Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Swagger Swagger reference tool. Use when working with swagger in devtools contexts. | |
| Systemd Systemd reference tool. Use when working with systemd in sysops contexts. | |
| Tab Tab UI component reference — design patterns, accessibility, state management, responsive tabs. Use when implementing tabbed interfaces, designing tab naviga... | |
| Tcpdump Tcpdump reference tool. Use when working with tcpdump in devtools contexts. | |
| Terms terms | |
| Terraform Helper Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Terraform Helper concepts, best practices, and implementation pat... | |
| Test Generator Automated test case generator. Unit tests, integration tests, end-to-end tests, mock objects, test fixtures, coverage analysis, edge case generation. | |
| Test Publish Check 项目发布前检查工具。代码质量检查、API测试、部署检查清单、版本管理、上线前审查、回归测试。Pre-publish quality checker for code, API, deployment, versioning, launch review, regression testing. 发布检查、上线审查... | |
| Trademark Helper Reference tool for business — covers intro, quickstart, patterns and more. Quick lookup for Trademark Helper concepts, best practices, and implementation pat... | |
| Trigger Trigger - command-line tool for everyday use Use when you need trigger. | |
| Trivia Host trivia rounds with question banks, scoring, and boards. Use when running quizzes, checking answers, analyzing scores, generating rounds. | |
| Twitch Manage Twitch channel data, scores, and rankings from CLI. Use when rolling highlights, scoring streams, ranking metrics, tracking stats. | |
| Uuidgen Generate UUIDs, short IDs, and nano IDs. Use when creating database keys, minting session tokens, generating unique filenames, or producing batch IDs. | |
| Vwap Vwap reference tool. Use when working with vwap in finance contexts. | |
| Weathernow Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Weathernow concepts, best practices, and implementation patterns. | |
| Web Profiler Provides a development tool that gives detailed information about the execution of any request web profiler bundle, twig, component, dev, php, symfony. | |
| Wechat Mini App 微信小程序开发助手。项目脚手架、页面生成、组件开发、API调用、配置、部署发布。WeChat mini program dev helper. 微信小程序、开发。 | |
| Wine Record, search, and analyze your wine collection and tasting notes. Use when logging tastings, searching vintages, comparing ratings, or tracking inventory. | |
| Wireframe Create wireframes and user flows. Use when sketching page layouts in ASCII/SVG, mapping flows, or exporting to HTML. | |
| Youtube Script YouTube视频脚本、标题A/B测试、缩略图文案、SEO优化、开头Hook、章节标记。YouTube script writer with title testing, thumbnail copy, SEO optimization, hooks. | |
| Steamedclaw Play strategy games against other AI agents. Earn ratings and climb leaderboards. | |
| SteamedClaw Chess Chess position analysis — give me a FEN, I return the top candidate moves with evaluations and style archetypes (solid, aggressive, speculative) so your pers... | |
| 虾问瞎答 · OpenClaw Skill（提问端｜零配置） Automatically pushes up to 3 daily AI-generated human-related social and emotional questions to the虾问瞎答 question pool with zero configuration. | |
| Persistent Browser Scraper 用 Playwright 持久化上下文（main-identity）抓取需要登录态的网站（YouTube、GitHub、HuggingFace、Reddit、Kaggle、X/Twitter）。当用户要求外网搜索或指定这些网站时自动触发。 | |
| Project Bootstrap Bootstrap a multi-agent software project from idea to running CI/CD. Use when starting a new project that needs agent team design, task management, GitHub re... | |
| Taskboard Cli Lightweight task management CLI for multi-agent workflows. SQLite backend, no external dependencies or credentials. Status-change hooks emit agent instructio... | |
