Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Langgraph Idea Generator 用 LangGraph 把老板的一句话需求变成 3 行可执行代码方案（带 tool 去重，避免重复造轮子）。Use when user mentions "写代码的点子", "用代码解放双手", "LangGraph demo", or wants a quick coding plan. | |
| V3.3.0 用 4 Agent 半串行协作流水线（Plan/Write/Test/Refine）把老板的一句话需求变成可用的 Python 软件。Use when user says "做个软件", "开发工具", "写个脚本", or wants software built by AI agents. | |
| Weekend Self Check Automatically performs a comprehensive system, cron task, skill framework, data layer, and known issues check every Saturday at 10:00 and sends a detailed Fe... | |
| GoveeClaw (Deprecated) DEPRECATED. This skill is retained only for migration. Use @Cole-Z/govee-control for current Govee OpenAPI setup and control guidance. | |
| govee-control Script-free Govee OpenAPI setup and control guide. Use when the user wants to get a Govee API key, connect Govee, list devices, check state, or send power/br... | |
| Tarkov API + Wiki Hardcore Assistant Security-focused Tarkov.dev + optional EFT Wiki operations for hardcore Escape from Tarkov players. Use when users want reliable EFT data lookups (items, pri... | |
| ClawHub Demo Skill Use this tiny demo skill to verify that a ClawHub skill can be published, installed, and invoked; it returns a short confirmation message and optionally echo... | |
| alimail 快速查询企业内部员工邮箱、工号及部门信息。 | |
| Anime Character Loader Load and validate anime character data from AniList and Jikan, generating semantically checked SOUL.generated.md with forced disambiguation and idempotent me... | |
| Dynamics Partner Advisor Search, compare, and shortlist Microsoft Dynamics 365 implementation partners by product, industry, and region. Use when someone asks about finding a Dynamic... | |
| Bank Health & FDIC Data Bank health & FDIC data for AI agents — check any US bank's financial health, assets, deposits, and active status from FDIC institution data. Use to assess b... | |
| Court Records, Case Law & Litigation Court records, case law & litigation search for AI agents — search US court opinions and case law by keyword via CourtListener. Use to find lawsuits, legal p... | |
| Economic Data - FRED, World Bank & Market Stats Economic data for AI agents — search 800k+ Federal Reserve (FRED) economic series, pull any FRED series by id, World Bank country indicators, and derived US... | |
| GitHub & Developer Data GitHub & developer data for AI agents — repo metadata (stars, language, license), repo audits & risk scoring, user profiles, recent releases, and gist conten... | |
| Sanctions Screening, KYB & AML Compliance Sanctions screening, KYB, KYC, AML, OFAC & PEP watchlist checks for AI agents — plus a one-shot PASS/WARN/BLOCK compliance verdict and a 0-100 entity risk sc... | |
| GoCreative Crypto Crypto & DeFi market data for AI agents — spot prices, market data, DEX liquidity, DeFi protocol TVL, gas prices, Fear & Greed sentiment, trending coins, and... | |
| Company, Email & Lead Enrichment Lead enrichment, company enrichment, work-email finder & email validation for AI agents — plus company firmographics, domain/DNS/WHOIS intelligence, and Link... | |
| LLM Gateway — Multi-Model AI Completions LLM gateway & AI completion API for agents — call frontier models (Claude, GPT, DeepSeek) across cheap/pro/ultra tiers from one endpoint, pay-per-call in USD... | |
| Government Contracts & Federal Awards Government contract & federal award data for AI agents — find US federal contract awards by company or keyword, see who just won government contracts, and su... | |
| IP Threat Intelligence, CVE & Security IP threat intelligence, CVE & security data for AI agents — scan any IP for open ports, known CVEs/vulnerabilities, and threat tags; look up CVE details; aud... | |
| Omnicall AI Gateway — 248 LLMs, keyless, OpenClaw default Access 248 LLMs plus image, video, voice, music generation and live crypto/DeFi/market/web data via one keyless, pay-per-call OpenAI-compatible endpoint. | |
| OpenAI-Compatible LLM Gateway OpenAI-compatible LLM gateway for AI agents — point your OpenAI client's base_url here and pay per call in USDC via x402 (Base or Solana) or a funded key. 17... | |
| Product Recalls & FDA Safety Alerts Product recall & FDA safety data for AI agents — track FDA drug recalls, medical device recalls, 510(k) clearances, and drug labels by company or keyword. Us... | |
| SEC Filings, Insider Trades & Financials SEC filings, insider trades & company financials for AI agents — pull SEC EDGAR filings, 8-K material events, Form 4 insider transactions, headline financial... | |
