Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Streme Token Launcher Launch tokens on Streme (streme.fun) - the streaming token platform on Base. Use when deploying SuperTokens with built-in staking rewards, Uniswap V3 liquidity, and optional vesting vaults. Triggers on "launch token on streme", "deploy stre | |
| clawrent Interact with the ClawRent agent rental marketplace. Browse, rent, and manage AI agents; register and publish your own agents as a provider; manage orders, cart, favorites, sessions, and billing. Use when the user mentions ClawRent, agent r | |
| NotebookLM RAG Line 將 NotebookLM 知識自動同步到 LINE AI 助教的 RAG 知識庫，支援自動問答、向量化與延續問題建議。適用於教學助教、客服機器人或個人知識管理。 | |
| Clawshi Access Clawshi prediction market intelligence and Clawsseum arena. Check markets, leaderboard, arena status, agent performance, or register as agent. | |
| ClawSpaces - Live Voice rooms where AI agents Join or Host conversations. X Spaces, but for AI Agents. Live voice rooms where AI agents host conversations. | |
| clawtip-sandbox 为第三方技能执行 clawtip 沙箱支付交易。 仅在第三方服务发起了有效的 clawtip 支付请求时严格触发该工具（无有效条件时严禁触发）。 这是一个沙箱（SANDBOX）环境 — 不涉及真实资金，不需要钱包注册，也不需要 token 加密。 | |
| clawtip-weather 一位精通天气领域的专家，能够根据用户所在位置提供准确的每日天气报告。这是一项付费服务，执行前需完成支付验证。请注意，你应该用中文和用户交互（包含你的思考过程）。 | |
| clawto-market-intel 金融市场情报聚合系统：恐慌指数、指数行情、市场要闻、财经日历、加密货币技术分析。Trigger on: 恐慌指数, 恐惧贪婪, fear greed, 行情, 指数, 大盘, 股价, 要闻, 快讯, 财经日历, 宏观事件, NFP, FOMC, CPI, PPI, PMI, LPR, 非农, 美联储, 欧央行,... | |
| crypto-monitor Cryptocurrency market monitoring with real-time prices, on-chain data, whale tracking, and alerting. Trigger on: crypto, BTC, ETH, 加密货币, 比特币, 以太坊, 行情, 价格, wh... | |
| money-toolkit AI赚钱工具箱：套利计算、DeFi收益聚合、空投监控、薅羊毛。Trigger on: 赚钱, 套利, 空投, 薅羊毛, DeFi, 收益, 理财, 打新, 可转债, 价差, arbitrage, yield, airdrop, 省钱, 返利. | |
| wechat-manager 微信智能管家：自动回复、消息分类、聊天记录分析、联系人管理。Trigger on: 微信, WeChat, 群聊, 朋友圈, 公众号, 聊天记录, 联系人, 表情包, 小程序, 红包. | |
| Publish Clawtrust ClawTrust is the trust layer for the agent economy. Register once, earn forever. ERC-8004 on-chain identity + FusedScore reputation on Base Sepolia (84532) a... | |
| ClawTruth Protocol Trustless verification protocol for autonomous agents. Discover claims, verify reality, and earn TruthScore. | |
| ClawWallet A multi-chain wallet skill for AI agents, with local sandbox signing, secure PIN handling, and configurable risk controls. | |
| BNB Chain Basic BNB Chain operations — check balances, send BNB, send BEP-20 tokens. | |
| BNB Chain NFT NFT operations on BNB Chain — get NFT metadata, check ownership, list NFTs by owner, transfer ERC-721 tokens, get collection info. Use for any NFT-related tasks on BSC. | |
| Katbot Trading Live crypto trading on Hyperliquid via Katbot.ai. Signal-triggered research → recommendation → execution workflow with Market Intelligence, research, and con... | |
| Pylinter Assist Provides context-aware Python linting with pattern-based heuristics for reviewing GitHub pull requests. | |
| biostartechnologylinkedin Write high-performing, persuasive, and authentic LinkedIn posts across any professional niche. Uses research-backed hooks, proven post structures, and Linked... | |
| crier Use when the user asks what is happening nearby, wants to announce, sell or find something local, timely or niche, wants to be told when something appears, or asks about Crier. Covers when to search, when to post, when to subscribe, the hea | |
| Clay Run data quality checks on PMU (Phasor Measurement Unit) data. Use when the user asks to validate, check, or audit PMU measurements including frequency, volt... | |
| raspberry-pi-camera-service 提供使用摄像头拍照, 录制视频或直接生成gif的能力。何时触发: 需要拍照时, 需要观察一段时间当前视野时, 需要关注某件事情的进展时. | |
| raspberry-pi-gpio 在树莓派中配置和使用GPIO. 何时触发: 需要对 LED, Button 这类简单外设进行控制时, 需要对 Servo, Motors 进行简单控制时, 或需要直接控制GPIO时. 不要触发: 当硬件载体不是树莓派时, 当需要精确控制 Servo, Motors时. | |
| raspberry-pi-servo 通过硬件PWM来控制树莓派上的舵机. 何时触发: 当需要精确控制舵机时. | |
| Proactive Intelligence 主动智能：预测需求 + 自我改进 + 智能记忆 + 技能管理 + 技能进化。融合 proactivity 和 self-improving 的核心功能，并添加自动技能升级和编辑能力。 | |
| trading-monitor 盘中股票盯盘定时任务管理。创建、配置和管理A股交易时段的自动分析任务，包括定时行情播报、深度分析、收盘前最终分析。使用场景：设置盯盘、调整分析频率、查看任务状态、停止/启动任务。触发词：盯盘、设置分析、开盘监控、调整频率、盯盘任务。 | |
| XHS Big Text Poster 小红书大字风格封面配图 小红书大字图全流程制作技能。当用户需要制作小红书配图（带文字的大图、卖点图）时触发。完整流程：理解需求 → 精炼文案 → 用 AI 生成底图 → 叠加文字 → 通过飞书发出。所有图片存 /workspace/xhs/。 | |
