Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| qweather 天气查询 — 实时天气、天气预报、生活指数、城市搜索。数据源为和风天气 (QWeather)。 触发词: 天气, 气温, 下雨, 预报, weather, forecast, 穿什么, 洗车, 紫外线, UV, 空气, 今天天气, 明天天气, 北京天气, 或任何 "[城市] 天气" 格式的输入。 | |
| Deprecated Skill [DEPRECATED] This skill has been renamed to translate-book. Install the new version: clawhub install translate-book | |
| Translate Book Translate books (PDF/DOCX/EPUB) into any language using parallel sub-agents. Converts input -> Markdown chunks -> translated chunks -> HTML/DOCX/EPUB/PDF. | |
| viral-article-deconstructor 深度拆解爆款文章，分析其核心观点、说服策略、情绪触发点、金句及语言风格。适用于分析高流量内容、学习爆款写作技巧以及内容营销研究。 | |
| Eidolon Search AI Agent memory search using SQLite FTS5. 90%+ token reduction (10x+) compared to reading full files. Use when the agent needs to search through markdown mem... | |
| Moltbook Validator Validate Moltbook API requests before sending. Checks required fields (content, title, submolt), warns about incorrect field names (text vs content), prevents failed posts and wasted cooldowns. Use before any POST to Moltbook API. | |
| RumbleTipAI Autonomous AI agent that tips Rumble.com creators in cryptocurrency based on watch time, with smart splits, community pools, event-triggered tipping, and con... | |
| OpenScan Scan binaries and scripts for malicious patterns before trusting them. Use when installing skills, evaluating unknown binaries, or auditing tool dependencies. | |
| ATSPrep: Cover letter Draft a cover letter, or a resignation letter, with ATSPrep's free letter builders using only the user's real experience, then fill its gaps together. Use when someone asks for a cover letter for a job, a letter to go with an application, o | |
| ATSPrep: Interview prep Run a mock job interview with ATSPrep's question bank - pick likely questions from the job post and resume, ask them one at a time, and give STAR-based feedback with a stronger version of each answer. Use when someone has an interview comin | |
| ATSPrep: LinkedIn profile polish Check and improve a LinkedIn headline and About section with ATSPrep's rules - score what's there, explain the issues, and write keyword-rich headline options from the user's real role and skills. Use when someone asks to improve, rewrite o | |
| ATSPrep: Resume ATS check Score a resume for applicant tracking systems (ATS) with ATSPrep's free checker, explain each issue in plain words and fix them with the user. Use when someone asks to check, score, review or "ATS-proof" a resume or CV, asks why they get no | |
| ATSPrep: Tailor a resume to a job Tailor a resume to a specific job posting with ATSPrep - rank the posting's keywords, show which are missing, and rewrite the user's own lines in the posting's wording without inventing anything. Use when someone shares a job link or job de | |
| hash health Hash Health — personal nutrition tracking, meal logging, medication management, and daily health dashboard. Use when user mentions food, meals, eating, loggi... | |
| test Log meals, check nutrition, manage medications, and view daily health dashboard via Hash Health. Use when user mentions food, meals, eating, nutrition, medic... | |
| travily_search_pro 使用 Tavily AI 进行网络搜索、深度研究、内容提取。支持 search、research、extract 三个功能。 | |
| FlowFi REST API instructions for FlowFi—authorization, smart accounts, workflows (AI generate, edit, deploy, undeploy, delete, pause, resume, stop), execution (list... | |
| trader Trade Solana tokens, track portfolio, bet on prediction markets, check NFT floors via the trader CLI. | |
| Scrapling MCP Use Scrapling's MCP server through mcporter for HTTP and browser extraction, persistent sessions and browser actions. Includes Python helpers and crawl recipes for tasks beyond the MCP tools. Use for web scraping, structured extraction, ada | |
| Scrapling MCP Advanced web scraping with Scrapling — MCP-native guidance for extraction, crawling, and anti-bot handling. Use via mcporter (MCP) to call the `scrapling` MC... | |
| Vibe Kanban MCP Control the local vibe-kanban MCP server to list orgs/projects/issues, create/update issues, manage workspaces, and find dashboard ports on macOS. | |
| OATDA Check Balance Check OATDA account balance, remaining credits, and total usage via the unified AI gateway. Triggers when the user asks "how much OATDA credit do I have left... | |
| OATDA Compare Models Compare multiple LLM models (GPT-5, Claude Sonnet 4.5, Gemini 3, DeepSeek v4-pro, Grok 4, etc.) side-by-side in one parallel request via OATDA's unified AI g... | |
| OATDA Generate Image Generate images from text descriptions using AI models through OATDA's unified API. Triggers when the user wants to generate, create, or produce AI images, a... | |
