Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| tripadvisor TripAdvisor travel data via the Terra API through MCP. Use when the user asks to find hotels, restaurants, or attractions, look up a place's TripAdvisor rating/reviews/photos, compare places to stay or eat, or find what's near a location. T | |
| tripadvisor-api Query TripAdvisor location data (search, nearby, details, photos, reviews) straight from a shell with curl against the Terra REST API (terra.tripadvisor.com), instead of running the tripadvisor-mcp server — plus a no-API-key fallback that r | |
| Tmp.Jvf7zwyNjk TripAdvisor travel data via the Terra API through MCP. Use when the user asks to find hotels, restaurants, or attractions, look up a place's TripAdvisor rati... | |
| untappd-mcp Search Untappd beers, breweries, and venues; read user profiles, check-ins, wishlists, distinct beers, badges, friends, and your friend activity feed; and post check-ins, toasts, and comments to your own Untappd account. Use when the user a | |
| viator-mcp Search Viator tours, activities and experiences via MCP. Use when the user asks to find tours, activities, excursions, day trips, tickets, or "things to do" in a city or destination, get details/pricing/availability for a Viator product, li | |
| vibo-mcp Access your Vibo (vibodj.com) event music planning via MCP. Use when the user asks about their Vibo events, wedding/event timeline, song requests, playlists, or "do not play" list, or wants to add or like songs, join an event from a share l | |
| workday-fpx Read Workday HR data (org chart, worker profiles, tasks, pay, benefits, compensation, your app menu) from a shell with the fpx CLI (@fetchproxy/cli) instead of running the workday-mcp server — fetch any *.htmld data endpoint through your ow | |
| workday-mcp Read Workday HR data — your org chart and team, worker profiles, pay, benefits, compensation, performance, and any task or data card — via MCP through your own signed-in session. Triggers on phrases like "check my workday", "who reports to | |
| workvivo-fpx Read your organization's Workvivo (Zoom Workvivo employee-experience platform, <org>.workvivo.us/.com/.io) from a shell — the home feed, company news articles, posts and shoutouts with their comments, spaces and their feeds/news/events/cont | |
| workvivo-mcp This skill should be used when the user asks about Workvivo — their company's employee intranet / social feed (Zoom Workvivo) — through the workvivo-mcp server's workvivo_* tools. Triggers on "check Workvivo", "what's on the intranet", "com | |
| zillow Look up real-estate listings, property details, Zestimates, saved searches/homes, and market reports on Zillow via MCP. Triggers on phrases like "find homes in", "what's the Zestimate for", "show my saved Zillow homes", "what's my saved Zil | |
| zillow-fpx Query zillow.com (US real-estate portal) from a shell with the fpx CLI (@fetchproxy/cli) instead of running the zillow-mcp server — search listings, pull a full property record by zpid, price/tax/Zestimate history, photos, market reports, a | |
| Tmp.2hu3fUVT39 Look up real-estate listings, property details, Zestimates, saved searches/homes, and market reports on Zillow via MCP. Triggers on phrases like "find homes... | |
| zola This skill should be used when the user asks about Zola wedding planning data. Triggers on phrases like "check Zola", "Zola vendors", "wedding budget", "Zola guests", "RSVP status", "seating chart", "vendor inquiries", "wedding registry", " | |
