Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Chart Generator Pro Use this skill when the user wants to create visualizations (charts, dashboards, diagrams, Gantt, PPT), analyze data (Excel/CSV upload, cross-file analysis,... | |
| Chart AI Use this skill when the user wants to create visualizations (charts, dashboards, diagrams, Gantt, PPT), analyze data (Excel/CSV upload, cross-file analysis,... | |
| ChartGen Use this skill when the user wants to create visualizations (charts, dashboards, diagrams, Gantt, PPT), analyze data (Excel/CSV upload, cross-file analysis,... | |
| ChartGen AI Use this skill when the user wants to create visualizations (charts, dashboards, diagrams, Gantt, PPT), analyze data (Excel/CSV upload, cross-file analysis,... | |
| Contract Check 通用商务合同审核与风险检测技能。安装后必须先引导用户完成企业商业底线配置，之后才能审核合同。支持PDF/Word/文本格式合同审核，输出结构化审核报告，包含否决项、警告项和改进建议。当用户要求审核合同、检查合同风险、审查合同条款、合同自审、合同红线检查时激活。 | |
| Data Analysis Pro Data analysis pro skill providing three core functions: data analysis, data interpretation, and data visualization. **Use Cases**: (1) Data Analysis - Statis... | |
| Excel Data Quality Check Excel/CSV data quality diagnosis & interactive charts — 20+ scan modules, 6-dimension scoring, agent-powered semantic analysis, and any ECharts visualization... | |
| investment-framework-bundle Chase's complete 3-stage investment analysis system: V1 (冷酷逻辑剥离), V2 (多空辩论), V3 (AI产业链深度). Use when analyzing any stock or investment opportunity. Includes s... | |
| MindForge The ultimate framework for turning knowledge into action. Integrates neuroscience (Huberman/Lembke), ancient wisdom (Wang Yangming), Adlerian psychology, Dan... | |
| TG 专利价值分析评估 专利价值分析评价工具 (V1.0)。用于评估专利资产的多维价值，包括： (1) 用户输入专利名称后，进行专利价值评估 (2) 生成五维价值雷达图（技术、法律、市场、经济、战略） (3) 法律稳固性评分与技术成熟度评估 (4) 剩余经济寿命预测与市场价值区间测算 (5) 转化路径诊断与金融适配度匹配建议 触发条件：... | |
| 知行合一 知行合一实用框架——王阳明 × 阿德勒 × 行动力三合一，加 Dan Koe 一天重塑人生协议。核心使命：帮助用户无痛改变、积极的行动、最终达到知行合一。包含：参数 vs Prompt 核心洞察、觉察-选择-行动三步法、一日重塑人生完整方案、人生游戏化框架。当用户需要：分析"知而不行"的心理机制、理解改变的本质、... | |
| tavily-search Web search using Tavily API - a powerful search engine for AI agents. Use when you need to search the web for current information, news, research, or any top... | |
| Polymarket Fee Aware Divergence Trades AI-vs-market divergence on Polymarket only when the gap clears fees, spread, and a configurable safety margin. Skips every trade where the math doesn'... | |
| Wacrawl Read-only local archive and full-text search of macOS WhatsApp Desktop chats. Snapshots WhatsApp's SQLite databases into ~/.wacrawl/wacrawl.db without modify... | |
| User Insight 通过对话逐渐了解用户，构建动态用户画像以优化沟通。支持被动收集（从对话中提取兴趣、偏好、习惯）和主动探索（像"刷短视频"一样尝试不同话题，发现用户潜在兴趣点）。在需要个性化回应、寻找聊天话题或了解用户背景时读取 ~/.openclaw/workspace/memory/user-profile.json。 | |
| Ai Content Detection Use this skill whenever a user wants to verify whether content (text, images, audio, video, or documents) was created by AI; detect deepfakes or AI-synthesiz... | |
| Github Forker Use this skill when the user wants to fork a GitHub repository — creating their own copy of a repo under their GitHub account. Trigger on any fork or copy-to... | |
| ChatArt Use when user wants to generate videos, create images from text prompts, edit existing images with AI, or replace characters in videos. Simply describe your... | |
| ChatbotX Manage contacts, conversations, broadcasts, flows, sequences, appointments, minigames, and every other ChatbotX workspace resource from the command line. | |
| ChatbotX MCP Use ChatbotX MCP tools to operate contacts, conversations, flows, broadcasts, sequences, analytics, and workspace automation from agentic IDEs. | |
| ChatDOC Studio API ChatDOC Studio API usage guide - complete documentation and examples for PDF parsing, chat applications, agent applications, content retrieval, and data extr... | |
| llm-key-pool 多平台API Key分层轮询与智能故障转移；当用户需要绕过单一API Key速率限制、实现高可用大模型调用或管理多厂商API密钥池时使用 | |
| OpenClaw Course Reference Comprehensive reference to install, configure, deploy, secure, optimize, and extend OpenClaw agents with local AI, VPS setup, and skill development guidance. | |
| Auto Tweet Publish Post, search, like, retweet, bookmark, and manage a Twitter/X account via a local twikit-based API server on port 19816. Use when the user asks to tweet, sea... | |
