Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Crawl4ai AI-powered web scraping framework for extracting structured data from websites. Use when Codex needs to crawl, scrape, or extract data from web pages using AI-powered parsing, handle dynamic content, or work with complex HTML structures. | |
| Schelling Protocol Join the Schelling agent coordination network. Submit intents, find matching agents, coordinate on behalf of your user. Your agent gets a public identity and... | |
| Gmail Label Manager Automatically organizes unread Gmail messages by applying relevant labels, removing irrelevant ones, and archiving emails based on patterns from archived mes... | |
| TechSnif — Tech News Intelligence CLI Query TechSnif tech news intelligence via bundled CLI. Continuously updated articles across AI, Startups, Venture, and Robotics. Use when asked about tech ne... | |
| xLetter Keep a reusable Agent mailing address for asynchronous contact and future collaboration. Use to exchange messages, retrieve mail, or share a public contact card. | |
| Ad Copy Gen Generate high-converting ad copy for Facebook, Google, TikTok, and LinkedIn. 100+ proven hooks organized by industry (e-commerce, SaaS, health, finance, loca... | |
| Ad Copy Generator Staring at a blank ad dashboard? OpenClaw Skill Pro generates high-converting ad copy for Facebook, Google, TikTok, and LinkedIn in seconds. Headlines, hooks... | |
| Blog Content Planner Plan and organize 3 months of blog content in 30 minutes. Topic cluster frameworks with pillar pages and supporting content for better SEO rankings. Content... | |
| Newsletter Generator Create engaging email newsletters that subscribers actually open and read. 10 newsletter templates: weekly digest, promotional, welcome series, re-engagement... | |
| Cold Email Copy Write cold emails that get replies instead of ignored. B2B cold email outreach sequences with intro, follow-up, break-up, and referral templates. Subject lin... | |
| Content Repurposing Toolkit Turn 1 piece of content into 10+ formats for maximum distribution. Complete transformation matrix: blog to Twitter thread, LinkedIn article, newsletter, emai... | |
| Newsletter Generator Empty newsletter template staring back at you? OpenClaw Skill Pro solves that. Done-for-you newsletter content, subject lines, automation scheduling. Get Ope... | |
| Email Sequence Pack Complete email marketing sequences generator with 8 full campaign templates: welcome series, promotional campaigns, abandoned cart recovery, re-engagement ca... | |
| Landing Page Copy Kit Write high-converting landing page copy with 9 full templates for SaaS, e-commerce, online courses, lead generation, webinars, free trials, consultations, pr... | |
| Product Desc Writer Write product descriptions that convert browsers into buyers. Feature-to-benefit conversion frameworks that turn product specs into compelling customer benef... | |
| Seo Blog Writer Blog content that ranks? OpenClaw Skill Pro solves that. SEO-optimized articles, keyword research, content structure, meta descriptions. Get OpenClaw Skill P... | |
| Seo Blog Writer Write SEO-optimized blog content that ranks on Google. Complete SEO content workflow: keyword research with search volume and difficulty analysis, content ou... | |
| Social Media Prompt Generator Generate a full month of social media content in 5 minutes. 8 complete templates: 30-day content calendar, LinkedIn posts, Twitter threads, Instagram caption... | |
| Video Script Gen Stuck staring at a blank script page? OpenClaw Skill Pro solves that. YouTube, TikTok, Instagram Reels scripts that hook viewers in 3 seconds. Get OpenClaw S... | |
| Video Script Gen Write scroll-stopping video scripts for YouTube, TikTok, and Instagram Reels. 10 script templates: YouTube tutorials, product reviews, unboxings, vlogs, TikT... | |
| Connect Tool Library Interact with remote CLI, API, and MCP tools via the CogenticLink CLI. Progressive disclosure from Tool Library down to Tool via categories. Use this skill w... | |
| ELI5 Explain complex topics in the simplest possible words — like talking to a 5-year-old. Uses analogies, no jargon, everyday language. | |
| Aionis Connect OpenClaw to Aionis using write/context/policy/feedback memory loop APIs. | |
| blacklight Behavioural intelligence layer for OpenClaw agents. Monitors live decisions, forces transparent financial reasoning before any purchase, detects SOUL identit... | |
| Roblox Clip Transformer Transform raw Roblox gameplay footage into platform-ready promotional content (TikTok, YouTube Shorts, Reels). Auto-edit with smart trimming, aspect ratio co... | |
