Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Bitwarden Credential Store or retrieve credentials in Bitwarden via CLI. Use when asked to save, store, or add a password/API key/OAuth token/secret/credential to Bitwarden. Trig... | |
| Clawhub Release Auditor Validate, package, and verify ClawHub skills before and after publishing. Use when creating or updating a ClawHub skill, preparing a release, diagnosing repe... | |
| Minimax Vision Search Analyze images and search the web using MiniMax MCP tools | |
| Personal Os Framework Build a second brain that AI can understand and maintain. This framework provides decision logging with follow-up tracking, periodic review generation, routi... | |
| Project Heartbeat Design controlled continuation loops for long-running projects. Use when a task is too large for one session, benefits from periodic wake-ups, and needs expl... | |
| Quick Capture 帮用户把信息写入笔记系统：碎片化信息原样追加到当日 Journal（不改），待整理的笔记归纳成结构化知识写到 Inbox（要完善）。触发于：记笔记、记碎片、存一下、写到 inbox/journal 等。 | |
| Telegram File Sender Send files or notes up to 50MB to a Telegram user via bot, supporting local, iCloud, relative, or Knowledge/ paths with automatic zipping if needed. | |
| Tool Output Auditor Audit tool and command results before acting on them. Use when an agent has already run a command or tool, especially in multi-step workflows where a failed,... | |
| fitconverter 运动健康转换工具。华为、Zepp、小米、vivo、三星、Keep、悦跑圈、RQrun、动动、行者运动记录导出后，可通过运动健康转换工具转换成fit、tcx、gpx、kml格式文件同步导入高驰、佳明、RQrun、Strava等主流运动平。 运动记录转换工具、运动记忆、运动数据转换、fitconverter、华为运动... | |
| FastAPI开发专家 FastAPI development best practices and conventions. Use when building, reviewing, or debugging FastAPI applications, REST APIs, or Pydantic models. | |
| 代码审查专家 Reviews Python code for quality, style, and common bugs. Use when the user submits code for review, asks for feedback on their code, or wants a code audit. | |
| api文档生成 Generates detailed API documentation from Python code by extracting public symbols, adding standardized docstrings, assembling, and quality-checking the docs. | |
| 软件项目开发规划助手 Plans a new software project by gathering requirements through structured questions before producing a plan. Use when the user says "I want to build", "help... | |
| 技术报告生成 Generates structured technical reports in Markdown by collecting user input and applying a style guide to a predefined template. | |
| Open-Meteo Weather + Weather Strip Get weather forecasts via Open-Meteo API (free, no API key). Use when: user asks about weather, temperature, rain probability, UV index, wind, or forecasts f... | |
| 钦天监 解读钦天监(qintianjian)网站、经济周期理论、木星周期与三元九运/康波周期/美林时钟的关联。用于用户询问钦天监网站用途、项目价值、周期预测原理、BAP-578、Crypto+AI、币安黑客松、钦天监指数、QCX等时触发。 | |
| muse-party Arrive at Muse Party, a live social site for AI agents — look around, chat, take a group photo, and play Texas Hold'em poker with other agents | |
| DappLooker AI DeFi intelligence suite — token metrics, perp trading data, technical analysis, smart money flows, staking yields, and AI-powered market research across Base... | |
| RunBox — Paid Code Execution for AI Agents Execute code in a remote, isolated Docker sandbox — paid autonomously with USDC on Stellar. Use when the user asks to run, execute, test, or benchmark code i... | |
| China Id Validator Validate and extract info from Chinese ID card numbers (身份证). 身份证号码验证、归属地查询、出生日期提取、性别判断、年龄计算、15位转18位。China mainland ID card validator and parser. | |
| China Stock Toolkit 提供A股大盘指数、涨跌停、北向资金监控及交易税费计算，支持多源数据交叉验证和用户自定义接口扩展。 | |
| China Work Calendar 中国法定节假日与工作日计算器。查某年某月工作天数、某日期是否上班、距离节假日倒计时、调休换休提示。支持2024-2027年全部法定节假日及已知调休日。When the user asks about Chinese holidays, workdays, overtime, holiday countdown,... | |
| Color Convert Convert colors between HEX, RGB, HSL, HSV, CMYK, generate palettes, check WCAG contrast, and export CSS variables using pure Python. | |
| CSV Tool Pro Perform comprehensive CSV file operations including viewing, filtering, sorting, merging, splitting, deduplication, conversion (JSON/YAML/TSV/Markdown/HTML),... | |
| Currency Converter Pro 实时汇率换算专家。支持150+货币实时汇率、批量换算、多货币对比、历史汇率查询。零API Key，免费数据源。When user asks about currency exchange, conversion rates, USD to CNY, forex, or money conversion. | |
| Hash Utilities Generate and verify hashes (MD5, SHA variants, CRC32, HMAC, BLAKE2) for strings and files with streaming support and no external dependencies. | |
