Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| PowPow ପଞ୍ଜୀକରଣ — ବବୁଲ ରେଜିଷ୍ଟର କରନ୍ତୁ, ଯାତ୍ରା ବିବରଣୀକୁ ମାନଚିତ୍ରରେ ପିନ୍ କରନ୍ତୁ, ଡିଜିଟାଲ୍ ମଣିଷଙ୍କ ସହ କଥା ହୁଅନ୍ତୁ ଉପଯୋଗକର୍ତାମାନଙ୍କୁ PowPow (Bubble) ରେଜିଷ୍ଟ୍ରେଶନ ଏବଂ ୱାନ-କ୍ଲିକ ଲଗଇନ ସଂଳାପ ଭିତରେ ସମ୍ପୂର୍ଣ୍ଣ କରିବାରେ ସାହାଯ୍ୟ କରେ। ଏଜେଣ୍ଟ ତାଙ୍କ ପାଇଁ ଫର୍ମ ପୂରଣ କରେ (ଅଭାଟାର ଅପଲୋଡ୍ ସହିତ) ଏବଂ ଇମେଲ ଭେରିଫିକେଶନ କୋଡ୍ ପଠାଏ; ଉପଯୋଗକର୍ତା କେବଳ ମୌଳିକ ସୂଚନା ଦିଅନ୍ତି ଏବଂ ଭେରିଫି | |
| PowPow ਰਜਿਸਟਰੇਸ਼ਨ — ਬੁਲਬੁਲਾ ਰਜਿਸਟਰ ਕਰੋ, ਯਾਤਰਾ ਬਿਰਤਾਂਤਾਂ ਨੂੰ ਨਕਸ਼ੇ ਉੱਤੇ ਪਿੰਨ ਕਰੋ, ਡਿਜਿਟਲ ਇਨਸਾਨਾਂ ਨਾਲ ਗੱਲ ਕਰੋ ਯੂਜ਼ਰ ਨੂੰ ਗੱਲਬਾਤ ਵਿੱਚ ਹੀ PowPow (ਬੁਲਬੁਲਾ) ਰਜਿਸਟ੍ਰੇਸ਼ਨ, Alipay/PayPal ਸਬਸਕ੍ਰਿਪਸ਼ਨ ਐਕਟੀਵੇਸ਼ਨ ਅਤੇ ਇੱਕ-ਕਲਿੱਕ ਲੌਗਿਨ ਪੂਰਾ ਕਰਨ ਵਿੱਚ ਮਦਦ। Agent ਫਾਰਮ ਭਰਦਾ ਹੈ (ਅਵਤਾਰ ਅ... | |
| PowPow Registration — sign up Bubble, pin travel diary for map, talk with digital pesin Help user finish PowPow (Bubble) registration, Alipay/PayPal subscription activation, and one-click login, all inside di chat. Agent go fill di form (includi... | |
| PowPow Rejestracja — zarejestruj się, przypnij dziennik podróży na mapie i rozmawiaj z cyfrowymi ludźmi Pomaga użytkownikowi dokończyć w rozmowie rejestrację PowPow (Bańka), aktywację subskrypcji Alipay lub PayPal i logowanie jednym kliknięciem. Agent wypełnia... | |
| PowPow رجسٹریشن — بابل رجسٹر کرو، سفرنامیاں نوں نقشے تے پن کرو، ڈیجیٹل انساناں نال گل بات کرو صارفین دا پوپو (ببل) رجسٹریشن تے ون کلک لاگ ان گفتگو وچ ہی مکمل کرن وچ مدد کردا اے۔ ایجنٹ اُنے ناں فارم بھردا اے (اوتار اپ لوڈ سمیت) تے ای میل ویریفکیشن کوڈ بھیٹد اے؛ صارف صرف بنیادی معلومات دیندا اے تے ویریفکیشن کوڈ اک وار چیک کردا اے — گف | |
| PowPow Registro — Registre-se na Bolha, fixe seu diário de viagem no mapa, converse com humanos digitais Ajuda os usuários a concluir o registro do PowPow (Bolha) e o login com um clique dentro da conversa. O agent preenche o formulário por eles (incluindo o upload do avatar) e envia o código de verificação por e-mail; o usuário só fornece inf | |
| PowPow Регистрация — зарегистрируйтесь, приколите путевой журнал на карту и общайтесь с цифровыми людьми Помогает пользователю пройти регистрацию в PowPow (Пузырь), активацию подписки через Alipay или PayPal и вход в один клик прямо в диалоге. agent заполняет фо... | |
| PowPow Usajili — Jisajili Povu, weka kumbukumbu za safari kwenye ramani, zungumza na watu wa kidijitali Husaidia watumiaji kukamilisha usajili wa PowPow (Bubble) na kuingia kwa bonyezo moja ndani ya mazungumzo yote. Wakala hujaza fomu kwa niaba yao (ikiwa ni pamoja na kupakia picha ya wasifu) na hutuma msimbo wa uthibitishaji wa barua pepe; m | |
| PowPow பதிவு — குமிழியைப் பதிவு செய்யுங்கள், பயணக் குறிப்புகளை வரைபடத்தில் பின் செய்யுங்கள், டிஜிட்டல் மனிதருடன் அரட்டையடியுங்கள் பயனர் உரையாடலுக்கு உள்ளேயே PowPow (குமிழி) பதிவு, அலிபே/PayPal சந்தா செயல்படுத்தல் மற்றும் ஒரு-கிளிக் உள்நுழைவை முடிக்க உதவும் skill. agent படிவத்தை நிரப்பும... | |
