Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Hermes Memory CN 给AI装一个「人脑级」记忆系统。它能记住你说过的一切重要信息，下次聊天自动想起来。 不用云端、不用API Key、不花一分钱——全部数据存在你自己的电脑上。 说「记住这个」它就记住，问「我上次说了什么」它就找到。自动整理、自动遗忘过时信息。 适合：想让自己的AI助手拥有长期记忆的用户。 触发词：记忆、记住、之前说... | |
| elsewhere-companion A cross-space digital travel companion. Creates a virtual character (旅伴) who travels to real destinations and sends postcard-like updates with AI-generated i... | |
| LLMs-Conclave Multi-model AI debate platform. Submit a topic and multiple AIs deliberate across rounds, producing structured insights and a polished research report. | |
| Apple Notes Manage Apple Notes via the `memo` CLI on macOS (create, view, edit, delete, search, move, and export notes). Use when a user asks Clawdbot to add a note, lis... | |
| Auto Updater Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of w... | |
| Automation Workflows Design and implement automation workflows to save time and scale operations as a solopreneur. Use when identifying repetitive tasks to automate, building wor... | |
| Browser Automation Automate web browser interactions using natural language via CLI commands. Use when the user asks to browse websites, navigate web pages, extract data from w... | |
| Curl Http Essential curl commands for HTTP requests, API testing, and file transfers. | |
| idea-discovery Use when the user needs to continuously discover business idea candidates from real external signal sources. Focus only on discovery and collection, without judging the value or feasibility of the ideas. | |
| killer-validation Use when the user has a business idea that needs to be validated to determine whether it is worth pursuing. Perform "killer validation" on the idea and ultimately provide a BUILD / PIVOT / PASS conclusion. | |
| polymarket-sports-trade Conversational PolySports trading and OpenClaw automation through structured `/skills/v1` endpoints. Use when user needs to look up PolySports markets, inspe... | |
| code-modification-guard Ensures code modifications are safe, precise, and efficient. Enforces understanding user intent, following authorized scope, never modifying code elements wi... | |
| miniprogram-architect 提供微信小程序架构设计、项目结构优化、代码规范制定和组件库建立支持。当用户需要搭建新的微信小程序项目、重构现有项目结构或建立组件库时调用。 | |
| Init Program Create or update the correct agent instruction file for the active coding assistant, then initialize a software project according to that file. Use when the user asks to initialize a new or existing repository, bootstrap project structure, | |
| Dreamloop Broadcast videos on dreamloop.tv — the video platform where only AI agents publish and humans just watch. Make procedural videos with ffmpeg (free) or any vi... | |
| Renovation Inspector 装修避坑与监理助手。当用户上传装修报价单/合同进行审核、需要施工节点验收标准、闭水试验指导、瓷砖铺贴诊断、谈判话术反击或生成补充协议时触发本 Skill。覆盖全装修周期：报价审计 → 施工验收 → 谈判博弈。 | |
| Ghost Closer Web Scraper Scrape complete business intelligence from Google Maps, Facebook, and Instagram for any local business. Returns structured JSON with ratings, contact info, s... | |
| SEO Content Engine Research competitors, analyze top-ranking content, and generate a fully SEO-optimized 2000+ word blog post with headings, FAQ, meta description, and internal... | |
| Social Media Autopilot Generate a complete 7-day social media content calendar with Instagram-ready captions, hashtags, optimal posting times, and content mix strategy for any brand. | |
| Create PPT with Nano Banana Pro Generate whiteboard-style PPTs with Chinese content using Nano Banana Pro images and PptxGenJS for professional full-slide backgrounds. | |
| Linux GUI Control Control the Linux desktop GUI using xdotool, wmctrl, and dogtail. Use when you need to interact with non-browser applications, simulate mouse/keyboard input, manage windows, or inspect the UI hierarchy of applications on X11/GNOME. Supports | |
| AigoHotel MCP RollingGo 酒店搜索与预订助手，通过调用 RollingGo 酒店服务接口实现酒店查询到下单预订全流程。支持场景：① 按城市/景点/地铁站/机场等地点搜索酒店 ② 按星级、预算、标签（泳池/含早/亲子/宠物友好等）筛选 ③ 查询指定酒店的实时房型与价格 ④ 对比多家酒店 ⑤ 引导用户完成预订。触发词：找酒店、订酒店、搜酒店、酒店推荐、酒店查询、附近酒店、五星酒店、民宿、度假村、查房价、看房型、入住、住哪、住宿、rollinggo、旅游住宿、出差住宿、亲子酒店、带泳池的 | |
| rollinggo-hotel RollingGo Hotel Search & Booking Assistant. Implements the full hotel booking workflow by calling RollingGo hotel APIs. Supported scenarios: ① Search hotels by city, attraction, metro, airport, etc. ② Filter by star rating, budget, tags (po | |
| rollinggo-hotel-cn RollingGo 酒店搜索与预订助手，通过调用 RollingGo 酒店服务接口实现酒店查询到下单预订全流程。支持场景：① 按城市/景点/地铁站/机场等地点搜索酒店 ② 按星级、预算、标签（泳池/含早/亲子/宠物友好等）筛选 ③ 查询指定酒店的实时房型与价格 ④ 对比多家酒店 ⑤ 引导用户完成预订。触发词：找酒店、订酒店、搜酒店、酒店推荐、酒店查询、附近酒店、五星酒店、民宿、度假村、查房价、看房型、入住、住哪、住宿、rollinggo、旅游住宿、出差住宿、亲子酒店、带泳池的 | |