| OATDA Generate Speech Generate speech or audio from text using OATDA's unified audio API. Triggers when the user wants to convert text to speech, create narration, voiceovers, acc... | |
| OATDA Generate Video Generate videos from text descriptions using AI models through OATDA's unified API. Triggers when the user wants to generate, create, or produce AI video cli... | |
| OATDA List Models List available AI models from OATDA's 10+ providers with optional filtering by type (chat, image, video) or provider name. Triggers when the user wants to se... | |
| OATDA Text Completion Generate text using OATDA's unified LLM API. Triggers when the user wants to generate, write, or complete text using a specific LLM provider (OpenAI, Anthrop... | |
| OATDA Transcribe Audio Transcribe audio to text using OATDA's unified audio API. Triggers when the user wants speech-to-text, transcription of meetings, podcasts, voice notes, subt... | |
| OATDA Translate Audio Translate foreign-language audio into English text using OATDA's unified audio API. Triggers when the user wants audio translation, spoken-language translati... | |
| OATDA Video Status Check the status of an asynchronous video generation task from OATDA. Triggers when the user wants to check if a video is done generating, retrieve the video... | |
| OATDA Vision Analysis Analyze images using vision-capable AI models through OATDA's unified API. Triggers when the user wants to analyze, describe, or understand images; extract t... | |
| Slack Thread Export Export Slack thread messages from a logged-in Slack web tab into CSV using an attached Chrome Browser Relay tab. Use when the user wants to collect Slack con... | |
| hyperbot-quote 提供Hyperbot平台加密货币交易数据分析，包括聪明钱追踪、鲸鱼监控、市场行情查询和交易统计等功能。 | |
| hyperbot-quote-mcp Provides cryptocurrency trading data analytics including smart money tracking, whale monitoring, market data queries, and trader statistics. Use this skill w... | |
| Coder Workspaces Manage Coder workspaces and AI coding agent tasks via CLI. List, create, start, stop, and delete workspaces. SSH into workspaces to run commands. Create and monitor AI coding tasks with Claude Code, Aider, or other agents. | |
| Home Assistant Assist Control Home Assistant smart home devices using the Assist (Conversation) API. Use this skill when the user wants to control smart home entities - lights, sw... | |
| EngageLab App Push Call EngageLab App Push REST APIs to send push notifications and in-app messages to Android, iOS, and HarmonyOS devices; manage tags and aliases; create sche... | |
| EngageLab Email This skill is used to send emails via the EngageLab REST API. It supports regular sending, template sending, variable replacement, attachment handling, and s... | |
| EngageLab OTP Call EngageLab OTP REST APIs to send one-time passwords (OTP), verify codes, send custom messages, and manage OTP templates across SMS, WhatsApp, Email, and... | |
| EngageLab SMS Call EngageLab SMS REST APIs to send SMS messages and manage SMS templates and signatures (sender IDs). Use this skill whenever the user wants to send an SMS... | |
| EngageLab Web Push Call EngageLab Web Push REST APIs to send push notifications and in-app messages to web browsers (Chrome, Firefox, Safari, Edge, etc.); manage tags and alias... | |
| EngageLab WhatsApp Business Call EngageLab WhatsApp Business REST APIs to send WhatsApp messages (template, text, image, video, audio, document, sticker), manage WABA message templates,... | |
| Blended Learning Instructional Design 3.5.81 为高校及职业院校教师生成混合式教学设计方案、课程教学日历 Word 文档，以及 HTML 交互式说课课件与说课 PPT。当用户提到混合式教学、混合式教学设计、混合式教学设计大赛、线上线下融合课程、翻转课堂、超星学习通教学设计、说课课件、教学日历等关键词时调用本技能；即使用户未说出上述关键词，只要需求本质是“为一门课程设计线上线下融合的教学方案（含教学日历、说课课件或说课 PPT）”，也应主动调用本技能。 | |
| Extropy Operator Run Extropy CLI pipelines and analyze results | |
| MemPalace Memory System for OpenClaw MemPalace memory system for OpenClaw/XClaw/WorkBuddy. Archive AI conversations to local long-term storage with semantic search. Commands: /mem-arc (archive),... | |
| Kash - Agentic Payment Provider Pay for APIs, tools, and services from your agent's Kash wallet. Spends below $5 are autonomous; above $5 requires explicit user YES. Requires KASH_KEY and K... | |
| Medium Writer Write and publish SEO-optimized monetizable articles for Medium Partner Program, targeting specific audiences and submitting to popular publications. | |
| toutiaoAutoPublish 今日头条微头条自动发布工具。自动发布短内容到今日头条平台，支持文本和图片。 使用场景：(1) 用户说"发布头条"、"发微头条"、"头条发布"时触发 (2) 需要自动发布社交媒体内容时 (3) 需要定时发布今日头条时 | |
| multi-account-config Configure multiple messaging platform accounts for OpenClaw. Use when the user wants to add or configure additional accounts for Telegram, WhatsApp, Discord,... |
25,351–25,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.