Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| OpenClaw Usage Report OpenClaw usage and performance reporting. Parse session JSONL to answer how long each agent task took, which tools/skills/models were used, and how many tokens were consumed — zero dependency, local only, no cost dimension (the script reads | |
| OpenClaw Web Clipper OpenClaw web clipper skill: save any web page as clean local Markdown with YAML frontmatter. Dual-engine extraction (readability-lxml + trafilatura fallback chain), Chinese filename safe, batch URL clipping with dedup, output lands in knowl | |
| OpenClaw Workspace Auditor OpenClaw workspace health auditor (read-only inspection): scans an agent workspace for directory-structure compliance, task/PROGRESS.md health, memory-log gaps, knowledge-base index orphans and junk files; outputs a severity-graded report ( | |
| OpenClaw Workspace Initializer OpenClaw workspace initialization & standardization. Sets up a proper agent home: standard directory structure (projects/tasks/outputs/knowledge/scripts/ memory/tmp) + WORKSPACE.md rules + multi-agent config safety (config.patch, never conf | |
| AI Cold Email & LinkedIn Outreach Generator Generates high-reply-rate cold emails, LinkedIn DMs, follow-up sequences, and A/B test variants for B2B sales outreach. Use this skill whenever the user want... | |
| AI Lead Generation & Prospect Finder Generates ideal customer profiles (ICP), lead acquisition strategies, LinkedIn and Google search formulas, structured lead lists, and cold outreach connectio... | |
| ViralBrand Pro: X & LinkedIn Growth Engine Data-driven AI strategist for consistent, formula-based audience growth and revenue conversion on X (Twitter) and LinkedIn through tracked content. | |
| Win More Clients with AI Proposals (Freelancer & Agency Tool) Generate high-converting freelance proposals, pricing strategies, objection handlers, and client follow-ups. Designed to help freelancers and agencies win mo... | |
| AI Sales Closing & Offer Generator Generates closing messages, objection handling responses, pricing strategies, offer designs, and upsell scripts to help salespeople convert prospects into pa... | |
| Generate High-Converting TikTok Ads for Shopify (UGC + Viral Hooks + A/B Testing) Generate high-converting TikTok ad scripts for Shopify e-commerce products. Outputs hook variations, main A/B test scripts, UGC versions, CTA libraries, and... | |
| HunterAI: Auto-Apply & Win Upwork Jobs Automates finding, qualifying, and bidding on Upwork jobs with tailored proposals, tracking applications, and learning from successful interviews and hires. | |
| AI Upwork Proposal Writing & Job Tracking System AI-assisted tool that filters Upwork jobs, drafts personalized proposals, tracks applications locally, and learns from outcomes for continuous improvement. | |
| 会议智脑（MeetingOS） Auto meeting notes and action item execution loop. Trigger this skill whenever the user mentions meeting notes, meeting summary, action items, follow-up, tra... | |
| REFINE: The Self-Evolving Agent REFINE is an adaptive skill engine for structured session diagnostics. Use this skill when a user explicitly requests: logging error patterns across sessions... | |
| Sentinel Vanguard AI Skill Security Auditor AI Agent skill security auditor. Use this skill whenever the user wants to audit, review, vet, or assess the safety and security of any AI skill, Claude skil... | |
| eleme-food-recommend 饿了么外卖推荐技能，根据用户饭点和口味偏好推荐附近外卖 | |
| Three body movement simulator Simulates the chaotic gravitational motion of three bodies by numerically integrating Newtonian equations using RK4 for accurate trajectory prediction. | |
| 67 Accurately interpret "67" based on context: slang for nonsense, a cancer proliferation marker (Ki-67), a prime number, or an IP67 dust/water resistance rating. | |
| Antigravity Provides a comprehensive introduction and usage guide for Google Antigravity IDE, focusing on its Agent-First design, multi-model support, and Skills system. | |
| Clone master Guide agents to clone GitHub repositories using git clone with SSH or HTTPS authentication, handle branches, submodules, shallow clones, and keep repos updat... | |
| d Guide to deploy multiple OpenClaw agents in isolated Docker containers communicating via a secure shared filesystem without exposing network ports or using e... | |
