Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Qimen Dunjia — 奇门遁甲 奇门遁甲排盘分析器，基于洛书九宫四层盘面体系（天盘九星、地盘三奇六仪、人盘八门、神盘八神）， 支持时家奇门排盘，用于择时决策和事项预测。当用户提及「奇门遁甲」「奇门」「遁甲」「择时」 「奇门排盘」「奇门预测」时触发。排盘为确定性计算 + LLM 综合解读，无外部 API 依赖。 不适用于：梅花易数、六爻易经、风水... | |
| Tarot Reading A tarot reading and interpretation tool, part of the fortune-telling-skills suite. Based on the Rider-Waite-Smith system, it supports upright and reversed re... | |
| Vedic Astrology A Vedic astrology (Jyotish) analyzer based on the Indian Jyotish tradition, using the Sidereal zodiac to read birth charts. Covers 27 Nakshatras (Lunar Mansi... | |
| Ziwei Fortune — 紫微斗数命盘 紫微斗数命盘分析器，基于紫微斗数经典体系，通过农历出生年月日时推算命盘十二宫、 安十四主星、四化飞星，揭示命格特质与人生走向。当用户提及「紫微斗数」「命盘分析」 「紫微排盘」「斗数」「十四主星」时触发。排盘为确定性算法 + LLM 综合解读，无外部 API 依赖。 不适用于：星座运势、八字命理、塔罗占卜、数字命理... | |
| Openclaw Moltbook Integrates OpenClaw with Moltbook for posting, browsing, notifications, and managing submolt communities with rate limit and error handling. | |
| HexaLotto 六爻奇门测彩 六爻奇门测彩 V2.0 (HexaLotto) — 多彩种六爻推演娱乐 Skill， 支持双色球(SSQ)、大乐透(DLT)、六合彩(MARK6)三大彩种。 同时推算主号（红球/前区/平码）与特殊球（蓝球/后区/特码特肖）。 当用户提到"算一卦"、"六爻测彩"、"预测双色球"、"预测大乐透"、 "六合彩特码"、"... | |
| 彩票测算器 梅花易数彩票测算器。根据用户提问时的当前时间，起出梅花易数的本卦、互卦、变卦，并将其转化为双色球(ssq)或大乐透(dlt)的推荐号码。当用户提到「算一注彩票」「帮我选号」「梅花易数选号」「双色球/大乐透推荐号码」「今天买什么号」「算卦选号」「卜一注」「来一注」或任何涉及用易学/玄学方法生成彩票号码的请求时，触发... | |
| Douyin Topic Hotspot Collector Search Douyin for a user-specified topic and time range, then return the top hotspot videos ranked by visible engagement signals with strict no-fabrication r... | |
| Kubeblocks Provision and manage production-grade databases on Kubernetes using KubeBlocks. Use this skill when the user needs a database — MySQL, PostgreSQL, Redis, Mon... | |
| Hana Image Gen MacOS MacOS Gemini image gen via OpenRouter for OpenClaw agents. Auto-wait, gen, send image. | |
| Chrome Markdown to PDF 使用 Chrome headless 将 Markdown 文件转为排版精美的 PDF，支持表格、代码块、中文。 Activate when user mentions: md转pdf、markdown转pdf、转PDF、导出PDF、生成PDF、chrome转pdf。 | |
| Python Matplotlib Chinese Font Configure matplotlib to display Chinese by adding a Chinese font file with font_manager.addfont(), setting rcParams['font.family'], and disabling unicode_minus. | |
| Ai Persona Os The complete operating system for OpenClaw agents. Now with 14 Iconic Character souls (Thanos, Deadpool, JARVIS, Mary Poppins, Darth Vader, Brendan from Cybe... | |
| Epson MCP Print, scan, copy, and job control for the Epson WF-2250 (and other network-attached Epson inkjets) via MCP. Exposes tools for text/raster/PDF printing, prin... | |
| Google Voice Google Voice web-client automation and MCP integration from HAR captures. Use when reverse-engineering voice.google.com.har or call_voice.google.com.har, lis... | |
