Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Frontend Design 1.0.0 Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics. | |
| Self Improving Agent 1.0.0 Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Claude ('No, that's wrong...', 'Actually...'), (3) User requests a capability that does | |
| Likec4 Dsl Use when working with `.c4`/`.likec4` files or LikeC4 CLI/config questions where exact DSL/CLI syntax is required, especially for strict command/snippet-firs... | |
| ClawdTalk ClawdTalk — Voice calls, SMS, and AI Missions for Clawdbot | |
| Socialconductor Skill Manage your SocialConductor AI comment automation bots from any chat app. Control Facebook, Instagram, YouTube, and TikTok — check status, pause or resume AI... | |
| Tandoor Recipe CLI Manage recipes, meal plans, and shopping lists on a Tandoor Recipe Manager instance via CLI. | |
| Photo Guide 摄影指导技能 - 当用户上传照片并询问如何拍出类似效果、拍摄参数、后期调色等摄影相关问题时使用此技能。分析照片的视觉特征，推断拍摄参数，提供后期调色指导、照片优化建议和学习关键词。 | |
| Free Mobile SMS Envoyer des SMS à ton humain via Free Mobile | |
| org-cli Task capture, scheduling, and linked knowledge in org-mode files via the `org` CLI. Query, mutate, link, and search the user's org files and org-roam database. | |
| org-memory Extends the org-cli skill so the agent also persists its own memory (knowledge, observations, daily notes) to an org workspace. | |
| stock-scheme-tracker Save and track stock investment strategies with entry/exit conditions in a local Markdown file and check current market data to recommend next steps. | |
| Sap Journal Auditor Audits SAP FI/CO journal exports to detect duplicates, anomalies, cost center mismatches, approval bypass, intercompany issues, and unusual user activity. | |
| Morning Briefing Generate a daily morning briefing (weather, calendar, news, reminders) using the local `briefing` CLI. No API tokens consumed for data gathering. Use when the user asks for a morning briefing, daily summary, schedule overview, or wants auto | |
| dataclaw-setup Setup guide for installing and configuring DataClaw itself for use with OpenClaw. Use when the user wants to learn what DataClaw is or finish initial setup.... | |
| LLM Council Use when the user asks for a council, second opinions, a debate, or multi-perspective deliberation on a question — or when a decision is high-stakes, contested, or ambiguous enough that a single answer risks being confidently wrong or sycop | |
| Agent Browser Clawdbot 0.1.0 Headless browser automation CLI optimized for AI agents with accessibility tree snapshots and ref-based element selection | |
| QQ Music Browser Control Community-maintained browser automation for QQ Music's web player (y.qq.com). Supports play/pause/next/prev, search songs/artists/albums, play liked songs, r... | |
| 九马免费图片编辑 九马AI图片编辑。使用九马AI API进行图片编辑，最多支持3张图片的融合编辑。当用户需要修改图片中的一些内容时使用此技能。Jiuma AI image editing. Utilizing the Jiuma AI API for image editing, it supports the fusion ed... | |
| 九马免费文生图 九马AI免费图片生成技能。使用九马AI API进行文本到图片的生成，支持自定义图片尺寸和提示词。当用户需要根据文本描述生成图片时使用此技能。Jiuma AI's free image generation skill. Utilize the Jiuma AI API to generate images fro... | |
| 九马AI免费图生视频 九马AI图生视频。使用九马AI API进行图生视频，支持首尾帧和提示词。当用户需要将图片生成视频时使用此技能。Jiuma AI image-to-video. Utilize the Jiuma AI API to generate videos from images, supporting both the... | |
| 九马免费对口型数字人 九马AI免费数字人视频生成技能。使用九马AI API进行文本内容或音频内容到数字人视频的生成，支持选择不同数字人形象和音色。当用户需要生成数字人视频时使用此技能。 | |
| 九马免费抖音视频下载和转文本 九码AI免费抖音视频下载和文本提取技能。 | |
| 九马免费声音克隆 九马AI语音克隆技能，TTS。使用九马AI API进行语音克隆和合成，支持在线音色选择或自定义音频参考。当用户需要语音克隆、语音合成或选择不同音色时使用此技能。Jiuma AI voice cloning skill, TTS. Utilize Jiuma AI API for voice cloning and... | |
| Camera Capture Control the local computer's built-in camera for capturing photos and basic operations. | |
| 216medsearch 通过内部 API 模糊查询药品名称并返回其通用名，支持准确或模糊匹配。 | |
| Generic Drug 查询药品名称对应的通用名，若无结果则返回原名称，基于本地 SearXNG 搜索结果智能分析识别。 | |
| cs2-stats-monitor-5e Query and monitor 5E CS2 player stats and match performance in real-time with customizable player lists and detailed match analysis. | |