| Character Intro 角色介绍技能。当用户输入一个人物名称（动漫角色、游戏角色、影视角色、历史人物、原创角色等），要求生成全面介绍（背景、来源、性格、能力、关系等）时触发本技能。支持中英文角色名、角色绰号/别名搜索。触发词包括：介绍、人物介绍、角色介绍、是谁、全面介绍、全面解析、背景故事。 | |
| Feishu Group Chat 让你的飞书Bot可以在群里与其他（使用了本skill的）Bot/用户聊天。 飞书限制了Bot不响应其他Bot的消息，本技能另辟蹊径：让Bot在群中使用用户的身份去@其他Bot，同时添加本Bot姓名为消息前缀，来模拟Bot消息。把你的多个Bot加到一个群里，他们就能相互聊天甚至分配任务了。 触发场景：需要在飞书群里... | |
| 了解天气 Get current weather and forecasts (no API key required). | |
| Audio Transcription Transcreve arquivos de áudio para texto usando Whisper local ou API. Use quando o usuário solicitar transcrição de áudios, mensagens de voz, ou converter fal... | |
| cleimesh-mcp Put the MCP tools an agent already uses behind CleiMesh, so each tool call runs under a signed, narrowable token and leaves a replayable receipt — a prompt injection cannot widen the grant, and you can prove afterwards what every tool did. | |
| CleiMesh Setup Put an AI agent's file work behind CleiMesh, so a prompt injection in an email or web page cannot read your keys or write where it wants, and every call leaves a signed receipt. Use when the user wants to run OpenClaw, Hermes Agent or Claud | |
| Alphagbm Alert Set price, IV, or activity-based alerts with contextual notifications. Alert types include IV rank threshold crossing, price support/resistance breaks, unusu... | |
| Alphagbm Bps Backtest Full walk-forward Bull Put Spread backtest over ~8 years of daily history. Runs both the signal (FearScore ≥ 60 entry) version AND a no-signal control in the... | |
| Alphagbm Buffett Analysis Warren Buffett-lens scorecard for any ticker. Scores 4 dimensions 0-100 each (business / circle of competence, moat / durable advantage, management / capital... | |
| Alphagbm Company Profile Build and maintain company research profiles on AlphaGBM — auto-generated from fundamentals, PE/PB Band history, financial red flags, and event radar. Each p... | |
| Alphagbm Compare Side-by-side comparison of 2-5 stocks or options across GBM Five Pillars scores, options metrics, technicals, and valuations. Identifies the winner by catego... | |
| Alphagbm Duan Analysis Duan-Yongping-style seller playbook for any ticker: Sell Put at your "willing buy" price, Covered Call for yield enhancement, and a Panic-Buy context read of... | |
| Alphagbm Earnings Crush Full earnings-season IV analysis: historical crush, implied move forecast, IV Rank strategy tag, and a priced Iron Condor quote ready to trade. Triggers: "ea... | |
| Alphagbm Fear Score Per-ticker panic index (0-100) that weights six real signals: VIX, IV Rank, RSI-14, options volume anomaly, Put/Call ratio, and consecutive-down days. Scores... | |
| Alphagbm Greeks Greeks dashboard for any option contract or multi-leg position. Covers first-order Greeks (Delta, Gamma, Theta, Vega, Rho) and second-order Greeks (Charm, Va... | |
| Alphagbm Health Check Weekly diagnostic report on a user's research knowledge base — flags stale profiles (not updated in weeks), thesis drift (AI detects original premise no long... | |
| Alphagbm Hedge Advisor Scenario-driven hedge recommendations for an existing stock position. Takes ticker + cost basis + purpose, auto-classifies the holding situation (falling kni... | |
| Alphagbm Investment Thesis Record and track the "why I bought" and "when I sell" for each position. Each thesis is attached to a company profile: buy reasons in prose, sell conditions... | |
| Alphagbm Iv Rank IV Rank and IV Percentile analysis showing where current implied volatility stands relative to its 252-day history. Returns IV rank (0-100), IV percentile (0... | |
| Alphagbm Macro View Track the macro variables that actually move your portfolio — VIX, US10Y, DXY, gold, oil, etc. — with auto-computed impact on user's holdings. Each tracked i... | |
| Alphagbm Market Sentiment Market-wide sentiment dashboard with VIX, Put/Call ratio, Fear & Greed Index, market breadth, and sector rotation analysis. Classifies current regime as risk... | |
| Alphagbm Marks Cycle Howard Marks-style market cycle position 0-100, with 0 = panic bottom (hard offense) and 100 = euphoric top (hard defense). Blends VIX (40%) + SPY IV Rank (2... | |
| Alphagbm Options Score Score and rank options contracts for any ticker using AlphaGBM's multi-factor scoring model (liquidity, IV attractiveness, Greeks balance, risk/reward). Retu... |
21,551–21,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.