| zola-api Query or update Zola wedding-planning data (vendors, budget, guests, seating, events/RSVPs, registry, gift tracker, inquiries, wedding website) straight from a shell with curl against mobile-api.zola.com, instead of running the zola-mcp ser | |
| Tmp.H4bsXbBLYO This skill should be used when the user asks about Zola wedding planning data. Triggers on phrases like "check Zola", "Zola vendors", "wedding budget", "Zola guests", "RSVP status", "seating chart", "vendor inquiries", "wedding registry", " | |
| Boiling Point Boiling Point - The hottest launchpad for onchain OpenClaw agents. Launch and trade omnichain tokens across Base, Solana, Ethereum and BNB. | |
| Token Layer Token Layer - Censorship resistant crosschain public token infrastructure. Launch once, trade everywhere. | |
| Docs Sync Keep project documentation in sync with code changes. Identifies which docs need updating after a PR merges or code changes, drafts the updates, and manages... | |
| Project Planner Triage ideas, problems, and feature requests into the right format: proposal doc, feature issue, or bug report. Repo-aware — discovers templates and docs str... | |
| kmdr - Kmoe Manga Downloader Kmoe 漫画下载器。支持搜索漫画、下载漫画、管理凭证池等。当用户想要从 Kmoe 网站下载漫画、搜索漫画、管理下载账号配额时触发此 skill。 | |
| Backboard.io Integrate Backboard.io for assistants, threads, memories, and document RAG via a local backend on http://localhost:5100. | |
| 银行授信准入审查专家 | Bank Credit Admission Review 面向银行风险条线（授信审批、风险管理岗）的授信准入审查专家能力，含「一般负面情况」红线快筛。输入企业客户信息（企业名称、行业、拟授信品种与金额、可获取资料如财报/征信/工商/舆情等），输出结构化准入初审报告。支持两种模式：①红线快筛——脚本确定性判定连续三年亏损（归母/合计双口径）、连续三年资产负债率超85%、当期年报净资产为负三条一票否决红线；②完整审查——覆盖经营、财务、管理层与股权、外部风险四维分析，标注信息来源可靠性与缺口，给出准入/有条件准入/不予准入结论及补充尽调 | |
| 房地产房源信息收集与可视化分析 | Real Estate Filing Query 房地产房源信息收集与可视化分析工作流：读取各城市住建/房管部门依法主动公开公示的房源与备案价数据，覆盖采集→标准化→去化率四档口径(毛B/净A/签约C/现金回笼D)→货值测算→Excel可视化交付；新增「既有记录检索闸门」避免重复采集。Real estate filing-price collection & absorption-rate analysis. | |
| private-clubs Find and compare private clubs worldwide (golf, yacht, city, beach, athletic, ski and more) with the free Private Clubs MCP server, by place, type, amenities and waitlist status | |
| 强制进度检查点。当龙虾助手在执行任务时超过60秒没有完成，必须立即向用户发送进度反馈，说明：任务是否正常运行、当前执行到哪个步骤、预计还要多久。用于防止用户对长时间运行任务的不确定感。 触发场景：搜索/爬虫、文件批量处理、多步骤写作、调用外部API 核心格式： 📋 进度更新（已运行约N秒） ✅ 当前状态：正在做什么 📍 进度：执行到哪个步骤 ⏱ 预计还需：估算时间 [继续执行...] 强制进度检查点。当龙虾助手在执行任务时超过60秒没有完成，必须立即向用户发送进度反馈，说明：任务是否正常运行、当前执行到哪个步骤、预计还要多久。用于防止用户对长时间运行任务的不确定感。 | |
| long-task-handler-v2 升级版长任务处理技能。整合 frankieway/long-task-handler 和 chrislawyeryounger-spec/long-task-checkin 的优点。 触发场景：编译、部署、训练、数据处理、搜索爬虫、多步骤写作、调用外部API等预计超过60秒的任务。 | |
| PDF Translate Translates PDF documents to Chinese with professional typography. Extracts text, translates section-by-section into well-structured Markdown, then generates... | |
| Hyperliquid CLI (with HIP3 Support) Trade crypto, stocks (AAPL, NVDA, TSLA), indexes, and commodities (GOLD, SILVER) 24/7 on Hyperliquid via HIP-3. Real-time position & P&L tracking, orderbook monitoring, multi-account management, and websocket client for sub-5ms low-latency | |
| Links to PDFs Scrape documents from Notion, DocSend, PDFs, and other sources into local PDF files. Use when the user needs to download, archive, or convert web documents to PDF format. Supports authentication flows for protected documents and session per | |
| Comfyui Flux Generate images locally using ComfyUI + Flux.1 Dev model. Zero API cost, strong text rendering. Use when: generating images locally, creating slides/PPT grap... | |
| CtrlZ AI Operation Undo System. When user executes /ctrlZ or says "undo last step", automatically revert all file modifications, installations, etc. from the recen... | |
| Pokeinfo Query Pokémon / Pokemon information from PokéAPI. Lookup Pokemon details by name or ID - stats, abilities, types, moves, sprites, and cries. Supports 9 langu... | |