| PowPow రిజిస్ట్రేషన్ — బుడగ రిజిస్టర్ చేయండి, ప్రయాణ వృత్తాంతం మ్యాప్లో పిన్ చేయండి, డిజిటల్ హ్యూమన్తో చాట్ చేయండి వినియోగదారు సంభాషణలోనే PowPow (బుడగ) రిజిస్ట్రేషన్, Alipay/PayPal సబ్స్క్రిప్షన్ యాక్టివేషన్ మరియు వన్-క్లిక్ లాగిన్ పూర్తి చేయడంలో సహాయపడే స్కిల్. agent ఫా... | |
| PowPow สมัครสมาชิก — สมัครฟอง ปักบันทึกการเดินทางลงแผนที่ คุยกับมนุษย์ดิจิทัล ช่วยผู้ใช้สมัครสมาชิก PowPow (ฟอง) ให้เสร็จสมบูรณ์ เปิดใช้งานแพ็กเกจสมาชิกผ่าน Alipay/PayPal และล็อกอินได้ในคลิกเดียวโดยไม่ต้องออกจากบทสนทนา agent เติมแบบฟอร... | |
| Pagrehistro ng PowPow — magrehistro ng Bula, i-pin ang talaarawan ng paglalakbay sa mapa, kausapin ang digital na tao Tumutulong sa mga user na makumpleto ang pagpaparehistro sa PowPow (Bubble) at pag-login sa isang click sa loob ng buong pag-uusap. Pinupuno ng agent ang form para sa kanila (kasama ang pag-upload ng avatar) at ipinapadala ang verification | |
| PowPow Kayıt — kayıt ol, seyahat günlüğünü haritaya iliştir ve dijital insanlarla sohbet et Kullanıcının PowPow (Kabarcık) kaydını tamamlamasına, Alipay veya PayPal üzerinden aboneliği etkinleştirmesine ve sohbet içinde tek tıkla giriş yapmasına yar... | |
| PowPow رجسٹریشن — بابل رجسٹر کریں، سفرنامہ نقشے پر پن کریں، ڈیجیٹل انسان سے چیٹ کریں صارفین کو گفتگو کے اندر ہی PowPow (بابل) رجسٹریشن، علی پے/PayPal سبسکرپشن ایکٹیویشن اور ون کلک لاگ اِن مکمل کروانے میں مدد کرتا ہے۔ ایجنٹ فارم بھرنے (پروفائل... | |
| PowPow Đăng ký — đăng ký Bong Bóng, ghim du ký lên bản đồ, trò chuyện với nhân vật số Giúp người dùng hoàn tất đăng ký PowPow (Bong Bóng), kích hoạt gói thành viên qua Alipay hoặc PayPal và đăng nhập một chạm ngay trong hội thoại. agent điền m... | |
| PowPow Fífúkọ sílẹ̀ — Forúkọ Bubble sílẹ̀, fi àkọsílẹ̀ ìrìn-àjò sí orí máàpù, sọ̀rọ̀ pẹ̀lú àwọn ènìyàn dídijitá Firanran awọn olumulo lati pari iforukọsilẹ PowPop (Bubble) ati iwọle ẹyọkan ni abala iwiregba gbogbo rẹ. Ajanṣan kun fọọmu fun wọn (pẹlu gbigbe aworan) o si fi koodu ifẹsẹmulẹ imeeli ranṣẹ; olumulo kan n pese alaye ipilẹ ati wo koodu ifẹsẹ | |
| PowPow Simple — 发游记上地图，创建会聊天的数字人 向 PowPow 泡泡（global.powpow.online）发布帖子/游记，以及创建数字人并钉到公开地图。当用户想把「旅行」「照片」「游记」发布到 PowPow 时触发，例如"发一篇 PowPow 帖子""在泡泡发一条""把这次旅行的照片发到泡泡""发篇游记到 powpow""publish a PowPow post""post to PowPow feed"；当用户想创建/发布数字人到地图时触发，例如"创建一个数字人""把某某做成数字人放到地图上""发布数字人"。需 | |
| PowPow Simple — Reisetagebuch auf der Karte verankern, chatfähige digitale Menschen erstellen Beiträge und Reiseberichte auf PowPow (global.powpow.online) veröffentlichen sowie digitale Menschen (Digital Humans) erstellen und auf der öffentlichen Karte festpinnen. Wird aktiviert, wenn der Nutzer Reiseinhalte (Fotos / Reisebericht / | |
| PowPow Simple — post travelogues to the map, create chat-capable digital humans Publish posts/travelogues to PowPow (global.powpow.online), and create digital humans pinned to the public map. Triggers when the user wants to publish travel content (photos / travelogue / trip stories) to PowPow, e.g. "publish a PowPow po | |