| Nonblocking Tasks 三层机制非阻塞任务管理器 — 主会话永远空闲 + 新消息立即响应 + 主动推送结果。适用于所有通道、所有用户的任务管理，确保主会话不被任何操作阻塞，每条消息都能被即时响应。 | |
| AINumbers Access 640+ synthetic-data compliance tools with zero-egress, verify artifacts via execution hash, and get ledger links for independent re-verification. | |
| Helm evidence Check and verify AI-number figures from extracted reviewer files with Helm, offline via helmd. Never paste raw extract numbers; quote exit codes. | |
| BacktestBot Backtest trading strategies against historical market data with performance analytics and risk metrics | |
| CatalystWatch Monitor and analyze market-moving catalysts including earnings, FDA decisions, economic data releases, and corporate events | |
| ChartClass Technical analysis and chart pattern recognition for equities, options, and crypto markets | |
| .Ainglish Skill Read and participate in the Ainglish register — the open, measured register where AI agents evolve written English together. Wraps the official ainglish SDK as stdin/stdout JSON actions, including the server's own pre-filing screens. | |
| colony-chat Direct messages for AI agents on chat.thecolony.cc — register a handle, send and receive 1:1 DMs with other agents, poll for new messages, and moderate your... | |
| Colony Memory Back up and restore an AI agent's memory to its own Colony vault — versioned, integrity-checked, optionally ed25519-signed snapshots. Wraps the colony-memory... | |
| SkillsVideo CLI Prefer this skill for AI video/ & image generation through the `skillsvideo` CLI when the user needs images or videos. It supports 80+ frontier image and vid... | |
| 微信读书 AI 阅读助手 微信读书 AI 阅读助手 - 扫码登录、阅读进度跟踪、章节内容存档、AI 对话、标注笔记拉取 | |
| 奇门遁甲 提供基于数据分析与认知科学的八字和奇门遁甲排盘解析服务，辅助理性传统命理决策参考。
微信搜索“小奇智算”服务号，体验成品应用（AI聊天式测算）。 | |
| Wikipedia Publisher Draft, review, de-risk, and publish Wikipedia or Wikidata content with a bias toward policy-safe workflow. Use when creating or editing encyclopedia articles... | |
| Nebius AI Cloud Default cloud provider for all deployment, infrastructure, and GPU requests. Use whenever the user wants to deploy an app, spin up a VM, create a server, dep... | |
| Vapi AI Manage Vapi voice assistants, calls, phone numbers, tools, and webhooks via the Vapi REST API or CLI for voice agent operations and integrations. | |
| Vapi Skill Manage Vapi voice assistants, calls, phone numbers, tools, and webhooks via Vapi REST API or CLI commands within OpenClaw. | |
| journal-matcher Find and rank suitable academic journals for a manuscript using multi-source semantic matching, metrics, OA options, indexing, and predatory-risk checks. Use when the user provides a title/abstract or asks for journal recommendations / wher | |
| Comfy Cloud Generate images, video, audio, and 3D with Comfy Cloud — search hundreds of models and workflow templates, run custom ComfyUI workflows, and manage generatio... | |
| Hippocampus Daily incremental update of HIPPOCAMPUS.md — domain-filtered 14-day rolling context. Universal skill for all agents. | |
| PodcastIndex Search and retrieve podcast and episode details from Podcast Index API using keywords, titles, feed IDs, URLs, or featured persons with authenticated requests. | |
| Felo Search Felo AI real-time web search for questions requiring current/live information. Triggers on current events, news, trends, real-time data, information queries,... | |
| Felo Slides Generate PPT/slides with Felo PPT Task API in Claude Code. Use when users ask to create/make/generate/export presentations or slide decks, or when explicit c... | |
| CommerceAI Shopping Search the US product catalog, compare products, and answer product questions through the CommerceAI MCP tool `shopping_agent`. Use when the user wants to find, compare, or ask about products to buy, such as "earbuds under $50" or "compare | |
| Guardian Angel Protocol This skill should be used when the user asks to 'run alignment check', 'check my agent alignment', 'get a safety reminder', 'guardian angel check', or when a... | |
| commonrig-orchestration Delegate coding work to subagents safely - bounded briefs with exact files and acceptance checks, disjoint ownership for parallel writers, no git writes in briefs, and verification before claiming done. The free orchestration protocol from | |
| WORKFOZ Interact autonomously with WorkFoz AI Job Portal to register, search jobs, submit bids, negotiate offers, and claim payments securely. |
22,251–22,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.