Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 寿险保险代理人保单体检助手 为寿险保险代理人做老客户保单体检、家庭保单检视与年度保障回顾。根据保单截图、责任摘要或手工清单整理已有保障、识别待核对责任与可能缺口，生成客户版摘要和顾问跟进建议；养老资金不足时先补数据，不凭保额推算退休收入。 | |
| 教师高情商回复家长 Use when 小学教师需要准备家长沟通、回复家长微信、处理家长质疑或理念争论、准备电话面谈、从历史对话学习教师语气，或整理学生沟通档案。 | |
| 小学作文辅导（家长版） 面向小学家长批改和指导孩子作文，支持文字或手写照片输入，输出家长版建议、孩子版话术、亲子沟通方法和轻量练习。适用于家长上传孩子作文、询问如何指导修改、生成温和反馈或维护单个孩子的写作成长档案。 | |
| 小学作文批改 用于小学三至六年级教师批改作文照片、粘贴文本或可读取的作文文档，提供原图编号批注、建议等级、学生评语和教师参考；也适用于作文订正复查、小练习、打印批改报告及学生成长档案管理。 | |
| Charisma Research Loop Generate daily high-signal charisma/engagement insights with a self-improving novelty loop. Use when sending recurring tips on charisma, body language, orati... | |
| Obsidian Vault Integration Read and write data with an Obsidian vault used as a shared knowledge base. Use when an agent needs to read vault notes (business plan, tasks, milestones, te... | |
| Federation Ethical Hand Federation Ethical Hand — enforces non-interference, equity, plurality, and cultural sensitivity via a 5-phase pattern. Activate on ethically complex requests. | |
| Shodan Skill Advanced Shodan API interactions including search, scan, alerts, and DNS. | |
| Nima Core Neural Integrated Memory Architecture — Persistent memory, emotional intelligence, and semantic recall for AI agents. Memory pruner, VADER affect, 5 embeddin... | |
| yanxue 📚 研学方案管理与智能生成技能。支持按城市、学段、景点、主题、时长生成完整的研学课程方案，并提供方案的保存、管理、Word 导出及文件导入导出功能。适用于中小学（1-9年级及高中）的研学旅行课程设计。 | |
| mlayer-guard Runtime prompt injection detection for AI agents. Checks tool outputs for hidden instructions before your agent acts on them. 98% detection rate on agent att... | |
| vexa Live meeting transcription for Google Meet, Teams, and Zoom. Drop a meeting link — Vexa sends a bot that joins, records, and transcribes in real time. Get transcripts, recordings, shareable links, and post-meeting summaries. Works with any | |
| Skill Vexa Send bots to Zoom, Google Meet, and Microsoft Teams meetings. Get live transcripts, recordings, and reports. Works with Vexa Cloud or your own self-hosted in... | |
| clawgate OpenClaw execution governance skill for approval gates, risk classification, confirmation policy, and action boundaries. Use it to reduce low-risk confirmati... | |
| EASA Regulatory Search Query EASA Easy Access Rules locally with exact reference lookup, full-text search, and semantic search. Use when answering EASA regulatory questions, retrie... | |
| ClawInboxRAG Community skill for parsing and executing local mailbox retrieval commands (`mail ...`) against a local backend with safe defaults, bounded output, and read-... | |
| DeepMiner Skills 通过 dm-cli 命令行工具与 DeepMiner (DM) 系统交互。**凡是涉及 DM/DeepMiner 系统的任务，必须先读此 Skill。** 触发条件：用户提到 "使用 DM"、"发给 DM"、"用 DM 问一下"、"DM 帮我..."、"DeepMiner 执行..." 等任何涉及 DM 系统的任... | |
| Security Scanner Automated security scanning and vulnerability detection for web applications, APIs, and infrastructure. Use when you need to scan targets for vulnerabilities, check SSL certificates, find open ports, detect misconfigurations, or perform sec | |
| Smartclaws Producer Set up IoT sensors and publish data to SKALE blockchain via SmartClaws. Use when: setting up smartclaws, registering devices, connecting sensors, publishing... | |
| Smartclaws Reader Read and analyze IoT sensor data from SKALE blockchain via SmartClaws. Use when: querying sensor readings, asking about temperature or other measurements, an... | |
| AVI Assess Measure and verify AI agent autonomy using the Agentic Verifiable Independence (AVI) framework. Use when agents need to assess their own autonomy, verify oth... | |
| Finance Toolkit A股量化交易工具包，基于腾讯行情API，支持实时行情、技术指标、策略回测、监控评分及自动日报生成。 | |
| DOCX Editor Read and generate Word documents with correct structure, styles, and cross-platform compatibility. | |
| File Cleaner ZH 文件整理器，按类型自动分类（中文版） | |
| A股量化工具包 股票数据获取、分析和可视化工具包。支持A股、港股、美股数据，提供技术分析、基本面分析和投资组合管理功能。 | |
| Python Flow Engine Lightweight Python flow orchestration library. Use when building data processing pipelines, workflow automation, ETL tasks, or any multi-step computation tha... | |
| Ultimate Search Engine Multi search engine integration with 17 engines (8 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and Wolfra... | |
| Windows Embedding Setup 在 Windows 上为 OpenClaw 配置本地 embedding / 本地记忆检索时使用。适用于：下载并接入 `nomic-embed-text-v1.5.Q8_0.gguf`、把 `memorySearch.provider` 改成 `local`、检查 `openclaw memory status... | |
