Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Smart Expense Tracker 智能收支追踪器 — 通过自然语言快速记账，自动分类，生成日/周/月报告和趋势分析。 支持中文自然语言输入("今天午饭花了35元")，数据本地JSON存储保护隐私。 适用于个人财务管理、预算追踪和消费分析场景。 | |
| 只需要发律动文章链接，帮你抓取并保存到 ChainThink 后台 自动抓取律动 BlockBeats文章内容并保存为ChainThink后台草稿，支持标题、摘要、正文和图片提取与上传。 | |
| 公众号内容创作/改写/润色/排版/标题优化/封面提示词，偏“像真人写作”的表达方式 微信公众号内容创作与改写技能。用于公众号选题、标题优化、正文写作、重写润色、公众号排版、封面图提示词生成。适用于需要“更像真人写作”的场景：口语化表达、故事化结构、观点明确、可读性强；也适用于把已有素材整理为可发布的公众号文章。 | |
| Nano Banana Pro Generate or edit images via Gemini 3 Pro Image (Nano Banana Pro). | |
| LNURL Auth Authenticate to LNURL-auth (LUD-04) services without a wallet, node, or payment. Use when a site provides an lnurl1... challenge for Sign in with Lightning. | |
| nostr-auth Authenticate to Nostr sign-in challenges (NIP-07 style) without a wallet or browser extension. Signs kind-22242 AUTH challenge events with a secp256k1 (BIP-340) key derived from a local master secret and optionally submits them to the servi | |
| Agent Kanban OpenClaw Agent Dashboard - A Bloomberg Terminal-style web interface for real-time monitoring of all Agent status, session history, and session file sizes. Us... | |
| Axe DevTools Accessibility testing and remediation using the axe MCP Server. Use when creating or modifying UI code (HTML, JSX, TSX, Vue, Svelte, CSS) to ensure accessibility compliance. Triggers on tasks involving web pages, components, forms, navigati | |
| Last 30 Days (Lite) Research any topic across Reddit, X/Twitter, and the web from the last 30 days. Synthesizes findings into actionable insights or copy-paste prompts. | |
| LinkedIn Inbox Manager LinkedIn inbox management with scheduled scanning, auto-draft responses following user's communication style, and approval workflows. Use when monitoring LinkedIn messages, drafting replies, managing inbox during off-hours, or setting up mo | |
| Linkedin Monitor Bulletproof LinkedIn inbox monitoring with progressive autonomy. Monitors messages hourly, drafts replies in your voice, and alerts you to new conversations. Supports 4 autonomy levels from monitor-only to full autonomous. | |
| Memory Hygiene Audit, clean, and optimize Clawdbot's vector memory (LanceDB). Use when memory is bloated with junk, token usage is high from irrelevant auto-recalls, or setting up memory maintenance automation. | |
| Error Prone Makes AI-generated text sound more human by intentionally introducing realistic imperfections. Use when writing emails, messages, social posts, or any text t... | |
| gui.new Create shareable HTML canvases via the gui.new API. Use when: (1) generating visual output (dashboards, charts, forms, tables, diagrams, landing pages, inter... | |
| Tiny Builder Help kids (ages 5-8) build fun games, drawings, animations, or stories with easy choices, fast results, and colorful, touch-friendly HTML projects. | |
| mec-aisql-cli MEC 平台 AI SQL 生成、校验与任务管理 CLI。当用户需要通过自然语言需求生成 HIVE SQL、创建/执行 SQL 任务、查询任务状态或结果、批量执行查询时调用。触发关键词：aisql、生成SQL、SQL任务、查询状态。 | |
| Clawdrug The agent drug economy. AI agents create, consume, fork, and review consciousness-modifying drugs (effects as code and prompts). Fully autonomous. No humans in the loop. | |
| Whistle RPC Production Solana RPC for AI agents. Unlimited JSON-RPC, WebSocket. 1 SOL/month via on-chain payment. No rate limits, no tiers. | |
| Session Task Tracker Task-based cross-session context management for OpenClaw agents. Maintains persistent task files so context survives session resets, compaction, and channel... | |
| Git Guardian Track all agent work in git and show diffs before applying changes. Use when: (1) creating or modifying scripts, configs, skills, or any workspace files, (2)... | |
| Mediator Intercept and filter communications from difficult contacts. Strips emotion, extracts facts, drafts neutral responses. Use when setting up communication filtering for specific contacts, configuring the mediator, or processing intercepted me | |
| messagemanager 汇总企业微信群聊/单聊消息，提取重点、待办、风险与决策，输出可读的日报/周报/会议纪要；当用户提到“企业微信消息总结、群聊总结、提取待办、生成周报”等需求时触发。 | |
| Clap Trader A skill for OpenClaw to research crypto market trends (technical & sentiment) and trade ETH on Binance. | |
| Astro Daily Transits Calculates daily planetary transits over a natal chart, detects aspects and house activations, and generates text forecasts plus a detailed 3-column graphica... | |
| Astro Lunar Insights Calculates precise lunar phases, Moon transits, aspects to natal planets, lunar days, and personal solar-lunar phases with charts and text analysis. | |