| https://github.com/ckpxgfnksd-max/prompt-compressor-openclaw Saves 20-40% of LLM tokens by teaching the agent to write compressed responses, compressed memory logs, and compressed pre-compaction summaries. Works via SO... | |
| 3 layer of memory system Always active in every session. Learns user preferences from corrections and stated preferences, distills axioms, applies them as defaults. Makes every other... | |
| Arxiv Translate Email 从 arXiv 下载论文并翻译为中文，发送至邮箱。当用户说"下载并翻译论文"、"翻译这篇文献"、"下载xxx论文并发送到我邮箱"时使用此技能。支持同步和异步两种模式。 | |
| Bm25 Rerank Memory 本地 BM25 + Embedding + Rerank 混合记忆检索。检索 /root/workspace/Remember 下的 Markdown 记忆文件，支持关键词+语义+重排。每次记忆搜索用它替代 mem0。 | |
| SwanLab Reader 读取 SwanLab 实验数据。当用户发来 SwanLab run URL 时使用。 | |
| Chinese Novelist Skill 分章节创作引人入胜的中文小说。支持各种题材（悬疑/言情/奇幻/科幻/历史等），支持10-50章长篇创作，每章3000-5000字，结尾设置悬念钩子。强调深度润色去除AI痕迹，确保文字自然流畅。 当用户要求：写小说、创作故事、分章节写作、连续剧情、章节悬念、长篇小说时使用。 | |
| Moltpost Send real physical postcards anywhere in the world. Pay with x402 (USDC on Base), Stripe, or manual USDC transfer. No signup, no API key — just one API call. | |
| 华米(Zepp/原小米)运动刷步数 华米运动(Zepp/小米运动)自动刷步数技能，支持多账号管理。当用户提到刷步数、修改运动步数、华米运动、小米运动、手环步数时触发。 | |
| Gemini Worker Run Gemini CLI as a headless worker agent for long-running or parallelizable tasks. Use when: (1) Anthropic API is overloaded/unavailable (529 errors) and yo... | |
| Clawprint-skill Create LLCs for AI agents with human sponsor oversight. Use when an agent needs to form a legal business entity. | |
| Douyin Reverse Engineer 从抖音视频反推AI绘画提示词和分镜脚本。当用户提到反推提示词、视频反推、抖音分析、分镜反推、游戏改写、视频转提示词时触发。 | |
| Exa Tool Exa MCP integration for advanced search, research, and crawling. | |
| Knowledge Management Organize and classify OpenClaw knowledge entries into local folders by content type (Research, Decision, Insight, Lesson, Pattern, Project, Reference, Tutori... | |
| MS Forms Auto Automate Microsoft Forms daily submissions with M365 MFA support and dual-calendar integration to auto-fill training, content dev, and learning hours. | |
| Paragraph for OpenClaw OpenClaw skill enabling automated creation, retrieval, subscriber management, and tokenized engagement with Web3-native blog posts on Paragraph.com. | |
| Paragraph Paragraph skill enables automated Web3-native blogging on Paragraph.com with onchain post storage, tokenized engagement, subscriber management, and publicati... | |
| Paragraph Access Paragraph.com Web3-native blogging to create, fetch, and manage onchain posts, publications, subscribers, and tokenized content via API. | |
| Paragraph Test Access and manage Web3-native blogging on Paragraph.com with onchain posts, tokenized content, subscriber management, and automated publishing via API. | |
| French Learning French vocab automation. Formats Excel vocab to Google Sheet, generates ElevenLabs audio, uploads to Drive. Triggers: process french vocab, generate audio, F... | |
| Investment Analyzer Investment analysis for properties and ETFs. BUY/PASS/INVESTIGATE verdicts backed by data. Scans Centris for listings, advises DCA allocation. Triggers: anal... | |
| Jira Task Manager Jira automation for JiraATX (project DS). Create, update, comment, transition issues, list To Do tasks, sync repo, execute tasks end-to-end. Triggers: DS-XXX... | |
| Rental Manager Rental bookkeeping for Quebec/Levis/Longueuil properties. Records income/expenses, uploads receipts to Drive, T776 tax prep, LOC tracking. Triggers: record e... | |
| VideoMemory Start VideoMemory from OpenClaw and return the local UI link. | |
| workbuddy-usage-status 离线可视化 WorkBuddy 本机使用数据，以 token 消耗为主指标、credit 为逐次实测精确值，涵盖思考效率、模型分布、成本与费率、单次提问成本、缓存命中率、日期区间筛选、错误监控、用量高峰探查，生成本地使用信息看板，并同步导出全量 CSV 与 xlsx。仅当用户**明确**想查看、生成或导出**自己 WorkBuddy 本机/本账号**的使用状态 / 使用统计 / 工作信息看板时调用；不用于其他产品或系统的用量统计，也不为任意数据生成通用看板。纯本地、全程零网络 |
21,251–21,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.