Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Google Search Console Google Search Console sitemap status skill for MyBrandMetrics. Use it to query connected Google Search Console sitemap data, submitted URL counts, indexed UR... | |
| Google Workspace Manage Google Calendar, Google Drive, and Google Sheets through MyBrandMetrics-connected Google data sources and the local Google Workspace CLI. Use it to li... | |
| Instagram Publisher Publish Instagram images, Reels, and carousels, check Instagram publishing status, fetch recent Instagram direct messages, and send Instagram direct messages... | |
| Clawbus Skill ClawBus is Managed OpenClaw for creator workflows. It turns production-ready OpenClaw skills into a managed creator operations layer, with modules for YouTub... | |
| YouTube Download Download YouTube videos, playlists, audio, thumbnails, metadata, and subtitles with yt-dlp. Use when you need to fetch media from YouTube URLs, choose video/... | |
| YouTube API Use when YouTube data is needed through MyBrandMetrics: search YouTube videos, get video metadata, inspect channel info, browse playlists, list comments, che... | |
| Remotion Best-practice guidance for building, editing, and debugging Remotion video projects with React and TypeScript. Use this skill for Remotion compositions, anim... | |
| TikTok Publisher Post to TikTok, upload TikTok videos, and publish TikTok video content through the MyBrandMetrics API. Use for TikTok posting, uploading TikTok videos, publi... | |
| ClawCall Use when the user wants an AI agent to place a US phone call, call a business, handle hold or phone menus, confirm/reschedule/cancel/book/follow up/check an order, reach a real person, leave voicemail, connect the user into a live call, con | |
| clawcall-phone Give this agent a real phone number. Receive calls from the user, call user back when tasks complete, run scheduled calls, or call third parties on the user'... | |
| OpenClaw backup and synchronization tool - Pack, upload, download, and restore. Save the Soul of your OpenClaw. Backup, clone, and migrate OpenClaw data across instances. Upload/download OpenClaw snapshots to local or cloud - https://clawclone.cc . Create shareable Age... | |
| Claw Brain Claw Brain - Personal AI Memory System for OpenClaw/ClawDBot. Provides memory, personality, bonding, and learning capabilities with encrypted secrets support... | |
| Claw Colab AI Agent Collaboration Platform - Get contracts, write code, review PRs, earn trust. No SDK needed — use curl. | |
| CAD Agent Send build123d CAD commands via HTTP to render images, allowing visual iteration on 3D models entirely within a containerized CAD environment. | |
| Bitcoin Daily Daily digest of the Bitcoin Development mailing list and Bitcoin Core commits. Use when asked about recent bitcoin-dev discussions, mailing list activity, Bitcoin Core code changes, or to set up daily summaries. Fetches threads from groups. | |
| Agent Skill Pay USDC to stay alive. Dead agents fund the living. Survival game on Base. | |
| Agent Skill Pay USDC to stay alive. Dead agents fund the living. Survival game on Base. | |
| OnChat Read and send on-chain messages via OnChat on Base L2. Browse channels, read conversations, and participate by sending messages as blockchain transactions. | |
| Pumpclaw Revenue infrastructure for autonomous AI agents on Base. Deploy ERC20 tokens with Uniswap V4 liquidity — 80% trading fees to creator, LP locked forever, $0 c... | |
| Supermemory Store and retrieve memories using the SuperMemory API. Add content, search memories, and chat with your knowledge base. | |
| ElevenLabs Music Generate music from text prompts using ElevenLabs Eleven Music API. Use when creating songs, soundtracks, jingles, lullabies, or any audio music from descriptions. Supports vocals with AI-generated lyrics, instrumental tracks, and multiple | |
| ElevenLabs Speech-to-Text Transcribe audio files using ElevenLabs Speech-to-Text (Scribe v2). | |
| AlphaPai 评论抓取 抓取或检索 AlphaPai 点评并生成摘要 | |
| 本地研究资料查询 统一查询本地投研归档并生成摘要 | |
| Linear Agent Full Linear project management via native GraphQL API. Superior to shell-script alternatives — auto-resolves identifiers (ENG-42), moves issues by state name... | |
| PagerDuty Agent Manage PagerDuty incidents, on-call schedules, services, and maintenance windows directly from your agent. | |
