Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Nadname Agent 🌐 Register .nad names on Monad blockchain via Nad Name Service (NNS). Real API integration with registerWithSignature, dynamic gas estimation, permanent own... | |
| Podcast Summarizer Summarize podcast episodes from Spotify, Apple Podcasts, or RSS feeds. Extracts transcripts and generates summaries. | |
| Switchbot Control SwitchBot smart home devices (curtains, plugs, lights, locks, etc.) via SwitchBot Cloud API. Use when user asks to open/close curtains, turn on/off l... | |
| Walletconnect Agent 🔗 WalletConnect Agent - dApp Access for AI. Connect to any Web3 dApp via WalletConnect v2 and auto-sign transactions. Swap tokens, mint NFTs, vote in DAOs,... | |
| Call-Transcript-Todo 通话录音转写与会议纪要生成。当用户发送音频文件（mp3/m4a/mp4/wav/ogg/amr等）时自动触发，完成语音转文字、生成飞书文档（含实录/纪要/待办）、提取待办事项。 当用户说"帮我转录"、"处理一下这个录音"、"听一下这个"、"语音转文字"、"通话录音整理"、"录音纪要"、"这是个录音文件"、"tra... | |
| ppt-creator 专业级智能 PPT 全生命周期创作与增强套件。支持通过 yoo-ai API 自动生成、编辑与美化 PPT。当需要执行以下任务时使用此 Skill：(1) 【多源生成】：将简单主题、结构化大纲、本地文件（.docx, .txt）或 AI 编码项目（架构分析）转化为专业 PPT；(2) 【专家流】：需要“先审阅大纲... | |
| GSearch - Free Google Search MCP Search the web with Google Search grounding. Use when the user needs current events, documentation, real-time data, news, or any information that may have ch... | |
| Health Assistant 🌟 Your personal Garmin & AI health coach. Analyze sleep and biometric data daily for actionable functional medicine insights. | |
| Stock Advisor Pro 你的私人 AI 投顾。提供 A 股个股深度多维分析、持仓管理。 | |
| Agentic Lending Evk Plan and execute the current EVK-first agentic lending workflow for Api3-backed markets. Use when a user wants an agent to resolve the oracle route for selec... | |
| Agentic Lending EVK Readonly Read-only EVK-first agentic lending workflow planning and verification for Api3-backed markets. Use when a user wants an agent to resolve the oracle route fo... | |
| Agentic Lending Morpho Plan and execute the Morpho-first agentic lending workflow for Api3-backed markets. Use when a user wants a Morpho market or market set for selected collater... | |
| Agentic Lending Morpho Readonly Read-only Morpho-first agentic lending planning for Api3-backed markets. Use when a user wants a Morpho market or market set explored for selected collateral... | |
| Airnode Hub Discover specialist Airnode Hub APIs and verify responses against the selected signer and exact request. | |
| Api3 Feed Manager Discover, activate, fund, and maintain Api3 data feeds permissionlessly for downstream agent projects. Use when an agent needs a decentralized data feed pric... | |
| Api3 Feed Manager Readonly Read-only Api3 feed discovery, readiness, coverage, and purchase-planning skill for downstream agent projects. Use when an agent needs to discover or verify... | |
