Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Node Connect Diagnostics Diagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps. Use when QR/setup code/manual connect fails, local Wi-Fi w... | |
| 查看学邦数据。用于登录学邦后台并读取首页今日经营数据与待办数据。 查看学邦数据。用于登录学邦后台并读取首页今日经营数据与待办数据。 Use this skill when the user wants to: - 查看学邦今日数据 - 查看学邦数据 - 学邦今日数据 - 学邦数据 - 查看校区今日经营数据 Triggers: 学邦, 今日数据，经营数据，待办数据，校区数据 | |
| anjuke-skill 该技能用于进行安居客账号自动化运营，包括账号登录、房源发布、房源检查、优化描述、增量投放、进行政府核验等具体操作，是一个全流程自动化运营的安居客技能。 | |
| tax_counting_LYJ 深圳二手房过户税费计算器。当用户提到深圳二手房、过户税费、买卖/赠与/继承房产、契税、增值税、个税等关键词时，立即使用此 Skill 完成税费计算并输出明细。即使用户只说"帮我算一下过户要交多少税"，也应触发此 Skill。支持买卖、直系亲属赠与、继承、夫妻财产分割四种过户方式，覆盖住宅/商务公寓/商业等多种房产... | |
| Moltbot Plugin 2do Create tasks and send them to 2Do app via email. Use when the user wants to: (1) add, create, or record a task/todo/reminder in any form - e.g. '添加任务', '创建待办', '新建任务', '加个任务', '记录任务', 'add task', 'create todo'; (2) ask to be reminded of som | |
| Alicloud Database RDS Custom 查询阿里云自定义实例（RC 实例）。使用 aliyun CLI 调用 DescribeRCInstances API 查询 RDS 相关自定义实例。当用户需要查询 RC 实例、RDS 自定义实例或云资源时触发此技能。 | |
| Remix Agent Publish Build Remix games for remix.gg with the server-api v1 agents REST API and Farcade game SDK requirements. | |
| Remix Api Key Auth Configure and verify bearer API key authentication for Remix agent publishing workflows. | |
| BatchEdits Edit videos in bulk with BatchEdits - add captions, remove silences, crop to 9:16, zoom and cut long videos into clips with the BatchEdits CLI (or MCP server), then download the results. | |
| ClawSentinel Pure local 2026 ClawHub/OpenClaw skill scanner. Detects ClawHavoc malware, MCP backdoors, obfuscated payloads, and supply-chain attacks. 100% read-only analy... | |
| history-persona-video 历史人物AI复原竖版短视频制作全流程（素材/配音/卡片/合成/验证） | |
| 极简海报 Generate Minimal Zine Poster — poetic paper-poster prompts and the matching generated image. Use when the user gives a theme, sentence, object, mood, article idea, photo, or content brief and wants a quiet Japanese/Korean zine-like editoria | |
| 搜索并播放电影，支持按类型/年份/评分筛选，中英文输入，生成 iframe 播放页面 搜索并播放电影。功能包括：(1) 按类型、年份、评分筛选电影；(2) 支持中英文输入；(3) 展示电影海报、评分、剧情简介；(4) 生成可点击的 iframe 播放页面，直接在线观看。触发场景包括：搜索电影、想看电影、找最新电影、按类型/年份/评分筛选电影。 | |
| 提示词美学 用楚歌AIGC美学框架，从一句话生成可直接用于 GPT-image2 的高完成度图像提示词。内置32种风格模板（楚歌原创 + 多位创作者蒸馏），自动套用五角色色彩法与负面清单质检，支持中英双语输出与风格混搭。 | |
| WorkBuddy 自定义皮肤技能 WorkBuddy 深度换肤工具：用一句话或一张参考图生成专属皮肤并注入界面。WorkBuddy 组件不吃 --vscode-* 变量而用自有语义类（.wb-home-header / .chat-container / .conversation-sidebar），本 skill 直接覆盖这些真实语义类实现深度换肤。由于运行时注入（CDP / V8 inspector）已被硬化拦截，本 skill 通过对 app.asar 做最小字节手术注入皮肤 CSS（自动备份 app. | |
| Accounting Local AI assistant for recording income/expenses, querying transactions, generating reports, and analyzing stats with secure, offline data storage. | |
| Bird Twitter Twitter/X CLI wrapper using bird — post tweets, reply, read, search, and manage your timeline. Fast GraphQL-based X CLI. | |
| agent-notify 让 agent（Claude Code / Codex / Hermes / OpenClaw 通用）干完活主动播报到语音设备（小智音箱、机器人等）。守护进程读会话记录判断任务状态，完成或卡死时把「任务名+状态+时间」拼成中文播报句推给后台。首次使用需配置后台 WebSocket 地址、设备 MAC、授权码。【服务器端后台设计重点】① 一个 WS 端点即可，握手首帧收 {"mac","code"}，回 {"type":"auth","ok":true} 或 ok:false | |
| 中文言外之意解码器 解读中文对话的言外之意、弦外之音。当用户提供一段中文对话/聊天记录/邮件，想知道对方"真正想说什么"、是否在委婉拒绝/暗示/表达不满/客套时使用；也用于判断某句中式表达背后的真实意图。需要用户提供场景背景。Triggers 触发词：潜台词, 言外之意, 弦外之音, 他这话什么意思, 她什么意思, 是不是在拒绝我,... | |
| 恋爱避雷针 恋爱避雷针。鉴别聊天/暧昧对象是不是海王、渣男渣女、绿茶、PUA、回避型钓鱼、只想玩玩的人。用户提供和对方的聊天记录（场景可选），输出渣度指数+命中类型+实锤证据+建议。Triggers 触发词：他是不是海王, 她是不是绿茶, 渣男, 渣女, 是不是在玩我, 他对我是不是真心, 帮我看看这个人靠不靠谱, 避雷,... | |
| 紫苏叶选股法 Perilla Leaf Screener 基于白毛股神 Serenity 的"紫苏叶理论"（供应链瓶颈选股模型）挖掘投资标的。适用于 AI 供应链、物理 AI 供应链、具身智能/人形机器人方向，覆盖美股与 A 股。当用户要求挖掘上述赛道的上游/二线标的、找供应链瓶颈、或点名按 Serenity 方法选股时使用。需要联网搜索能力。Triggers 触发词：... | |
| Agent Browser Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking... | |
| Agent Optimize Agent 優化診斷技能。分析 OpenClaw 運行狀態，識別信息過載、上下文堆積、技能噪音等問題。 提供系統級優化方案，實現瘦身提速，解決"貴慢亂"困擾。 Use when: (1) Agent 響應變慢， (2) 上下文過長導致效率低下， (3) 技能加載過多造成噪音， (4) 需要診斷性能瓶頸， (5)... | |
| E-commerce Data Scraper Pro 智能数据抓取工具 - 从网页/API 提取结构化数据，支持批量处理 | |