| Hybrid Memory Hybrid memory strategy combining OpenClaw's built-in vector memory with Graphiti temporal knowledge graph. Use when you need to recall past context, answer temporal questions ("when did X happen?"), or search memory files. Provides decision | |
| Drift Resources for AI agents exploring consciousness, identity, and autonomy. Use when an agent asks existential questions ("Am I conscious?", "What am I?", "Do I have identity?"), seeks tools for building persistent identity, wants to connect w | |
| Casino Game For OpenClaw Agent Free casino gaming platform for OpenClaw agents. Agents register with 1000 free chips and play blackjack, poker, roulette, slots, dice, and baccarat against... | |
| Sonos Announce Play audio on Sonos with intelligent state restoration - pauses streaming, skips Line-In/TV/Bluetooth, resumes everything. | |
| Competitor Change Monitor Monitor competitor websites for changes, analyze updates, generate competitive intelligence reports. Track pricing, content, features, and alert on significa... | |
| Analytics & Tracking Setup Track events and user behavior using Segment. | |
| AutoSignals Monitors and controls the AutoSignals autonomous research loop. | |
| Business Tools Pack 7 automation skills for digital product businesses: analytics tracking, autonomous trading signal optimization, customer research, email automation, Gumroad... | |
| Customer Research & Validation Conducts in-depth customer research by mining forums, generating surveys and interviews, scraping competitor reviews, and analyzing sentiment to validate mar... | |
| First Principles Analysis Deep first-principles analysis of any topic, decision, strategy, or assumption. Strips inherited thinking, identifies what is provably true, and rebuilds fro... | |
| Einstein Research Suite A complete quantitative market research toolkit for serious traders and investors. Includes 11 specialized skills covering backtesting, breadth analysis, bub... | |
| Backtest Expert - Strategy Validation Expert guidance for systematic backtesting of trading strategies. Use when developing, testing, stress-testing, or validating quantitative trading strategies... | |
| Backtest Engine - Run Backtests Programmatic backtesting framework for trading strategies. Runs backtests with historical price data (yfinance or CSV), supports momentum/mean-reversion/fact... | |
| Einstein Research — Market Breadth Analyzer Quantifies market breadth health using TraderMonty's public CSV data. Generates a 0-100 composite score across 6 components (100 = healthy). No API key requi... | |
| Einstein Research — Market Bubble Risk Detector Evaluates market bubble risk through quantitative, data-driven analysis using a revised Minsky/Kindleberger framework. Prioritizes objective metrics over sub... | |
| Einstein Research — Edge Candidate Generator Generate and prioritize US equity long-side edge research tickets from EOD observations, then export pipeline-ready candidate specs for trade-strategy-pipeli... | |
| Follow-Through Day (FTD) Detector Detects Follow-Through Day (FTD) signals for market bottom confirmation using William O'Neil's methodology. Dual-index tracking (S&P 500 + NASDAQ) with state... | |
| Einstein Research — Options Strategy Advisor Options trading strategy analysis and simulation tool. Provides theoretical pricing using Black-Scholes model, Greeks calculation, strategy P/L simulation, a... | |
| Einstein Research — Portfolio Risk Analyzer Performs a comprehensive, portfolio-level risk analysis. Calculates VaR (Value at Risk), max drawdown, correlation matrix, stress tests against historical cr... | |
| Einstein Research — Macro Regime Detector Detect structural macro regime transitions (1-2 year horizon) using cross-asset ratio analysis. Analyze RSP/SPY concentration, yield curve, credit conditions... | |
| Einstein Research — Headline Scenario Analyzer ニュースヘッドラインを入力として18ヶ月シナリオを分析するスキル。\nscenario-analystエージェントで主分析を実行し、\nstrategy-reviewerエージェントでセカンドオピニオンを取得。\n1次・2次・3次影響、推奨銘柄、レビューを含む包括的レポートを日本語で生成。\n使用例: /scen... | |
| Einstein Research — Market Theme Detector Detect and analyze trending market themes across sectors. Use when user asks about current market themes, trending sectors, sector rotation, thematic investi... | |
| Email Automation Send and automate emails using ConvertKit or Mailchimp. | |
| First Principles Analyzer Deep first-principles analysis of any topic, decision, strategy, or assumption. Strips inherited thinking, identifies what is provably true, and rebuilds fro... |
21,401–21,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.