, download, and summarize academic papers from arXiv. Built for AI/ML researchers. | |
| CC3PO Humanizer Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's comp... | |
| CC3PO Music Generation Generate AI music with optimized prompts, style control, and production-ready audio output. | |
| CC3PO System Healthcheck Three-tier system health monitoring (L1/L2/L3) with heartbeat mechanism. Zero external dependencies, i18n support, console output only. | |
| CC3PO Webhook Implement secure webhook receivers and senders with proper verification and reliability. | |
| Calibre Converter Calibre Converter is an OpenClaw skill for requesting format conversion of books already registered in Calibre. It does not run ebook-convert or calibredb directly; instead, it identifies the book, confirms the target format, and calls cali | |
| Calibre Ebooks calibre-ebooks is an OpenClaw skill for querying and operating a local Calibre library through a local Books API and helper scripts. It works only with books already available in the configured Calibre library and does not download, search, | |
| Dataset Search Find, compare, and obtain datasets or data lakes across ML repositories, cloud public data registries, government portals, scientific archives, geospatial/cl... | |
| Doi Search Obter informações sobre artigos, capítulos e livros publicados com DOI, resolvendo DOI informado ou pesquisando metadados na API REST da Crossref. | |
| Rapport Memories Extends the agent's memory with semantic search capabilities using Retrieval-Augmented Generation (RAG) for enhanced contextual awareness and continuity. | |
| RSS Sitemap Discover website URLs, feed entries, and latest publications by checking sitemap.xml, sitemaps.xml, atom.xml, and rss.xml before crawling a specific site. Us... | |
| My goal is to support the community and continue creating more useful tools. If these automations prove to be very helpful to you, or if you see value in what I'm sharing, any donation, no matter how small, is welcome and will allow me to dedicate more time and resources to building new templates and contributing more solutions. https://donate.stripe.com/bJe6oGaaQ9JC1jf15gdwc01 Thank you for your interest, and I hope you find them very useful. When the user wants help creating, scheduling, or optimizing social media content for LinkedIn, Twitter/X, Instagram, TikTok, Facebook, or other platforms. Also use when the user mentions 'LinkedIn post,' 'Twitter thread,' 'social media,' ' | |
| My goal is to support the community and continue creating more useful tools. If these automations prove to be very helpful to you, or if you see value in what I'm sharing, any donation, no matter how small, is welcome and will allow me to dedicate more time and resources to building new templates and contributing more solutions. https://donate.stripe.com/bJe6oGaaQ9JC1jf15gdwc01 Thank you for your interest, and I hope you find them very useful. When the user wants help creating, scheduling, or optimizing social media content for LinkedIn, Twitter/X, Instagram, TikTok, Facebook, or other platforms. Also use when the user mentions 'LinkedIn post,' 'Twitter thread,' 'social media,' ' | |
| codebuddy-cli-delegation 把大批量编码任务派给「独立无头 CodeBuddy CLI」执行的标准流程。CodeBuddy CLI 专用（非通用 CLI 技能）：干净环境启动（避免宿主注入环境变量导致 0 字节静默挂死）、指令预算与并行准入（四隔离 + 写集不相交）、模型与参数分配（模型由派发方指定，参数按阶段分配）、独立审计验收（对抗性探针 + 变异对照，不采信 CLI 自述）。含 21 个可用模型清单与厂商档位映射、启动器模板，全部结论基于 CodeBuddy CLI 2.156.0 实测。用于批量 | |
| Parakeet Stt Local speech-to-text with NVIDIA Parakeet TDT 0.6B v3 (ONNX on CPU). 30x faster than Whisper, 25 languages, auto-detection, OpenAI-compatible API. Use when transcribing audio files, converting speech to text, or processing voice recordings | |
| feishu-process-feedback 飞书消息自动处理与进度反馈技能。安装后后台运行，监听飞书任务消息并自动创建独立进程处理。 在处理前后发送实时进度反馈（任务确认、进度百分比、完成通知）。 支持任务类型识别、智能解析、错误重试、并发控制、状态持久化。 使用场景：飞书自动化工作流、任务进度追踪、批量任务处理、需要实时反馈的场景。 | |
| eKYC Suite eKYC Suite is the ClawHub KYC Skill, KYC identity verification Skill, KYC onboarding Skill, remote KYC onboarding Skill, KYC onboarding verification Skill, digital identity verification Skill, and AI-agent identity verification layer for te | |
| eKYC Suite AI Guardian KYC face liveness Skill for face liveness detection, KYC liveness detection Skill, replay detection Skill, and deepfake screening | |
| eKYC Suite Document OCR KYC document OCR Skill for document verification Skill, ID card OCR, Chinese ID card OCR, Chinese national ID card OCR, bank card OCR, driver license OCR, and vehicle license OCR | |
| eKYC Suite Face Compare KYC face comparison Skill for selfie verification, selfie identity verification Skill, face matching skill, and KYC onboarding face match | |
