Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 南京留学移民审计 | Nanjing Agency Audit 南京留学、移民、海外身份及因私出入境机构的中英双语证据审计；用于全量列举南京机构、核验资质或合同主体、横向比较与评分、审计指定机构、识别初创或渠道型中介、调查客诉与营销话术，以及起草防坑条款。Bilingual evidence-led audit of Nanjing study-abroad, immigration, overseas-identity, and private-entry/exit agencies; use for full rosters, ent | |
| VPS Backup Automated daily VPS backup using restic — backs up OpenClaw workspace, SSH keys, project code, and session transcripts. Configures encrypted incremental snap... | |
| Send Usms Uspeedo Sends international SMS (USMS) via uspeedo platform HTTP API. Use when the user needs to send international SMS, batch SMS, verification/notification/marketi... | |
| uspeedo-email-sending-channel Sends user-authorized transactional email via uSpeedo API with ACCESSKEY credentials (env preferred). Before SendEmail, calls GetSenderList to resolve SendEm... | |
| Wangwen Author Suite 网文写作助手（爆款引擎·写审一体）：写小说/创作小说/生成小说/小说大纲/网文创作/番茄小说/起书名/写简介/网文评审/锐评/巨著桌/导出番茄/MD转TXT。含番茄专线、女频、上架文案、内置四十年读者巨著桌、export_fanqie导出脚本。当用户提到写小说、番茄小说、小说大纲、锐评、巨著桌、导出番茄、MD转TXT、番茄粘贴、网文写作助手时启用。 | |
| OpenHarmony React Native Performance OpenHarmony React Native performance static checks and optimization. Based on ohos_react_native performance doc. Use when writing or reviewing React Native for OpenHarmony code, bundle-harmony, lifecycle, or TurboModule. Applies to RNAbilit | |
| Content Moderation Moderate text, images, and video using Vettly's content moderation API via MCP server. | |
| Shelter Connect to your Shelter financial data. Check safe-to-spend, predict cash crunches, find zombie subscriptions, simulate purchases, get AI coaching, and ask G... | |
| 1gateway-korea-data Use when an agent needs Korean data (apartment sale prices, Korean public holidays, Korean company lookup) or agent utilities (HWP/HWPX/PDF/DOCX to Markdown, clean web page reading, document extraction). Pays per call in USDC via AgentCash/ | |
| Spotify Playlist Builder Build and manage Spotify playlists from natural language requests. Search tracks/artists/albums, create playlists, manage tracks, view listening history. Use... | |
| Asset Allocation Professional investment advisory skill. Use when user asks about investing, wealth management, asset allocation, fund/etf selection, retirement planning, or... | |
| Crypto Investment Strategist Professional cryptocurrency investment and strategy analysis for spot, swing, and leverage decisions. Combines technical analysis, market regime assessment,... | |
| Email Assistant 多邮箱管理助手，支持 Gmail、163、QQ、Outlook、Hotmail。功能：(1) 读取收件箱并展示邮件摘要 (2) 关键词分析标记重要邮件 (3) 自动提取邮件中的日程信息并生成日历事件。适用于需要统一管理多个邮箱、避免错过重要邮件和日程的用户。 | |
| Expense Tracker v2 Track expenses and income with multi-backend storage (local/Notion/Google Sheet/Supabase). Credentials are encrypted with AES-256-GCM. Use when user wants to... | |
| Memory Organizer Organize, compress, and curate OpenClaw memory without polluting permanent memory. Use when the user wants to compress memory files, clean dated memory notes... | |
| Memory Transfer Transfer memory files from one OpenClaw agent to another. Use when you need to migrate memory, configuration, or context from one agent to another agent. | |
| Memory Transfer Enhanced Transfer memories between OpenClaw agents with optional topic filtering, supporting sharing mode with role transformation or cloning mode for verbatim copies. | |
| Openclaw Remote Install One-click remote OpenClaw deployment via SSH. Auto-detects OS and selects best method (Docker/Podman/npm). Use when: (1) Installing on VPS/cloud servers, (2)... | |
| Skill Analyzer Analyzes OpenClaw skills for functionality, security, usability, documentation, maintainability, and best practices to provide quality scores and improvement... | |
| Skill Autogenesis Review completed work, summarize reusable procedures, identify recurring workflow patterns, and decide whether to create a skill, patch an existing skill, st... | |
| SkillHub Manager Manage and publish agent skills on SkillHub and ClawHub. Best for developers and operators who need a repeatable workflow to search skills, inspect packages,... | |
| Akshare Finance 1.0.0 AKShare财经数据接口库封装，提供股票、期货、期权、基金、外汇、债券、指数、加密货币等金融产品的基本面数据、实时和历史行情数据、衍生数据。 | |
| Kaspa Dev Comprehensive Kaspa blockchain development toolkit for building transactions, integrating wallets, creating dApps, block explorers, and interacting with the Kaspa network. Use when working with Kaspa blockchain development including: (1) Bu | |
| Agent Browser Core OpenClaw skill for the agent-browser CLI (Rust-based with Node.js fallback) enabling AI-friendly web automation with snapshots, refs, and structured commands. | |
| Auto Shorts Repurposer Repurpose long-form video or audio into short-form clip plans with timestamps, hooks, captions, and packaging notes. Use when a user asks to turn a long video, podcast, or stream into Shorts, Reels, TikTok-style outputs, or highlight clips | |