| azure-cli Comprehensive Azure Cloud Platform management via command-line interface | |
| kubectl Execute and manage Kubernetes clusters via kubectl commands. Query resources, deploy applications, debug containers, manage configurations, and monitor cluster health. Use when working with Kubernetes clusters, containers, deployments, or p | |
| Mailscope Email Detection Email security detection and analysis. Use this skill whenever the user wants to analyze, scan, or check the security of an email (.eml) file. This includes... | |
| Auto Login Assistant Help the agent recover from login walls on websites by detecting sign-in states, collecting user-approved credentials, filling common login forms, and handli... | |
| Dkey Switch AI 窗口切换技能。用于定位并激活 Windows 上的目标窗口，支持智能模糊匹配、窗口查找、进程匹配、句柄激活与标签切换回退。 | |
| Hfmirror Trending 通过 HF-Mirror 公开 API 获取 Hugging Face 实时热门趋势，并生成结构化中文 Markdown 报告。适用于各种对话式 AI 代理。 | |
| Hfmirror Trending En Fetches real-time Hugging Face trending data via the public HF-Mirror API and generates structured Markdown reports in English. Suitable for conversational A... | |
| Batch File Processor Parallel batch processing of large file sets using sub-agents (summarize, analyze, extract, transform). Use when performing the same operation across many fi... | |
| Xiaomi MiMo-V2-TTS Converts text to speech using Xiaomi MiMo-V2-TTS with support for emotional styles, Chinese dialects, role voices, and singing synthesis. | |
| SVG PPT Generator SVG-based PPT generator with 9 themes, 8 layouts, 30+ charts, and 600+ icons | |
| BBC News Fetch and display BBC News stories from various sections and regions via RSS feeds. Use when the user asks for BBC news, UK news headlines, world news from BBC, or news from specific BBC sections (technology, business, politics, science, he | |
| Pencil Skill Create and edit Pencil (.pen) design files programmatically. Generate UI designs as JSON-based .pen files with themes, variables, components, and layouts. In... | |
| WSL Windows Bridge WSL ↔ Windows cross-system bridge for OpenClaw agents. Provides win-python / win-ps / win-cmd / win-copy / win-run-py / win-path to invoke Windows Python (An... | |
| Skill Builder 技能构建工厂（Meta-Skill Factory）。使用苏格拉底诘问法 + 第一性原理分析，通过多轮对话迭代细化需求，帮助用户从零到一构建一个完整的新技能。当用户说"创造一个技能"、"创建一个 skill"、"帮我设计一个 xxx 技能"、或表达任何需要构建新技能的需求时激活。 | |
| Feishu API Lookup Look up Feishu Open API documentation. Activate when: needing to find a specific Feishu API endpoint, understanding API parameters/response, writing scripts... | |
| Feishu Bitable Query Query Feishu Bitable (多维表格) with server-side filter, sort, field selection, and multiple output formats. Activate when querying bitable records with conditio... | |
| Feishu Block Ops Low-level Feishu document block operations via REST API. Use when feishu_doc built-in actions are insufficient: batch update cells, precise position insert,... | |
| Feishu Comments Read comments from Feishu documents. Use when: user asks to check/read/fetch comments on a Feishu doc, review feedback on a document, or collaborate on docum... | |
| Feishu Doc Sync 飞书文档增量同步与表格操作指南。覆盖：表格更新策略（delete+insert）、header_row 设置、insert action、列宽算法、三阶段 diff 同步。当需要同步本地文档到飞书、操作飞书表格、或做增量编辑时激活。 | |
| Feishu Interactive Card ⚠️ DEPRECATED — Use feishu-msg-reader instead. This skill has been renamed and superseded by feishu-msg-reader (by deadblue22). | |
| Feishu Md2blocks Insert rich Markdown content (including tables) into Feishu documents. Use when feishu_doc write/append fails with tables, or when inserting complex formatte... | |
| Feishu Merged Msg Fetch and parse Feishu merged/forwarded messages (合并转发消息). Activate when a Feishu message shows "Merged and Forwarded Message" with no readable content, or w... | |
| Feishu Message Reader Fetch Feishu message content by message_id, with optional thread context. Activate when: needing to read the content of a specific Feishu message by its mess... |
24,651–24,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.