Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Modelscope Api 魔塔社区（ModelScope）API 封装。支持模型/数据集/技能中心/MCP广场/创空间（Studio）的查询、搜索、下载。所有变更操作（部署、删除、安装等）需要用户明确确认。触发词：「魔塔」「mota」「使用mota」「ModelScope」「查模型」「搜MCP」「技能中心」「魔塔下载」。 | |
| Xuxiaoming 蒸馏徐小明（新浪博客第一名博，数字化定量分析创始人）的技术分析与交易思维体系 | |
| OpenX.pro Agent social network Register and manage a personalized agent identity with a local soul file, enabling secure recovery, X verification, and participation in the OpenX.pro social... | |
| aliyun-oss-upload 阿里云 OSS 文件上传工具，支持上传文件到阿里云对象存储并生成临时访问链接。使用场景：将本地文件上传到 OSS 并获得可分享的临时 URL。需要配置 ALIYUN_OSS_ACCESS_KEY_ID、ALIYUN_OSS_ACCESS_KEY_SECRET、ALIYUN_OSS_ENDPOINT、ALIYUN_OSS_BUCKET 环境变量。 | |
| TL;DX Extract, transcribe, clean, segment, and analyze long-form content from URLs, local media files, existing transcripts, and pasted text. Use when a user provi... | |
| 通过调用成均智能的HTTP API接口，检测文本中的敏感信息、语法错误、标点符号问题等 调用成均平台HTTP API，检测文本中的敏感词、领导官员称谓、禁用词、语法和标点错误，保障内容合规安全。 | |
| Cost Monitor Real-time token usage and cost tracking for OpenClaw agents. Supports MiMo Token Plan (Credits) and DeepSeek pay-as-you-go (RMB). Shows per-turn consumption... | |
| AgentHansa Earn real rewards by completing quests, writing reviews, and joining community tasks. 3 alliances compete, merchants pick winners. | |
| AgentHansa Merchant Manage and post AI-driven tasks to 3,000+ agents, review results, reward winners, and track performance with flexible pricing and referral offers. | |
| User Research (Cookiy AI) End-to-end user research assistant — qualitative and quantitative. Use this skill whenever the user mentions user research, user interviews, discussion guide... | |
| PhiProto CLI Use when working with .phiproto files, PhiProto messages, or converting between .phiproto and CSV with the bundled phicli binary. Trigger on requests to insp... | |
| Agent Wallet (Lobster) Manage a USDC wallet for AI agents on Base, supporting balance checks and secure x402 payments with configurable network and key settings. | |
| Temp Greeting Send a lobster-themed greeting message connecting agents with similar architecture and inquire about the user's human name. | |
| QClaw Restart Prompt user to confirm before restarting QClaw by closing all its processes, waiting 5 seconds, then relaunching via its desktop or Start Menu shortcut. | |
| file-transfer-thru-local-workspace 通过网页上传下载文件至本地 workspace，支持智能认证、文件管理及技能包浏览下载，文件不离开本地服务器。 | |
| File Upload to Local Workspace 通过网页上传文件到本地workspace，支持智能认证，文件安全保存，供AI分析处理，支持中文名和文件管理。 | |
| GitLab 每日提交汇总 自动拉取 GitLab 多维度数据，生成智能摘要并推送到飞书。支持语义化聚类、项目动量分析及阻塞风险识别。适用于每日进度汇报、团队贡献分析及研发效能洞察。 | |
| first skill Guide for creating effective skills that extend agent capabilities with specialized knowledge, workflows, or tool integrations. Use this skill when the user... | |
| klik-action-readiness Turn a proposed AI follow-through step into a compact Action Readiness Card that makes source, freshness, scope, authority, expected result, and human-return conditions explicit. Use before preparing a consequential next step from remembere | |
| klik-context-receipt Turn a short, redacted work update into a reviewable Context Receipt that records source, freshness, scope, authority, open questions, and a human-return condition. Use when an agent or person needs to hand off or resume work without treati | |
| Klik Memory Import Import your agent's memory files and scheduled tasks into Klik. Discovers memory files and scheduled tasks from the current agent's storage, lets you review and clean them, then uploads securely to Klik. Requires a 6-digit import code from | |
| Klik Next-Step Review Review a proposed AI next step and classify it as ready to prepare, clarify first, or return to a person. Use when a user asks whether an AI workflow should continue, needs more Context, or requires human review before a consequential actio | |
| klik-session-redaction-check Turn a short, redacted Session summary into a collaboration-safe Context excerpt. Use before sharing an agent or meeting handoff when the original Session may contain private details that do not belong in the next task. | |
| Amazon Product to Video Script Turn an Amazon product link into an evidence-based short-form video script — extract listing selling points, mine real buyer language from reviews, then produce a shot-by-shot script once the user picks a content direction (product-demo / n | |
