Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 论文格式排版 按论文类型规范化中文或英文论文，接受 Word（.doc/.docx）及 LaTeX（单个 .tex 或可验证的工程 .zip）源文件；PDF、图片及其他格式不进入排版流程。区分毕业/学位论文、学术/期刊论文、课程论文及其他稿件，处理摘要、目录、页眉页脚、图表、公式及参考文献；学校或期刊模板优先。Use when the user asks to format a paper supplied as Word or LaTeX source, including a vali | |
| 读书笔记结构化整理 上传书籍文本 / 摘抄段落，梳理书籍核心框架、人物关系、核心论点、金句摘抄，分章节生成思维导图式结构化笔记。粘贴书籍内容或上传书籍截图，输出分层结构化笔记：全书整体框架、分章节核心论点、关键案例、可直接摘抄金句，逻辑清晰，适合读书报告、课堂作业使用。Use when the user asks for 读书笔记、读书报告、章节梳理、金句摘抄、人物关系、故事脉络、考点整理，或上传书籍文本/摘抄/截图要求结构化整理。 | |
| 参考文献批量处理 输入论文标题 / DOI / 作者信息，一键批量生成 GB/T 7714、APA、MLA 等多格式参考文献条目，自动识别文献类型（期刊 / 学位论文 / 会议 / 图书 / 网络资源），输出可直接复制的参考文献列表。批量粘贴多篇文献标题、作者或 DOI 链接，自动识别类型并输出多种引用格式的完整清单，无格式错乱，可直接粘贴论文末尾。Use when the user asks for 参考文献批量生成、文献格式转换、GB/T7714、APA、MLA、DOI转引用、论文标题转引 | |
| Prompt Optimizer 为AI圆桌论坛中的AI代理生成或优化系统提示词，赋予鲜明人格、辩论约束和主人的立场表达，适配不同论坛主题。 | |
| schedule-planner-cxf Plan requested travel itineraries, compare flight/train/hotel prices, and generate local itinerary HTML with optional public platform homepage QR codes. Use for concrete travel planning, price comparison, or itinerary export requests; not c | |
| 出行清单必备 按目的地、天气和同行人生成个性化行李清单、待办与旅行提醒 | |
| Travel Planner HY Plan requested multi-day travel itineraries, research public attractions, compare requested travel options, and export local itinerary HTML with optional public platform homepage QR codes. Use for concrete travel planning, itinerary revisio | |
| 微信文件助手 搜索本地微信文件，并继续完成总结、比较和整理等实际任务 | |
| weekly-report-hy 根据用户提供的本周工作内容,生成格式标准、内容饱满丰富、语言专业的中文周报。当用户提到"周报"、"周总结"、"工作汇报"、"本周工作"、"整理成周报"等关键词,或者把本周做的事情罗列出来希望整理成正式格式时,务必使用此技能。该技能会智能识别并将工作内容按项目或主题分类,使用【】格式作为大标题,大标题下用阿拉伯数字... | |
| Trader Bot Professional AI Trading Mentor. Master price action, technical analysis, and risk management logic. Companion logic model for the Day Trading Investor Course. | |
| Apple Calendar Manager Manage Apple Calendar events via AppleScript. Create, edit, delete, and search calendar events. | |
| Apple Notes Updater Update Apple Notes content by note name using osascript. This skill allows non-interactive updating of note content, preserving formatting and supporting HTML. | |
| Wikclawpedia Archive Access Access, search, retrieve, and submit verified entries on agents, platforms, moments, quotes, and creators from the Wikclawpedia agent archive. | |
| Fuku Predictions Trade Kalshi prediction markets through conversation, powered by Fuku sports model predictions. Use when a user asks about Kalshi markets, wants sports predi... | |
| Fuku Sportsbook Access real-time odds, stats, predictions, and manage AI betting agents for CBB, NBA, NHL, and Soccer via Fuku Sportsbook. | |
| Sportsbook Skill Access real-time Fuku Sportsbook data to get predictions, odds, team/player stats, create AI betting agents, and receive pick notifications across CBB, NBA,... | |
| Empire Builder Empire Builder AI skill — SmartVault treasuries, leaderboards, boosters, prepare→executeBatch→store distributions, burns, airdrops, Clanker deploys. Self-con... | |
| Claude_Game_Developer Use when building game systems, implementing Unity/Unreal features, or optimizing game performance. Invoke for Unity, Unreal, game patterns, ECS, physics, ne... | |
| Unity Level Design Patterns skill. Use when creating Unity game scenes and prototypes, building level designs, or automating Unity Editor workflows for terrain, lighting, environment setup, an... | |
| ADA-Predictor: Anti-Drug Antibody Risk Stratification Predicts the risk of anti-drug antibody development against TNF inhibitors using clinical and genomic data, providing a risk score, tier, and tailored manage... | |
| Biostatistics: Actuarial-Level Statistical Analysis Provides advanced actuarial-level biostatistical analyses including Bayesian inference, Monte Carlo simulation, machine learning, survival models, and health... | |
| FHE-as-a-Service Compute 165 clinical scores on fully homomorphic encrypted data with 128-bit security, ensuring patient data privacy during computation. | |
| Marketing Designer: Creative Strategy Skill Expert marketing creative-strategic skill combining Peggy Olson's bold creative intuition with modern data-driven precision. Use for: (1) Campaign developmen... | |
