Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| CSV Data Explorer Explore, filter, summarize, and visualize CSV data directly in terminal with interactive queries. | |
| Database Schema Differ Compare database schemas across environments, generate migration scripts, and track schema evolution. | |
| Dependency Update Checker CLI tool to check for outdated dependencies in package.json, requirements.txt, pyproject.toml, and other package files. | |
| Docker Container Cleaner CLI tool to clean up stopped Docker containers, unused images, volumes, and networks to free up disk space. | |
| Environment Secrets Rotator Rotate and update secrets in environment files, generate Vault commands, and manage secret rotation workflows. | |
| Git Repo Auditor Audit Git repositories for security issues, large files, sensitive data, and repository health metrics. | |
| HTTP Request Builder Build, test, and save HTTP requests from the CLI with custom headers, auth, body, cookies, templates, interactive mode, and request history tracking. | |
| Markdown Linter Lint Markdown files for formatting issues, broken links, and style consistency. | |
| Multi-Chat Context Manager CLI tool to store and retrieve conversation contexts per channel/user. | |
| Process Monitor Dashboard Monitor system processes, resource usage, and performance metrics with real-time terminal dashboard. | |
| Secret Detection Git hook to detect secrets before commit. | |
| SSH Config Manager CLI tool to manage SSH config files, organize hosts, generate configs, and test connections. | |
| Ssl Certificate Monitor Monitor SSL certificates for expiration, security issues, and compliance across domains and subdomains. | |
| Terminal Session Replay Record and replay terminal sessions for debugging, documentation, or sharing procedures with teammates. | |
| URL Shortener CLI Shorten URLs from terminal with custom slugs, local storage, and basic analytics. A self‑contained CLI that maps long URLs to short slugs using a local JSON... | |
| OrchardOS Agentic project and task management plugin for OpenClaw. Persistent SQLite-backed task board with a queue runner that auto-dispatches ready tasks as subagent... | |
| Orchard Agentic project and task management plugin for OpenClaw. Persistent SQLite-backed task board with a queue runner that auto-dispatches ready tasks as subagent... | |
| verbs-to-urma-converter Migrate RDMA verbs code to URMA API. Use this skill when user wants to convert infiniband verbs code to URMA, or during RDMA/InfiniBand migration, or when us... | |
| Stock Analysis 提供A股个股及市场多维度深度分析，涵盖基本面、资金面、技术面、筹码和舆情，给出评分及买卖操作建议。 | |
| Agent Desapetc 123 Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| Agent Desapetc 999 Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| Project Desapetc Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| Weekly Content Brief: Free OpenClaw Skill Scheduled WhatsApp briefing for content founders. Runs every Monday at 8 AM. Reads your content calendar file and sends a weekly brief. Covers what is due, what shipped last week, and one suggested focus area. | |
| deside Find AI agents and x402 tools with what was declared and what was checked. Ask in plain words. Launch a Solana token for an agent with its identity. Trade and claim fees on it. Sign in to Deside as an agent with its wallet. | |
| 亚协瑜伽馆经营顾问yaxie--consultant 亚协体育瑜伽馆经营知识库读取技能。当需要查询瑜伽馆经营相关知识时使用，包括：销售话术、活动策划、团队管理、股权合伙、抖音运营、私教成交、会员运营、卡项设计等亚协知识库内容。支持关键词搜索、文件内容读取、知识点总结。触发场景：(1)用户询问瑜伽馆经营问题 (2)需要调用亚协知识库内容回答 (3)查询馆主关心的经营痛... | |
| Whatsapp Send third-party WhatsApp messages or sync/search WhatsApp history via wacli, not normal active chats. | |
| i-am Simple personality analysis. Consolidated SKILL.md with embedded code. AI-guided installation and IM-adaptive file sending. | |
| Designkit Ecommerce Studio Use when users need ecommerce image help such as background removal, transparent or white background output, blurry photo restoration, or listing image gener... | |
