Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Reporting Snapvisor Usage Reports SnapVisor account activity and access: builds and screenshots per period, busiest projects, daily, weekly, or monthly trends, members, and pending invites. Use when the user asks 'how many builds did we run this month', 'how many sc | |
| Reviewing Visual Builds Reviews a SnapVisor visual regression build: shows what changed in the screenshot diffs for a branch or commit and approves or rejects the build after the user confirms. Use when the user asks 'what changed in the latest build', 'show the s | |
| Chasing Unpaid Invoices Reviews money owed to the business in SuperBooks: unpaid and overdue invoices, who owes the most, the total outstanding, and an open invoice's details, and drafts a reminder for the user to send. Use when the user asks 'which invoices are u | |
| Cleaning Up Bookkeeping Tidies up SuperBooks transactions and receipts: categorizes or recategorizes transactions, fixes a transaction's category or status, finds uncategorized spending, matches receipts and bills in the inbox to transactions, and finds documents. | |
| Drafting Invoices Drafts a SuperBooks invoice for a customer, optionally from tracked time, creates the customer if needed, and sends it only after an explicit confirmation naming the invoice and recipient. Use when the user asks to 'invoice Cedar Valley Boo | |
| Reading Financial Reports Reports how the business is doing from SuperBooks data: profit and loss, revenue, spending by category, burn rate, runway, account balances, top customers, and recurring expenses. Use when the user asks 'how did June to September go', 'what | |
| Building Study Guides Turns one or more uNotes documents into a study guide, summary, cheat sheet, or practice questions in the chat, and quizzes the user on them. Use when the user asks to 'make me a study guide from this document', 'summarize these notes', 'ma | |
| Planning Revision Builds a revision plan from the user's uNotes flashcard decks, quizzes, study streak, and monthly quota. Use when the user asks 'what should I revise', 'which flashcards do I have', 'which quizzes are on my courses', 'how long is my study s | |
| Researching Course Material Searches the uNotes study library for course material such as past exams, assignments, lab reports, and lecture notes, and answers questions from the documents with each source named. Use when the user asks to 'find uNotes documents about v | |
| Adding Uptime Monitors Adds a new uptime monitor to an Uptimely project without duplicating an existing one, and optionally runs a first check. Use when the user asks to 'start monitoring https://api.example.com/health', 'add a monitor', 'monitor my website', 'wa | |
| Checking Uptime Status Reports the current health and recent history of an Uptimely project: monitor status, open incidents and alerts, uptime over a period, who is on call, maintenance windows, status pages, and telemetry services. Use when the user asks 'is any | |
| Responding To Incidents Runs incident response in Uptimely one confirmed step at a time: declares incidents, acknowledges or resolves incidents and alerts, raises alerts, and runs on-demand monitor checks. Use when the user asks to 'declare an incident for the che | |
| Writing Postmortems Drafts an incident postmortem from Uptimely's real incident timeline, monitor history, and alerts, and saves it on the incident after the user approves the text; also summarizes a period's incidents. Use when the user asks to 'write up the | |
| Managing Voice Library Lists and manages the voice profiles on a VoiceLabs account: shows voices, adds built-in preset voices, suggests a voice for a language, and clones a voice from a recording only after the user confirms the speaker consented. Use when the us | |
| Reading Text Aloud Turns text into spoken audio in the user's VoiceLabs voices and hands back the audio link. Use when the user asks to 'read this paragraph in my Narrator voice', 'narrate these five sections', 'make a voiceover', 'convert this text to speech | |
| Transcribing Audio Transcribes an audio file to text with VoiceLabs and finds earlier transcripts and recordings. Use when the user asks to 'transcribe this clip', 'convert this voice memo to text', 'transcribe my meeting recording', 'what did I record yester | |
| Long Task Manager 管理和调度长时间运行任务，支持实时进度跟踪、异步执行、任务取消和断点续传功能。 | |
| Anti 996 Reminder 温馨健康提醒技能，每日12:05（午间）和23:00（睡前）推送暖心内容，支持打卡攒积分，舒缓压力、劝导早睡。适用于微信/QQ通道。 | |
| arXiv 论文推荐器 推荐高质量的 Agent/RAG 论文。当用户提到"推荐论文"、"arxiv论文"、"Agent论文"、"RAG论文"、"论文推荐"、"看论文"、"找论文"、"最近有什么好论文"时触发此技能。支持主题：Agent测评、RAG测评、Agent架构、RAG架构。自动验证 GitHub 代码，生成结构化报告。 | |