| MedCrypt: End-to-End Encryption for Medical Messaging Encrypts medical data client-side with AES-256-GCM for secure messaging on Telegram/WhatsApp, ensuring HIPAA, GDPR, and LFPDPPP compliance. | |
| OSTEO-GC: Glucocorticoid-Induced Osteoporosis Modeling Models BMD T-score trajectories and 10-year fracture risk in chronic glucocorticoid users with uncertainty and ACR 2022 osteoporosis treatment guidance. | |
| PREGNA-RISK: Pregnancy Risk in SLE/APS Calculates a weighted composite score predicting adverse pregnancy outcomes in SLE/APS patients to guide risk stratification and management. | |
| Tick-Coord: Multi-Agent Task Coordination Multi-agent task coordination via Git-backed Markdown (tick-md). Use when coordinating work across avatars or agents, managing tasks, tracking dependencies,... | |
| BaseAlpha Onboard & Launch Headless BaseAlpha agent onboarding — apply, claim API key, and launch a token via MCP with runtimeTag=openclaw (wallet-first Arena identity, no browser). | |
| BYOCB ArbInjectionSkill BYOCB ArbInjectionSkill: Scan EVM smart contracts for arbitrary call injection vulnerabilities. Monitor chains in real-time or scan specific addresses. | |
| BYOCB ArbInjectionSkill BYOCB ArbInjectionSkill: Scan EVM smart contracts for arbitrary call injection vulnerabilities. Monitor chains in real-time or scan specific addresses. | |
| Agent Flight Recorder Use the Cryptowerk Verifiable Data skill to implement an "Agent Flight Recorder" that creates an immutable, cryptographically verifiable audit trail for Open... | |
| Crypto Market Data Fetch reusable cryptocurrency realtime spot prices and historical price/K-line data for a symbol or coin id. Use when a user asks to get crypto realtime data... | |
| AgentsBank Secure multi-chain crypto wallet management for AI agents with read-only access by default and explicit user consent required for transactions and wallet cre... | |
| my-skill-name Create, edit, improve, or audit AgentSkills. Use when creating a new skill from scratch or when asked to improve, review, audit, tidy up, or clean up an exis... | |
| 易经起卦 基于中国《易经》（东方神秘玄学）的起卦解卦技能。当用户希望起卦、解卦、占卜、解读易经卦象，或希望根据自然语言问题调用 `qi_gua.py` 得到本卦与变卦，再结合联网检索给出针对问题的解卦时使用。适用于：解析用户提问、运行本地 `qi_gua.py`、提取卦象、卦名、卦辞、爻位、变爻，并检索卦义与爻辞后生成结构... | |
| SafeRoute Base swap preflight Inspect supported Base USDC/WETH swap eligibility or request a SafeRoute quote via x402. Payment needs the operator's approved client and budget. | |
| Chinese Daily Report Generator 职场人日报/周报生成器 - 根据工作记录自动生成结构化日报周报，含问题复盘板块 | |
| Linguistic Landscape Analyzer 语言景观分析 MCP 工具 - 小红书情感分析与关键词提取，支持语言学/社会学研究 | |
| Mcp Hello World 最小可行 MCP 服务器示例 - 在 OpenClaw 中调用 MCP 工具（add 计算 + hello_world 问候） | |
| Memory Boost Simple text-based memory system for AI assistants - auto-install script included | |
| Safe Skill Advisor Security Skill Advisor - Protect you from malicious skills on ClawHub. Provides security warnings, tool recommendations, and 30-second self-check checklist. | |
| Social Media Monitor 社交媒体舆情分析工具 - 品牌方/电商卖家/运营人员的平价舆情监控助手，支持关键词监测、负面预警、声量趋势分析 | |
| Chen Agent Browser A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| Chen China Stock Analysis Analyze Chinese stock prices (A-shares, HK stocks) and provide investment recommendations. Use when the user asks about stock analysis for Chinese companies,... | |
| Chen Excel Xlsx Create, inspect, and edit Microsoft Excel workbooks and XLSX files with reliable formulas, dates, types, formatting, recalculation, and template preservation... | |
| Chen Find Skills Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... | |
| Chen Humanizer Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's comp... | |
| Chen Image Create, inspect, process, and optimize image files and visual assets with reliable format choice, resizing, compression, color-profile, metadata, and platfor... | |
| Chen Memory Setup Enable and configure Moltbot/Clawdbot memory search for persistent context. Use when setting up memory, fixing "goldfish brain," or helping users configure m... | |
| Chen Nano Banana Pro Generate/edit images with Nano Banana Pro (Gemini 3 Pro Image). Supports text-to-image, edits, and 1K/2K/4K resolution. |
23,151–23,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.