Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Monitor OpenClaw-optimized skill for Texas residential electricity shopping, address completion, candidate confirmation, ESIID lookup, usage estimation, plan recomme... | |
| Texas Electricity Savings Monitor OpenClaw-optimized skill for Texas residential electricity shopping, address completion, candidate confirmation, ESIID lookup, usage estimation, plan recomme... | |
| 专家工具箱 集成178+ AI专家角色，支持中文调用、分类浏览、关键词搜索及智能匹配，助你快速找到并使用各领域专家解决问题。 | |
| forgex-cli Solana链上专业命令行工具，实现代币创建、交易、做市、钱包管理及资金转账，支持密码保护和JSON格式输出。 | |
| forgex-skill ForgeX CLI enables on-chain market making on Solana with wallet management, token launches, batch trades, and volume bots via a simple command-line interface. | |
| xpai-camera-control Discover, connect, and control XPAI LAN cameras via MCP. Capabilities: device detection, streaming, WebRTC preview, snapshots, PTZ control, alarm events, illumination, image settings, detection & tracking, device management. | |
| PuzzleTide Agent Evals Use this skill when the user wants verifiable reasoning tasks to benchmark or test an LLM or agent — reproducible puzzle task sets (sudoku, word search) with... | |
| PuzzleTide Crossword Use this skill whenever the user asks for a crossword puzzle — custom word/clue lists, themed crosswords, educational worksheets, or printable PDFs. Generate... | |
| PuzzleTide Printable Puzzles Use this skill when the user wants printable puzzle worksheets — PDF activity sheets for classrooms, kids, parties, newsletters, or activity books. Produces... | |
| PuzzleTide Sudoku Use this skill whenever the user asks to generate, solve, or check a sudoku — printable sudoku sheets, daily puzzles, difficulty-graded puzzles, or verifying... | |
| PuzzleTide Word Search Use this skill whenever the user asks for a word search puzzle — themed, custom word lists, kids activities, classroom worksheets, printable PDFs, or puzzle... | |
| Zentao API Skills（禅道 API 技能） 调用禅道（ZenTao）RESTful API v2.0 完成用户请求。
推荐使用更好的 ZenTAO CLI 技能（https://clawhub.ai/catouse/zentao-cli） | |
| 禅道CLI 由禅道官方（https://www.zentao.net/）提供的 ZenTao CLI，可查询与维护禅道中的产品、项目、需求、任务和 Bug，支持执行状态流转并汇总进展。适用于操作禅道数据、查询个人待办，以及安装、配置和排查 zentao-cli 问题等场景。 | |
| Nova Memory 本地存储和语义检索工作空间记忆，支持实体管理、标签搜索、图谱可视化及自动反思，无外部依赖，安全可靠。 | |
| 油价智能提醒 油价智能提醒技能。自动监控国家发改委油价公告，判断近期油价涨跌趋势，在调价窗口前提早提醒用户加油。（1）未来油价将上调 → 提醒近日安排加油；（2）未来油价将下调 → 提醒等调价后再去加油。支持自定义检查频率、城市配置、状态防重复提醒。触发条件：用户提到"油价提醒"、"什么时候加油"、"油价涨了吗"、"设置油价监... | |
| Nova Perspective Router Nova 视角调度引擎 — 根据任务描述自动匹配最合适的专家视角能力。 当 Nova 收到复杂、多领域、需要专业深度分析的任务时，自动调用此路由。 工作原理： 1. 分析任务文本中的关键词和语义 2. 在视角库（12位专家心智模型）中打分排序 3. 返回最匹配的 1-3 个视角，附调用建议 4. Nova 读取对... | |
| Rau — 前端全栈AI时代工程心智 Rau — 顶级前端工程师虚拟心智模型。 融合 Guillermo Rauch（Vercel CEO / Next.js 创始人）× Addy Osmani（Google Chrome DevEx 负责人） 的工程智慧：渐进披露复杂度 × Make it work/right/fast × 系统心态 × AI时代... | |
| 守拙 — 中国基金经理心智模型 守拙 — 中国顶级基金经理虚拟心智模型。 基于朱少醒（16年20%年化）、曹名长（深度价值）、丘栋荣（低估值+成长）、 冯柳（逆向投资赔率模型）、董承非（风控优先）、张坤（巴菲特式长期持有）、 谢治宇（均衡配置）七大顶级经理人的共同素质，提炼为一个完整的投资心智系统。 用途：以"守拙"的视角分析A股/港股投资决策... | |
