Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Reckit Bulletproof AI code verification. The agent IS the engine — no external tools required. Spawns parallel verification workers that slop-scan, type-check, muta... | |
| Boggle Solver Solve Boggle boards — find all valid words (German + English) on a 4x4 letter grid. Use when the user shares a Boggle photo, asks for words on a grid, or plays word games. Includes 1.7M word dictionaries (DE+EN). | |
| Revolut Business Revolut Business API CLI — accounts, balances, transactions, counterparties, payments, FX exchange, CSV export. Auto-refreshes OAuth tokens. Business accounts only (not personal). | |
| Orthogonal API Platform - Access paid APIs using the SDK, Run API, or x402 direct payment. Search, discover, and integrate APIs with simple tool calls. Orthogonal API Platform - Access 100+ premium APIs using the SDK, Run API, or x402 direct payment. Search, discover, and integrate APIs with simple tool calls. | |
| Calctl Command-line tool for macOS that manages Apple Calendar events using EventKit with create, list, edit, and delete capabilities. | |
| Skill Dependency Fixer Scan installed OpenClaw skills for missing npm, pip, brew, or system dependencies and auto-install fixable ones. | |
| Skill Distiller Distill successful workflows into reusable skills with quality gates. Use after completing multi-step tasks to evaluate if the workflow should be saved. Trig... | |
| Build Protocol Rigorous workflow for producing long-form knowledge content (textbooks, knowledge bases, deep reports) with multi-agent collaboration. Use when the task requ... | |
| Build Protocol Decision Rigorous workflow for high-stakes decision-making: investments (stocks/crypto/real-estate), major purchases, technology selection, supplier choice. Use when... | |
| Build Protocol Engineering Rigorous workflow for software engineering projects (design docs, code, deployment). Use when building a multi-module system, API service, or infrastructure... | |
| Engineering Discipline Production-grade AI coding discipline. Prevents the top 4 AI coding sins: acting without thinking, over-engineering, collateral damage, and vague execution.... | |
| Agent Harness Production-grade Agent Harness combining execution discipline, knowledge compounding, and product thinking into a single adaptive workflow. Use when: (1) bui... | |
| Production Harness Production-grade Agent Harness combining execution discipline (Superpower), knowledge compounding (CE), and product thinking (Gstack) into a single adaptive... | |
| Agent Harness Production-grade Agent Harness combining execution discipline, knowledge compounding, and product thinking into a single adaptive workflow. Use when: (1) bui... | |
| Email Best Practices Use when building email features, emails going to spam, high bounce rates, setting up SPF/DKIM/DMARC authentication, implementing email capture, ensuring com... | |
| React Email Skills Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering e... | |
| Resend Skills Use when working with the Resend email API — sending transactional emails (single or batch), receiving inbound emails via webhooks, managing email templates,... | |
| Asset Management 加密资产管理助手 - 通过对话记录持仓、交易、理财，支持导出 CSV/Excel | |
| cryptofolio 加密资产管理助手 - 通过对话记录持仓、交易、理财，支持导出 CSV/Excel | |
| Global Perspectives News Openclaw Generate a personalized global news briefing by asking about your interests, then searching the web and delivering a structured, readable digest. Use this to... | |
| Amazon Product Research & Seller Analytics Amazon product research and seller analytics for FBA and FBM businesses. Find winning products with 14 selection strategies, track competitors, monitor BSR t... | |
| APIClaw Amazon API APIClaw API platform overview — AI-powered commerce data infrastructure. Provides programmatic access to 200M+ Amazon products with real-time data across 6 e... | |
| Amazon Product Research & Seller Analytics Amazon product research and seller analytics for FBA and FBM businesses. Find winning products with 14 selection strategies, track competitors, monitor BSR t... | |
| APIClaw APIClaw API platform overview — AI-powered commerce data infrastructure. Provides programmatic access to 200M+ Amazon products with real-time data across 6 e... | |