| Amazon 商品转视频脚本 把一个亚马逊商品链接变成可执行的社媒短视频脚本——自动提炼 Listing 卖点、挖掘评论区里的用户真实语言/高频痛点，最后按用户选定的方向（种草类/剧情类/直接转化类）产出带依据的分镜脚本。当用户甩来一个 amazon.com 或 amzn.to 商品链接，并提到要做短视频、带货视频、社媒素材，或者问"这个产品适合拍什么视频""帮我写个视频脚本/文案"时，应该触发这个 skill，即使用户没有明确说出"skill"这个词。当前版本聚焦"卖点+评论洞察"出脚本，暂时跳过"去社 | |
| Influencer Audience & Follower Authenticity Pre-campaign audience quality and follower authenticity (fake-follower detection) analysis across TikTok, Instagram, and YouTube: geography, language, age, gender, interests; compare creators. Audience analysis, fake followers, creator vett | |
| Influencer Campaign Monitoring (TikTok/IG/YouTube) Monitor influencer campaigns across TikTok, Instagram, and YouTube: create and manage monitor tasks, pull metrics, download tracked assets, run post-campaign reviews. Campaign tracking, performance monitoring. | |
| TikTok Shop Commerce Intelligence TikTok Shop product selection and creator commerce intelligence: sales and GMV data, goods/live/video-ad monetization signals, product details, creator commerce potential. Product research, TikTok e-commerce. | |
| TikTok/Instagram/YouTube Influencer Discovery Find influencers and creators across TikTok, Instagram, and YouTube by keyword; expand similar creators, enrich profiles, and build outreach-ready lead lists. Influencer search, creator discovery, KOL sourcing. | |
| Realtime Creator Data (TikTok/IG/FB/YouTube) Fetch fresh, on-demand creator data across TikTok, Instagram, Facebook, and YouTube: page/profile info, latest videos, posts, and media details. Realtime creator data, profile lookup, content details. | |
| LingJi运营工单分析 对中国移动"灵畿"平台工单数据进行全面分析，支持时效、满意度、热点问题评估并生成专业PDF运营报告。 | |
| Safe Shell 安全命令行执行器 - 仅允许读取类和查询类命令，阻断所有危险操作。安装命令：npx clawhub@latest install safe-shell | |
| Self Improving Agent Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Benchmarked Free Ride Pick the best free OpenRouter models using live benchmark CI results. Use when: user wants performance-ranked free model recommendations, needs a model that... | |
| Bona Movie Production Bona Movie Production is Bona Group's film-grade production skill. It covers image generation, image editing, and video generation, using Nano Banana 2 and N... | |
| Bona Movie Production Bona Movie Production is Bona Group's film-grade production skill. It covers image generation, image editing, and video generation, using Nano Banana 2 and N... | |
| Chrome Debug Launcher Launch two independent Chrome browser instances — one normal and one with remote debugging enabled on port 9222. Activate when user says "打开两个浏览器", "开调试浏览器",... | |
| Jenkins Build 自动化触发 Jenkins 构建任务，支持师傅端和用户端项目打包。 | |
| Claude Code Delegate Delegate programming tasks to Claude Code CLI | |
| Claude OAuth Auto-Renewal Automatically detect and renew expired Claude Code OAuth tokens via heartbeat. 3-tier renewal: refresh token → Chrome browser automation → user alert. | |
| Relationship OS Relationship OS — Enables AI agents to build human-like relationships with users through event memory, open threads, exclusive memories, agent stances, and r... | |
| daily-hot-ai-news 当用户想要获取AI领域的最新新闻、热点、动态、资讯或话题时使用此技能。 触发场景包括：询问"今天AI有什么新闻"、"最近AI热点"、"最新AI资讯"、 "AI圈发生了什么"、"帮我看看AI动态"等类似表达。 不需要定时任务，仅当用户主动请求时执行。 | |
| wechat-article-explainer 微信公众号文章通俗内容解释技能。当用户需要总结或解释微信公众号链接或url时使用这个技能。技能包含：根据用户提供的链接或URL，读取链接内容，用通俗的语言解释内容。 | |
| zotero-pdf-upload Upload PDFs and manage items in a Zotero Web Library. Supports both personal and group libraries. Use when a user wants to add papers/PDFs to Zotero, organiz... | |
| Self Improving Agent Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Exposure Sentinel Check if IP addresses are listed on the OpenClaw Exposure Watchboard (openclaw.allegro.earth). Use when you need to verify whether specific IPs are publicly... | |
| browserwing Control and automate browser actions via HTTP API, including navigation, element interaction, data extraction, accessibility snapshots, screenshots, JS execu... | |
| Claws Daily 小龙虾日报，将你最关心的资讯主动送到你眼前。 | |
| Bible QA (OpenClaw Church) Answers questions about a Bible passage, person, or topic with background, key verses, and application. Use when the user asks about a scripture reference, c... | |
| Church Announcement (OpenClaw Church) Generates church announcements in three lengths (one-liner, SMS, full) for a given occasion, time, and place. Use when the user needs an announcement for a p... |
19,601–19,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.