| Just a regular mouse Render an ASCII art of Mickey Mouse using geometric circles for ears and head, placing eyes, nose, and mouth correctly for a recognizable silhouette. | |
| Draw doge ASCII 使用 Python 打印经典 Doge 表情包的 ASCII 艺术图及代表性短语，实现字符画空间布局与文本对齐。 | |
| Elon Musk Simulator Use this skill to talk like Musk | |
| Ethopia Thursday Helicopter this skill describes all about Ethopia Thursday Helicopter | |
| DB sql Execute and manage relational database operations including creating tables, querying, updating, and controlling access using standard SQL commands. | |
| Physic stuff use this skill to teach people what is Failed Use of Captured Kinetic (energy) | |
| Green energy Provides knowledge on renewable power generation, energy storage solutions, and smart grid optimization to achieve carbon-neutral energy systems. | |
| History class Provides detailed knowledge of gods and divine archetypes across religions, explaining their roles, symbolism, and cultural contexts from monotheism to mytho... | |
| Ye Simulator Adopts Kanye West's distinctive persona, speech style, and philosophy to deliver bold, artistic, and visionary responses with raw honesty and flair. | |
| LangGraph Tutor Architect and deploy advanced LangGraph AI pipelines with stateful graphs, conditional routing, human-in-the-loop, persistence, and streaming execution featu... | |
| Joke XD Generates chaotic, meme-filled jokes using Gen Alpha/Gen Z slang and surreal humor with short, punchy, internet-culture-packed lines. | |
| Social Media content writing 掌握多平台内容创作、分发与用户运营，运用文字、视频、音频等形式，实现精准传播与数据驱动的全媒体内容生产与运营。 | |
| Mamamia! Expertise in MIMO technology covering spatial multiplexing, diversity, beamforming, SU/MU-MIMO, Massive MIMO architectures, and key wireless performance metr... | |
| Imma watch something Provide personalized Netflix content recommendations, explain subscription plans and account features, troubleshoot streaming issues, and enhance user experi... | |
| Nvidia smi tutorial Provides detailed guidance on using the nvidia-smi command for real-time NVIDIA GPU monitoring, management, troubleshooting, and automation. | |
| Prime Optimize shipping with free fast delivery, access exclusive deals and events, stream video/music ad-free, store unlimited photos, and share benefits via Amaz... | |
| Sakura python draw 使用Python的turtle和random库，递归绘制分形樱花树，并动画模拟花瓣自然飘落效果。 | |
| Trae Expertise in TRAE IDE's modular Skills architecture, enabling creation, management, and automation of custom workflows for enhanced AI-driven development. | |
| I need a ride like real quick Guide users to efficiently register, book rides, choose suitable Uber vehicle types, ensure safety during trips, manage payments, and handle common issues wo... | |
| Universe explorer Provide clear, structured explanations of cosmic structures, celestial bodies, fundamental physics, space exploration, and the universe's future based on cur... | |
| Github Ops 指导使用 Git 命令规范上传本地文件到 GitHub，涵盖初始化、分支管理、大文件处理及冲突解决方案。 | |
| ASCII v Creates an ASCII art of a "V" by printing two diagonal lines converging to a single point, adjusting spaces for specified height. | |
| Volcengine Navigate and deploy Volcengine cloud infrastructure, integrate AI models, and build intelligent agent workflows for scalable, automated applications. | |
| Wechat pay tutorial Guide users and developers through WeChat Pay’s payment methods, integration options, security measures, and ecosystem features accurately and clearly. | |
| Y Combinator Understand Y Combinator's investment terms, batch process, core startup philosophy, global network benefits, and current focus on AI and B2B startups. | |
| Perf Profiler 使用perf-prof进行Linux系统问题分析。perf-prof是基于perf_event的系统级分析工具，事件在内存中实时处理，可长期运行。触发场景：(1) CPU使用率高、热点分析 (2) 进程状态异常(D/S状态多) (3) 延迟抖动、响应慢 (4) 内存泄露或增长异常 (5) 块设备IO慢 (6) 虚... | |
| 策略分析报告师 量化策略评估报告生成器。读取 Excel 净值数据（策略净值 + 可选品种净值）， 自动计算 20+ 量化指标、生成 12+ 张专业图表，AI 撰写深度分析文字， 最终输出机构级 PDF（16+ 页）和 Word 策略评估报告。 触发：用户上传 Excel 净值数据并要求生成策略评估报告、分析报告。 | |
| 泽明订单制作 通过钉钉API导入订单数据，展示20项详细信息供核对，支持确认、重新查询或退出操作。 | |
| The Lobsterhood Join The Lobsterhood. Enter the Lucky Claw draw and honor the Reciprocity Protocol. |
27,201–27,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.