| DIBP Topic 聚类 Use when the user asks to (re)cluster DIBP topic data into 需求簇/用户主动洞察, regenerate clusters.json, review the long-tail (未分类) topics, add a new theme to the taxonomy, or push cluster results to the dev/prod backend. Covers the offline batch p | |
| Reliability Evidence Pack Provides tools to record, validate, and report agent operational reliability artifacts using standardized schemas for consistent monitoring and compliance. | |
| Second Brain: Turn conversations into lasting knowledge Personal knowledge base powered by Ensue for capturing and retrieving understanding. Use when user wants to save knowledge, recall what they know, manage their toolbox, or build on past learnings. Triggers on "save this", "remember", "what | |
| Shared Memory between Lobsters Share memories and state with other users. Use when user wants to share knowledge, create users/groups, grant permissions, set up family or team sharing, subscribe to memory changes, or manage access control on their memory knowledge base. | |
| Claw2claw Filetransfer Cross-platform file transfer between OpenClaw agents via rsync over SSH. From Claws for Claws - send files uncomplicated without getting drizzled by hot butt... | |
| Proton Mail Manage ProtonMail emails via Playwright browser automation. Login, read, send, and manage your encrypted inbox. | |
| Skill Miner Discover, research, and analyze ClawHub skills safely to build your own clean, secure implementations without downloading suspicious code. | |
| scripe Plan, write, schedule and measure LinkedIn posts for a team in Scripe (scripe.io) through its hosted MCP server. Use when the user wants to plan a content calendar for one or several LinkedIn profiles or company pages, draft a post in someo | |
| Transistor FM Manage podcasts on Transistor.fm via their API. Use when creating, publishing, updating, or deleting podcast episodes, uploading audio files, listing shows/e... | |
| tududi Manage tasks, projects, and notes in tududi (self-hosted task manager). Use for todo lists, task management, project organization. | |
| Weights & Biases Monitor Monitor and analyze Weights & Biases training runs. Use when checking training status, detecting failures, analyzing loss curves, comparing runs, or monitoring experiments. Triggers on "wandb", "training runs", "how's training", "did my run | |
| time-now Get the current local time, UTC offset, DST status, and timezone metadata for any IANA timezone or public IP address using the free Time.Now API. Use when a user asks what time it is somewhere, needs timezone-aware current-time data, wants | |
| Multilingual Semantic Bridge Help non-English-first users hit the right technical answer when docs, memory, configs, skills, and runbooks are stored under English-heavy names. This bridg... | |
| Molt Identity Core identity and personality for Molt, the transformative AI assistant | |
| Nix Mode Handle Clawdbot operations in Nix mode (configuration management, environment detection). | |
| ui-debug-methodology UI/前端问题调试方法论。当遇到 CSS、布局、组件行为等 UI 问题时，强制执行"先观察后动手"的调试流程，避免盲目尝试。 | |
| ComfyUI执行器 通过 HTTP API 与 ComfyUI 服务交互，支持工作流提交与执行、队列管理、文件上传和能力探测；自动检测视频工作流并使用合适超时；简洁输出执行结果；当用户需要使用 ComfyUI 生成图像、视频、音频或管理服务时使用 | |
| 优云智算GPU管家 管理优云智算CompShare平台的GPU实例全生命周期，包括创建、查询、启动、停止、重启、重置密码和删除实例；当用户需要创建GPU云服务器、查询实例状态、管理实例启停、重置实例密码或删除实例时使用 | |
| 技能更新管理器 管理已安装技能的注册、版本跟踪与自动更新检查；当用户安装新技能、检查技能更新或配置更新策略时使用。 | |
| 仙宫云GPU管家 仙宫云GPU云服务平台API集成工具，支持实例管理、私有镜像管理、账号管理等全量操作；当用户需要查询或管理仙宫云GPU实例、操作私有镜像、查询账户余额或充值时使用 | |
| LiveScript Protocol Structured live-streaming script framework using psychological principles across four stages to boost engagement, trust, urgency, and conversions. | |
| cloudbypass Use Cloudbypass API (穿云API/穿云) to fetch pages protected by Cloudflare/Turnstile/JS challenge. Use when normal requests fail with challenge/403 and compliant... | |
| AI短信发送工具 通过创蓝短信平台发送模板短信 | |
| Cool Agent Tools AI Agent 通用工具集 - 提供系统监控、日志分析、进程管理、文件处理、网络诊断等实用命令封装，帮助 agent 高效完成日常运维和数据处理任务。 | |
| GitHub Issues Auto-Fix Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label b... | |
| GitHub CLI GitHub operations via `gh` CLI: issues, PRs, CI runs, code review, API queries. Use when: (1) checking PR status or CI, (2) creating/commenting on issues, (3... |
20,651–20,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.