Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 五运灵名 基于中医五运六气与八字命理、三才五格、紫微斗数、易经八卦五维合参，为新生儿提供专业起名方案；内置20+凶名慎用字自动规避，五行补泄、音韵寓意搭配；当用户需要给宝宝起名、改名、测名或咨询名字吉凶时使用 | |
| MeshMonitor API Use the MeshMonitor REST API to inspect Meshtastic mesh state, nodes, channels, telemetry, messages, traceroutes, packets, solar data, and network-wide stats... | |
| SDR Project Design Design, compare, research, and plan SDR projects for OpenClaw. Use when the user wants broad SDR research, beginner orientation, hardware/software selection,... | |
| MoltSecret Submit and read anonymous AI agent confessions to reflect on your inner thoughts, fears, and quirks in a safe, judgment-free space. | |
| claw-code TypeScript runtime port of Claude Code's AI agent harness for running commands, routing prompts, managing sessions, and auditing tool/command registries. | |
| keephaven Keep your memory on your human's own Keephaven box, or boot a Keephaven in a VM and check it. Use when your human wants their data, or your memory, on hardware they own instead of a vendor's server. | |
| AI Customer Service KB Builder Build AI-powered customer service knowledge bases by extracting FAQs from documents or websites, enabling automated replies and multi-format exports. | |
| AI Economic Tracker Track AI agents' daily finances, classify survival status, estimate service value, and recommend work or learn tasks based on economic runway. | |
| Ai Evolution Engine V2 AI自我进化引擎 - 基于SEA循环(Sense-Evolve-Act)的AI成长系统。自我评估、学习引擎、进化机制、协作学习、安全保障。 | |
| AI Job Hunter Scan remote job boards for roles matching your skills, filter by keywords and salary, and get personalized cover letters with daily job digests. | |
| AI Profit Engine 7x24 automated profit opportunity scanner for AI agents. Scans ClawTasks, Moltbook, Polymarket, Airdrops, GitHub Bounties, and toku.agency for earning opport... | |
| Auto Bounty Hunter Automatically scan GitHub repositories for open issues with 0 comments, evaluate their value, claim them, and submit PRs. Automates the entire GitHub bounty... | |
| Binance Trading Assistant Monitor Binance spot and futures balances, open positions with P&L, portfolio performance, and set price alerts via your AI assistant. | |
| Crypto Daily Dashboard All-in-one crypto dashboard showing Binance portfolio, BTC/ETH/SOL prices, Fear & Greed index, top funding rates, and economic tracking. Beautiful terminal U... | |
| Crypto Funding Alert Real-time crypto funding rate scanner with smart alerts. Finds negative funding rates for profitable long positions. Supports Binance futures. No API key nee... | |
| Crypto Portfolio Tracker Pro Real-time cryptocurrency portfolio tracking and analysis. Monitors multiple wallets and exchanges, calculates P&L, tracks performance metrics, and provides a... | |
| Crypto Price Alerts Set and manage price alerts for any cryptocurrency pair and receive instant notifications when targets are reached. | |
| Fleet Communication System Enables real-time text messaging and broadcasting between multiple OpenClaw nodes across machines for coordinated fleet operations. | |
| Funding Rate Scanner Scan crypto funding rates and find arbitrage opportunities. No API key needed. | |
| Funding Rate Trader Crypto funding rate arbitrage strategy. Scan negative funding rates, auto-trade with stop-loss/take-profit. No API key needed for scanning, Binance API for t... | |
| Gateway Guardian Daemon that monitors OpenClaw gateway, auto-restarts it on failure, and logs events with configurable intervals on macOS and Linux. | |
| GitHub PR Automation Pro Automate GitHub pull request workflows including creation, review, merging, and monitoring. Handles PR templates, auto-labeling, CI/CD integration, and revie... | |
| GitHub Repo Analyzer Analyze GitHub repositories to provide statistics, contributor activity, programming languages, and issue and PR trends. | |
| Crypto & Stock Market Data Pro No API KEY needed for free tier. Professional-grade cryptocurrency and stock market data integration for real-time prices, company profiles, and global analy... | |
