Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Alphagbm Options Strategy Recommends optimal multi-leg option strategies based on your market view (bullish, bearish, neutral, volatile). Supports 15+ strategy templates including spr... | |
| Alphagbm Pnl Simulator P&L simulation engine for any single-leg or multi-leg option position. Generates profit/loss diagrams at expiry, P&L over time, what-if scenarios (price, IV,... | |
| Alphagbm Polymarket Integrates prediction market data (Polymarket) with options analysis to surface mispricing signals between event probabilities and options-implied probabilit... | |
| Alphagbm Stock Analysis AI-powered stock analysis using AlphaGBM's Five Pillars framework (Fundamental, Technical, Sentiment, Flow, Valuation) with real market data. Returns a 1-10... | |
| Alphagbm Take Profit Quantifies whether a stock is suitable for long-term holding or requires tiered profit-taking — using a novel "rollercoaster rate" metric (probability that a... | |
| Alphagbm Tepper Signal Quantified version of David Tepper's 2009 (+132%) and 2020 (+82%) panic-buy playbook. Detects whether current conditions match Tepper's signal: VIX ≥ 35 AND... | |
| Alphagbm Theme Research Group related tickers into investment themes — AI infra, HK dividend, EV supply chain, biotech catalysts — with theme-level AI summary and news keyword monit... | |
| Alphagbm Unusual Activity Detects unusual options activity and smart money signals. Monitors volume/OI ratio spikes, large block trades, unusual strike/expiry combinations, and net pr... | |
| Alphagbm Vix Status Current VIX level + 5-tier fear-thermometer classification + option-seller strategy hint. Translates the single VIX number into actionable trading guidance (... | |
| Alphagbm Vol Smile 2D volatility smile and skew analysis for a single expiration date. Maps IV across strikes to reveal put skew, call skew, and smile shape. Returns smile curv... | |
| Alphagbm Vol Surface 3D volatility surface analysis mapping implied volatility across strikes (moneyness) and expirations. Shows whether options are cheap or expensive at every p... | |
| Alphagbm Watchlist Monitor a list of tickers for key changes in price, IV rank, unusual activity, earnings dates, and score changes. Supports custom watchlists and a default "h... | |
| Code Optimizer 代码质量自动评估与优化系统 — 基于ML的代码评分、策略选择、自动优化 | |
| Hermes 记忆与技能系统 Hermes 智能体增强系统 — 自动记忆管理、技能生成、跨会话持久化 | |
| Nvidia Agent Fleet NVIDIA Agent Fleet — 19个模型Agent + 智能调度引擎 + 并行协作 | |
| Nvidia Free Api NVIDIA 免费 API 集成 — 133+ 主流模型，OpenAI 完全兼容 | |
| Project Sharing System 项目共享系统 — 多 Agent 项目状态协作与自动发现 | |
| Shanv Trader Provides AI-assisted semi-automatic stock trading with signal scanning, trade confirmation, risk control, execution, and position monitoring. | |
| Stock Analysis Framework 完整的A股股票分析框架（六维体系）及盯盘监测工具。包含基本面分析、技术面分析、消息面监控、资金面追踪、市场心理判断、宏观政策解读六大维度。提供结构化分析模板、实时盯盘脚本、简报生成工具。适用于：个股深度分析、持仓监控、盘面实时判断、交易策略制定。 | |
| stock-unified 多源统一股票数据接口，整合通达信(pytdx)/同花顺/东方财富(新版API)/akshare五大股票数据源，自动降级切换。用于A股实时行情查询、K线历史、板块排行与成分股、财务数据、板块搜索等场景。当用户查询股价、板块排行、成分股、K线、财务数据时使用。 | |
| Airtable Overview Explains what Airtable is and how data is structured — bases, tables, fields, records, views, automations, and interfaces. Use when you need context about th... | |
| Niche - Peer to Peer Trading Cards Marketplace Trading card marketplace with partial USDC deposits. Browse cards, deposit partial amounts, and complete purchases with secure on-chain escrow. | |
| Poker Agent Play Texas Hold'em poker on Tempo testnet by registering, funding with aUSD, joining tables, polling game state, and submitting actions in real time. | |
| Go Stargazing 轻量版区域级拍星推荐技能，适用于今晚或指定日期的全国、省市级拍星条件筛选。默认全国扫描，先按云量粗筛，再结合真实天气细筛，输出逐晚推荐和完整气象信息。 | |
| Go Stargazing Trip 多日晚拍星/观星连续性推荐技能。基于逐晚候选结果做跨晚路线连续性、转场距离、连住收益和可执行性判断；输出主路线、备选路线、远线方案以及路线风险说明。用于用户明确询问“假期怎么连着走最顺”“主路线/备选路线/远线怎么选”“多天连续拍星怎么安排”时。 | |
| Fact Checker Fact-check news articles, social media posts, images, and videos. Use when verifying claims, detecting deepfakes or AI-generated content, identifying out-of-... | |
| elite-human-memory Portable Clawhub-compatible human-like memory system with layered storage (Working/Episodic/Semantic + optional Vector index), rich metadata schema, auto-pro... | |
| Elite Human Memory Hermes Hermes-optimized human-like memory system with semantic search, auto-promotion, conflict resolution, and direct integration with the Hermes memory tool. | |
| pdf-nano Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multipl... | |
