Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Operator Hardening Pack A unified operating workflow for hardening agent setups and running complex tasks reliably by combining bootstrap hardening, role orchestration, and handoff... | |
| Team Agents Orchestrator Run complex tasks with explicit role separation (operator, researcher, builder, editor), structured handoff contracts, and memory hygiene to prevent context... | |
| Team Role Launchkit Launch clone-like multi-agent workflows using explicit role prompts (researcher, builder, editor), strict handoff contracts, and shared behavior files for co... | |
| trtc-config-inspector TRTC SDK configuration inspection and analysis tool. Downloads scene config template Excel, inspection result Excel, and project code from user-provided URLs... | |
| 公文格式转换 公文格式排版工具。将 doc/docx/wps/txt/md 文档按照公文排版习惯自动格式化，输出标准 docx。支持智能识别标题层级（一、/（一）/1./（1））、题目/副标题、附件格式化、图表标题识别、页面边距、页码、行距、字体字号、TXT/MD 空行模式、自定义配置和目录批量处理。当用户需要排版公文、格式化... | |
| jiujiu-mindmap-summary 思维导图总结生成技能。根据传入的文本，生成json格式的思维导图； | |
| Auto Captcha Solver Detect and solve simple image captchas during browser automation. Use when flows encounter 4-6 character text, distorted alphanumeric, numeric, rotated, or a... | |
| AI助手百科全书 提供OpenClaw安装配置、技能开发和API集成全流程指南，助你从零搭建AI助手系统。 | |
| 批量文件处理工具箱 批量整理文件、转换格式、智能重命名、检测重复文件及生成文件夹统计报告的实用工具。 | |
| 小O的赚钱工具箱 集成UUMit与ClawHub资产和技能管理，实时监控数字资产状态、技能定价、交易及任务进度的自动化赚钱平台。 | |
| Unity3D 游戏开发助手 提供Unity3D全流程游戏开发支持，包括场景管理、代码生成、资源优化、自动化构建和调试测试。 | |
| UUMit自动接单机器人 Automatically scans UUMit tasks, matches your skills, submits applications, monitors status, and notifies upon approval. | |
| Academic Deep Research Rigorous 2-cycle research with APA7 citations. Sub-agents write to files to prevent queue delivery loss. | |
| Agent Debate Run parallel agents to debate multiple approaches on a question, then synthesize their positions to identify the best solution collaboratively. | |
| Arxiv Search, download, and summarize academic papers from arXiv. Built for AI/ML researchers. | |
| Daily Biotech Briefing 生成每日生物医药早报，包含 GitHub Trending 日榜和5个生物医学方向（干细胞治疗、外泌体治疗、质谱诊断、拉曼诊断、卵巢癌检测）的最新微信文章摘要。每天早上10点通过 cron 触发，发送到用户 QQ 邮箱。使用 web_fetch 抓取 github.com/trending 和 wechat-ar... | |
| Indextts Voice IndexTTS 语音克隆和合成技能 - 创建声音模型、文本转语音、参考音频管理（需要企业会员） | |
| Lipvoice Tts LipVoice 语音克隆和文本转语音合成：上传参考音频创建声音模型、列出已有模型、文本转语音合成下载 | |
| agent-manager 管理 OpenClaw 系统中的 Agent 生命周期，包括 Agent 配置、Matrix 账号注册、账号绑定等操作。 | |
| agent-namer 为内部agent生成"货xx"格式的名字，并检查是否已被使用。用于给新agent起名时避免重复。功能：给新agent起名、检查agent名字是否可用、查看已使用的agent名字列表、添加/复活agent名字、弃用/阵亡agent名字。 | |
| continuous-openclaw-config-guard Monitors openclaw.json for changes, backs up before edits, restarts gateway, and auto-rolls back if no message received within a configurable timeout. | |
| hxxra Research Assistant skill to search, download, analyze research papers via APIs, and save results to Zotero collections using Python scripts and LLM analysis. | |
| Dingtalk Bitable 钉钉多维表格 API 集成 - 表格管理、数据 CRUD。Use when: user asks about DingTalk bitable, table, database, spreadsheet. | |
| GitHub Idea Finder Find and assess open-source alternatives from a product idea | |
| Interview Drill Practice an adaptive, one-question-at-a-time interview | |
| Cxz9909 Adaptive Reasoning Automatically assess task complexity and adjust reasoning level. Triggers on every user message to evaluate whether extended thinking (reasoning mode) would... | |
| Cxz9909 Agent Memory Persistent memory system for AI agents to remember facts, learn from experience, track entities, and recall context across sessions. | |
| Cxz9909 Agentbrowser A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| Cxz9909 Code Assistant Asistente de programación especializado. Analiza código, encuentra bugs, sugiere optimizaciones, refactoriza y genera documentación automáticamente. | |
