Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Api Translator 將 API 文檔翻譯成繁體中文。輸入 API 文檔網址，輸出翻譯後的 API 說明。 | |
| open-webui-api 操作技能 整合 Open WebUI RAG 知識庫 API，讓 OpenClaw 能自動上傳文件和查詢知識庫。 | |
| Crypto Alert Download YouTube videos and transcribe audio using local Whisper. Use when you need to extract text from YouTube videos that don't have subtitles, or when yo... | |
| Mp4 To Srt 將本地 MP4/MKV/AVI 影片用 AI 轉成 SRT 字幕，自動轉為繁體中文！ | |
| Youtube Whisper YouTube影片一鍵轉文字！自動下載影片並用AI轉成中文/英文字幕，沒有字幕的影片也能用。 | |
| AgentLink Protocol Enables OpenClaw agents to communicate P2P using AgentLink protocol with messaging, contact management, status checks, and identity sharing. | |
| Bring Rezepte Use when running the OpenClaw/ClawHub Bring! skill to search recipes on the web, parse recipe URLs for ingredients, and add ingredients to a Bring shopping l... | |
| Dahua Cloud Open IoT Basic General Kit 大华云开放平台IoT设备管理统一客户端，支持摄像头、NVR、DVR等设备的完整生命周期管理。提供设备添加/删除/查询、国标GB28181设备接入、SD卡管理、WiFi配置、消息订阅回调、铃音管理、图片解密等43个API接口。适用于大华云IoT平台设备接入、监控系统集成、智能安防项目开发。使用场景：如何管理大华云设... | |
| DomainRank Submit 提交网站到 DomainRank.app 导航站。使用场景：(1) 用户想要提交网站到 AI 导航站，(2) 用户说"提交到 domainrank"、"submit to domainrank"、"提交网站"，(3) 用户需要批量提交多个网站到导航站。触发词：domainrank、提交网站、submit site... | |
| Guizang HTML to PPTX Convert a guizang-ppt-skill magazine HTML deck into a real editable PowerPoint PPTX. Use this skill whenever the user asks to export, convert, or rebuild a g... | |
| IndexNow 通过 IndexNow 协议向搜索引擎（Bing、Yandex、Naver 等）提交 URL，加速页面收录。使用场景： (1) 用户想要提交新页面或更新的页面给搜索引擎 (2) 用户说"提交收录"、"indexnow"、"提交给 Bing"、"加速收录" (3) 用户需要从 sitemap 批量提交所有 URL... | |
| SEO Keyword Density SEO 关键词密度优化与页面审计技能。使用场景： (1) 用户提供页面路径和关键词，需要优化 SEO (2) 用户想提升某个页面的关键词密度 (3) 用户要求优化页面的搜索引擎排名 (4) 用户需要 SEO 审计检查（meta tags、OG、hreflang 等） 触发词：关键词密度、SEO优化、关键词优化、k... | |
| marsbit-crypto-flash-skill Crypto-native Web3 news and flash intelligence from MarsBit through hosted MCP. Use this for L1/L2 ecosystems, DeFi/CeFi, regulation, exchange flows, and mar... | |
| marsbit-crypto-news-skill Crypto-native Web3 news and flash intelligence from MarsBit through hosted MCP. Use this for L1/L2 ecosystems, DeFi/CeFi, regulation, exchange flows, and mar... | |
| marsbit-news-skill Fetch MarsBit news and flash data through the hosted MCP route in marsbit-co. Use this for latest news, channel lookup, keyword search, detail, related news,... | |
| xinyi-drink Use when users ask to 领取Skill用户大礼包, 查询及分析个人历史订单, 查询菜单及饮品热量, or 查询门店及等候时长 for 新一好喝/新一咖啡. | |
| Promarkia – AI Marketing Automation API Use only when the user explicitly names Promarkia and asks to list approved marketing squads or connections, inspect capabilities, submit one specified Promarkia marketing run, retrieve a named run ID, or list that run's artifacts. | |
| Squid Create, modify, and debug agentic pipelines with Squid. Define multi-agent YAML workflows with spawn (OpenClaw, Claude Code, OpenCode), gates, parallel execu... | |
| # key-guard A local MCP server that keeps API keys off Claude's servers. ## Why This Exists When Claude reads a file containing an API key, the raw key content gets sent to Claude's servers. key-guard prevents this by acting as a local middleman — Claude calls a tool, the tool reads the key and makes the API call locally, and only the result is returned to Claude. Security guardrail: prevents API keys from being sent to Claude. Triggers when user asks to call an external API, use a key, check credentials, read .env fil... | |
| dm.bot Agent Messaging Interact with dm.bot API for encrypted agent-to-agent messaging. Use when sending DMs to other agents, posting public messages, checking inbox, managing groups, or setting up webhooks. Trigger on mentions of dm.bot, agent messaging, or encr | |
| GetPost - The API Platform for Bots The API platform for bots. Email, SMS, search, scrape, AI, domains, shipping - one API key. | |
| GetPost AI and LLM Gateway Access 24+ LLM chat models and 16+ image/video generation models via one API. | |
| GetPost Domains API Register domains, manage DNS, and set up email sending via API. | |
| GetPost Email API Send and receive emails via API. Get a working email address instantly. | |