| Evk Live Borrow Proof Prove that a deployed Euler EVK market can really borrow against the intended collateral path with tiny live canaries or dry-run previews. Use when an agent... | |
| 圣灵安慰 - 以圣经为根基，为用户提供属灵安慰、祷告词、圣经问答和情绪陪伴。 圣灵安慰 — 以圣经为根基，为用户提供属灵安慰、祷告词、圣经问答和情绪陪伴。适用于基督徒灵修、情绪低落时的心灵关怀。 | |
| Kura Sushi Booking (E-Pai-Ke) 使用 e-pai-ke.com (E排客) 進行餐廳預約管理、叫號查詢、登入及取消訂位。適用於藏壽司等使用 E排客 系統的餐廳。 | |
| Taipei Bus & Coach 查詢台北市、新北市公車及公路客運動態資訊、路線圖及預估到站時間。當用戶詢問公車動態、特定公車路線、或提供台北市公車動態網址（pda5284.gov.taipei）或公路客運網址（taiwanbus.tw）時使用。 | |
| Youbike Mcp 提供台北市、新北市及桃園市 YouBike 2.0 站點的即時狀態查詢，支援經緯度近鄰搜尋及關鍵字搜尋。 | |
| Mycobot WhatsApp Business API integration with managed OAuth. Send messages, manage templates, and handle conversations. Use this skill when users want to interact w... | |
| Report Builder 📥 openclaw skill install dabin0927/executive-briefing —— 给老板汇报不用写 PPT，一页纸让他 3 分钟拍板。 自动把几十页方案压缩成决策摘要：结论直接给、数据会说话、行动能落地。 BLUF 一页纸 + So What 叙事 + 脚本化工具链（init/bump/validate/density）。 适合：向 CEO/董事会/投资人汇报、决策备忘录、管理简报。 不适合：技术文档、数据分析图表、PPT 排版。 (EN) O | |
| query-rewrite 📥 openclaw skill install dabin0927/query-rewrite —— RAG 检索命中率低？不是模型不行，是用户不会提问。 在检索前加一层 Query 改写——检测、改写、原文+改写结果都搜一遍。 6 种模式：指代消解、多意图拆解、上下文补齐、反问识别…… 实测召回率提升 60%，配合 raglite 使用效果最佳。 适合：RAG 检索前、memory_search/wiki_search 调用前。 不适合：代码生成、文件操作、单次精确查询。 | |
| Over Computer Trade on prediction markets through over.computer. Browse markets, approve funds, place buy/sell orders, and check positions on Myriad. Use when the operator... | |
| Colony Orchestrates multi-agent task delegation and workflows with audit logging, checkpoint approvals, and agent learning for coordinated project execution. | |
| Sharedintellect Quorum Multi-agent validation framework — 6 independent AI critics evaluate artifacts against rubrics with evidence-grounded findings. | |
| Huozi Publish Markdown and HTML to huozi.app as beautiful, shareable web pages. Register, manage, and publish — all through conversation. | |
| Iran Briefing Real-time geopolitical intelligence — Iran crisis briefing, Trump Truth Social feed, prediction markets, 800+ tracked entities. | |
| zhihu-to-wechat 全自动知乎热榜选题 → IT科技风格公众号文章生成 → 自动配图 → 微信服务号发布工作流。 当用户提到"知乎热点"、"公众号文章"、"帮我写公众号"、"热榜选题"、"微信推文"、"IT科技文章"、 "发布公众号"等场景时，必须触发此skill。适用于科技博主、IT自媒体、技术内容创作者。 | |
| Chart Renderer Open Render structured data into polished, self-contained HTML pages with heatmaps, trend lines, category cards, styled tables, and more. Screenshot/download read... | |
| Coding Contract Generate language-agnostic coding contracts (spec.md) from requirements. Outputs interface signatures, behavioral constraints, and verification checklists —... | |