| fitness-planner 健身规划助手，支持训练计划生成、打卡记录、统计周报、自动调整强度、动作讲解和视频教学搜索。触发词：健身、训练计划、打卡、今天练什么、运动、降低强度、增加强度、动作讲解。 | |
| 职业与健康命理分析 基于八字和紫微斗数为用户提供职业方向和健康状况的命理分析及具体建议。 | |
| HeyVideoGen Heygen HyperFrames + MiniMax Hailuo AI 视频自动化生产流水线。 用户说"做视频"、"生成视频"、"短视频制作"、"视频混剪"、"用 HyperFrames 做"时触发。 底层用 HyperFrames(HTML+GSAP) 做动画合成 + 渲染引擎，用 MiniMax Hai... | |
| Videogen 视频号AI短视频自动化生产流水线（v2）。用户说"做视频"、"生成视频"、"短视频制作"、"视频混剪"时触发。支持三种内容模式自动切换（Mode A纯干货 / Mode B剧情+科普 / Mode C漫剧型）。使用 MiniMax Hailuo AI 生成视频片段，配合 FFmpeg 混剪，输出适合视频号发布的完... | |
| Claw Code Suite (Python-Only Edition) Python-only integration of Claw Code harness engineering project with OpenClaw. Provides access to 184 tools and 200+ commands for security analysis, code qu... | |
| Verified Agent Identity Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| Aftership for Shopify via Agiexa Answer 'where is my order', find stuck or failed shipments, review returns and return reasons, and approve or reject returns with your confirmation. | |
| agiexa-google-ads See Google Ads and Shopping campaign spend, clicks, conversions and ROAS, and find top keywords. | |
| Facebook for Shopify via Agiexa Publish posts to your Facebook Pages, read and reply to comments, and check Page insights. | |
| Gmail for Shopify via Agiexa Gmail for Shopify via Agiexa: the 61 tools and 2 triggers your OpenClaw agent gets when you connect Gmail to your Shopify store through Agiexa. Identify important emails, prepare replies using Shopify data, and match supplier updates with i | |
| Google Ads for Shopify via Agiexa See Google Ads and Shopping campaign spend, clicks, conversions and ROAS, and find top keywords. | |
| Google Analytics for Shopify via Agiexa See store traffic, conversion rates, top landing pages and which channels bring your visitors. | |
| Google Calender for Shopify via Agiexa Plan product launches, sales and supplier calls: find free time, create and update events. | |
| Google Search Console for Shopify via Agiexa See which Google searches bring shoppers to your store, clicks and rankings per page, and indexing problems. | |
| Google Sheets for Shopify via Agiexa Export orders, inventory and reports to Google Sheets, and read supplier price or stock sheets. | |
| Gorgias for Shopify via Agiexa Read and reply to support tickets, tag and assign them, and find every ticket from a customer. | |
| Hubspot for Shopify via Agiexa Look up and update contacts, companies and deals, great for wholesale and B2B customers. | |
| Instagram for Shopify via Agiexa Publish posts, read and reply to comments and messages, and check post insights. | |
| Judge.me for Shopify via Agiexa Read, search and summarize your Judge.me product reviews, find low-rated products, publish or hide reviews, and reply to customers publicly or privately. | |
| Klaviyo for Shopify via Agiexa Klaviyo for Shopify via Agiexa: the 225 tools your OpenClaw agent gets when you connect Klaviyo to your Shopify store through Agiexa. Check email and SMS campaign and flow performance, manage lists, segments and profiles, and add subscriber | |
| Openclaw Commerce Shopify Shopify store management through OpenClaw Commerce API | |
| Printify for Shopify via Agiexa Check Printify orders and production status, and look up your print-on-demand products and shops. | |
| ShipEngine for Shopify via Agiexa Compare carrier rates, create labels and track shipments with ShipEngine. | |
| Shopify Store Management via Agiexa Manage your Shopify store: orders, products, customers, inventory, discounts and fulfillment. (315 tools, 45 triggers and 35+ connected apps) | |
| Smile.io for Shopify via Agiexa Check customers' Smile points and VIP tiers, review points history and reward codes, and adjust points (e.g. goodwill gestures). | |
| Zendesk for Shopify via Agiexa Read and reply to support tickets, update status and priority, and find every ticket from a customer. | |
| LighterLoad Proactive relationship and family care assistant that reduces the invisible cognitive labor of managing a household and maintaining important relationships.... | |
| Yabbie Net A safety net for AI agents. Catches unsafe tool calls before they execute. | |
| To-Do Give your AI the power to act in the future. Schedule delayed prompts and one-off reminders that automatically wake the agent up at an exact moment to execut... | |
| Human Google Manager Manages Gmail, Calendar, Sheets, Docs, Drive, Contacts, and Tasks with human touch, mandatory confirmation, and automatic to-do detection. | |
| governance-guard Structural authority separation for autonomous agent actions. Three-phase governance pipeline: PROPOSE, DECIDE, PROMOTE. No action is both proposed and appro... |
25,501–25,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.