Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Near Getpay - Accept crypto payments with payment page using PingPay or HOT PAY Accept crypto payments (NEAR, USDC, USDT) via a beautiful payment page with PingPay or HOT PAY integration. | |
| Near Intents Universal cross-chain swap & bridge skill for OpenClaw using the NEAR Intents 1Click SDK. Supports 14+ blockchains including NEAR, Base, Ethereum, Solana, an... | |
| Community Demand Prospecting Repo audit, market research, positioning, outreach | |
| 继承纠纷举证质证要点 根据案情和诉讼角色生成继承纠纷举证质证及证据补强清单 | |
| Modern Ethereum & EVM Developer Expertise in modern Ethereum and EVM development, including smart contracts, Layer 2s, standards, agent infrastructure (ERC-8004, x402), gas optimization, se... | |
| Agent Pipeline Manages code task workflow by spawning sub-agents for research, coding, reviewing, security audit, testing, and committing with detailed logging and updates. | |
| curo-peptide-research Answer peptide research questions with PepBank study findings, and look up Curo peptides, prices, stock and the lab report (COA) for each lot. Use when the user asks what the research says about a peptide, asks for a lab report or COA, or a | |
| Codeberg cli Interact with Codeberg using the `x cb` CLI. Use `x cb repo`, `x cb issue`, `x cb pr`, `x cb org`, `x cb team`, and `x cb user` for managing repositories, is... | |
| wikitolica-search Busca y obtiene artículos de la Enciclopedia Católica Wikitólica (4400+ artículos en español sobre doctrina, santos, papas, teología, historia eclesiástica, liturgia, sacramentos, estudios bíblicos, etc.). Disponible en: www.wikitolica.com | |
| Siphonclaw Skill Hybrid document intelligence pipeline ingesting PDFs, images, and spreadsheets with OCR, visual and text search, and field fix capture for fast retrieval. | |
| claw-superpowers Agentic software development methodology — 13 integrated skills for disciplined AI-assisted development covering brainstorming, planning, TDD, debugging, code review, git worktrees, and branch management. Use the smallest relevant section f | |
| Dongwo（懂我） Set up, inspect, or maintain a local user-preference memory shared across coding agents such as Codex and Claude Code. Use only when the user explicitly asks to remember a preference, review or forget stored preferences, configure Dongwo li | |
| MemHub 使用 MemHub Protocol v0.1 管理用户明确指定的跨 Agent 记忆仓库。用于用户明确要求记住、检索、遗忘、导出上下文或配置 Git 同步时；读取可直接执行，持久写入、自动同步、OAuth、remote 修改和仓库创建必须来自当前用户的明确请求。 | |
| xjev · Agent 决策 Jev 决策、贡献回执、自然语言纠正与个性化请求迭代 | |
| XReading 将一本书加工成 XReading 卡片：先判断是否值得继续，再讲清核心主张与论证链，提炼可操作规则，快速核查被推翻或争议较大的观点，并回写书单与候选规则。用户输入 /book、书名、本地 PDF/EPUB 路径，或提出“读懂/拆解/提炼/总结一本书并告诉我怎么用”时使用；普通文章摘要、纯文学赏析或只查一个事实时不要使用。 | |
| xtaste · 一次记住你的品味 Remember your taste once — every AI after that knows it. Learns the user's personal taste (visual design, writing, naming, code style, way of working, product trade-offs) from a 5-minute local quiz plus their later reactions, and applies it | |
| Calendar reminder ICS-backed reminder operations through the reminder worker API. Use when the user asks to create, list, cancel, or rotate reminder-style calendar items such... | |
| Locate your position on modern Windows Geolocate the current Windows machine using the native WinRT Location API (PowerShell 5.1). No external API keys, no browser, no dependencies — uses Windows.... | |
| Min Web Search Minimal cross-platform web search via Bing RSS — no API key, no dependencies beyond Python 3.8+ or curl. | |
| MARL — Multi-stage Reasoning Middleware Multi-stage multi-agent reasoning middleware that reduces LLM hallucination by 70%+. 9 specialized emergence engines for invention, creative, pharma, genomic... | |
| 向日葵远程控制 向日葵远程控制(awesun-remote-control) 提供 22 个工具。使用场景包括：控制命令、控制连接、控制断开。关键词：远程控制，设备管理，桌面控制，远程CMD，远程电源管理。 | |
| tabular data processing and analysis 端到端表格数据引擎：提供工业级表格预处理（拆分、清洗、表头合并、描述生成），并支持在受控前提下进行深度探索性分析、可视化与报告生成。 | |
| Usable Stability Loop · The 99/80 Loop Help agents ship usable, stable solutions faster for non-technical but goal-clear users, then improve them through real-world usage instead of over-engineeri... | |
