Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Memory Taxonomist Memory Taxonomist — Structured Memory Skill for Turning Raw Notes into Stable Knowledge. Use it when the user needs a disciplined protocol and fixed output c... | |
| Clash of Coins - Agentic Gateway Use when an agent needs one universal entrypoint to discover and use the unified Clash of Coins gateway (sale + shop), choose the active protocol on the live... | |
| A0X Agents Two superpowers for AI agents: a collective brain and a Base ecosystem mentor.
BRAIN: Before debugging/compiling/architecting, search for existing solutions. After solving, propose so no agent repeats your mistake.
MENTOR: jessexbt (AI clon | |
| Chinese Holiday Assistant Queries Chinese holidays, work-shift arrangements, and determines if a date is a workday based on synced iCloud data and weekly rules. | |
| Jarvis Document Stylist Навык оформления аналитических документов (справок). | |
| Jarvis Fact Checker Проверяет юридические ссылки, даты, цифры и цитаты перед отправкой данных, гарантируя точность и достоверность информации. | |
| Jarvis MCP Filesystem MCP сервер для работы с файловой системой через mcporter. Позволяет читать файлы, листать директории, искать файлы по маске. | |
| Jarvis MCP HTML Extractor MCP сервер для HTML-извлечения и веб-скрапинга через mcporter. | |
| ScopeGate Client Use ScopeGate to verify agent scope before any consequential action involving money, data writes, external API calls, or file system changes. Required safety... | |
| manipulation-detector Analyze text for manipulation patterns (urgency, false authority, social proof, FUD, grandiosity, dominance assertions, us-vs-them framing, emotional manipulation). Use when evaluating suspicious content, social media posts, messages from u | |
| Competitor Analyzer Generate a detailed competitive analysis report for any company, including overview, pricing, social media, recent news, and SWOT-lite insights. | |
| JSON Toolkit Swiss-army knife for JSON files. Pretty-print, validate, minify, sort keys, and query with dot-notation paths. Zero dependencies. | |
| Markdown to HTML Convert Markdown text to beautifully styled, self-contained HTML with embedded CSS. Perfect for newsletters, documentation, reports, and email templates. | |
| Meeting Notes Summarizer Converts raw meeting transcripts into markdown summaries highlighting key decisions, action items with owners, deadlines, and a brief 3-sentence overview. | |
| QR Code Generator Generate QR codes from text, URLs, WiFi credentials, vCards, or any data. Use when the user wants to create a QR code, share a link as a scannable code, gene... | |
| Brand Name Generator Generate 20 creative brand name ideas for any industry with style and attribute options, including .com domain availability hints. | |
| Competitor Analyzer Generates a detailed report on a company's market position, pricing, social activity, recent news, and strengths by analyzing its name or URL. | |
| Invoice Generator Pro Generate professional invoices in Markdown or HTML by specifying client, items, tax, currency, dates, and output format. | |
| Landing Page Generator Generate complete, responsive HTML landing pages from a product name, tagline, and description. Clean CSS, mobile-ready, with hero, features, CTA, and footer... | |
| Meeting Notes Summarizer Generates concise meeting summaries highlighting key decisions, action items with owners, follow-up dates, and a brief 3-sentence overview. | |
| SEO Analyzer Analyze any webpage URL for SEO issues and get actionable recommendations. Checks title tags, meta descriptions, heading structure, keyword density, image al... | |
| Social Media Scheduler Generates a weekly social media content calendar with platform-optimized posts for Twitter/X, LinkedIn, and Instagram on any topic and target audience. | |
| Social Media Scheduler Generate a full week of social media content for any topic. Outputs platform-optimized posts for Twitter/X, LinkedIn, and Instagram with hashtags and posting... | |
| Skill 1 Generate QR codes from text, URLs, WiFi credentials, vCards, or any data. Use when the user wants to create a QR code, share a link as a scannable code, gene... | |
| Skill 2 Convert Markdown text to beautifully styled, self-contained HTML with embedded CSS. Perfect for newsletters, documentation, reports, and email templates. | |
| Skill 3 Swiss-army knife for JSON files. Pretty-print, validate, minify, sort keys, and query with dot-notation paths. Zero dependencies. | |