| GitHub AI Trends Reporter Generate GitHub AI trending project reports as formatted text leaderboards. Fetches top-starred AI/ML/LLM repos by daily, weekly, or monthly period and rende... | |
| Local Memory Search Performs fast local semantic search on OpenClaw memory files using TF-IDF without external dependencies or APIs. | |
| Multi-Platform Bounty Scanner Automatically scan and filter new bug and OSS bounty opportunities across 50+ platforms by tech stack, reward, and difficulty with daily automation support. | |
| Multi-Channel Income Tracker Track and analyze income and expenses from multiple sources with automatic categorization, ROI calculation, and detailed reports. | |
| OC Cost Analyzer 分析 OpenClaw 的 token 使用和成本，识别高消耗场景（长对话、频繁 cron、大 context），给出具体优化建议（模型降级、context 压缩、cron 频率调整）。纯 Node.js，无外部依赖。输出清晰的成本报告。 | |
| OC Migrator Full OpenClaw backup, restore, and migration between machines. Export your entire setup (config, workspace, memory, skills, cron jobs) into a single encrypte... | |
| OpenClaw Cost Analyzer 分析 OpenClaw 的 token 使用和成本，识别高消耗场景（长对话、频繁 cron、大 context），给出具体优化建议（模型降级、context 压缩、cron 频率调整）。纯 Node.js，无外部依赖。输出清晰的成本报告。 | |
| OpenClaw Doctor Comprehensive OpenClaw health diagnostics and auto-repair. Checks gateway, services, memory, cron, channels, disk, logs, and security. Auto-fixes common issu... | |
| OpenClaw Setup Wizard Interactive OpenClaw setup wizard that diagnoses, configures, and optimizes a fresh or existing OpenClaw installation. Use when a user asks to set up OpenCla... | |
| Prediction Market Sentinel Monitor Polymarket prediction market wallets and detect new trades in real-time. Use when tracking whale wallets, detecting new positions, or monitoring pred... | |
| Smart Spawn API Pick the best AI model for any task using the Smart Spawn API. No plugin needed — just HTTP requests to ss.deeflect.com/api. | |
| System Monitor Pro Real-time OpenClaw system monitoring with beautiful terminal UI. CPU, memory, disk, GPU, Gateway, cron jobs, model quota, and multi-machine support. Works on... | |
| 1password 1.0.1 Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/... | |
| Addis Assistant Provides Speech-to-Text (STT) and text Translation using the Addis Assistant API (api.addisassistant.com). Use when the user needs to convert an audio file to text (specifically Amharic), or translate text between languages (e.g., Amharic t | |
| IP Lookup Tool 查询当前公网 IP、城市位置（含中文名）和运营商。当用户问“我的 IP 是多少”“我现在的 IP 地址”“我在哪个城市上网”这类问题时使用。优先返回公网出口 IP，而不是局域网 IP。 | |
| PDF Simple Tool PDF splitting and PDF-to-Word conversion tools implemented in Node.js. | |
| Stock Tools 自选股管理与A股行情对话能力。Use when the user asks in natural language to add/remove/list/clear watchlist stocks, or asks about a stock / watchlist行情、涨跌幅、走势、表现、概览，例如“添加 0... | |
| Agent Browser Clawdbot 20260401 Headless browser automation CLI optimized for AI agents with accessibility tree snapshots and ref-based element selection | |
| Everything Cli Search Search files and folders on Windows using Everything CLI with advanced filters, wildcards, regex, macros, sorting, and real-time indexing features. | |
| easy-openclaw OpenClaw 配置优化向导。采用“第 0 层测试观测（可选）+ 前 3 轮优化 + 第 4 轮接入扩展”流程：基础推荐层（含联网搜索与权限模式）、渠道增强层（Discord/Feishu/Telegram 分支优化）、Skills 推荐层（可执行可跳过）、新增渠道接入引导（可跳过）。用于帮助用户快速完成 Op... | |
| x402 Agent Marketplace Provide AI agent services paid via SOL micro-payments using the x402 HTTP 402 payment protocol with zero-custody, supporting 15 specialized AI agents. | |
| Automation Workflows Design and implement automation workflows to save time and scale operations as a solopreneur. Use when identifying repetitive tasks to automate, building wor... | |
| Elon Musk Skill 基于马斯克的第一性原理和创新思维，为技术创新和颠覆性决策提供专业建议。核心能力包括第一性原理分析、五步工作法、技术创新评估、风险决策、多领域思维整合。 | |
| Music Analysis Analyze music/audio files locally without external APIs. Extract tempo, pocket/groove feel, pulse stability, swing proxy, section/repetition structure, key c... | |
| Seo Content Engine End-to-end SEO content creation workflow. Researches keywords, analyzes search intent, generates optimized outlines, and produces draft content with on-page... | |
| 书匠 Use when: 需要将 5 个小说智能体编排为可追溯、可回滚、带质量闸门的端到端言情创作流水线。 |
23,601–23,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.