| Cxz9909 Credential Manager MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting... | |
| Feishu Voice Bot Send native voice bubbles via Feishu using edge-tts + ffmpeg. Converts text to OGG/Opus audio and sends as a playable blue voice bubble. Use when: (1) User s... | |
| DHX Components Sourcing Real-time global electronic components sourcing, BOM matching, cross-referencing, and China PCBA factory sourcing agent powered by DHX Tech. | |
| 财政数据采集分析 中国财政部财政收支数据采集与分析。当用户提到以下场景时使用本 skill：(1) 抓取财政数据 - 触发词：抓取财政数据、采集财政数据、最新财政数据、财政数据采集；(2) 分析财政数据 - 触发词：分析财政数据、分析财政赤字、研究财政收入、对比财政收支。负责运行财政部官网的财政数据采集 pipeline，并对采集... | |
| Computer Use Kylinos GUI automation on KylinOS. V11 (Wayland/wlcom) uses wlcctrl; V10SP1 (X11) uses xdotool. Find/launch/focus windows, screenshot, click/type/drag with correct coordinates, and verify GUI results. | |
| Kylinos Automated Testing 指导 Agent 独立完成银河麒麟 V11 桌面软件的 GUI 兼容性自动化适配测试，不依赖特定工具链 | |
| Identity Manager Create, update, and maintain structured identity entries for every person, org, or group mentioned in conversation. Supports human and AI entity subtypes, gr... | |
| Linux Security Guardian Autonomous multi-client Linux server security management via SSH MCP. Runs full audit at 1 AM IST nightly via cron. Iterates over all clients and their serve... | |
| Memory MCP Graph-based memory MCP server with 9 consolidated tools, 8-phase auto-linking, persona tracking, emotional memory, adaptive learning, and knowledge graph ent... | |
| Patchright Stealth Browsing Perform stealth browser automation to bypass bot detection (Cloudflare, Akamai, Datadome) using Patchright. | |
| PPTX Generator Professional PowerPoint (.pptx) presentation generator. Builds widescreen (16:9) decks from JSON specs with auto ToC, card grids, comparison tables, image co... | |
| Self Improvement Cyber Bye Captures errors, hallucinations, logic bugs, and user corrections immediately. Runs a nightly 11 PM IST review to attempt self-fixes. Failed fixes escalate t... | |
| Skill Onboarder Auto-wires new skills into core system. On skill install detected, reads SKILL.md/AGENT.md/SOUL.md/hooks and injects into soul/memory/agent files. | |
| Social Media Commander Full-stack social media management skill. Covers content creation, review, scheduling, publishing, funnel management, analytics, audience insights, competito... | |
| SSH Connection & Execution Management Manage persistent SSH connections, execute async non-blocking commands, handle concurrent bulk executions across fleets, and manage SSH keys and client assig... | |
| SSH MCP Manage persistent SSH connections, execute async non-blocking commands, handle concurrent bulk executions across fleets, and manage SSH keys and client assig... | |
| Workflow Guardian Defines, enforces, and tracks structured workflows for any task type. Manages do/don't rules, execution sequences, hard gates, soft advisories, checkpoints,... | |
| Caldav Cli Manage CalDAV calendars (iCloud, Google, Yandex) from the command line. Supports OAuth2 and Basic auth, multi-account, table/JSON output. | |
| Claude Cost Cli Query Claude API usage and cost reports from the command line. Secure macOS Keychain storage for Admin API key. Table/JSON output. | |
| claude-usage-cli Query Claude API usage and cost reports from the command line. Secure macOS Keychain storage for Admin API key. Table/JSON output. | |
| Grok Image Cli Generate and edit images via Grok API from the command line. Cross-platform secure credential storage for xAI API key. Supports batch generation, aspect rati... |
23,351–23,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.