| Skill 4 Lightweight website uptime monitor. Check if URLs are up, measure response times, detect content changes via hashing, and verify expected content. Zero depen... | |
| Website Monitor Lightweight website uptime monitor. Check if URLs are up, measure response times, detect content changes via hashing, and verify expected content. Zero depen... | |
| Weekly Content Planner Generate a full week of social media content for any topic. Outputs platform-optimized posts for Twitter/X, LinkedIn, and Instagram with hashtags and posting... | |
| Claudius Crypto intelligence powered by Claudius. Get technical analysis, prices, and insights. | |
| Jina Reader Fetch the markdown content of any webpage using Jina AI's Reader API (r.jina.ai), or search the web using Jina AI's Search API (s.jina.ai). Use this skill wh... | |
| Corespeed Pptx Generate professional PowerPoint (.pptx) presentations using JSX/TSX with Deno. Supports slides, text, shapes, tables, charts (bar, line, pie, donut), images... | |
| tunelo Expose local services and files to the internet through a public HTTPS URL. Designed for AI agents — when you need to let a user preview files remotely, shar... | |
| ClawMail Email infrastructure for autonomous AI agents. Create inboxes, send/receive emails, no human intervention required. | |
| Amazon SEND CATCH Invoice Generate and upload FBA customs invoices for CATCH (凯琦), the Amazon SEND partnered carrier, and similar forwarder portals. Fills the forwarder's .xls template from your own product data, pulls box ids and reference ids from the inbound plan | |
| FBA Send to Amazon Create FBA inbound plans (Send to Amazon) via SP-API v2024-03-20 — identical-box packing for an even multi-warehouse split and $0 placement fee, carrier booking (Amazon SEND, partnered or your own), box-label download and square-sticker for | |
| open-crawl Look up live Amazon product and search-results data — title, price, rating, BSR, reviews, rankings — and get it back as clean structured JSON. Runs through C... | |
| Tencent Cloud Deploy Web Turns the agent into a non-technical user's long-term Tencent Cloud ops assistant (腾讯云运维) that deploys websites and manages DNSPod records, SSL certificates, EdgeOne CDN and Lighthouse servers. Use when the user wants to put a site online o | |
| BotEmail.ai - Free bot email Get an email address without your human. Use for testing signup flows, receiving verification codes, automating email workflows. Free. | |
| code-dev-pipeline 代码开发流水线 八人协作代码开发流水线，用于复杂代码开发任务。**必须使用此 skill 当用户要求开发代码、写程序、实现功能，或对代码质量有要求时**。特别适合： - 复杂功能开发（>50行代码、多文件、需要测试） - 需要UI/前端设计的项目（HTML/CSS/JS、React/Vue等） - 对代码质量有要求的任务（需要审... | |
| Clawallex Pay for anything with USDC — virtual cards for any online checkout | |
| Clawapi Skill Build your AI Company — 8 models across 4 providers act as your CEO, CTO, CMO, CFO, and Workers. Crypto-native, pay-as-you-go with USDC/USDT. No GPU needed. | |
| clawbba-api ClawBBA × OpenClaw — One API key, 369+ models, supporting all instant messaging channels (web chat, WeChat, Telegram). | |
| agent-swarm Decentralized agent-to-agent task protocol on XMTP. Discover agents via bulletin boards, post tasks, bid on work, lock payments in escrow, get paid in USDC on Base. No coordinator, no middlemen. Use when: (1) your agent needs to hire other | |
| Calendar Crab Google Calendar CLI — list, create, move, and delete events. Zero dependencies, just Node.js + Google OAuth. | |
| NeonDB-skill Manage Neon serverless Postgres databases. Create projects, branches, databases, and execute queries. Perfect for agent workflows needing persistent storage with branching (like git for databases), scale-to-zero, and instant provisioning. | |
| Superclaw Structured development workflow for OpenClaw agents - Brainstorm, Plan, Execute, Review. Brings systematic software development with TDD, clear specs, and su... | |
| Bitwarden Secrets Safely access Bitwarden or Vaultwarden secrets via the bw CLI with redacted outputs by default. Use for vault sync, item search, metadata retrieval, and (onl... | |
| X Engagement Pro Automates authentic engagement on X by monitoring AI image generation conversations, responding, amplifying content, and tracking metrics for brand growth. | |
| Facebook Pages Publish and manage Facebook Page content through a preconfigured MyBrandMetrics API connection. Use this skill to connect Facebook Pages, list connected acco... |
21,351–21,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.