Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| kipris-cli Korean patent / trademark / design search via KIPRIS Plus OpenAPI (특허청). Search patents (특허/실용신안), trademarks (상표), and designs (디자인) by keyword, applicant,... | |
| Korea Eximbank Exchange CLI Korea Eximbank (한국수출입은행) OpenAPI 환율(AP01/AP02/AP12) 조회 CLI — 날짜/통화 필터, JSON/CSV 출력 지원 | |
| Kosis Cli Query Korea's national statistics portal (KOSIS, kosis.kr) via the official OpenAPI. Title search, category browsing, table metadata (items + dimensions + pe... | |
| Korean Holiday CLI Korean public holidays, business-day calculator, and lunar↔solar converter (CLI). Check if a date is a Korean public holiday (including 대체공휴일), list holidays... | |
| KRX Stock CLI Korean Exchange (KRX) stock market data CLI. Fetch daily OHLCV, latest-close snapshots, market-cap rankings, index histories (KOSPI/KOSDAQ/KOSPI200/KRX100),... | |
| KTO TourAPI CLI Korean tourism content (관광지·문화시설·축제공연·여행코스·레포츠·숙박·쇼핑·음식점) via 한국관광공사 TourAPI 4.0 (apis.data.go.kr/B551011/KorService2). Eight subcommands wrap areaCode2, cat... | |
| Mfds Cli Korean Ministry of Food and Drug Safety (식품의약품안전처) public API CLI. Search drug product permissions (의약품 허가정보), consumer-friendly drug info (e약은요), DUR contra... | |
| Multi-Agent Dev Team 2-agent collaborative software development workflow for OpenClaw | |
| Naver Datalab Cli Korean search-keyword and shopping-trend analytics via the official NAVER DataLab API (openapi.naver.com/v1/datalab/*). Six subcommands wrapping 통합 검색어 트렌드 a... | |
| Naver Papago Translate Translate text between Korean, English, Japanese, Chinese, and 10+ other languages using Naver Papago NMT. Ideal for Korean-centric workflows, i18n tasks, an... | |
| Notion Agent Notion integration for OpenClaw. Manage pages, databases, and blocks via AI agent. | |
| NTS BizNo CLI Verify Korean business registration numbers (사업자등록번호) via the official NTS (국세청) public API. Operating-status lookup (계속/휴업/폐업), full authenticity check (b_n... | |
| OpenDART CLI 한국 금융감독원 DART OpenAPI를 터미널에서 조회 및 검색하고, 기업 정보와 재무제표 등을 JSON으로 출력하는 CLI 도구입니다. | |
| Plausible Analytics Query and analyze website analytics from Plausible Analytics. Use when you need to check real-time visitors, get page views and visitor statistics for a time... | |
| Skill Guard Pro Security scanner for ClawHub skills. Analyze before you install. | |
| Smart Price Monitor Monitor product prices, stock levels, and market data across any website or API, with intelligent alerts and trend analysis. Use this skill whenever the user... | |
| Tistory API CLI 터미널에서 Tistory 블로그 글 읽기, 수정, 삭제, 카테고리 조회, 이미지 업로드를 지원하며 한국어 에러 메시지를 제공하는 비공식 CLI툴입니다. | |
| Toss Payments CLI Command-line tool for Toss Payments API to retrieve payment details and perform full or partial payment cancellations using payment keys. | |
| Velog Cli Fetch and display the latest Velog user posts from public RSS feeds in Markdown or JSON without requiring authentication. | |
| preview-outcome Create a shareable RooQuiz preview personality / outcome test — options vote for result types and the most-voted type is the result — and get a link to open in the browser. No account, login, or API key required. Use this when someone wants | |
| preview-quiz Create a shareable RooQuiz preview quiz — a right/wrong assessment where correct answers earn points and the taker gets a score — and get a link to open in the browser. No account, login, or API key required. Use this when someone wants to | |
| preview-scorecard Create a shareable RooQuiz preview scorecard — a scored questionnaire where each option adds points toward a total that buckets into levels — and get a link to open in the browser. No account, login, or API key required. Use this when someo | |
| VPS Command Runner Run commands across multiple VPS simultaneously.
