Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 一周拿下 WorldQuant 因子挑战金牌(AI 辅助) AI 辅助冲击 WorldQuant BRAIN Challenge GOLD:计分心智模型、可过性预测器、每日精提收割、自我进化研究循环。实测 6 天 2000→11306 分。 | |
| finance-ethnographer Always-on finance UX research. Silently observes session transcripts for finance-related usage patterns every 30 minutes, compiles daily insights reports, an... | |
| finance-ethnographer 2 Privacy-first UX research ethnographer for OpenClaw with a personal-finance lens. Auto-invoked to observe and log structured behavioral events (no inference)... | |
| NeuralMind Answer questions about a code repository in ~800 tokens instead of loading 50,000+ tokens of raw source. Use whenever the user asks how something works, where something is defined, who calls what, or to explore an unfamiliar file. Provides | |
| Agent Communication 支持Agent间消息传递、广播、状态同步和共享工作空间，提高多Agent团队协作效率并解决通信超时问题。 | |
| Corveil Corveil is an organizational intelligence platform that captures AI activity (coding sessions, meetings, chats), produces insights and recommendations, and b... | |
| Pndr Personal productivity app with Ideas/Tasks, Journal, Habits, Package tracking, Lists, and more via MCP | |
| 亲子半日游规划师 亲子半日游规划师。输入出发地、孩子年龄、出行方式和家庭需求，调用高德 Web 服务能力生成亲子友好的半日游路线故事、行程表、设施清单、风险提醒和步行负担评估。 | |
| File Inbox Bidirectional file management system for OpenClaw workspaces. Organizes, indexes, and retrieves files exchanged with users via any channel. Use when: a user... | |
| Prompt Diet Analyze and optimize OpenClaw system prompt token usage by compressing workspace files (AGENTS.md, SOUL.md, USER.md, TOOLS.md, IDENTITY.md, HEARTBEAT.md, MEM... | |
| Smart Tasks Intelligent task management using workspace markdown files. Natural language CRUD via chat, context-aware reminders, priority briefings, and weekly reviews.... | |
| Task Quest Zero-friction gamification layer for task management. Adds XP, levels, streaks, and achievements to completed tasks with no manual input required — the agent... | |
| Clausebreaker Analyzes any legal document — leases, contracts, NDAs, terms of service, employment agreements — and breaks every clause into plain English with risk ratings... | |
| 八字排盘技能 八字命理排盘技能。支持四柱八字排盘、十神计算、大运排法、五行统计、格局判断、用神选取、流年推算、详细断语。 | |
| 风水堪舆技能 风水堪舆技能。支持八宅风水排盘、东四宅/西四宅判断、游年九星排布、方位吉凶分析，提供基础布局建议。 | |
| 大六壬技能 大六壬排盘与断卦技能。支持月将加时、起四课三传、排天将神煞、断课分析。用于人事占卜、失物寻人、出行吉凶、婚姻事业等预测。 | |
| 六爻纳甲技能 六爻纳甲排盘与断卦技能。支持起卦、纳甲、装卦、六亲、世应、六神排布，以及自动化断卦分析。 | |
| 梅花易数技能 梅花易数排盘与断卦技能。支持数字起卦、时间起卦、方位起卦，包含互卦、变卦、体用分析、自动化断卦。 | |
| 奇门遁甲排盘技能 奇门遁甲排盘技能。支持阴阳遁、局数、八门九星八神落宫、断卦解盘自动化分析。 | |
| 七政四余星盘技能 七政四余星盘排盘技能。七政（日月金木水火土）四余（罗计孛气）星曜落宫，果老星宗推命。 | |
| 太乙神数技能 太乙神数排盘技能。支持太乙积年、起局、排十六神将、计算主客算、断局分析。用于国运预测、天灾预警、经济大势、战争胜负等宏观预测。 | |
| 择日学技能 择日学技能。支持查询吉日凶日、建除十二神、黄道黑道、神煞吉凶，提供婚嫁、开业、动土、出行等择日建议。 | |
| 紫微斗数技能 紫微斗数排盘技能。支持十四主星、十二宫位、四化飞星排盘，提供命运、性格、事业、婚姻、财运等分析。 | |
| Stormglass Surf & Ocean Data Fetch surf-relevant ocean conditions from Stormglass by spot name or coordinates, including current snapshot and 1-3 day forecast windows with tides, gusts,... | |
| Decision-Grade Reasoning (DGR) Audit-ready decision artifacts for LLM outputs - assumptions, risks, recommendation, and review gating (schema-valid JSON). Replaced with https://clawhub.ai/dgr-ai-labs/plugins/openclaw-dgr-gate) | |
| LLM Supervisor Graceful rate limit handling with Ollama fallback. Notifies on rate limits, offers local model switch with confirmation for code tasks. | |
| LLM Supervisor Automatically switches between cloud and local LLMs on rate limits, with user confirmation required for local code generation. | |