| Community Mod Pack Assist community moderation with summaries, spam detection suggestions, and draft replies for Discord or Telegram. Use when a user wants moderation help, rule reminders, or daily summaries without automatic enforcement actions. | |
| Discord OpenClaw skill for Discord Bot API workflows, covering interactions, commands, messages, and operations using direct HTTPS requests. | |
| Elevenlabs AI Access ElevenLabs APIs for text-to-speech, speech-to-speech, realtime speech-to-text, voice/model management, and dialogue workflows with direct HTTP calls. | |
| Facebook OpenClaw skill for Facebook Graph API workflows focused on Pages posting, comments, and Page management using direct HTTPS requests. | |
| Google Sheet API OpenClaw skill that installs a Google Sheets CLI with setup steps and commands for read/write, batch, formatting, and sheet management. | |
| Google Sheets API OpenClaw skill that installs a Google Sheets CLI with setup steps and commands for read/write, batch, formatting, and sheet management. | |
| Meeting To Action Convert meeting notes or transcripts into clear summaries, decisions, and action items with owners and due dates. Use when a user asks to turn a meeting recording, transcript, or notes into a follow-up plan. | |
| Messenger OpenClaw skill for Facebook Messenger Platform workflows, including messaging, webhooks, and Page inbox operations using direct HTTPS requests. | |
| n8n API Operate n8n via its public REST API from OpenClaw. Use for workflow management, executions, and automation tasks such as listing, creating, publishing, triggering, or troubleshooting. Works with both self-hosted n8n and n8n Cloud. | |
| n8n Hub Centralized n8n hub for designing reliable flows (idempotency, retries, HITL) and operating them via the public REST API. Use for planning, JSON output, and lifecycle actions like list/publish/debug. | |
| Podcast Chaptering Highlights Create chapters, highlights, and show notes from podcast audio or transcripts. Use when a user wants chapter markers, highlight clips, or show-note drafts without publishing or distribution actions. | |
| Receipt Subscription Cleaner Identify recurring charges and subscriptions from receipts or email exports, and produce a clean summary with renewal dates, price changes, and cancellation drafts. Use when a user wants to audit spending without initiating payments or canc | |
| Shopping Price Drop Coupon Scout Track product prices and surface official coupons or discounts without purchasing or account access. Use when a user wants price alerts, deal summaries, or coupon lists for specific items or retailers. | |
| Smart Home Energy Saver Analyze home energy usage and propose safe, read-only automation plans for savings. Use when a user wants Home Assistant energy insights, optimization ideas, or draft automation YAML without directly controlling devices. | |
| Telegram OpenClaw skill for designing Telegram Bot API workflows and command-driven conversations using direct HTTPS requests (no SDKs). | |
| Travel Price Drop Visa Reminder Plan travel price monitoring and visa or document reminders with safe, read-only guidance. Use when a user wants price drop alerts, travel checklists, or visa timelines without booking or payment actions. | |
| Twilio Integrate Twilio APIs for SMS, WhatsApp, Voice, Verify, and more via direct HTTP requests with webhook validation and operational best practices. | |
| Wordpress REST API OpenClaw skill that provides a WordPress REST API CLI for posts, pages, categories, tags, users, and custom requests using plain HTTP. | |
| Zalo OpenClaw skill for Zalo Bot API workflows (bot token) plus optional guidance on unofficial personal automation tools. | |
| Elytro Smart Account CLI Entry point for the Elytro wallet skill plus the curated DeFi sub-skills. Start here before loading any individual protocol skill. | |
| Case Research 中国财税法律案例与法规检索助手。当用户需要检索税务相关判例、行政复议决定、税收法规政策、国家税务总局公告、各地税务实践案例，或需要查找类似税务争议案例时，应使用本 Skill。适用于税务争议应对、税务筹划合规性验证、法律研究等场景。 | |
| China Tax Law 中国财税法律专业知识助手。当用户涉及中国税法咨询、税务筹划分析、税务合规审查、税收政策解读、税务争议处理等任务时，应使用本 Skill。适用场景包括但不限于：增值税、企业所得税、个人所得税、印花税、土地增值税等税种分析，税务筹划方案设计，税务稽查应对，以及涉税法律法规查询。 | |
| Legal Doc Writer 中国财税法律文书起草助手。当用户需要起草、审查或修改法律文书时应使用本 Skill，包括：税务筹划报告、法律意见书、合同税务条款、税务行政复议申请书、税务行政诉讼状、税务咨询报告、客户尽职调查报告、税务处理意见函等各类涉税法律文书。 | |
| Tax Calculator 中国税务计算工具。当用户需要计算具体税额时应使用本 Skill，支持增值税、企业所得税、个人所得税、土地增值税、印花税等主要税种的税额计算，以及多方案税负对比分析。适用于税务筹划效果量化、交易税务成本估算、税负分析报告等场景。 | |
| Threads Repurposer Repurpose source content into Threads-ready posts or threads for founders, creators, and consultants. Use when the user wants to turn a blog post, transcript... |
21,851–21,900 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.