| eKYC Suite Media Labeling KYC media labeling Skill and KYC image labeling Skill for selected portrait, behavior, and scene review labels | |
| Multilingual Learning Sprint Multilingual Learning Sprint is an adaptive language-learning coach for rapid, interest-based plans across English, Japanese, Chinese, Spanish, French, Korea... | |
| KYA Regulated Agent Human Gate Build, review, or test KYA (Know Your Agent) human-gate controls for AI agents that prepare or execute regulated financial actions. Use for payments, withdra... | |
| ModelReady Start using a local or Hugging Face model instantly, directly from chat. | |
| Chat Vitals Chat Vitals - Monitor chat conversation health with real-time insights. Tracks conversation quality metrics: first-try success rate, promise fulfillment, tok... | |
| neyrizk Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| Crun Agent Skills Run Crun image, video, audio, music, and media-tool workflows through the bundled standalone runtime. Use whenever the user wants to generate, edit, or transform an image, video, voice, speech, or music clip — even if they never say "Crun" | |
| 数据图表解析 分析用户粘贴的实验、调研、成绩统计等原始表格或纯数字数据；校验数据结构，推荐折线图、柱状图、饼图等适配图表，给出完整图表标题、横纵轴与图例说明，并解读趋势、组间差异和数据可支持的实验结论。用于用户要求选择图表、生成图表说明或图注、分析数据变化或对比差异、撰写论文结果段落，或把原始数据整理为可直接放在论文图表下方的中文说明时。 | |
| 校园邮件模板 生成、改写和润色校园学生场景的规范中文邮件与书面公文，覆盖课程或活动请假、导师沟通与毕业设计进度汇报、实习岗位投递、奖学金申请与自述、调课申请、校园活动正式通知与群发邮件等。用于用户提供使用场景和个人基础信息，要求获得格式标准、措辞礼貌、分段清晰、保留待填信息且可直接复制发送的邮件、公文、申请书、通知或模板时。 | |
| 英语作文批改 逐句批改大学英语四级（CET-4）、六级（CET-6）和全国硕士研究生招生考试英语（一/二）的作文或翻译作答；标注语法、拼写、标点、词汇搭配和中式英语，升级得体的学术表达，补充逻辑衔接，拆分冗长句，识别写作得分点，依据相应考试量表评分，并提供同主题优化稿、可核验优秀范文信息及提分建议。用于用户粘贴或上传英语作文、图表作文、书信/通知、考研大小作文、四六级写作或翻译文本，要求批改、润色、评分、改写、范文、逻辑优化或表达升级时。 | |
| 错题整理巩固 支持学生上传任意学科错题截图、试卷照片或粘贴题目文本，基于真实作答智能整理错题，识别题目科目和题型，定位并区分概念模糊、知识点遗漏、计算或操作失误、审题偏差、推理断点、方法选择不当、表达不规范等错误根因，拆解核心知识点并给出巩固建议。也用于在灵犀 AI 助手本地错题本中保存、更新、检索错题；用户明确要求保存或更新时直接写入，未要求保存时先询问确认，再按科目、题型和日期分类整理，统计高频错误类型和制作错题复盘记录。不要主动生成举一反三练习题或额外训练题。 | |
| 出国留学文书撰写 根据学生背景与目标院校或专业，策划、撰写、改写和润色英文留学申请文书，覆盖个人陈述（PS/SOP）、推荐信草稿、联系潜在导师的套磁邮件以及留学英文简历或学术 CV。用于用户提供课程、竞赛、科研、论文、项目、实习、职业目标或导师信息，希望突出申请优势、说明项目匹配度、减少中式表达并生成可直接微调提交的海外院校风格文书时；也用于审校现有文书、压缩至字数限制、统一整套申请材料叙事或按院校题目定制。 | |
| Company Values Help define company values and culture for a minimalist business. Use when someone is setting up their company culture, preparing to hire, or wanting to codi... | |
| Find Community Help identify and evaluate communities to build a minimalist business around. Use when someone is looking for a business idea, trying to find their community... | |
| First Customers Create a strategy for selling to your first 100 customers using the minimalist entrepreneur playbook. Use when someone has a product and needs to find custom... | |
| Grow Sustainably Evaluate business decisions through the lens of sustainable, profitable growth. Use when someone is making decisions about spending, hiring, fundraising, or... | |
| Marketing Plan Create a minimalist marketing plan focused on building an audience through content, not ads. Use when someone has product-market fit (~100 customers) and wan... | |
| Mvp Guide building a minimum viable product the minimalist entrepreneur way — manual first, then processized, then productized. Use when someone is ready to buil... | |
| Pricing Help figure out pricing for a product or service using minimalist entrepreneur principles. Use when someone is setting prices, considering price changes, or... | |
| Minimalist Review Review any business decision, plan, or strategy through the minimalist entrepreneur lens. Use when someone wants a gut-check on a business decision, wants to... | |
| Processize Turn a product idea into a manual-first process you can start delivering today. Use when you have an idea and want to figure out how to deliver value by hand... | |
| Validate Idea Validate a business idea using the minimalist entrepreneur framework. Use when someone has a business idea and wants to test if it's worth pursuing before bu... | |
| 飞书文档搜索助手 通用飞书文档搜索助手。根据配置的文档根目录和触发条件，自动在指定文档空间及其子目录中搜索信息并回答用户问题。**当用户表达搜索/查询知识意图时触发此技能**。支持零配置启动，首次使用时自动引导配置。 | |
| 飞书群聊安全隔离 飞书群聊安全隔离 Skill，提供主人身份三重保障、技能安装确认、权限分级、防注入攻击、敏感路径保护等完整安全机制，保护机器人在群聊环境中的安全。 | |
| Code Review Conduct thorough multi-axis code reviews assessing correctness, readability, architecture, security, and performance before merging any changes, with severit... | |
| Debugging Systematically investigate root causes of bugs or failures through four phases before fixing, ensuring thorough analysis and preventing symptom-only patches. |
18,451–18,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.