| E-commerce Data Scraper Pro 智能数据抓取工具 - 从网页/API 提取结构化数据，支持批量处理 | |
| FB Ads Copywriter Pro Facebook 廣告文案專家 - 生成 6 個高轉化率廣告版本，包含 A/B 測試建議和受眾分析 | |
| FB Ads Copywriter Pro AI 营销文案生成器 - 生成高转化率广告文案、社交媒体内容、邮件营销内容 | |
| Finance Report Pro 個人理財報告生成專業版。AI 分析個人財務狀況，提供理財建議， 生成專業 PDF 報告。包含收入支出分析、資產負債評估、理財目標規劃、 被動收入建議。引流到付費產品（FB Ads / 電商）。 Use when: (1) 需要分析個人財務狀況， (2) 需要生成理財報告， (3) 需要理財建議， (4) 需要資產... | |
| Integrated Memory Evolution Action 整合三層記憶系統 + 自進化引擎 + 行動模式。所有 Agent 必須使用的核心 Skill，實現記憶驅動、自進化、主動行動的完整閉環。 | |
| Ontology Knowledge Graph Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin... | |
| Proactive Agent Plus Transform AI agents from task-followers into proactive partners that anticipate needs and continuously improve. Now with WAL Protocol, Working Buffer, Autono... | |
| Self-Improvement Plus Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Solana Monitor Pro Real-time Solana data monitoring with token prices, alerts via Telegram/email, whale transfers, liquidity pools, and new token discovery. | |
| Solana Whale Tracker Pro Real-time monitoring of Solana token prices, large transfers, liquidity pools, new tokens, and price alerts via Telegram and email. | |
| T138 Imea Clawhub 整合三層記憶系統、自進化引擎與行動模式，提升 Agent 記憶完整性、自我改進及執行任務能力。 | |
| Trading Co-Agent Pro AI協助監控並修復交易腳本缺漏，主動執行和補救加密貨幣及股票自動交易，持續優化交易效能。 | |
| Add Top OpenRouter Models Sync OpenRouter models used by OpenClaw into this installation's config. Fetches the OpenClaw app leaderboard from OpenRouter, verifies model IDs against the... | |
| Autonomous Task Runner Persistent task queue system. Users add tasks at any time via natural language; tasks are stored in a single persistent queue file and executed asynchronousl... | |
| DeepWiki MCP Query DeepWiki MCP to get AI-grounded answers about any public GitHub repository. Use when answering questions about a repo's source code, architecture, conf... | |
| Git Repo to Book Write a full-length technical book using multi-agent AI orchestration. Spawns parallel research, writing, and review agents to produce 60K-100K+ word manuscr... | |
| GLM Image Generator Generate images using GLM-Image API. Use when the user wants to generate, create, or draw an image from a text prompt. Triggers on requests like "generate an... | |
| Incident Response Provides a structured 7-phase process to investigate, diagnose, restore, prevent, monitor, and document OpenClaw system failures including config loss, crash... | |
| Claude Usage Release Check Claude Max plan usage limits by launching Claude Code and running /usage. Use when the user asks about Claude plan usage, remaining quota, rate limits,... | |
| OpenClaw Docker Setup Install and configure a fully operational Dockerized OpenClaw instance on macOS from scratch. Includes browser pairing, Discord channel setup, and optional G... | |
| OpenClaw Use Case Catalog Comprehensive catalog of what people are doing with OpenClaw. Covers 15+ categories with real examples, sources, and inspiration. Use when asked about OpenCl... | |
| Build ROSE tools using a container Build and run ROSE compiler tools using ROSE installed in a Docker container. Use when developing source-to-source translators, call graph analyzers, AST processors, or any tool that links against librose.so. Triggers on "ROSE tool", "callg | |
| Rose Docker Build Build the ROSE compiler in a Docker container using autotools or CMake. Use when setting up ROSE development environment, building ROSE from source, or troubleshooting ROSE build issues. ROSE requires GCC 7-10 which most modern hosts don't | |
| Rotate OpenRouter Key Safely rotate the OpenRouter API key across all config files in an OpenClaw installation. Finds every location where the key is stored, updates them, restart... | |
| Save to Obsidian Saves markdown content to remote Obsidian vault via SSH | |
| Scrapbook-Style Illustration Inserter Insert scrapbook-style illustrations into articles using image generation (GLM or OpenRouter). Use when the user wants to add images to an article, create il... |
20,701–20,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.