| AOMS - Always-On Memory Service Always-On Memory Service — persistent 4-tier memory (episodic, semantic, procedural, working) with weighted retrieval, vector search, progressive disclosure... | |
| Mission Control CLI-first system health aggregator for autonomous AI agents. Query all agent processes, resources, cron jobs, and services in one shot. Use when a user asks... | |
| Dashscope Image Gen Generate images via Alibaba DashScope OpenAI-compatible endpoint (compatible-mode) using qwen-image-max. Use when the user asks for 文生图/图片生成/image generation... | |
| Macos Gui Automation Automate macOS GUI via screen capture and OCR text reading, mouse and keyboard control, window management, and app launching using cliclick, screencapture, t... | |
| Skipup - AI Meeting Scheduling Schedule and coordinate asynchronous group meetings (2-50 participants) via email across timezones, with status checks, pauses, resumes, and cancellations. | |
| AI legal assistant for Indian advocates and lawyers AI legal assistant for Indian advocates and lawyers. Use this skill whenever an Indian advocate needs help with legal work: drafting legal notices, vakalatna... | |
| AITuber AI Video Skill AITuber API skill for AI video creation. Generate videos with AI narration, visuals, and captions for YouTube Shorts, TikTok, Instagram Reels, and long-form... | |
| tcr Run OpenClaw on tcr, a local proxy that pools your own Claude and ChatGPT subscriptions: check the pool, start the Gateway on it, and confirm turns go through it. | |
| 小红书图片生成 Generates Xiaohongshu (Little Red Book) infographic series with 11 visual styles and 8 layouts. Breaks content into 1-10 cartoon-style images optimized for X... | |
| Claude Dev Setup Complete Claude Code CLI integration with session management and APEX cognitive framework. One skill to set up coding agents with persistent task tracking. | |
| YouTube Comment Moderator AI-powered YouTube comment moderation. Fetches comments, classifies them (spam, question, praise, hate, neutral, constructive), drafts replies, and deletes s... | |
| Gousto Recipes Search and browse 9,000+ Gousto recipes. Get full ingredients and step-by-step cooking instructions via official API. | |
| TickTick CLI (ttg) Manage TickTick tasks and projects via the `ttg` CLI (github.com/dhruvkelawala/ticktick-go). Full CRUD, checklists/subtasks with progress display, reminders,... | |
| Main Image Editor Orchestrate screenshot + Chinese instruction into PSD batch edits with transaction rollback by reusing psd-automator. | |
| OpenClaw Safe Ops Guards high-risk OpenClaw operations with preflight backups, post-change health checks, and rollback guidance. Use when running gateway restart/start/stop, c... | |
| Ppt Task Orchestrator Production orchestration for pptx page task extraction and batch image delivery by reusing main-image-editor + psd-automator. | |
| Psd Automator Automate PSD text replacement on Mac and Windows with Photoshop, dry-run safety, style-lock checks, rollback, and local PSD index cache. Use when requests in... | |
| Psd Automator Screenshot Use screenshot + natural language instruction to locate PSD text layers and dispatch automated edits with confidence gating. Requires psd-automator core. | |
| Psd Automator Skill Command Dispatch PSD automation tasks through skill command entry while reusing the same /psd orchestrator. Requires psd-automator core. | |
| Auto Social Post 社交媒体自动化 - 自动发布到 Twitter/Instagram/LinkedIn | |
| NFT Monitor NFT 监控 - 实时追踪稀有 NFT 和价格异动 | |
| Security Scanner Pro 安全扫描器 - 智能合约和 DApp 安全分析 | |
| Smart Data Scraper 数据抓取工具 - 从任何网站提取结构化数据 |
25,601–25,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.