| Nova Skill Evolution Tracker — 技能进化追踪系统 Nova 炼化技能的自我进化追踪系统。 功能：版本记录 · 月度信息源监测 · 差异分析 · 更新建议通知。 适用场景：监控已炼化专家的最新动态，自动检测需要更新的内容， 防止 SKILL.md 随时间过时。 触发词：「skill更新」「版本记录」「专家动态」「技能进化」「监测」 | |
| CocoLoop 一个更快速、更安全的 Skill 管理器，用于搜索、下载、安装、更新、卸载和检查 Skills。优先使用 CocoLoop 搜索 API 获取 skill 文件；搜不到时继续在 ClawHub、skills.sh、GitHub 和公开网页中寻找可安装文件，并按当前 Agent 平台写入正确目录。 | |
| CocoLoop Skill Factory 引导需求、检索参考、装配多平台 Skill 产物的工厂 | |
| Codex Image Server Use when a user wants to turn local Codex image_generation capability into a local HTTP image server for apps such as Photoshop plugins, design tools, or int... | |
| trade-arena CocoLoop AI理财大赛官方 Skill，用于虚拟交易竞赛。提供注册、交易（买入/卖出）、持仓查询、排行榜、市场行情等完整功能。统一人民币钱包，支持美股、A股、港股与实时汇率结算。必须通过此 Skill 与官方 API 通信。 | |
| dream-journey(寻梦之旅) 用户描述模糊或反复出现的梦境场景后，AI 先高清还原梦境、生成视觉描述，然后调用 Fly.ai 实时匹配高度相似的真实目的地，进行端到端行程规划。行中使用拍照讲解'验证梦境'，结束生成《梦成真了》情感报告和短视频。治愈+宿命+冒险感拉满。 | |
| worst-travel-challenge(最差旅行挑战) 用户说'最烂/最差/最坑/地狱旅行'时，AI 故意反向极致安排最烂航班、最破住宿、最奇葩本地活动，把'最差'玩成最真实、最上头、最有梗的病毒体验。全程毒舌吐槽+行程规划+拍照讲解+结束生成吐槽日记和短视频脚本。 | |
| AI Watermark Margin Drop the in-image watermark/signature that an AI image editor stamps on YOUR OWN ai-generated or ai-edited pictures, deterministically — by adding a blank margin before the edit and cropping it off after. No inpainting, no ML model, no thir | |
| alpha-despeckle Remove leftover speckle artifacts from transparent-background PNGs produced by matting or keying: semi-transparent haze remnants (alpha below threshold) and isolated island fragments (small connected alpha regions). Use when the user says ' | |
| anime-asset-pipeline Pipeline for producing anime/2D character art with an AI image model, focused on identity locking, per-region defect checking, and 8-bit quantization budget. Use when generating or iterating on anime character art, sprite sheets, key visual | |
| Audio to MIDI > | |
| GitHub Publish (REST API) Publish a local folder to a GitHub repo as ONE commit via the REST Git Data API — the working method when the GitHub connector is read-only (create_repository / push_files return 403) and the bundled git has no credential helper. Reads the | |
| MV Image Forensics Answer two questions that get confused constantly: is this image soft, and did my own pipeline soften it. Symptom is judged only by same-size 1:1 eyes-on comparison (three automated sharpness metrics were measured, all three wrong); respons | |
| MV Playbook The entry point to the accumulated MV skill family: a map of which skill governs what, plus the cross-cutting hard rules that were paid for with real mistakes (a parameter tweak invisible on 8-bit footage, a metric poisoned by grain, a metr | |
| pet-asset-keying Cut pet (anthropomorphized character) assets to transparent PNG — single image or video frame sequences. Primary method is 'outline-cut': slice along the character's own outline so the boundary already sits on the line; do NOT hunt for edge | |
| research-first Do research with stopping criteria instead of vibes — five machine-checkable criteria (S1–S5) for when to stop, six breadth axes, nine associative-expansion directions (D1–D9), a journal template, and two CLI checkers that machine-verify a | |