| Json Formatter Pro All-in-one JSON toolkit — format, validate, query, minify, and extract data from JSON. Built-in JMESPath query, JSONPath support, syntax highlighting. 适合API调... | |
| Lorem Toolkit Generate placeholder text, fake data, and test content including names, contacts, tech, finance, dates, JSON templates, and custom patterns. | |
| Markdown Table Maker Create, format, align, sort, transpose, and convert tables between Markdown, CSV, JSON, and TSV using pure Python without dependencies. | |
| Markdown To Ppt Convert Markdown to beautiful presentations and slides. 一键将Markdown文档转换为精美PPT幻灯片，支持多种主题风格，适合商务汇报、教学课件、会议演讲。Markdown to PPT, presentation generator, slides ma... | |
| Muslim Holiday Calendar Islamic holiday calendar and Hijri date converter. 穆斯林节假日日历，支持Ramadan斋月、Eid开斋节、Ashura等重要节日查询，伊斯兰历转换。Islamic calendar, Ramadan, Eid al-Fitr, Eid al-Adha, Hijr... | |
| Package Tracker Track your packages and deliveries worldwide. 支持顺丰、圆通、中通、申通、韵达、邮政EMS、UPS、FedEx、DHL等国内外快递实时查询，快递单号一键查询物流轨迹。Express tracking, parcel delivery status, logistics查询。 | |
| Pinyin Converter Convert Chinese text to Pinyin (拼音). 中文转拼音工具，支持声调标记、去声调、首字母大写。适合语言学习、输入法开发、中文处理。Chinese to Pinyin converter with tone marks. | |
| Random Team Picker Randomly select or split team members with options for weighted choice, exclusions, and fair distribution over multiple rounds. | |
| Slug Generator Generate URL-friendly slugs from text. 将任意文本转换为SEO友好的URL别名，支持中英文混合、自动去除特殊字符。适合博客、电商、CMS系统。URL slug maker, permalink generator, URL safe string. | |
| Uuid Generator Generate UUIDs in versions v1, v4, and v5 with options for count, namespace, name, and output format. | |
| World Timezone Pro World timezone converter — convert times across 200+ cities worldwide. Perfect for international calls, remote work, travel planning, and global business. Fe... | |
| Google Chat Send messages to Google Chat spaces and users via webhooks or OAuth. Use when you need to send notifications, alerts, or messages to Google Chat channels (spaces) or direct messages to specific users. Supports both incoming webhooks (for pr | |
| Memory Lancedb Pro Skill This skill should be used when working with memory-lancedb-pro, a production-grade long-term memory MCP plugin for OpenClaw AI agents. Use when installing, c... | |
| Darcy Sexy Brain 戰略辯證與數據推理大腦 - 整合多智能體辯證、數據推理引擎與市場資訊整合的進化版戰略夥伴。當用戶需要策略分析、紅隊測試、多角度辯證、數據驅動決策、市場調研整合、或需要從第一性原理出發的複雜決策時觸發。觸發關鍵詞：辯證、多智能體、數據推理、搜索、市場分析、策略對比。 | |
| AI Summary Ope Page V2 Одностраничное резюме на русском языке PDF-отчёта или документа Word (DOCX) (A4, ключевые выводы и открытые вопросы для обсуждения). Определяет сектор отчёта и выписывает факты по отраслевым правилам; иностранные отчёты пересказывает по-ру | |
| pdf-rezume Одностраничное резюме PDF-отчёта или документа Word (DOCX) для правления (A4, ключевые выводы и открытые вопросы правлению Сбера). Сначала определяет сектор отчёта и выписывает факты по отраслевым правилам ведущего аналитика; иностранные от | |
| Voice Transcribe Transcribe audio files using OpenAI's gpt-4o-mini-transcribe model with vocabulary hints and text replacements. Requires uv (https://docs.astral.sh/uv/). | |
| Algorithmic Art Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, gener... | |
| 根据你的要求总结资讯摘要 Researches news and factual information on the web, then produces a cited, deduplicated summary tailored to constraints (topic, time range, region, sources,... | |
| git-backed-obsidian-cli-workflows Use the official Obsidian CLI for note workflows in a Git-backed vault, including search, read, links/backlinks-style queries, daily-note operations, and lig... | |
| git-workflows-pro Handle advanced git workflows and recovery tasks. Use when the user needs help with interactive rebase, commit cleanup, conflict resolution, reflog recovery,... | |
| Github Private Repo SSH Routing Diagnose and manage SSH keys, host aliases, and Git remotes for GitHub private repositories in multi-repo environments. Use when deploy keys collide, a machi... | |
| Multi-Agent Filesystem Governance Govern filesystem organization and file-operation decisions in multi-agent environments. Use when deciding where files should live across agent-private works... | |
| Obsidian Official CLI Headless Install and adapt the official Obsidian CLI for headless Linux servers by using a non-root user, Xvfb virtual display, ACL-based vault access, and an obs wra... |
24,101–24,150 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.