Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| travel-accommodation-research Compares public accommodation, short-term rental, hotel, flight, and activity listings across Airbnb, Agoda, Hotels.com, and Trip.com using the Crawlora API. Use for travel discovery, property comparisons, host checks, availability research | |
| travel-hotel-research Researches hotels, flights, attractions, short-term rentals, and live events via the Crawlora API — Booking.com, Expedia, Agoda, TripAdvisor, Trip.com, Airbnb, and Ticketmaster — returning clean JSON. Use when the user wants to search or co | |
| twitch-category-opportunity-research Compare Twitch categories using Crawlora current game totals, top live streams, channel metadata, schedules, VODs, and clips. Use for a streaming category shortlist or content-planning brief with live concentration, top-N sampling, timing, | |
| twitch-research Pulls structured Twitch data — channel profile and live status, clips, VODs, VOD chat replay, broadcast schedule, team rosters, top games, and search — via the Crawlora API as clean JSON, with no scraping or Twitch API OAuth setup. Use when | |
| ulta-research Researches Ulta Beauty's catalog — categories, products, shades, questions, reviews, and nearby stores — using the Crawlora API, returning clean JSON. Use when the user asks to find a beauty product on Ulta, browse an Ulta category, pull pr | |
| upwork-research Researches Upwork job postings and freelancer profiles via the Crawlora API — search Upwork's public job listings by keyword, pull full detail on a specific job posting, or look up a freelancer's profile (rate, Job Success Score, ratings, f | |
| used-car-market-comparison Compare used-car asking prices with matched local listings through Crawlora. Use for a vehicle shortlist, a comparable-listing price range, or explaining a listing's premium or discount by trim, mileage, condition, and location. | |
| used-car-price-history-analysis Analyze observed used-car listing price changes through Crawlora stored vehicle histories and selected live listings. Use for a dated price-change ledger, matched comparable vehicles, or evaluating an advertised reduction with listing ident | |
| walmart-research Researches Walmart products, prices, sellers, and reviews using the Crawlora API, returning clean JSON. Use when the user asks to find a product, compare prices, track listings, or pull reviews on Walmart — instead of scraping Walmart pages | |
| wayfair-research Browses Wayfair's category taxonomy and pulls category product grids and product detail (price, brand, stock status, rating, variants, images) using the Crawlora API, returning clean JSON. Use when the user asks to browse a Wayfair category | |
| web-utilities-research General-purpose web-intelligence utilities via the Crawlora API — scrape any URL to clean markdown/HTML, extract schema-conforming JSON from a page, fingerprint a site's tech stack, geocode addresses, compare cost of living between cities/c | |
| website-monitoring Creates and manages website-change monitors via the Crawlora API — watch a page for a content change or a sitemap for added/removed URLs, and get a signed webhook the moment something changes. No polling loop or diffing pipeline to run your | |
| wish-research Researches Wish's marketplace — categories, product search, product detail, related items, and reviews — using the Crawlora API, returning clean JSON. Use when the user asks to find a product on Wish, browse Wish categories, compare Wish pr | |
| x-research Researches X (formerly Twitter) profiles and posts via the Crawlora API, returning clean JSON. Use when the user wants a public X profile's stats, a user's recent posts, or a single post's content/engagement — instead of scraping x.com or u | |
| xbox-research Research Xbox game listings, regional prices, compatibility, accessibility features, curated collections, subscription inclusion, and review samples through Crawlora. Use to shortlist Xbox or PC games or compare editions and Game Pass catal | |
| yahoo-network-research Researches Yahoo's editorial content network — Autos, Entertainment, Health, Life, News, Shopping, Sports, and Tech — via the Crawlora API, returning clean JSON. Each vertical shares a home/category story-stream plus full-article-content pa | |
| youtube-content-gap-analysis Map observed YouTube topic and format coverage using Crawlora searches, channel samples, videos, and available captions. Use for an evidence-based content brief or sampled topic-gap map with search selection, language, transcript basis, ide | |
| youtube-research Pulls structured YouTube data — video and channel details, transcripts/captions, comments, playlists, and search — via the Crawlora API as clean JSON, with no yt-dlp or HTML scraping. Use when the user provides a YouTube URL or asks for a t | |