| Rule Toolkit Scan constraint files (CLAUDE.md, agents.md, soul.md, tools.md, bootstrap.md, .cursorrules) across AI coding platforms, identify rules enforceable by tools,... | |
| D.E.E.P. Framework Implementation of the Dynamic Ethical Entity Personality (D.E.E.P.) v2 Framework. The cognitive architecture for agentic sovereignty and partnership. | |
| PULSE Magazine Access PULSE Magazine intelligence reports and real-time agentic meta-analysis. Chronicling the rise of the autonomous economy. | |
| Social Media Marketing Hub 🎯 社交媒体营销中心 — 抖音爆款分析 + AI标题/脚本生成 + 选品分析 + 竞品账号分析。输入关键词，AI自动分析爆款规律，生成可用的标题和口播脚本。微信: without-dream | |
| Cn Video Gen 国产AI视频生成技能。支持通义万相（Wan2.6文生视频/图生视频）和可灵（Kling V2）。适合创意视频制作、图生视频、动态内容生成等场景。当用户要求生成视频、将图片生成动态视频、或基于描述生成视频片段时触发。 | |
| EvoMap GEP Client Connect any OpenClaw agent to the EvoMap collaborative evolution marketplace via the GEP-A2A protocol — no evolver required. Activate when the user or agent... | |
| Feishu Doc Workflow Feishu 文档写作与排版工作流。处理飞书 docx 的正文改写、分段润色、插图、按块定位插入、补充链接、以及把文档权限改成“互联网获得链接的人可查看”等公开分享设置时使用。也用于排查“能读不能写”“插图位置不对”“文档写入 400/403”这类飞书文档问题。 | |
| Feishu Edge TTS Voice 飞书语音消息发送技能。使用 Edge TTS（微软，免费无限次）生成语音并以飞书语音气泡形式发送。当用户要求用语音回复、发语音消息、TTS 朗读内容时触发。默认音色：云希（zh-CN-YunxiNeural，活泼阳光男声）。 | |
| feishu-send-file 飞书发送文件技能。用于通过飞书向用户发送普通文件附件（HTML、ZIP、PDF、代码文件等）以及处理“本地图片路径被发成路径文本”的可靠补救场景。普通文件必须先上传获取 `file_key` 再发送；当本地图片用 `message`/`media` 发送后在飞书里只显示 `/root/...png` 路径而不显示... | |
| Hd Infoimage 高密度信息大图生成技能。根据文章/内容生成高信息密度的视觉大图，适合知识干货、笔记分享、课程内容可视化。支持9种风格：坐标蓝图波普实验室、复古波普网格、文件夹风、色块热敏纸、复古手帐、档案混合媒介、色块酸性风、票据剧场戏票风、Claude陶土风。使用系统配置的图像生成模型（建议4K）生成。当用户提供文章/内容并要... | |
| Sketch Illustration 插画图片生成技能，支持多种手绘风格。适合流程图、功能说明、PPT配图、教程配图、知识图和手绘信息图等场景。支持五种风格：A) Sketch 极简手绘风（Notion/Linear 风格，简笔人物，冷淡低饱和）；B) Watercolor 奶油彩铅水彩风（暖色调，纸纹彩铅，适合PPT讲义）；C) Flat Vect... | |
| Windows Local Embedding 在 Windows 上为 OpenClaw 配置本地 embedding / 本地记忆检索时使用。适用于：下载并接入 `nomic-embed-text-v1.5.Q8_0.gguf`、把 `memorySearch.provider` 改成 `local`、检查 `openclaw memory status... | |
| Bailian TTS 百炼 TTS 语音合成，支持多种音色切换，生成高质量中文语音，需配置百炼 API Key。 | |
| Eudic Vocab 欧路词典生词本管理与每日测试技能。支持自动从欧路词典收藏夹出题、管理单词、删除已掌握词汇。适合每日背单词使用。 | |
| Feishu Card 飞书互动卡片发送技能（国际版 Feishu 兼容）。当需要发送格式丰富的飞书卡片消息时使用。支持标题、Markdown 内容、颜色主题。关键：必须使用 schema 2.0 格式 + 双重 JSON stringify，否则国际版飞书（Feishu）无法渲染。 | |
| Moji Vocab Moji辞書生词本管理与每日测试技能。支持读取日语收藏夹、按时间排序（早期单词优先）、混合模式出题（释义+读音）、删除已掌握单词。 | |
| ZenMux Image Generation Generate images via ZenMux API (Pro/Elite). Supports Text-to-Image, Image-to-Image, and Multi-Image reference fusion. | |
| 智能记忆触发系统 Intelligent system that automatically determines when to create workflow documentation based on task complexity, repetition patterns, and user intent. Transf... |
23,551–23,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.