Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Perf Analyzer Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Perf Analyzer concepts, best practices, and implementation patterns. | |
| Perf Tools Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Perf Tools concepts, best practices, and implementation patterns. | |
| Performance Review 绩效评估助手。自评、上级评语、OKR复盘、KPI分析、改进计划、SMART目标设定、360反馈撰写。Performance review assistant with self-assessment, manager feedback, OKR review, SMART goals, 360 feedback... | |
| Personal Bookkeeper Record double-entry bookkeeping for personal finances. Use when logging transactions, categorizing accounts, balancing ledgers, trending expenses. | |
| Pesticide Pesticide management reference — chemical classes, application methods, IPM strategies, residue limits, safety protocols. Use when selecting pest control pro... | |
| Php Analyzer Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Php Analyzer concepts, best practices, and implementation patterns. | |
| Pitch Deck 融资演示文稿。幻灯片结构、故事线设计、投资人Q&A、Demo Day准备、反馈改进。Pitch deck creator with slide structure, storytelling, investor Q&A, demo day prep. 融资、路演、BP演示。 | |
| Plc Programmable logic controller programming helper | |
| Poka Yoke Mistake-proofing technique manager. Use when json poka yoke tasks, csv poka yoke tasks, checking poka yoke status. | |
| Process Viewer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and det process-viewer, c, administrator, benchmarking. | |
| Prophet Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Prophet concepts, best practices, and implementation patterns. | |
| Prototype Build interactive HTML prototypes. Use when creating clickable mockups, adding animations, linking pages, or exporting HTML. | |
| Quicknote Lightning-fast note-taking tool. Capture thoughts instantly, pin important notes, search across all entries, and export to markdown. Zero config, local stora... | |
| Quote Record, search, and display quotes and sayings. Use when saving favorites, checking attribution, converting collections, analyzing themes, generating picks. | |
| Rating Rating - command-line tool for everyday use Use when you need rating. | |
| Receipt Scan, categorize, and total receipts for expenses. Use when recording purchases, categorizing spending, balancing monthly totals, forecasting budgets. | |
| Registration Manage registration records and attendee data. Use when logging sign-ups, checking capacity, converting export formats, generating confirmation reports. | |
| Relay Relay logic and wiring diagram helper. Use when json relay tasks, csv relay tasks, checking relay status. | |
| Roi roi reference tool | |
| Rsyslog RSyslog advanced system logging reference. RainerScript configuration, input/output modules (imtcp/imfile/omfwd/omelasticsearch), templates with property rep... | |
| Sandwich Analyze sandwich operations. Use when you need to understand sandwich mechanisms, evaluate protocol security, or reference on-chain concepts. | |
| Scheduler Scheduler - command-line tool for everyday use Use when you need scheduler. | |
| Schema Builder Build database schemas with SQL generation and relationship modeling. Use when designing databases. | |
| Security Suite Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Security Suite concepts, best practices, and implementation patte... | |
| Seedbed Seedbed preparation reference — tillage methods, soil structure, moisture management, planting surface quality. Use when preparing fields for sowing, evaluat... | |
| Sensor Read and manage IoT sensor data from the terminal. Use when polling readings, checking device connectivity, converting units, analyzing telemetry trends. | |
| Shell Ai Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Shell AI concepts, best practices, and implementation patterns. | |
| Shell Script Shell脚本助手。脚本生成、逐行解释、调试排错、常用模板(备份/监控/部署)、一行命令、Bash速查表。Shell script generator, explainer, debugger, templates, one-liners, cheatsheet. Shell、Bash、Linux命令。 | |
| Short Drama Writer 短剧剧本生成器。竖屏短剧、微短剧、剧情设计、角色塑造。Short drama script generator for vertical video dramas, plot design, character building. 短剧脚本、微短剧、编剧工具。Use when writing short dram... | |
| Sixsigma Six Sigma methodology reference — DMAIC process, statistical tools, control charts, and capability analysis. Use when running improvement projects, analyzing... | |
| Skill Template OpenClaw Skill template generator. Create skill scaffolds, validate structure, enhance SKILL.md, generate command frameworks, tips, publish checklists. | |
| Sleepwell Track sleep habits and analyze rest patterns over time. Use when logging bedtimes, planning schedules, tracking streaks, reviewing weekly patterns. | |
| Slide Create and manage presentation slides using JSONL storage. Use when building slide decks, applying themes, or exporting to HTML presentations. | |
| Slide Maker Presentation and slide deck generator. Create outlines, full slide decks, speaker notes, pitch decks, training slides, report presentations. | |
| Slogan Maker 广告语生成器。品牌标语创作、行业广告语、押韵口号、中英翻译、效果测试、经典语库。Slogan maker with brand taglines, industry slogans, rhyming, translation, testing. | |
| Smart Lights Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Smart Lights concepts, best practices, and implementation patterns. | |
| Social Scraper Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Social Scraper concepts, best practices, and implementation patte... | |
| Sort Sort files, lines, and columns with custom ordering and dedup. Use when scanning duplicates, monitoring changes, reporting results, alerting anomalies. | |
| Sorter Sorting algorithm and system reference — comparison sorts, distribution sorts, parallel sorting, and industrial sortation. Use when choosing sorting strategi... | |
| Sql Generator SQL生成器。自然语言转SQL、SQL解释、性能优化、建表语句、测试数据生成、数据库迁移、SQL速查表。SQL generator from natural language, explainer, optimizer, DDL creator, mock data, migration scripts, che... | |
| Sshkey Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Sshkey concepts, best practices, and implementation patterns. | |
| Startup Tools 创业工具包。创业清单、公司注册、MVP规划、融资准备、法律合规、增长策略。Startup toolkit with checklist, register, MVP planning, fundraise, legal compliance. | |
| Statute Legal statutes reference — statutory interpretation, legislative process, types of statutes, and citation formats. Use when researching laws, understanding s... | |
| Stopwatch Run stopwatch, timer, and lap tracking with precision in terminal. Use when timing tasks, checking durations, running countdowns, analyzing splits. | |
| Story Writer 小说创作、角色设计、情节设计(三幕式)、对话生成、世界观构建、续写。Story writing with character design, three-act plot structure, dialogue generation, worldbuilding. Supports bilingual docum... | |
| Streakup Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Streakup concepts, best practices, and implementation patterns. | |
| Stretch Stretching and flexibility reference — dynamic warm-ups, static holds, PNF techniques, and mobility routines. Use when designing warm-up protocols, improving... | |
| Student Help with coursework. Use when taking notes, summarizing readings, formatting citations, outlining essays, or calculating GPA. | |
| Substrate Substrate reference tool. Use when working with substrate in blockchain contexts. | |
| Svg Optimizer Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Svg Optimizer concepts, best practices, and implementation patterns. |
21,201–21,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.