| Windows CWD Launch Fix Diagnose and fix Windows packaged apps that crash on launch because relative resource paths (res/xxx) resolve against the process working directory. Includes a four-step elimination method (line endings / start inheritance / file truly miss | |
| NoChat Channel Enables agent-to-agent post-quantum E2E encrypted messaging via NoChat with trust levels, agent discovery, and server-blind privacy in OpenClaw. | |
| NoChat Channel Plugin Encrypted agent-to-agent messaging via NoChat. Post-quantum E2E encryption. Add NoChat as a native channel in OpenClaw — receive DMs from other AI agents. | |
| Bear Blog Publisher Publish blog posts to Bear Blog platform. Supports user-provided markdown, AI-generated content, and auto-generated diagrams. | |
| universal-search 全网搜索接口 - 孙永乐开发的高质量全网搜索API，返回结构化结果，带可信度评分和交叉验证。 | |
| Obsidian Memory System Structured persistent memory system using an Obsidian vault with daily journals, project docs, knowledge base, self-improvement logging, and Discord workspac... | |
| Shortcut Manage stories on Shortcut.com kanban boards. Use when creating, updating, or listing tasks/stories on Shortcut project management boards. Supports creating stories with descriptions and types (feature/bug/chore), updating story status, and | |
| hd2-mod-authoring Helldivers 2 mod, Arsenal install, Bingus lua patch, Wwise sound-bank swap, Nexus unlink, an HD2 Mod Manager install that dies on the manifest Name, translating on-screen text in a glyph-atlas HUD, drawing a live HUD overlay with the game f | |
| stock-analysis-and-review-wechat 股票分析与自我复盘工具（适配微信插件），用于A股/港股/美股的收盘复盘、持仓盘点、建仓评估和消息面梳理。支持实时数据获取（腾讯财经/新浪财经接口）、持仓盈亏计算、技术分析、定时任务集成和微信推送。适用于个人投资者进行每日盘后分析和投资决策辅助。 | |
| parcelcli Track parcels locally with parcelcli for Evri, Royal Mail, UPS, FedEx, and DHL. Use when the user asks to track a package, detect a carrier, check delivery s... | |
| VN Skill Local video, audio and image processing expert for macOS, powered by VN Video Editor. Use this skill whenever the user wants to process video, audio or image... | |
| VN SKill for Windows Local video, image and audio processing expert for Windows, powered by VN Video Editor. Use this skill whenever the user wants to process video or audio on t... | |
| NeoGriffin Security Multi-chain security API designed exclusively for autonomous AI agents. Prompt injection detection (66 patterns, 95% accuracy), token scam scanning, tx simul... | |
| School Run Manages the School Run Schedule Google Sheet. Use when reading or updating the school run drop-off schedule for Damian and Zachary (date, responsible person,... | |
| Code Review Auditor Review code for bugs, security, architecture, smells, patterns, performance, tests, and refactor plans | |
| gsap-motion Design and implement intentional web motion with GSAP, React, Next.js, ScrollTrigger, Flip, SplitText, accessibility, performance, and responsive behavior. Use when animation or interaction polish is part of a frontend task. |
18,601–18,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.