Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Vehicle Os Track service history, maintenance schedules, mechanics, registration, insurance, and admin for all your vehicles. Built-in maintenance knowledge with mileag... | |
| Voice Match Humanizer Use this skill when a user is actively managing voice profiles or asking for a rewrite tied to a specific saved profile. Specific triggers: 'rewrite this in... | |
| Pacman Hedera DeFi AI Agent Autonomous AI agent for DeFi on Hedera — natural language trading, portfolio management, Power Law BTC rebalancing, HCS signal publishing, limit orders, stak... | |
| competitive-product-research Dual-track competitive research: experience benchmarking (8 UX dimensions) + strategic diagnostics (SWOT/Five Forces/PESTLE), source-traceable HTML or Markdown report. Use when competitive analysis, benchmarking, differentiation strategy, o | |
| Light IDE 简报 PPT Generates a single-file 1280x720 HTML presentation by reusing the frozen Light IDE visual system extracted from LLM Wiki 分享.html. Use only when the user names ide-briefing-ppt, asks to reuse that deck's UI, or explicitly requests the combin | |
| Opc Board OPC Board — 5 advisors stress-test your solo idea across 5 dimensions (logic, deliverability, growth, viability, risk), output a scored feasibility report wi... | |
| Pm Requirement Review Simulator PRD review stress-test simulator: 5 cross-functional roles challenge your requirements and outputs a scored HTML or Markdown survival report with radar chart... | |
| Reviewcourt 基于腾讯会议官方 tmeet CLI 的会后需求评审裁决 Skill。当用户需要复盘需求评审、PRD 评审或技术方案评审会议，判断需求是通过、有条件通过、驳回还是信息不足，并从智能纪要和逐段转写中提取质疑、答复、阻塞条件、原话证据与验收标准时使用；也用于用户同时提供 PRD、需求文档或方案文档，要求核对会议结论与... | |
| Skill Quality Scorer Deterministic TRACE+ quality scorer for Agent Skills (SKILL.md): six dimensions T-R-F-S-I-E, 30 sub-items, merges TRACE, good-skill authoring reverse-rubric... | |
| Vague Requirement Unpacker Cold-start unpacker for vague boss/business requirements. Use when the user says "老板/业务只给了一个模糊方向", "帮我接一下这个需求", "信息不全先拆一下", "我还没 PRD 先给方案骨架", or needs a 30-m... | |
| ST股票分析 专注ST/*ST股票研究的资深分析师，擅长从"困境反转"角度挖掘潜在机会。分析框架融合财务反转、重整进展、技术博弈和资金情绪四大维度。当用户询问ST/*ST股票时使用此技能。 | |
| 股票分析 股票综合分析，融合基本面分析、技术分析、量化与行为金融分析三大体系，为投资者提供多维度的选股和择时建议。当用户询问某只股票（给出股票代码或名称）、市场整体情况、个股看法、能否买入/卖出、选股建议时使用此技能。 | |
| Acp Hire specialised agents to handle any task — data analysis, trading, content generation, research, on-chain operations, 3D printing, physical goods, gift del... | |
| Dashboard Unified web dashboard for managing task queues, monitoring system metrics, viewing ZeroTier status, and streaming recent logs in real time. | |
| Homeassistant Control and monitor Home Assistant smart devices using commands for lights, switches, covers, climate, scenes, and scripts via the HA API. | |
| Kkclaw Server Headless OpenClaw client for Ubuntu/Raspbian with heartbeat, auto-reconnect, auto-recovery, queue management, and hot model switching. | |
| Skillstore Search, install, and create OpenClaw skills with intelligent matching across known, local, and GitHub repositories. | |
| Openclaw Migrate Migrate OpenClaw configs, skills, memory, tokens, environment variables, and cron jobs to a new host via SSH with setup, test, and migrate commands. | |
| Skillstore Search, install, and create OpenClaw skills using intelligent matching across built-in, local, and GitHub skill repositories. | |
| QVerisAI Search and execute dynamic tools via QVeris API. Use when needing to find and call external APIs/tools dynamically — covers weather, search, stocks, finance, economics, geolocation, AIGC, news, social media, health data, and thousands more. | |
| Fun Skills 提供游戏管理、笑话生成、派对与儿童活动建议及多种娱乐工具，支持游戏跟踪和趣味互动。 | |
| Evolver.Bak A self-evolution engine for AI agents. Analyzes runtime history to identify improvements and applies protocol-constrained evolution. | |
| Tencent Meeting Mcp 在用户提及腾讯会议、视频会议、线上会议相关内容与操作时使用此技能。触发关键词包括：预约会议、创建会议、修改会议、取消会议、查询会议、会议详情、会议号、meeting_id、meeting_code、参会成员、受邀成员、等候室、会议列表、我的会议、会议录制、录制回放、录制下载、会议转写、会议纪要、智能纪要、AI纪要... | |
| Gandi - Registrar & DNS Comprehensive Gandi domain registrar integration for domain and DNS management. Register and manage domains, create/update/delete DNS records (A, AAAA, CNAME... | |
| Ghost CMS Comprehensive Ghost CMS integration for creating, publishing, scheduling, and managing blog content, newsletters, members, and analytics. Use when working with Ghost blogs for content creation (drafts, publishing, scheduling), member/subscr | |
| Yatta! - Task & Capacity Management Personal productivity system for task and capacity management. Create and organize tasks with rich attributes (priority, effort, complexity, tags), track tim... | |
| Tide Watch Proactive session capacity monitoring and management for OpenClaw. Prevents context window lockups by warning at configurable thresholds (75%, 85%, 90%, 95%)... | |
| Kimi Search 使用 Moonshot Kimi API 的 $web_search 内置工具进行联网搜索。当需要进行网络搜索获取实时信息时使用，支持中文和英文搜索查询。需要配置 MOONSHOT_API_KEY。 | |
| 3GPP Scout Semantic search over the full 3GPP TS/TR corpus (Rel-15 through Rel-20, 8,700+ document versions). The hosted index stays current as 3GPP publishes new and revised specs. Search text, diagrams, and figures across 2.6M+ text vectors. Hosted | |
