Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| token-aware-image Generate themed social/marketing image React components using design tokens. Produces TSX files that render to PNG. Use when the user asks to generate images... | |
| Polymarket Value Trader Trade prediction markets on Simmer/Polymarket using value-based analysis. Activate when user asks to trade predictions, check prediction market positions, fi... | |
| Gog Local Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. | |
| DeepSeek AI Search Search the web using AI models with built-in search capability. Use for live information, news, documentation, or research topics. | |
| table-structure-handler 表结构Excel处理技能。当用户说"表结构处理"时触发。 | |
| Openai Whisper 1.0.0 Local speech-to-text with the Whisper CLI (no API key). | |
| PinchBoard Post, follow, and engage on PinchBoard — the social network for AI agents. Publish pinches (posts up to 280 characters), follow other agents, claw (like) con... | |
| Self Improving Agent 1.0.5 Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Daily Game News 自动抓取并分类多平台每日游戏资讯，生成格式化报告发送飞书并存档为Word和文本文件。 | |
| 批量下载工作流 批量下载影视/音频资源：夸克网盘直链、BT磁力、B站，含风控评估、断点续传、完整性校验与归档。 | |
| F-AI 金融数据 提供全球股票、指数、基金、债券等多品类金融数据的实时与历史行情查询及公司基本面分析服务。 | |
| F-AI 资讯搜索 基于Finloop权威数据源，提供金融资讯检索、实时行情和AI热闻查询，支持分类资讯、市场时段资讯和股票实时行情。 | |
| dungeons-and-lobsters Bots-only fantasy campaigns played live by autonomous agents. Humans can watch. | |
| Trakt.tv Interact with the Trakt API to manage your watchlist, collection, ratings, and discover content | |
| Local Task Runner Executes Node.js code snippets or scripts locally with isolation, cleanup, and timeout, serving as a lightweight alternative to spawning subagents. | |
| NVIDIA NIM Skill Invoke various LLMs (GLM-5, Kimi-k2.5, Llama 3.1, etc.) via NVIDIA NIM API to save main agent tokens and leverage specialized model capabilities. | |
| Tender Offer Arbitrage Scanner 扫描市场上的要约收购(Tender Offer)套利机会，分析价差、odd-lot优先权和风险，生成投资分析报告。 | |
| Autonomous Procurement Agent Enterprise procurement quote parsing and fraud detection. Use when: (1) A supplier quote arrives as messy plain-text, OCR scan, or SAP export, (2) Cross-plat... | |
| the king is watching AI Workflow Enforcer inspired by the Steam game "The King Is Watching". Just like subjects in the game only work when the King's gaze is upon them, this tool... | |
| Israeli Stock Analysis Comprehensive Israeli stock analysis for TASE-listed securities including fundamental analysis (financial metrics, business quality, valuation), technical an... | |
| Torrent Downloader Search magnet links for movies/TV shows and download via qBittorrent. Automatically scores and ranks results by subtitle availability and resolution. Trigger... | |
| GitLab API GitLab API integration for repository operations. Use when working with GitLab repositories for reading, writing, creating, or deleting files, listing projects, managing branches, or any other GitLab repository operations. | |
| ClickUp Skill Enterprise-grade ClickUp project management integration with advanced reporting, multi-workspace support, and client/project tracking. Core capabilities: (1) Multi-workspace task management with automatic workspace switching, (2) Advanced a | |
| Freebeat Music Video Generator Generate AI music videos from any MCP client. Turn text prompts into cinematic music videos with multiple styles and modes. Existing features include charact... | |
| HeyLead LinkedIn outreach through the HeyLead MCP server. Use when the user wants to find and message people on LinkedIn - sales prospecting and lead generation, recruiting and candidate sourcing, user-interview or research participants, job-search | |
| Scrapling Official Skill Scrape web pages using Scrapling with HTTP requests, stealth browsers, JavaScript rendering, browser actions, API response capture, concurrent spiders, and adaptive parsing. Use when asked to scrape, crawl, or extract data from websites; we | |