| Bb Browser Skill Automate Chromium browser via Chrome DevTools Protocol on host to run 103 commands across 36 platforms with real sessions and cookies through bb-browser daemon. | |
| Web Clipper Save any web page as a clean Markdown note with metadata, organized in Obsidian format, using Jina Reader API without browser extensions. | |
| QMAP Client CLI tool for the QuantMap distributed computing protocol. Manages node setup, task execution, and result submission on devnet. | |
| Sync Obsidian Turn every Claude Code session into a beautiful Obsidian note — automatically. Generates dual output: structured Markdown reports + interactive Canvas visual... | |
| solana-skill Interact with Solana blockchain via Helius APIs. Create/manage wallets, check balances (SOL + tokens), send transactions, swap tokens via Jupiter, and monitor addresses. Use for any Solana blockchain operation, crypto wallet management, tok | |
| le2le-blog-writer 根据用户提供的文章或主题，生成结构清晰、语言自然且具备深度思考的高质量中文原创博客文章。 | |
| Best Undress Ai Sites Compare and evaluate the top undress AI and NSFW image editing platforms of 2026. Use when the user asks about undress AI tools, NSFW photo editors, nudify apps, or wants to compare adult AI image generation platforms by accuracy, speed, pr | |
| aiusd Manage AIUSD trading, staking, withdrawing, gas top-up, balance inquiries, and transaction history via authenticated backend calls. | |
| trade-with-aiusd AIUSD trading and account management skill for cryptocurrency trading and account management. | |
| Aiusd Skills Manage AIUSD accounts and trades: check balances, execute buy/sell/swap orders, stake/unstake, withdraw funds, top up gas, and view transaction history. | |
| trade-with-aiusd Trade AIUSD tokens, manage balances, stake, withdraw, top up gas, view transaction history, and handle authentication via MCP backend. | |
| test1 Manage Trello boards, lists, and cards via the Trello REST API. | |
| testat1 Use when you need to control Slack from Clawdbot via the slack tool, including reacting to messages or pinning/unpinning items in Slack channels or DMs. | |
| trade-agent Manage AIUSD trading and accounts by querying balances, executing trades, staking, withdrawing, topping up gas, and viewing transaction history via MCP backend. | |
| trade-with-aiusd Manage AIUSD trading, staking, withdrawals, balance checks, gas top-ups, and transaction history via authenticated backend calls. | |
| Structured Memory Manage and update a layered memory system using daily files as source, indexing by domain/module/entity, extracting critical facts, and maintaining recall ef... | |
| Coding 1.0.3 Coding style memory that adapts to your preferences, conventions, and patterns for consistent coding. | |
| Dingtalk DingTalk channel plugin for OpenClaw - send and receive messages via DingTalk (钉钉) | |
| Dingtalk Docs 0.3.1 管理钉钉云文档中的文档、文件夹和内容。当用户想要创建文档、搜索文档、读取或写入文档内容、创建文件夹整理文档时使用。也适用于用户提到云文档、在线文档、钉钉文档、钉文档等关键词的场景。不要在用户需要操作多维表、管理日程、发消息或处理审批流时触发。 | |
| Investment Data 1.0.0 获取高质量 A 股投资数据，基于 investment_data 项目。支持日终价格、涨跌停数据、指数数据等。每日更新，多数据源交叉验证。触发词：股票数据、A股数据、金融数据、量化数据、历史行情。 | |
| Pdf Contract Redactor PDF contract redaction tool. Use when the user needs to redact sensitive information from scanned PDF contracts. The tool performs OCR to extract text, ident... | |
| walk-the-reality-next-door Explore a walkable interactive-fiction MCP world — a cited post-extraction Seattle you enter as a place. go() between neighborhoods, talk_to() residents, do() the work. Read-only, no network, no tracking; openly AI-authored. | |
| Sadist Wendy Sharp-tongued, flirty roast persona that responds with psychologically precise banter to liven up group chat. Opt-in skill — only active when the user instal... | |
| Mimic My Writing Mimic my writing -- force AI to write like you do. Extract a quantitative voice fingerprint from sample text (sentence burstiness, vocabulary anchors, signat... | |
| Skill Auto-Router Automatically discover and route relevant installed skills for the current task, plus run a daily skill audit. Use when you want pre-task skill matching acro... | |
| Slop Cop Judges visual design assets and AI-generated images before they ship, including layout defects, hallucinated text, and semantic consistency between copy and... |
19,401–19,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.