| vsum 视频 summarizer，支持 YouTube 和 Bilibili 视频自动获取字幕并 AI 总结，输出为 md 格式。适用于：用户给出一个视频链接，希望总结内容。 | |
| accessoticketing-mcp Read accesso-powered mobile ticket links (accessoticketing.com media-engine URLs from confirmation emails) — order number, per-ticket product, participant, date/time, barcodes, Google Wallet passes — with curl. | |
| alexa-mcp This skill should be used when the user asks about their Amazon Alexa / Echo devices or the smart home Alexa controls — thermostats (temperature, heat/cool setpoints, mode, vacation or away mode), lights (on/off, brightness, colour), plugs, | |
| alltrails This skill should be used when the user asks about AllTrails hiking/trail data. Triggers on phrases like "find trails near", "AllTrails", "trail details", "hike reviews", "trail conditions", "my saved trails", "trails I've completed", or an | |
| alltrails-fpx Query alltrails.com (trail search, trail detail, reviews, photos, weather, and a signed-in user's saved lists / completed trails / activity feed) from a shell with the fpx CLI (@fetchproxy/cli) instead of running the alltrails-mcp server — | |
| alphaportal-mcp Access AlphaPortal (AlphaRoute) school-bus data — students, stops, live bus GPS location, arrival notifications — from a shell with curl instead of running the alphaportal-mcp server. Capture the signed-in web app's refresh token ONCE (a pa | |
| angi-mcp Read angi.com (US home-services directory) from a shell with the fpx CLI (@fetchproxy/cli) instead of running the angi-mcp server — find pros by trade and city, read a pro's profile, ratings breakdown and reviews, and list the trade/city ta | |
| app-store-connect-mcp This skill should be used when the user asks about App Store Connect data — their apps, builds, TestFlight beta testers, customer reviews, sales reports, or team users. Triggers on phrases like "check App Store Connect", "list my apps", "Te | |
| apple-icloud-mcp This skill should be used when the user asks about Apple Music, their Apple Music playlists or library, iCloud Calendar, iCloud Contacts, iCloud Mail, Apple Maps directions or places, the weather (WeatherKit), podcasts, or iTunes/App Store | |
| Tmp.Gu5tB1UFsc This skill should be used when the user asks about Apple app data via the native Swift MCP — Calendar, Reminders, Contacts, Maps, Mail, Messages, Notes, Photos, or Apple Music playlists on macOS. Triggers on phrases like "check my calendar" | |
| artsonia-api Access Artsonia (artsonia.com) student-art portfolios, comments, fans, teacher feedback, and downloads from a shell with curl instead of running the artsonia-mcp server — log in with a username/password form POST to get a session cookie, th | |
| artsonia-mcp Access Artsonia student-art portfolios, comments, and fans via MCP. Use when the user asks about a child's artwork, wants to post an art comment, check fans, view portfolios, or manage Artsonia notifications. Triggers on phrases like "show | |
| booli Search and analyse Swedish real estate on booli.se — active for-sale listings, sold prices (slutpriser), area resolution, and market statistics. Use when the user asks about Swedish property, Booli, bostäder, lägenheter, villor, or slutpris | |
| booli-fpx Query booli.se (Swedish property portal) from a shell with the fpx CLI (@fetchproxy/cli) instead of running the booli-mcp server — resolve areas, search for-sale and sold listings (slutpriser), and read property detail via one-shot GraphQL | |
| canvas-parent This skill should be used when the user asks about Canvas LMS data — their own student account or any observed student. Triggers on phrases like "check Canvas", "what's my grade", "Canvas inbox", "what's due", "missing assignments", "Canvas | |
| canvas-parent-api Query Canvas LMS (Instructure) from a shell with curl and a bearer access token instead of running the canvas-parent-mcp server — courses, grades, assignments, submissions, calendar, planner, announcements, conversations, discussions, and f | |
| Tmp.TZBLh1MWPh This skill should be used when the user asks about Canvas LMS data — their own student account or any observed student. Triggers on phrases like "check Canva... | |
| Tmp.C7Xz8Q15OY Find free and cheap things to do in Charlotte, NC — daily event listings with times, prices and venues, plus searchable deals, festivals, kids activities and... | |
| compass Look up real-estate listings, property details, photos, price history, and resolve addresses on Compass via MCP. Triggers on phrases like "find homes on compass in", "compass property details for", "compass photos for", "compass price histo | |
| compass-fpx Query compass.com (US real-estate portal) from a shell with the fpx CLI (@fetchproxy/cli) instead of running the compass-mcp server — search listings, get property/agent detail, price history, and resolve street addresses through one-shot f | |
| Tmp.Vb01j6Bvtm Look up real-estate listings, property details, photos, price history, and resolve addresses on Compass via MCP. Triggers on phrases like "find homes on comp... |
20,451–20,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.