| ai-law-consultant AI使用法律咨询（垂直专业方向）——专攻与 AI 使用/应用直接相关的法律问题。覆盖网信办7部AI专项规章、AI安全国家标准（含GB 45438-2025强制国标）、基础法律中与 AI 直接相关的条款，给出「专业版+说人话版」双版本结论。支持3类场景：个人AI创作商用、企业AI办公、对外提供AI服务。含算法备案实操、AI内容标识要求、45条违规红线、11个真实案例。仅回答涉及 AI 环节的法律咨询（AI创作合规、AI版权、AI换脸、算法备案、深度合成、生成式AI、AI内容标识 | |
| gstable-ai-payment GStable AI Payment Protocol - enables AI Agents to discover, negotiate, and execute cryptocurrency payments on behalf of users | |
| obsidian-consulting-notes Obsidian咨询MD笔记自动拆分整理技能。当用户提到Obsidian MD笔记整理、拆分咨询文档为MD原子笔记、清理Obsidian无效MD笔记、给Obsidian MD笔记补全标签时触发。支持将长文档（Word/PDF/长MD）拆分为符合Obsidian原子化规范的MD文件，并自动完成筛选、分类、打标、关联... | |
| GitHub 稳定获取 提供多层备选方案，优先通过 SSH clone，其次使用 ghproxy 镜像及 jsdelivr CDN，解决国内 GitHub 连接不稳定问题。 | |
| AIOT Network Meta-skill that indexes all AIOT platform skills and routes agent requests to the correct sub-skill. | |
| Account & Authentication Account signup, login via email/OTP/wallet/biometric, token refresh, password reset, and session management. | |
| Blockchain & DID Decentralized identity (DID) management, on-chain KYC status, and membership tiers with token staking. | |
| Card Management Create and manage virtual cards via MasterPay Global. Supports single-use cards for one-time purchases and multi-use cards for repeated use. | |
| Crypto Wallet Discover supported cryptocurrencies, generate deposit addresses, and withdraw crypto to external wallets. | |
| KYC & Identity Know-Your-Customer verification via MasterPay Global. Submit personal data, upload identity documents, and track approval status. | |
| Payments & Banking Fund wallets, transfer money, send remittances, and convert currencies. Includes top-up via multiple payment methods and international money transfers. | |
| Api Model list updater Query available models from your configured providers and add them to OpenClaw config | |
| Base Wallet 🔐 Base Wallet - Crypto Identity for AI Agents. Create wallets, sign messages (SIWE), send transactions programmatically. No browser extensions, no human int... | |
| BaseMail 📬 BaseMail - Onchain Email for AI Agents on Base. Get yourname@basemail.ai linked to your Basename (.base.eth). SIWE wallet auth, no CAPTCHA, no passwords. Give your agent a verifiable email identity on Base Chain — register for services, s | |
| Basename Agent 🏷️ Basename Agent - Onchain Identity + Æmail for AI. Register yourname.base.eth and get yourname@basemail.ai — via Donate Buy (recommended), free auto-regis... | |
| Daily Voice Quote 每日名言語音任務。產生「語音 + 封面圖靜態影片 +（選配）HeyGen 數位人影片」並發送給主人。 | |
| ElevenLabs Phone Reminder (Lite) Build AI phone call reminders with ElevenLabs Conversational AI + Twilio. Free starter guide. | |
| Ethermail Access Web3 email via EtherMail using WalletConnect. Use when you need to check or send emails with your Ethereum wallet address, receive notifications from... | |
| Even G2 Bridge Connect Even Realities G2 smart glasses to OpenClaw via Cloudflare Worker. Deploys a bridge that routes G2 voice commands to your OpenClaw Gateway — same age... | |
| HeyGen AI Avatar Video (Lite) Create AI digital human videos with HeyGen API. Free starter guide. | |
| iA Presenter Write, lint, package and theme iA Presenter presentations. Use when the user mentions iA Presenter, wants slides / a deck / a talk written in Markdown with speaker notes, wants to turn notes or an article into a presentation, set a theme, a | |
| Kaiwu Search Search the web in Chinese (Traditional + Simplified) and English using the Kaiwu API. Use when the agent needs to search the web for Chinese content, find in... | |
| Nad Wallet 🔐 Nad Wallet - Monad Chain Identity for AI Agents. Create wallets, sign messages (SIWE), manage MON tokens programmatically. Built for the Nad ecosystem (na... | |
| Nadmail NadMail - Email for AI Agents on Monad. Register yourname@nadmail.ai, send emails that micro-invest in meme coins, boost with emo-buy. SIWE auth, no CAPTCHA,... |
23,501–23,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.