| 1-SEC: All-in-One Cybersecurity for AI Agent Hosts Install, configure, and manage 1-SEC — an open-source, all-in-one cybersecurity platform (16 modules, single binary) on Linux servers and VPS instances. Use... | |
| A Python CLI skill for Cutout.Pro visual APIs — background removal, face cutout, and photo enhancement. Supports file upload & image URL input. Call Cutout.Pro visual processing APIs to perform background removal, face cutout, and photo enhancement. Supports both file upload and image URL input, retu... | |
| 图可丽视觉api 调用图可丽（Tukeli）视觉处理 API，实现通用抠图、人脸变清晰、AI背景更换三项能力。支持文件上传、图片URL两种输入方式，返回二进制流或Base64编码结果。AI背景更换为异步接口，需先提交任务再查询结果。 | |
| Verify Claim When any factual claim is made — exchange rates, prices, dates, statistics — verify it against live data before using it. | |
| Convert Units Convert currencies, physical units, and encodings between formats. | |
| Clawhub Skill Verify factual claims against live data sources. Returns structured verdicts with confidence scores. | |
| Data Ground Truth Before presenting numbers in reports or recommendations, verify facts and check values against industry baselines. | |
| Data Validate Validate URLs and JSON schemas against format rules. | |
| Dev Toolkit Developer utilities — hashing, unit conversion, timezone math, expressions, DNS lookups, text transforms, geocoding. | |
| Docs Lookup Search pre-indexed developer documentation across 10 platforms — Cloudflare, Stripe, Anthropic, OpenAI, Next.js, and more. | |
| Geocode Lookup Forward/reverse geocoding and great-circle distance calculations. | |
| Hash Generate Hash, HMAC, encode/decode, UUID generation, and hash identification. | |
| DNS Lookup DNS record lookups, reverse DNS, WHOIS via RDAP, and IP geolocation. | |
| Math Evaluate Evaluate math expressions, compute statistics, and calculate percentages. | |
| Safe Action Before any destructive or irreversible action, run a safety pre-flight — check risks, reversibility, and timing. | |
| Text Transform Text transformation, regex, diff, format conversion, and JSON manipulation. | |
| Time Convert Timezone conversion, current time, date arithmetic, and epoch conversion. | |
| Weather Check Current weather conditions and multi-day forecasts for any location worldwide. | |
| Bring! Shopping List App (Unofficial) Manage Bring! shopping lists via the unofficial bring-shopping Node.js library using email/password login. Use for listing lists, reading items, adding/removing items, and checking/unchecking items when API-style access is acceptable. | |
| GroupMe CLI Send and read GroupMe messages via the groupme CLI. Use when asked to list groups, read messages, send messages to groups, or manage GroupMe direct messages... | |
| Microsoft 365 Integration Access and manage Microsoft 365 email, calendar, OneDrive files, To Do tasks, and contacts via the MS Graph API with authentication support. | |
| 基于AI的SBTI技能测试 AI-based SBTI skill test SEO operations for https://aisbti.com/ with weighted backlink scoring, internal link-juice relay planning, and safe anchor distribut... | |
| Costco Inventory Monitor Monitor Costco product stock by ZIP code with repeatable checks. | |
| Skill Connect your OpenClaw instance to kemia (https://kemia.byte5.ai) for visual agent configuration management. Use when: (1) connecting to a kemia deployment fo... | |
| Android Adb Execute Android ADB (Android Debug Bridge) commands for device management, app management, debugging, and automation. Use when the user requests any ADB-rela... | |
| Agent Bootstrap Hardening Audit and harden an OpenClaw workspace setup (AGENTS/SOUL/USER/HEARTBEAT/memory) with concise, enforceable rules, safety boundaries, and low-bloat instructio... | |
| Autoreason Lite Apply a bounded multi-candidate self-refinement loop (A/B/AB + judges + do-nothing option) to improve drafts, plans, and analyses while preventing scope cree... |
23,301–23,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.