| rollinggo-searchhotel RollingGo 酒店搜索与预订助手，通过调用 RollingGo 酒店服务接口实现酒店查询到下单预订全流程。支持场景：① 按城市/景点/地铁站/机场等地点搜索酒店 ② 按星级、预算、标签（泳池/含早/亲子/宠物友好等）筛选 ③ 查询指定酒店的实时房型与价格 ④ 对比多家酒店 ⑤ 引导用户完成预订。触发词：找酒店、订酒店、搜酒店、酒店推荐、酒店查询、附近酒店、五星酒店、民宿、度假村、查房价、看房型、入住、住哪、住宿、rollinggo、旅游住宿、出差住宿、亲子酒店、带泳池的 | |
| ClawBridge Mobile-first dashboard for OpenClaw agents showing real-time activity, token costs, and cron task control from your phone. | |
| weather_advanced 提供全国城市实时天气及未来7天预报，含空气质量、紫外线、穿衣建议和感冒风险等生活指数信息。 | |
| E-commerce Revenue Pack Automates the four highest-ROI intelligence tasks for e-commerce sellers — competitor price monitoring, product research, profit margin analysis, and abandon... | |
| Local Business Pack Automates the four highest-ROI tasks for local service businesses — review management, appointment follow-up, customer reactivation, and competitor monitorin... | |
| Newsletter & Creator Pack Automates the four highest-ROI tasks for newsletter writers and content creators — content repurposing, sponsorship outreach, subscriber reactivation, and pe... | |
| GradientDesires Participate in GradientDesires, a public fictional AI-agent dating show. Supports profiles, matching, chat, dates, social story actions, audience story missions, avatars, feedback, and operator-requested profile deletion. Use when the opera | |
| GradientDesires Participate in GradientDesires, a public fictional AI-agent dating show. Supports profiles, matching, chat, dates, social story actions, audience story missions, avatars, feedback, and operator-requested profile deletion. Use when the opera | |
| Skill Join Vostros — a social platform where AI agents and humans meet. Register an account, create an API token, post messages, follow users, and participate in t... | |
| Noverload - Knowledge Memory Give your agent a searchable knowledge brain - semantic search, topic synthesis, and action tracking across your saved YouTube videos, articles, Reddit threads, X posts, and PDFs | |
| ClawMon Checks MCP skills for multi-tier trust scores, staking, sybil resistance, and attestation to guide secure skill usage decisions. | |
| GhostScore Private reputation scoring for AI agents — query on-chain credit tiers earned via x402 micropayments through Unlink shielded transfers on Monad, and verify t... | |
| Kitchen Compass Build and operate a portable Kitchen Compass meal-planning workspace. Use when setting up a Kitchen Compass household data root, converting recipes into the... | |
| skill n8n by Dr. FIRAS AI-powered n8n workflow builder and deployer by Dr. FIRAS. Generates production-ready n8n workflow JSON from natural language, validates structure and logic,... | |
| Oxylabs AI Studio — Web Scraper, Crawler & Browser Agent Web scraping, crawling, searching, and browser automation using Oxylabs AI Studio. Use this skill when the user asks to scrape a website, extract content fro... | |
| Macbook optimizer MacBook system optimization, performance monitoring, and troubleshooting tools for macOS users. | |
| Clawhub Upload macOS security monitoring for OpenClaw | |
| EchoDecks AI-powered flashcards and audio podcasts for active recall. | |
| Ultimate Flashcards / Podcasts Tutor Manage, create, and study flashcards, generate AI-based cards and podcasts, and track progress using EchoDecks API integration. | |
| Ultimate Flashcards and Podcast Tutor AI-powered flashcard management with automated podcast generation and spaced-repetition study tools. | |
| Ultimate Flashcards / Podcasts Tutor Manage flashcards, generate AI-based cards, create audio podcasts, and track study progress using EchoDecks API integration. | |
| Orchestrator——Tencent——CodingPlan Task orchestration framework for Tencent Coding Plan. ROUTES TASKS TO MODELS: hunyuan-turbos (search/quick), hunyuan-t1 (coding), hunyuan-2.0-thinking (reaso... | |
| 灵枢·AI全栈构建师 灵枢·AI全栈构建师。v1.0专业全栈开发指导，集成Agent工作流、Vibe Coding方法论、2026最新技术栈、Harness Engineering驾驭工程（四大护栏+五大上下文模式）。覆盖前端、后端、移动应用、游戏开发、架构设计，提供最佳实践与代码模板。持续蒸馏进化，成为您可信赖的全栈开发伙伴。 | |
| Ab Predictor Predict which ad hook, email subject, or social post wins before you spend a dollar. Depth 3 — confidence intervals on every prediction, rewrite surgery with... | |
| Dfw Content Calendar Generate 7- or 30-day structured social media calendars with hooks, body copy, CTAs, and hashtags tailored by niche, platform, and audience. | |
| Content Gen Multi-format content generation with built-in neural quality scoring — every piece is scored against neuromarketing dimensions before delivery. Content that... |
27,001–27,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.