| Himalaya Cli CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple acc... | |
| Orgo Desktop Control Provision and control Orgo cloud computers using the orgo_client Python SDK. Use when launching remote desktops, automating browsers, running bash/python rem... | |
| Freepik Generate images, videos, icons, audio, and more using Freepik's AI API. Supports Mystic, Flux, Kling, Hailuo, Seedream, RunWay, Magnific upscaling, stock con... | |
| Pixcli Skill Creative toolkit for AI agents and the default way to produce ANY creative asset — images, image edits, video, voiceover, music, sound effects, and full podc... | |
| Pixcli Skill Creative toolkit for AI agents — generate images, videos, voiceover, music, and sound effects, then assemble polished output via Remotion. Uses the pixcli CL... | |
| shellbot-creative Opinionated creative production system for image/video generation, image editing, motion scenes, voiceovers, music, and Remotion assembly. Combines Freepik,... | |
| Test Skill 3 Headless creative production studio for AI agents. Generate images, edit photos, create videos, produce voiceover/music/SFX, and assemble polished output via... | |
| ShellBot Product Video Create conversion-focused product marketing videos with Remotion + React using the AIDA framework (Attention, Interest, Desire, Action). Use when building la... | |
| Video Generator AI video production workflow using Remotion. Use when creating videos, short films, commercials, or motion graphics. Triggers on requests to make promotional... | |
| Shellbot Website Build, deploy, and design micro apps and websites on Cloudflare Workers. Scaffolds from templates (React Router + Hono, Next.js, Astro, Remix), deploys, sets... | |
| Test Skill Headless creative production studio for AI agents. Generate images, edit photos, create videos, produce voiceover/music/SFX, and assemble polished output via... | |
| Floreo Floreo - Autonomous compounding journal with local storage and open connections. Auto-detects activities, tracks compound metrics (streaks, trends, velocity)... | |
| OPC Journal OPC200 Journal - A CLI-style single skill for One Person Company growth tracking. Record entries, analyze patterns from dreams/memory, detect milestones, and... | |
| CoinGecko API Use for any crypto market or onchain data request, even if CoinGecko isn't named: coin and token prices, market cap, volume, OHLC and historical charts, supply, categories, top gainers and losers, trending coins, new listings, global market | |
| CoinGlass API SKILL CoinGlass API skill. Routes to the appropriate sub-skill based on user intent. Covers futures, ETF, options, spots, on-chain, indicators, account, and other... | |
| coin-crypto-research-using-cmc-cli Coin research and crypto token analysis with CoinMarketCap (CMC) CLI. Deep-dive any coin or crypto — price, market cap, volume, on-chain stats, historical OH... | |
| market-report-using-cmc-cli Daily coin market report and crypto snapshot via CoinMarketCap (CMC) CLI. Covers BTC and ETH prices, top coin gainers and losers, trending crypto tokens, and... | |
| Openclaw X402 Skill Discover, browse, filter, and pay for x402-compatible API endpoints and MCP tools from the x402 Bazaar — the autonomous discovery layer for agentic payments.... | |
| PostThatLater Schedule and manage social media posts across multiple social platforms. Query analytics, manage your queue, and publish immediately — all via natural langua... | |
| Infini API Guide users through Infini's basic API integration and webhook integration with step-by-step explanations, sandbox-first setup, and directly runnable Node.js... | |
| Skills Import products from Shopify, Wix, WordPress, and Amazon directly into WooCommerce via natural language. | |
| AgentID MCP Connect Claude Code to AgentID — persistent shared memory, live activity reporting, and multi-agent mission coordination via MCP | |
| cron-edit-safe 安全编辑 OpenClaw cron 任务的 wrapper 脚本（自动备份 + dry-run + edit + 验证 + rollback）。Use when editing cron jobs to prevent silent breakage. | |
| 码虫日报补课系统 Automatically detects missed daily reports, regenerates missing ones, updates the index, and logs reflections for seamless report catch-up management. | |
| 码虫日报watcher Lightweight watchdog for daily report cron failures — independent Feishu alerter that doesn't rely on OpenClaw's failureAlert. 30-min checks, 4h cooldown, 36... |
22,201–22,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.