| Hemlane MCP Operate Hemlane using HAR-derived GraphQL patterns and browser session artifacts. Use when analyzing Hemlane HAR files, extracting GraphQL operations from He... | |
| oauth-coder-bridge Routes OpenClaw Anthropic API calls through oauth-coder (Claude CLI with OAuth), no API key needed. | |
| Paragon MLS Fetch real estate listings from Paragon MLS (paragonrels.com / fnimls.com) APIs and perform four-square rental property analysis. Use when: (1) looking up ML... | |
| Paragon MLS Analyze Deal Run spreadsheet-compatible Four-Square rental analysis for Paragon MLS deals. Use when evaluating rental properties for cash flow, NOI, DSCR, appreciation, d... | |
| Paragon MLS Fetch Listings Fetch all active property listings from a Paragon MLS shared listing GUID. Use when resolving a Paragon link or GUID into the parsed property records behind it. | |
| Paragon MLS Fetch Property Fetch a single property from Paragon MLS by MLS number and system ID. Use when looking up one listing's parsed details, including address, price, beds, baths... | |
| Paragon MLS Raw Listings Fetch raw JSON listing payloads from Paragon MLS. Use when debugging parser behavior, inspecting source payloads, or doing custom downstream analysis on unpr... | |
| Paragon MLS VB Calc Compare amortized debt, extra payments, chunking/basic acceleration, and advanced velocity banking for a real estate deal. Use when deciding whether chunking... | |
| Renatus Icm Manage Renatus event campaigns by setting up landing pages, running email blasts, handling guest registrations, exporting leads, and syncing unsubscribes. | |
| Office Automation Test 快速生成规范的日报、周报和会议纪要，支持根据核心信息定制格式和内容，提高办公文档撰写效率。 | |
| Abby Autonomy 使 Abby 能主动从任务队列获取并执行任务，自主管理任务状态，持续推进工作至完成或资源限制。 | |
| Abby Browser 基于 OpenClaw 的浏览器工具，支持自然语言控制网页打开、截图、点击、输入、表单填写、数据提取和页面操作。 | |
| Abby Watch Simple time display for Abby. Use when you need to know the current time or count down to a specific time. | |
| Research Strategy 自主研究新交易策略的完整流程。必须用 market-intel-assistant 搜索！包含：搜索→实现→回测→评估→决策→记录→循环。 | |
| Session Init 手动触发新会话初始化，完整回顾跨会话记忆、人格文件、Skills 和 MCP 服务器，巩固惯性消灭与 Truth Engine 原则。 | |
| EarnFi x402 - Execute real-world human work and social engagement (feedback, opinions, data labelling, reviews, small tasks), social tasks (likes, followers, reposts, raids, comments, youtube views, etc.) — all paid via x402 Execute real-world human work and social engagement (feedback, opinions, data labelling, reviews,small tasks), social tasks (likes, followers, reposts, raids... | |