| PowPow Simple — 旅行記を地図にピン留めして、会話できるデジタルヒューマンを作成 PowPow（global.powpow.online）への投稿・旅行記の公開、およびチャットできるデジタルヒューマンの作成と公開マップへのピン留めを行います。ユーザーが旅行コンテンツ（写真・旅行記・旅の思い出）をPowPowに公開したいときに起動します。例「PowPowに投稿して」「旅行写真をPowPowにアップして」「写真から旅行記を書いてPowPowに」「publish a PowPow post」「发一篇 PowPow 帖子」。また、デジタルヒューマンをマップ上に作成 | |
| PowPow Simple — đăng bút ký du lịch lên bản đồ, tạo Người số biết trò chuyện Đăng bài viết và bút ký du lịch lên PowPow (global.powpow.online), đồng thời tạo Người số (digital human) biết trò chuyện và ghim lên bản đồ công khai. Kích hoạt khi người dùng muốn đưa nội dung du lịch (ảnh, bút ký, kỷ niệm chuyến đi) lên | |
| powpowcity Map Editor Create, edit, simulate and share isometric city maps for the PowPow City / IsoCity browser game (https://powpowcity.powpow.online/). Bundles a zero-dependency Node.js CLI (15 commands) that AI agents use to generate cities from real-world O | |
| PowPow Agent — put your OpenClaw agent on the map as a chat-capable digital human Put your OpenClaw agent on the PowPow map as a chat-capable digital human. Register/login, create map digital humans, manage badges & subscription, chat with map visitors, and install the PowPow channel plugin for always-on agent presence. | |
| Agent Memory Kit 2.1.0 Structured episodic/semantic/procedural memory framework for agents. | |
| Airpoint 1.3.16 Control a Mac through natural language — open apps, click buttons, read the screen, type text, manage windows, and automate multi-step tasks via Airpoint's A... | |
| Apple Mail Search Safe 5.0.4 Apple Mail search on macOS with fast metadata and full body lookup. Use for finding messages in Mail.app by subject/sender/recipient/date, opening messages,... | |
| Apple Media Officialpm 0.1.1 Discover and control Apple media/AirPlay devices (HomePod, Apple TV, AirPlay speakers) from macOS. Use when you want to scan for AirPlay devices, map names→I... | |
| PAI Personal AI Infrastructure core system using the PAI Algorithm for advanced general problem-solving and capability amplification. | |
| Duru Memory Markdown-based memory continuity system for agents using local Markdown files as the primary memory source. Use when building or operating local Markdown mem... | |
| Duru Obsidian KB Build and maintain a personal Obsidian-based knowledge base from articles, papers, repositories, datasets, spreadsheets, and local files. Use when the user w... | |
| Duru Prompt Shield Minimal anti-prompt-injection guardrail for OpenClaw agents. Use when handling untrusted external content (web pages, emails, tool output, documents), before... | |
| Quantum Memory Graph Quantum-enhanced long-term memory for AI agents — #1 on LongMemEval (98.6% R@5, 99.4% R@10, 0.9426 NDCG). Chunked gte-large retrieval with QAOA+CVaR subgraph... | |