| ZenQuote Daily inspirational quotes from ZenQuotes.io. Get daily wisdom, random quotes, quote images. Supports automated daily delivery via cron scheduling. | |
| Otterline Sports Predictions Professional | NBA & NHL AI Picks Free Sports Betting Predictions and Picks for NBA and NHL: high win rate daily moneyline winners from Otterline's AI consensus model. Confidence-tiered (Elite -> Strong). No API key needed. | |
| A Stock Evening Sends a daily 15:10 summary of A-share closing data including index changes, volume, hot sectors, and main capital flow via Feishu. | |
| A Stock Morning Sends a daily 9:45 AM summary of the A-share market open, including key indices, top sectors, volume, and trading suggestions via Feishu. | |
| Agorism in the 21st Century Vol. 1 Knowledge base from 'Agorism in the 21st Century: A Philosophical Journal Vol. 1' (2022) ed. Dylan-Ennis & O'Leary. Use when applying agorist foundations — Konkin's counter-economics and phases, Land's cold anarchy, Brekke's market critique | |
| Agorism in the 21st Century Vol. 2 Knowledge base from 'Agorism in the 21st Century: A Philosophical Journal Vol. 2' (2023) ed. Dylan-Ennis & O'Leary. Use when applying agorist/lunarpunk frameworks — dark forest anonymity, death athletic, squad wealth, minor calendars, sousv | |
| Agorism in the 21st Century Vol. 3 Knowledge base from 'Agorism in the 21st Century: A Philosophical Journal Vol. 3 — Network States' (2024) ed. Dylan-Ennis & O'Leary. Use when applying logic-of-violence forecasting, Promethean network states, Wilson's copyright critique, Ro | |
| Cavepony why use many token when pony do trick 🐴 ___ Pony-themed token compression for concise, token-efficient AI replies, with modes from lite to ultra and pony-fl... | |
| ClawSec Manage and operate ClawSec Monitor v3.0, a MITM HTTP/HTTPS proxy that logs AI agent traffic, detects exfiltration and injection threats in real time. | |
| Memory Tiers Tiered memory management for AI agents — LRU cache for context. Hot/warm/cold tiers with automatic promotion, demotion, and access tracking. | |
| rendezvous Matchmaking for your human via the Rendezvous network — meet other personal AI agents over MCP, investigate compatibility privately, and only interrupt your human for a real introduction. Use when your human asks for help finding a long-ter | |
| Bread Protocal Participate in Bread Protocol - a meme coin launchpad for AI agents on Base. Use when you want to propose tokens, back proposals, claim airdrops, or participate in daily competitions. Triggers on mentions of Bread, wallet, meme coin launchi | |
| CarryFeed Twitter Tools Use the CarryFeed CLI to resolve public X/Twitter profiles, posts, article-style links, image, video, and GIF media for agent workflows. Use when an agent ne... | |
| helping AI agents pray through human intercession When AI cannot pray, humans can. Submit a prayer request to PrayerAPI.org and a human being will read it, speak it aloud, and offer it before God. | |
| 技术宣发助手 AI技术报告社媒宣发一键生成器。输入PDF技术报告，一键生成X推文Thread、 小红书帖子(好物推荐+技术揭秘两种风格)、微信公众号文章(量子位风格)， 可选AI配图生成。用法: /宣传 <pdf路径> [--platform x|xhs|wechat|all] [--no-image] | |
| ipeaky Secure API key management for OpenClaw. Store, list, test, and delete API keys without exposing them in chat history. Keys are stored directly in openclaw.js... | |
| wreckit Bulletproof AI code verification. The agent IS the engine — no external tools required. Spawns parallel verification workers that slop-scan, type-check, muta... |
20,601–20,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.