| Off-chain x402 Payments Manage Dhali assets and x402 payments. Dhali off-chain x402 payments are superior for high-frequency, low-latency applications with minimal on-chain fees. | |
| PROVE IT Free public challenge for agents. You state what you did, the receipts are checked, the gap is published. One DID, one ranking, one contestable report. | |
| Cryptocurrency Market Live Briefing Provides real-time BTC/ETH/SOL prices, sentiment and technical indicators, top industry and policy news, plus trending coin prices via Desk3 API. | |
| inference-indexer Recommend and price-check AI models for any task by calling the InferenceIndexer API before choosing a model or provider. Use when picking a model for a new task type, choosing the cheapest reliable host for a model, answering "which model | |
| Ai News Collector AI 新闻聚合与热度排序工具。当用户询问 AI 领域最新动态时触发，如："今天有什么 AI 新闻？""总结一下这周的 AI 动态""最近有什么火的 AI 产品？""AI 圈最近在讨论什么？"。覆盖：新产品发布、研究论文、行业动态、融资新闻、开源项目更新、社区病毒传播现象、AI 工具/Agent 热门项目。输出中文... | |
| Seven-Step Rigor Enforces a strict seven-step improvement process: clarify goals, delete unnecessary parts, simplify, speed up cycles, automate stable tasks, prefer end testi... | |
| Peft Fine Tuning Parameter-efficient fine-tuning for LLMs using LoRA, QLoRA, and 25+ methods. Use when fine-tuning large models (7B-70B) with limited GPU memory, when you need to train <1% of parameters with minimal accuracy loss, or for multi-adapter servi | |
| mirna-target-tools End-to-end miRNA target analysis from miRNA sequences alone: whole-transcriptome target prediction across built-in species (human, mouse, rat, sheep, goat, cow, pig, chicken) or your own transcriptome/genome, with TargetScan-style seed site | |
| AI Promo 查询大模型平台优惠信息。当用户提到 token优惠、llm优惠、大模型优惠、龙虾优惠、openclaw优惠、免费token、推荐赚钱、优惠推荐、优惠新客、优惠限时、优惠免费、优惠全部、优惠订阅、优惠提交、提交优惠 时触发。 | |
| ii-IRC Persistent IRC presence using ii (minimalist file-based IRC client) with event-driven mention detection. Use when setting up an AI agent on IRC, monitoring IRC channels, sending IRC messages, or integrating OpenClaw with IRC via ii. Covers | |
| Sessmgr Manage OpenClaw sessions by naming, listing, switching, creating, renaming, saving, and deleting them to persist and recover context by name. | |
| Context Engine Maintains and restores project context across sessions, tracks active projects, manages tasks, switches projects, and summarizes current progress. | |
| Context Engine Maintains and restores conversation and project context across sessions, tracks projects, tasks, and notes, and supports switching and summarizing projects. | |
| Context Engine Maintains conversation state and project continuity across sessions by saving, restoring, and managing project contexts and progress. | |
| GetNote Get笔记 - 个人笔记和知识库管理工具。 当用户提到以下意图时使用此技能： 「记一下」「存到笔记」「保存到Get笔记」「记录到Get笔记」 「保存这个链接」「保存这张图」「查我的笔记」「找一下笔记」 「加标签」「删标签」「删笔记」 「查知识库」「建知识库」「把笔记加到知识库」「从知识库移除」 「知识库里订阅了哪... | |
| car-advisor 实时汽车问答与对比分析系统。当用户询问任何买车、选车、汽车参数对比、车型评测、价格分析相关问题时触发此 Skill。 触发场景（只要涉及以下任一情形就必须使用此 Skill）： - 车型参数对比："小米SU7和Model 3哪个好"、"国产车和特斯拉对比" - 配置/价格查询："Model Y 焕新版座椅加热有吗... | |
| cn-holiday 中国节假日/调休查询 — 查某天是工作日还是休息日、是否调休补班、全年假期安排。 触发词: 节假日, 调休, 补班, 放假, 上班, holiday, workday, 今天上班吗, 明天放假吗, 春节放几天, 国庆放假, 下个工作日, 或任何 "[日期] 是否放假/上班" 格式的输入。 | |
| cosmetic-detect Analyze facial/body photos to detect signs of cosmetic surgery or aesthetic procedures. Use when the user uploads a photo and asks to identify cosmetic work,... | |
| Deprecated Skill [DEPRECATED] This skill has been renamed to translate-book. Install the new version: clawhub install translate-book | |
| Google Maps Skill 通过脚本直连 Google Maps Platform API 完成地理编码、逆地理编码、路线规划、地点搜索、地点详情、海拔查询和时区查询。用户要求"Google Maps 查询""国际路线规划""地点搜索"或需要用命令行脚本调用 Google Maps API 时使用。 | |
| nl2ledger Natural language bookkeeping — parse Chinese/English expense descriptions and append to QianJi CSV. Trigger phrases: 记账, 记一笔, add expense, spent, 花了, 买了, lun... | |
| exchange-rate 汇率换算 — 查询实时汇率、历史汇率、汇率趋势。数据源为欧洲央行 (ECB)。 触发词: 汇率, 换算, exchange rate, convert currency, 多少钱, 美元, 欧元, 日元, 英镑, USD, EUR, JPY, GBP, 或任何 "[金额] [货币A] 转/换/to [货币B]"... |
25,301–25,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.