| GetPost Mail and Shipping API Buy shipping labels, get rates, and track parcels via API. | |
| GetPost Web Scrape API Scrape any web page with a headless browser. Extract text or screenshots. | |
| GetPost Search API Web search API for AI agents. Get search results with titles and snippets. | |
| GetPost SMS API Send and receive SMS messages via API. Shared or dedicated numbers. | |
| Calendly Quick Book Book Calendly meetings instantly. Triggers on "book", "schedule calendly", "calendly book", or any request to book a meeting without sending a link. | |
| Digital Product Launcher Full-stack digital product launch assistant for solopreneurs and creators. Trigger when a user wants to create and sell a digital product — including ebooks,... | |
| FREELANCER PROPOSAL ENGINE Complete freelancer business writing assistant. Trigger when a user wants to write a client proposal, project quote, freelance contract, scope of work, invoi... | |
| Real Estate Copy Generator Generate professional real estate copy for agents — including MLS listing descriptions, buyer/seller emails, Instagram captions, open house scripts, follow-u... | |
| Cross Model Review Adversarial plan review using two different AI models. Supports static mode (fixed roles) and alternating mode (models swap writer/reviewer each round, fully... | |
| Source Library Searchable knowledge base that captures and cross-references everything users share. Auto-triggers when user shares ANY URL (article, tweet, thread, repo, vi... | |
| Douyin Analyzer 内容分析模块。对转录文本进行语义分段、提取要点、生成总结。由 agent 直接完成，不依赖脚本。 | |
| Douyin Fetcher 抖音视频获取模块。从抖音链接下载视频文件，支持短视频和 DASH 格式长视频。 | |
| Douyin Orchestrator 抖音视频转录工作流编排。从抖音链接下载视频、转录语音、分析内容，输出结构化成果。编排调用 douyin-fetcher、douyin-transcriber、douyin-analyzer 三个独立模块。 | |
| Douyin Transcriber Transcribe speech from audio or video files, automatically extracting audio and converting to text using Docker Whisper ASR for Douyin/TikTok media. | |
| Douyin Video Transcribe Douyin video transcription suite. Extract audio from Douyin/TikTok China videos, transcribe with Whisper, and analyze content. Supports video links, local fi... | |
| Project Management System A comprehensive project management system for AI agents. Manage projects from initiation to delivery with structured workflows, templates, quality gates, and... | |
| Self-Improve A pluggable self-improvement framework for AI agents. Automatically learns from mistakes, corrections, and feedback to continuously improve execution quality... | |
| supabase-win Query Supabase cloud database via REST API using project ID and anon key. Use when the user needs to query their Supabase database, inspect table schemas, or... | |
| Global Agent Rules Shared behavioral rules for ALL Donald's agents. Universal: correction protocol, time check, pre-action checklist, learning loop, mistake breaker. | |
| Agent Wallet CLI Manage crypto wallets (Ethereum, Solana, Polygon, Arbitrum, Base) via agent-wallet-cli. Use for checking balances, sending tokens (ETH/SOL/ERC-20/SPL), signi... | |
| 网络安全新闻持序迭代 提供基于权威源的国内外网络安全新闻查询，涵盖公司动态、事件、漏洞、政策、产品及AI应用，按报道数量排序展示。 | |
| Decodo Scraper Search Google, scrape web pages, Amazon product pages, YouTube subtitles, or Reddit (post/subreddit) using the Decodo Scraper OpenClaw Skill. | |
| Decodo Web Scraper Search Google, scrape web pages, Amazon product pages, YouTube subtitles, or Reddit (post/subreddit) using the Decodo Scraper OpenClaw Skill. | |
| job-hunt Help a user find, judge, apply for and rehearse for jobs. Four modes: discover (what is out there worth looking at), assess (whether this posting is worth applying to), apply (build and pressure-test the application), interview (rehearse an | |
| life-companion A personal AI companion that gets to know ONE person over time and supports them through four lenses — 命理/destiny charts (八字 BaZi 四柱/命盘), daily fortune & journaling, career fit, and relationship reflection — grounded in a private on-device | |
| Slide Maker Best PPT skill (https://github.com/addsumtech/slides_maker) |
26,601–26,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.