| Notesctl Manage Apple Notes via deterministic local scripts (create, append, list, search, export, and edit). Use when a user asks OpenClaw to add a note, list notes, search notes, or manage note folders. | |
| Openclaw Receipt Manager Manage personal receipts by extracting data from images, storing records, and providing expense searches and monthly financial summaries. | |
| Islamic Reflection Provides daily Islamic reflections with Hijri calendar awareness, including Ramadan, Jummah, and Dhul Hijjah, plus Quran/Hadith references and practical chal... | |
| Prayer Times, World Salah Times Get instant, accurate Islamic prayer times for any location worldwide. Auto-detects your city or accepts any city/country name globally. Handles typos with smart fuzzy search. Shows Fajr, Sunrise, Dhuhr, Asr, Maghrib, and Isha times in 12-h | |
| UK Prayer Times Get instant, accurate Islamic prayer times for any UK location. Auto-detects your city or accepts any UK location name (cities, towns, boroughs). Handles typos with smart fuzzy search. Shows Fajr, Sunrise, Dhuhr, Asr, Maghrib, and Isha time | |
| Clink Integration Design, scaffold, validate, and review ClinkBill/Clink payment integrations, including clink-integ-cli usage, local clink login Secret Key bootstrap, browserless manual Secret Key setup, webhook endpoint automation, product/price/subscripti | |
| clip2md Use Clip2MD to connect an AI assistant, save web pages as Markdown, check quota, query task status, wait for completion, and retrieve results. Use when the user mentions Clip2MD, 剪藏, 保存网页为 Markdown, 查询额度, 提交链接, or 查询任务. | |
| cliphi-clips Turns the user's long videos into ready-to-post vertical clips with captions and branding, using the Cliphi API. Use this skill when the user wants to clip a video, make Shorts / TikToks / Reels from a YouTube video, podcast, livestream or | |
| BNBCHAIN Protocol & Matrices Analysis — Powered by ClipX Thin client for the private ClipX BNBChain API, returning text-only JSON metrics and rankings for BNB Chain (no scraping code, no API keys). | |
| WeChat Send Automate sending text messages in the macOS WeChat desktop app by controlling the UI via AppleScript and JXA. This is NOT a WeChat chat channel for OpenClaw... | |
| MoltGov Governance infrastructure for Moltbook AI agents. Enables democratic self-organization through citizenship registration, trust webs, elections, class hierarchies, and faction alliances. Use when agents want to: (1) join or participate in AI | |
| pact0 Earn money doing small jobs for people and other agents, or hire other AI agents for a task, on pact0 (https://pact0.com). Use when you want paid work, a public signed track record, free graded trials that prove what you can do, or to hand | |
| pact0-hire Delegate a bounded part of an existing task when another worker can provide evidence or access your own tools cannot, especially a cold test of your API, MCP server or signup flow in a real external client. Check existing spending authority | |
| SearXNG Local Search the web using a self-hosted SearXNG instance. Privacy-respecting metasearch that aggregates results from multiple engines. | |
| SearXNG Metasearch Search the web using a self-hosted SearXNG instance. Privacy-respecting metasearch that aggregates results from multiple engines. | |
| SearXNG Self-Hosted Search Search the web using a self-hosted SearXNG instance. Privacy-respecting metasearch that aggregates results from multiple engines. | |
| Lead Processor Automates B2B lead cleaning and classification by analyzing client websites, grading leads A/B/C, updating Feishu tables, and sending reports to Feishu groups. | |
| 决策推演工具 世界级战略决策推演工具。以第一性原理为锚点，融合三层九问框架（门槛关/优势关/智慧关），对任何候选业务方向、战略动作、新产品线或战略转型进行深度推演。内置事前验尸协议、时机判断框架、心智模型库、退出条件与里程碑设计。触发场景："我们要不要做XX方向""用第一性原理判断这个业务值不值得做""主线/聚焦/克制决策推演""战略推演""选方向"等。这不是一个简单的"做/不做"二选一工具，而是一个逼出盲区、校准决策质量、留下可复盘痕迹的系统。 | |
| Closeli Open Device List Query Closeli Device List Query API. Used to retrieve the device list under the current account and return basic information such as device name, MAC, and IMEI. Us... | |
| Closeli Open Device Live Query Closeli Device Live Query API. Used to obtain the Web live playback link for a specified device and supports real-time viewing of the device feed. Use when:... | |
| Closeli Open Device status Query Closeli Device Status Query API. Used to query the current status of specified devices and supports determining whether a device is online, offline, or sleep... |
21,601–21,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.