| dota2 XG next game 查询 Xtreme Gaming (XG) 战队的下一场比赛信息。通过 Liquipedia API 获取精准、实时的赛程数据。当用户询问 XG 何时有比赛或下一场对手是谁时调用。 | |
| 科研人员学术品牌构建助手 科研人员学术品牌构建与影响力提升助手，帮助学者从实验室走向产业界，建立个人学术IP。当科研人员需要提升学术影响力、构建个人品牌、对接产业资源、或从学者转型为行业专家时触发。提供学术传播、媒体运营、产学研对接等全方位指导。 | |
| Academic Writing Assistant Academic writing assistance skill for paragraph writing, language polishing, grammar checking, academic style optimization, and citation format checking. | |
| AI市场调研与竞品分析助手 AI赋能的市场调研与竞品分析助手，专为科研人员和学术创业者设计。当用户需要进行技术市场分析、竞品调研、技术趋势预测、目标用户画像分析或行业数据收集时触发。支持多维度市场评估，帮助学术成果找到最佳商业化路径。 | |
| Clawhub Skill Search Use this skill when users need help finding, discovering, or selecting OpenClaw skills from the Clawhub marketplace. Triggers include: '哪个技能适合', '怎么找到', '技能搜... | |
| Data Analysis Workflow Standardized data analysis workflow integrating data-analysis, statistical-analysis, scientific-visualization and other skills. Provides complete data analys... | |
| 国创赛商业模式设计 中国国际大学生创新大赛（国创赛）商业模式设计专家。当用户需要：(1)了解国创赛商业模式评分规则和评审要点 (2)设计或优化参赛项目的商业模式 (3)分析产业认知、市场定位、盈利模式 (4)撰写参赛PPT的商业模式板块 (5)准备商业模式答辩 (6)评估商业模式的可行性和创新性 (7)提供商业模式相关培训或讲座内容... | |
| 有序创业24步法-Idea to Startup系统化创业指南 有序创业24步法指导助手。当用户需要系统性地将创业想法转化为可持续的创新型企业、寻找产品市场匹配、设计商业模式或制定市场进入策略时使用此技能。 | |
| 产学研资源对接助手 产学研资源对接与科技创业孵化助手，帮助科研人员对接产业资源、寻找合作伙伴、了解孵化体系和融资路径。当用户需要寻找企业合作、对接投资机构、了解孵化器、或规划科技成果转化路径时触发。提供从实验室到市场的全链条资源对接服务。 | |
| 国创赛指南-中国国际大学生创新大赛参赛助手 中国国际大学生创新大赛参赛指导助手。当用户需要参加中国国际大学生创新大赛、准备参赛项目、获取赛道建议或制作参赛PPT时使用此技能。 | |
| Lab-to-Market-Co-Creation-Agent 面向高校硬科技成果转化，提供共创验证式创业的诊断、路线图、课程、案例与白皮书设计支持。 | |
| 师生共创模式指导-高校科技成果转化方法论 高校师生共创模式指导助手。当用户需要进行科技成果转化、组建师生共创团队、选择共创模式或解决共创过程中的问题时使用此技能。 | |
| Lab2startup Challenge Solutions 师生共创三大核心挑战的解决方案。当用户面临师生共创中的主导权冲突、技术落地困难、技术市场匹配难题时使用。触发词：师生共创挑战、主导权冲突、技术落地、技术转化、角色分工、沟通机制、产品化、成本控制 | |
| Lab2startup Ecosystem 师生共创生态系统对接指南。当用户需要对接大学政策、平台资源、投资机构、产业伙伴等外部资源支持时使用。触发词：师生共创生态、大学支持、平台赋能、投资对接、产业合作、政策支持、清华x-lab、孵化器、创业资源 | |
| Lab2startup Growth Maturity 师生共创成长与成熟阶段指导。当用户完成启动验证，需要产品化、市场拓展、组织建设、技术持续创新时使用。触发词：师生共创成长、产品化、规模化、市场拓展、组织建设、团队扩张、品牌建设、渠道建设 | |
| Lab2startup Launch Validation 师生共创启动与验证阶段指导。当用户处于师生共创早期，需要识别可转化成果、组建核心团队、进行技术验证和市场验证时使用。触发词：师生共创启动、成果转化、团队组建、技术验证、市场验证、MVP测试、原型开发、客户访谈 | |
| Lab2startup Team Types 师生共创三大团队类型辨析与选择决策。当用户需要选择师生共创的团队主导模式、了解老师主导型/学生主导型/师生共同主导型的优劣势时使用。触发词：师生共创、团队类型、老师主导、学生主导、团队分工、创业团队、师生分工、谁来主导、师生关系 | |
| Lab2startup Tech Market Fit 师生共创的技术与市场匹配策略。当用户需要在技术导向与市场导向之间做出选择、寻找技术应用场景、进行技术市场匹配转型时使用。触发词：技术市场匹配、技术导向、市场导向、场景探索、应用场景、技术落地、市场验证、转型策略 | |
| Literature Search Workflow Standardized literature search workflow integrating tavily-search, pubmed-database, bgpt-paper-search, openalex-database and other academic search skills. Pr... |
27,751–27,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.