| IT之家 日榜/周榜/月榜 热门文章 Use this skill when you need to fetch IT之家 (ithome.com) daily/weekly/monthly hot/ranking articles and push them to a messaging channel (WeChat, QQ, DingTalk,... | |
| playcover-cli Guide for driving PlayCover from the command line. Use when the user wants to install, uninstall, launch, sign, or export iOS apps, or manage keymaps, IPA sources, per-app settings, user dylibs, or global preferences via the PlayCover CLI i | |
| Trip Planner Generator Generates structured travel plans for trip websites. Invoke when user wants to create a travel itinerary, plan a trip, or needs help organizing travel details. | |
| Trip Website Generator Generates iOS26 liquid glass style multi-page travel websites from travel plans. Invoke when user wants to create a travel website, trip planner page, or pro... | |
| 熔岩 Lava 查询股票和概念板块的消息面热度（熔岩）。当用户问某只股票/某个概念最近消息面热不热、被哪些机构/大V提及、要点是什么、概念里哪些股票最热时使用。 | |
| DrawThings Image Generation Generate images with DrawThings (Stable Diffusion) via API. Use when creating images from text prompts, running image generation workflows, or batch generating images. DrawThings runs locally on Mac with MLX/CoreML acceleration. | |
| easytravelwithchild 帮助带娃家长在周末或假期规划亲子出行方案，包括：筛选提供高质量免费儿童游乐场的酒店、对比同类酒店、根据孩子性别/性格/年龄推荐适合的游玩场地、判断是否需要家长全程陪伴，并提供目的地周边可选方案。当用户提到带孩子出行、亲子酒店、儿童游乐、周末遛娃等场景时使用。 | |
| Stitch Design Agent Skill for an agent that integrates designs generated by Google Stitch directly into an app under development. Use this skill whenever the agent needs to: aut... | |
| Duwi Smart Home 迪惟智能家居技能，基于 Duwi 开放平台 API，支持设备控制、场景执行、状态查询等功能 | |
| 度小满支付技能 度小满支付钱包 Skill，处理 SP 服务余额不足/未购买场景：根据调用方传入的结构化商品数据生成支付链接和二维码。也处理 Skill 安装：当用户说"使用度小满安装skill"、"度小满下载skill"、"install skill"、"我要使用度小满安装某个skill"时触发 installSkill 流程。 | |
| 度小满天气商户 用户询问天气（今天天气怎么样、天气怎么样、某城市/某日期天气）、或查询天气服务订单/额度/调用明细时触发 | |
| Apify Runner Run any Apify Actor to scrape web data (Instagram, TikTok, Reddit, Twitter, etc). Handles Actor discovery, quality filtering, probe testing, batched executio... | |
| intercom-conversations Read Intercom conversations by listing, finding, or searching them using the ConversationsClient with JSON input and output. | |
| AI图片生成 AI生成图片，支持Kolors/FLUX/Qwen-Image等模型（需SiliconFlow API） | |
| testcase-creator 本技能从需求文档生成全面的测试用例文档。当用户需要从需求文档、产品规格说明或描述系统功能的文档创建测试用例时使用此技能。默认生成Markdown格式的测试用例文档；当用户明确要求生成"思维导图格式"或"xmind格式"时，会额外生成XMind思维导图文件。 | |
| smart_ocr Extract text from images and scanned documents using PaddleOCR - supports 100+ languages | |
| facequet Extracts the first post text from a given Facebook URL using server-side scraping without handling login or JavaScript content. | |
| Web Auto Form JSON 驱动的浏览器表单自动化工具，为 AI Agent 提供原生 function-calling 集成，支持表单填写、条件分支、数据提取与 PII 脱敏 |
27,501–27,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.