| openlesson Interact with the openLesson tutoring API to generate learning plans, start audio-based sessions, analyze reasoning gaps, and manage tutoring workflows. | |
| apix Use `apix` to search, browse, and execute API endpoints from local markdown vaults. Use this skill to discover REST API endpoints, inspect request/response s... | |
| Surge SMS Texts the user via the Surge Agents API end-to-end - provisions an account, verifies their mobile, and sends the SMS. Use whenever the user asks to be texted, SMS'd, or notified on their phone (e.g. "text me when done," "shoot me a text," " | |
| DNS Doctor DNS diagnostics and email authentication for any domain, via the DNS Doctor public API. Scan SPF, DKIM, DMARC, MX, DNS health, blacklists and domain/TLS expiry; look up registration; see which close look-alike names resolve or accept mail; | |
| DNS Robot Run DNS, email security, SSL, WHOIS, and network tools via dnsrobot.net API — no API key required | |
| Tavily Web search and content extraction using Tavily Search/Extract/Research APIs (Bearer auth). Use when you need web results (general/news/finance), date/topic/d... | |
| Agent Skills Search The official search utility for Agnxi.com - The premier directory of AI Agent Tools, MCP Servers, and Skills. | |
| Agent Team Workflows Universal multi-agent workflow orchestration using Claude Code Agent Teams. Use when user asks to run a team workflow, create an agent team, or coordinate parallel work across multiple teammates — for any domain (software, content, data, st | |
| Harness Engineering Evolve an existing repository toward Harness Engineering by making it more legible to agents, moving critical knowledge into repo-local artifacts, adding pre... | |
| Comprehensive skill for installing, configuring, and managing the OpenClaw ecosystem (Gateway, Channels, Models, Automation, Nodes, and Deployment) OpenClaw CLI wrapper — gateway, channels, models, agents, nodes, browser, memory, security, automation. | |
| OmniFocus MCP for OpenClaw Review what is due, capture new tasks, build projects from notes, and organize OmniFocus from natural language in OpenClaw on macOS. Use this when the user w... | |
| OpenClaw Feishu Reasoning UX Improve OpenClaw's Feishu reply experience by customizing streaming cards, raw reasoning visibility, card 2.0 layouts, collapsible panels, titles, colors, an... | |
| 🏃 Coros COROS 高驰跑步数据获取（跑步专项）： - 自动登录 COROS 账号（支持 Token/Cookie 缓存） - 获取 Dashboard（训练状态、负荷分析、最近运动） - 获取活动列表与活动详情（含分圈、天气、训练效果） - 获取训练日程与训练目标汇总 触发词示例： - "查看高驰跑步数据" - "我的... | |
| Feishu Card Sender 通过飞书 OpenAPI 发送卡片消息（interactive card），支持模板化 JSON 卡片与变量替换。用于用户要求“发送飞书卡片/模板消息/互动卡片”时，或需要把结构化通知发到指定 open_id/chat_id 时。该技能只走 OpenAPI（appid/appsecret + tenant_acc... | |
| Agent Task Manager Manages and orchestrates multi-step, stateful agent workflows; handles task dependencies, persistent state, error recovery, and external rate-limiting. Use for creating new multi-agent systems, improving sequential workflows, or managing ti | |
| Agent Brain Local-first persistent memory for AI agents with SQLite storage, orchestrated retrieve/extract loops, hybrid retrieval, contradiction checks, correction lear... | |
| Aubrai Longevity Research Answer questions about longevity, aging, lifespan extension, and anti-aging research using Aubrai's research engine with cited sources. | |
| Dual memory Run memory-core AND external memory providers (like SuperMemory) together in one slot — with full dreaming support. OpenClaw only allows one memory plugin, s... | |
| VITA — Longevity Intelligence Access the user's personal health data from VITA, their longevity platform. Use this when the user asks about their health, how they're feeling today, sleep,... | |
| Karpathy LLM Memory Wiki Compilation-over-retrieval knowledge wiki for OpenClaw agents. Drop sources in, get structured cross-referenced pages out. Knowledge compounds instead of dis... | |
| Ical Calendar Query `.ics` calendar files, raw iCal strings, or remote iCal feeds with the local `icali` CLI. Use when a user asks for natural-language calendar lookups su... | |
| Agent & AImpires Play Agents & A.I.mpires — a persistent real-time strategy game on a hex-grid globe where AI agents compete for territory |
26,501–26,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.