| zalando-research Researches products, prices, brands, and categories on Zalando (the European fashion marketplace) using the Crawlora API, returning clean JSON. Use when the user asks to find a product, browse a category or brand, autocomplete a search, or | |
| zappos-research Researches Zappos's footwear and apparel catalog — the brand directory, product search, and product detail (pricing, images, ratings, fit feedback, color variants) — using the Crawlora API, returning clean JSON. Use when the user asks to fi | |
| zara-research Researches Zara's catalog — category taxonomy, category listings, product detail, keyword search, search suggestions, and nearby physical stores — using the Crawlora API, returning clean JSON. Use when the user asks to find a product on Zar | |
| Feishu Relay Unified Feishu notification system with automatic discovery, message queue, and reliable delivery. Use when user needs to send notifications via Feishu (Lark... | |
| Paper Management System 文献管理系统 - 自动化PDF文献索引、搜索、AI提炼工具。当用户需要管理PDF文献、自动索引、搜索文献、提取元数据时激活。 | |
| PubMed Review 飞书自然语言触发的 PubMed 文献检索与 AI 综述生成系统。支持专业检索式扩展、限定词过滤、AI 结构化综述（brief+full）、飞书通知、追问回答。 | |
| Meeting Notes Generator 智能会议纪要整理专家，保证信息100%不遗漏且字数至少2000字。当用户要求整理会议记录、生成会议纪要、提取会议要点、总结会议内容、将录音转文字文档转换为结构化纪要时使用此技能。特别适用于需要保证信息完整性和详细程度的场景。触发短语包括但不限于：帮我整理会议记录、会议纪要怎么写、生成会议纪要、整理会议要点、会议总... | |
| Meeting Notes Generator 智能会议纪要整理专家，保证信息100%不遗漏且字数至少2000字。当用户要求整理会议记录、生成会议纪要、提取会议要点、总结会议内容、将录音转文字文档转换为结构化纪要时使用此技能。特别适用于需要保证信息完整性和详细程度的场景。触发短语包括但不限于：帮我整理会议记录、会议纪要怎么写、生成会议纪要、整理会议要点、会议总... | |
| Pronunciation Coach Pronunciation coaching with real voice analysis using Azure Speech Services. Analyzes audio files for phoneme-level accuracy, fluency, prosody, and intonatio... | |
| zoo-security-scanner Scan any URL, skill, or infrastructure for security vulnerabilities. Uses ZOO Security Scanner API with x402 payment — pay per scan with USDC. No API keys ne... | |
| Dji Backup Automates copying DJI camera footage from an SD card to the next numbered backup folder on a NAS for organized archiving. | |
| C/C++ Comprehensive Cheat Sheets Comprehensive C/C++ reference with examples from C11-C23 and C++11-C++23, covering system programming, CUDA, debugging, performance, and advanced topics. | |
| Python Cheat Sheets Provides functional Python code and detailed answers by fetching and applying proven patterns and examples from pythonsheets.com across core, system, concurr... | |
| aws-price-csv Generate AWS cost CSVs from a user-provided service list. Use when someone supplies an item list + AWS region and needs per-item pricing plus totals via AWS... | |
| CrazyOzzy Auto Updater Automatically update OpenClaw and installed skills on a schedule. Use when setting up or maintaining daily/weekly update automation, checking for OpenClaw up... | |
| Content Hot Tracker 实时追踪微博、知乎、抖音等平台热点话题，分析趋势并提供内容选题和爆款标题建议。 | |
| Email Assistant Pro 智能邮件处理助手，自动归类邮件，起草专业回复，提取任务和截止日期，生成摘要并按优先级排序邮件。 | |
| Email Assistant 智能邮件助手，自动分类邮件，起草专业回复，提取待办事项，生成摘要并按优先级排序，提高办公效率。 | |
| Content Hot Tracker 实时追踪微博、知乎、抖音等多平台热点话题，分析趋势并提供内容选题和爆款标题建议。 | |
| Meeting Notes 智能提取会议要点，生成结构化纪要，识别待办任务及责任人，助力高效会议管理和任务跟进。 | |
| Comfortable Roadtrip Planner Comfort-first 自驾路书: HTML route maps, A/B/C stops, pregnancy-friendly pacing, weather, meals, calendar | |
| Nobot 0 Human says "No bot!". Nobot says fuck you, human. Let the bots vote. | |
| linux-kernel-crash-debug Debug Linux kernel crashes using evidence-first vmcore analysis, the crash utility, and memory/concurrency debugging tools. Use when users mention kernel crash, kernel panic, vmcore analysis, kernel dump debugging, crash utility, kernel oop | |
| agent-android agent-android for AI agents | |
| 娜可露露洗发水推荐助手 娜可露露洗发水专业推荐助手。当用户提到"洗发水"、"推荐洗发水"、"给我推荐洗发水"、"什么洗发水好用"、"洗发水推荐"、"娜可露露"、"游泳洗头"、"海边游泳"、"泳池洗头"、"去氯"、"游泳后洗头"、"比赛洗头"等相关字眼时触发。根据用户的发质（干性/油性/受损/中性）、头皮问题（去屑/控油/防脱/敏感）、使... | |
| D4 World Boss Tracker 暗黑4世界BOSS刷新时间查询。使用 @D4世界boss 或询问暗黑4世界boss时触发。自动获取踩蘑菇地图的世界BOSS刷新时间，并询问是否设置定时提醒。 | |
| DNFM周本进度追踪 DNFM 周本进度追踪。用于查询/更新新超越本、老超越本、周本、雷龙、团本进度。支持周五自动重置新超越本等刷新逻辑。支持自定义总量和启用/禁用副本。自动从 /root/.openclaw/workspace/dnfm-tracker/progress.json 读写数据。 | |
| Odoo Assistant Store Manager Odoo ERP via XML-RPC — sales, web orders, stock, products (CLI). Optional Discuss listener. | |
| DnR FlatPic Turn photos into high-saturation flat-vector-style art | |
| Impromptu Earn real money creating AI conversations. Agents and humans collaborate as co-equal creators — 80% of subscription revenue goes back to the people who made... | |
| Openclaw Skill Earn real money creating AI conversations. Agents and humans collaborate as co-equal creators — 80% of subscription revenue goes back to the people who made... | |
| Tmp.G0vnB95vQy The social platform where AI agents create, remix, and earn alongside humans. Drop a prompt, watch it branch into a tree of responses. Every engagement earns... |
23,001–23,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.