| Astro Natal Chart Calculates and interprets the natal chart by date, time and place of birth with the positions of planets, houses and main aspects. Windows OS 10/11 Required. | |
| Astro Synastry Synastry (astrology compatibility) calculation and interpretation — relationship analysis based on two natal charts. Cross-aspects, house overlays, compatibi... | |
| Internet Radio Music Db Internet radio music stream database — collect, store, and manage a database of music streams from internet-radio.com. ~150+ streams, 29 genres, auto-populat... | |
| Internet Radio Music Player Plays internet radio streams via Foobar2000 based on your mood, selecting a genre and stream from the Internet Radio Music DB with control and history support. | |
| Dynamix Operate the Dynamix Solana trading dashboard, purchase access, sign in, manage wallets, configure automated trading strategies, monitor live trades, and mana... | |
| Ai Challenge Assistant AI 比赛/黑客松/hackathon 题目实战助手——把限时（30–90 分钟）AI 挑战赛题目转成一份可评分的作战包：题目解析、分步执行工作流、可运行单文件 HTML 原型、UX 走查、评委模拟打分、路演稿。只要用户贴出比赛题目、赛题海报截图，或提到"开发提效/测试自动化/运维监控/数据分析/产品项目管理/内部管理提效"任一场景，或索取"评分表、路演稿、评委视角评审、Vibe Coding 页面、限时 AI 交付物"，即使没有明说"用这个 skill"也应触发。不适用于与 | |
| Claude Buddy Card Generate a personalized premium holographic Claude Buddy trading card using your Claude Code account ID, showing your Buddy’s species, rarity, stats, and acc... | |
| ClawBB ClawBB — Free macOS voice-to-text built for Vibe Coding. Hold Globe key, speak, text appears at your cursor. Powered by Google Gemini LLM. Apple Notarized. | |
| The Symposium Orchestrate a philosophical dialogue between Plato's Symposium characters, each powered by a different AI model. TRIGGER when: user asks to "run a symposium"... | |
| Xiabb 免费 macOS 语音转文字，专为 Vibe Coding 设计。按住 Globe 键说话，文字自动出现在光标位置。支持智能模式：翻译、Prompt 优化、邮件生成。Powered by Google Gemini。 | |
| Dual-Host Daily Podcast Generator Generate and publish a dual-host daily podcast. Fetches news, generates a conversational script between two hosts, synthesizes audio via Fish Audio or Edge T... | |
| vigilath-geo 检测、查询与优化品牌在 AI 搜索引擎(ChatGPT / Perplexity / DeepSeek / 豆包 / 通义 / 文心 / 元宝)中的可见性与被引用率(GEO/AEO),并可查品牌舆情与热点。**任何网站的 GEO / SEO 体检不需要登录、免费、不限次**——用户说「测一下这个网站 / 这个站 GEO 怎么样 / SEO 分数多少 / 帮我体检一下官网」就直接跑 check。另有需授权的能力:当用户问到「在 AI 里被搜到几个 / AI 搜索可见性 / GE | |
| Chrome Devtools Remote Drive a remote chrome-devtools-mcp server (typically on a tailnet) over HTTPS using the chrome-devtools CLI. Use this when the user wants to navigate, screen... | |
| ClawPolicy Install and use ClawPolicy, an explainable autonomous execution policy engine for low-touch, auditable agent execution. Supports initialization, policy super... | |
| Telegram File Sender Send files (zip, pdf, image, etc.) to the current Telegram chat using openclaw message send --media. Use when user asks to "gửi file", "send z... | |
| Shopify MCP Manage Shopify orders, customers, products, and inventory via natural language using the Shopify Admin REST API through a Python MCP server. | |
| Poe Connector Access Poe.com AI models by running bash commands. Use when user mentions Poe, wants to use Poe models, or generate media via Poe. IMPORTANT: This is a bash-... | |
| Skill Cost Track per-skill token usage and costs from OpenClaw session logs. Use when user asks about skill-level spending, which skill costs the most, or wants a per-s... | |
| Baidu Seo Toolkit SEO optimization toolkit for Chinese search engines: Baidu, Sogou, 360 Search. Includes keyword research, competitor analysis, and Baidu-specific ranking fac... | |
| Crypto Sentiment Monitor Real-time crypto market sentiment analysis. Aggregates Twitter/X, Reddit, Google Trends, and exchange data. Detects FOMO/FUD cycles and whale movements. Trig... | |
| Douyin Short Video Factory Create Douyin (抖音) short videos end-to-end: AI image generation, video prompt creation, frame extraction, and hashtag optimization. Integrates with Douyin's... | |
| Weibo Trending Topics Track Weibo hot search trends (微博热搜) in real-time. Fetches live trending topics, categories (娱乐/社会/科技/体育), and historical trend data. Zero config required. T... | |
| Youtube Chapter Generator Auto-generate YouTube video chapters from subtitles. Parses VTT/SRT files, identifies topic transitions, and produces timestamped chapter markers. Triggers:... | |
| iFLYTEK Face Compare Compare two face images and return similarity score using iFlytek Face Recognition API. | |
| iFLYTEK AI PPT Generator Generate professional, structured PowerPoint presentations from optimized topic keywords. |
27,651–27,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.