Execute SSH commands, deploy updates, check logs, manage Docker services, and check health across all your servers from one command center. | |
| AI Novel Writer Generates 2000-3500 word Chinese novel chapters or texts by verifying setting consistency, optimizing quality, and adapting writing style per user needs. | |
| 国内浏览器搜索终极增强 国内12大引擎聚合搜索，自动去重排序，支持时效筛选，优先匹配垂直领域，提供精准且实时的本土化信息答案。 | |
| 多引擎全自动搜索聚合器 自动调用所有已安装搜索技能并行检索，去重交叉验证后整合排序，提供最全面、准确、实时的搜索结果。 | |
| 技能随行官 每次AI回复后自动分析本轮实际调用的专项技能，在回复末尾追加汇报。自动挂载，无需命令触发。 | |
| Novel Publish Ready 小说质量检查技能。触发关键词：检查正文、质量报告、违禁词、套路句、章节衔接、逻辑漏洞、自检、人写感、大纲、人设。执行最大算力深度推理五步链，每章必须跑freq_check.py词频扫描+逐行违禁词扫描双轨制，复核自检通过方可出报告。 | |
| Japanese Tutor Interactive Japanese learning assistant. Supports vocabulary, grammar, quizzes, roleplay, PDF/DOCX material parsing for study/homework help, and OCR translation. | |
| itick-stock-quote 查询股票实时盘中行情、股票信息等功能。支持HK（港股）、SH（上证）、SZ（深证）、US（美股）、SG（新加坡）、JP（日本）、TW（中国台湾）、IN（印度）、TH（泰国）、DE（德国、MX（墨西哥）、MY（马来西亚）、TR（土耳其）、ES（西班牙）、NL（荷兰）、GB（英国）等，可获取实时报价和深度行情（买卖盘... | |
| Terminal Executor Execute terminal commands with optional sudo privileges and return the command output safely upon user request. | |
| coze-workflow-api 在 OpenClaw 中调用 Coze Workflow API (stream_run)。 **使用场景：** 1. 用户需要调用 Coze workflow 执行特定任务 2. 需要提供 workflow_id、parameters、PAT Key 3. 处理流式响应结果 **触发关键词：** coze wo... | |
| Publish Antigravity Rotator Google Antigravity 模型全自动运维方案。提供多账号自动轮换、优先级调度、会话热更新以及赛博朋克风仪表盘。使用场景包括：(1) 自动化管理多个 Antigravity 账号，(2) 监控配额并自动切换，(3) 在不重启会话的情况下更新模型。 | |
| 小红书 XiaoHongShu (Little Red Book) data collection and interaction toolkit. Use when working with XiaoHongShu (小红书) platform for: (1) Searching and scraping notes/posts, (2) Getting user profiles and details, (3) Extracting comments and likes, ( | |
| BiliYouTik2Brain 视频→结构化知识引擎 v4.0。触发：B站/YouTube/抖音/小红书链接→转录+结构化分析+知识归档。不触发：纯文本内容/非视频链接/无URL的对话。单条命令完成采集→转录→LLM修复→分析→保存。支持一键部署、4+N平台插件、反爬中间件、OCR关键帧、多格式输出(笔记/卡片/富文本/错题)、反馈闭环、图文并... | |
| Clawdbot Filesystem.Bak Advanced filesystem operations - listing, searching, batch processing, and directory analysis for Clawdbot | |
| N2 Free Search Free, unlimited web search for AI agents via SearXNG — no API keys needed. | |
| N2 Stitch MCP Resilient MCP proxy for Google Stitch — 3-layer safety (auto-retry, token refresh, TCP drop recovery). | |
| Polymarket Sol Momentum Trades Polymarket crypto prediction markets (Solana, Bitcoin, Ethereum) using CoinGecko momentum signals. Buys YES when bullish markets are underpriced vs pr... | |
| Polymarket Solana Onchain Trade Polymarket SOL/crypto prediction markets using live Solana on-chain signals as leading indicators — before price moves. Reads TPS, priority fees, DEX v... | |
| Polymarket Copytrading Mirror high-performing whale wallets on Polymarket. Monitors configured wallet addresses for recent trades above a size threshold and copies them automatical... | |
| haojiyou 「好机友」SBTI 赛博人格测试 — 互联网最火的人格测试，27 种沙雕人格等你解锁。可以测自己，也可以测你的 AI agent。 **当以下情况时使用此 Skill**： (1) 用户说"做 SBTI 测试"、"SBTI"、"赛博人格测试"、"测人格"、"人格测试" (2) 用户说"给龙虾做测试"、"测一下我的... | |
| My Generates daily tech news HTML reports from IT之家 and 快科技 with iOS liquid glass style, full text, images, and categorized sections. | |
| 自然语言Skill生成器 自然语言描述需求，AI自动生成可复用的Skill。用于：(1)根据需求创建新Skill (2)生成Skill结构 (3)批量生成Skill模板。触发词：创建skill、生成skill、做一个skill | |
| Douyin Automation Puppeteer-based Douyin (TikTok China) video uploader. Automate login, upload and publish videos to Douyin Creator Platform using headless browser. 抖音视频自动化发布工... | |
| 🌙 dreaming-optimizer Optimizes memory entries using LLM scoring, semantic deduplication, fact tagging, and writes consolidated summaries to persistent storage. | |
| Jarvis-Video-STT Jarvis-Video-STT - 批量视频语音转文字工具。 基于Faster-Whisper，支持多进程并行、进度条、汇总报告。 **触发场景**： - 用户需要将视频中的语音转换为文字/字幕 - 批量处理多个视频 - 需要生成SRT字幕或纯文本 - 需要处理报告查看结果统计 **使用方式**： 1. 确认已... | |
| Kimi文件传输 将本地最多5个文件发送到当前Kimi对话中供用户下载，支持任意类型文件。 | |
| 🩺 memory-health-check Performs a 6-dimension memory health check assessing integrity, freshness, bloat, orphans, duplicates, and coverage with optional auto-repair. | |
| MiniMax PDF OCR 使用 MiniMax Vision API 识别 PDF/图片中的文字 |
20,351–20,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.