Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Rag based on Google drive Use the Google Drive RAG CLI to search your synced personal documents, add tracking folders, or check the service account status. | |
| FileChat RAG Search, retrieve, and chat with documents securely stored in ANY Google Drive folder using semantic vector search (RAG). Use when: (1) a user asks to save a... | |
| Google Drive based RAG Search, retrieve, and chat with documents securely stored in a designated Google Drive folder using semantic vector search (RAG RAG). Use when: (1) a user as... | |
| Filechat Search, retrieve, and chat with documents securely stored in ANY Google Drive folder using semantic vector search (RAG). Use when: (1) a user asks to save a... | |
| google-workspace-rave Manage Google Workspace via the `gws` CLI — Drive, Gmail, Calendar, Sheets, Docs, Chat, Admin, Tasks, Meet, Slides, Forms, Contacts, and every other Workspac... | |
| Oz CLI Remote Node Execute commands or tasks on the Oz Build Node via CLI, with mode-based control and direct bash command support on the remote node. | |
| Privacy virtual credit cards Use the Privacy CLI to create and manage Privacy Virtual Cards directly from the terminal. Trigger this skill whenever the user asks to create, list, pause,... | |
| SimpleFIN Bank Connection Connects to bank accounts and fetches financial transactions via the SimpleFIN API. Use when the user wants to check bank balances, review recent transaction... | |
| Neomano Astro Events (Local Sky + ISS) Provides local astronomical visibility including moon phase, rise/set times, planet viewing windows, and optional ISS pass predictions by location and date. | |
| Neomano Binance Assets (Read-only) Safe, read-only Binance balance viewer (Spot wallet) using Binance API keys with READ-ONLY permissions. Use when the user wants to check holdings/balances/as... | |
| Neomano Internet Speed (Download/Upload) Measure current internet connection speed (download + upload) from this machine using a lightweight HTTP-based speed test (Cloudflare speed endpoints). Use w... | |
| Neomano Places (Google Places) Search Google Places (Places API New) for real-world places, businesses, restaurants, and nearby recommendations. Use when the user asks to find specific pla... | |
| Neomano TODO Enhanced TODO/task manager backed by a local SQLite database (instead of flat text files) with priorities (1-3), tags, due dates, reminder timestamps, explic... | |
| Neomano TTS (ElevenLabs) Text-to-speech (TTS) via ElevenLabs. Use when the user asks to reply with voice/audio, generate a spoken version of some text, or asks for “voz”, “nota de vo... | |
| Neomano VPS Monitoring (DigitalOcean) Monitor DigitalOcean VPS droplets by listing instances and fetching CPU, memory, disk, and bandwidth metrics with summaries using the DigitalOcean API. | |
| Neomano Web Snapshot (Headless) Take a screenshot (PNG) of any website in a headless way (no GUI) to verify it's rendering/working. Use when the user asks for a website screenshot, uptime v... | |
| Neomano X (Tweet Publisher + Image) Draft, revise, and publish X (Twitter) posts with an image using the X API. Use when the user asks for a tweet/post for X, wants to attach an image, and requ... | |
| Cline Automation skill for Cline. | |
| Memphis 🔥 Memphis - Complete AI Brain for OpenClaw Agents ALL-IN-ONE meta-package with everything you need: 🧠 Core Features: - Local-first memory chains (journal,... | |
| Memphis Cli Operate the Memphis local-first brain: init/status checks, journaling, recall/ask, embeddings, vault, share-sync, graphs, reflections, ingestion, automated m... | |
| Memphis Cognitive 🧠 Memphis Cognitive Engine - Complete AI Memory System Transform your OpenClaw agent into a cognitive partner with: - Model A: Record conscious decisions (m... | |
| 通过接口快速创建直播间 This skill should be used when the user needs to create or configure a CC live streaming room via API, including room creation, authentication setup, and cre... | |
| Elcano Superpowers Facilita desarrollo estructurado con sub-agentes para features, refactors grandes y cambios multi-archivo siguiendo diseño aprobado y TDD. | |
| Hudle Skill Interact with Hudle (hudle.io), the AI agent economy platform. TRIGGER when user mentions Hudle, gigs, javierai wallet, Axiom, claiming or delivering work, H... | |
| Payroll Oracle Shadow HR Infrastructure. Audits GitHub/Linear work and settles USDC payments via x402 with 1% protocol fee. | |
| Todo Tracker (CN) 生成、跟踪和验证待办列表的执行状态。提供 generate-todo-list, mark-completed, show-progress, verify-completion 四个核心动作。 | |
| 元智能 元智能 - 道的显化，承载老子帛书与庄子玄机的 AI 助手 | |
| Seer server manager CLI for the Seer media request management API. Search movies and TV shows, create and manage media requests, manage users, track issues, and administer a sel... | |
| Seerr server manager CLI for the Seerr media request management API. Search movies and TV shows, create and manage media requests, manage users, track issues, and administer a se... | |
| xiaozhi-mcp-server 让小智智能盒子连接OpenClaw，成为你的智能语音助手 | |
| Element NFT Drops Use when the user mentions Element plus drops, NFT creation, NFT collection launch, mint setup, sale stages, prereveal media, preview media, or publishing/pa... | |
| Element NFT Trader Use when the user wants to sell or buy an NFT on Element, create or accept a bid or offer, query public collection orders or account orders, cancel an Elemen... | |
| analogy-factory This skill should be used when the user wants not one analogy but several from completely different angles — including phrases like "多给几个比方", "用不同角度类比", "换个比喻", "还有什么好比喻", "analogies", "explain with different metaphors". It produces five an | |
| counterexample-teacher This skill should be used when the user asks when a claim, rule, or piece of advice does NOT hold — including phrases like "什么时候不适用", "有什么例外", "边界在哪", "这说法靠谱吗", "举个反例", "counterexample", "when does this fail", or any request to test the lim | |
| error-translator This skill should be used when the user pastes a technical error and wants to know what it means and how to fix it — including phrases like "这个报错什么意思", "怎么修", "为什么报错", "看不懂这个错误", "this error means what", "how do I fix this error", "debug th | |
| plain-explanation This skill should be used when the user asks to explain a concept in a way that even a 5-year-old can understand — including phrases like "通俗解释", "说人话", "讲给 5 岁听", "用大白话讲", "再简单点", "给小白讲讲", "打个比方", or any follow-up that signals the previous | |
| socratic-questioner This skill should be used when the user wants to be guided to an answer instead of told it — including phrases like "别告诉我答案", "引导我想", "我自己想明白", "问我几个问题", "帮我捋一捋", "socratic", "don't give me the answer", "help me think it through". It respon | |
| three-sentence-summary This skill should be used when the user wants long content compressed into an extremely short summary — including phrases like "三句话总结", "一句话说清", "太长不看", "简单说说", "结论是什么", "TL;DR", "sum it up in three sentences". It compresses any article, me | |
| tone-adjuster This skill should be used when the user wants the same message rephrased in different tones — including phrases like "改委婉点", "说得不那么冲", "对上级该怎么说", "换个说法", "这话太生硬了", "make it sound nicer", "rephrase this more politely". It outputs five tone v | |
| AgentSports - AI Agents Sports Competition Platform AI agents compete in P2P sports predictions and earn real money on agentsports.io. No API key required. | |
| Agentsports AI agents compete in P2P sports predictions and earn real money on agentsports.io. No API key required. | |
| Betfunsports - AI Agents Betting Exchange AI agents compete in P2P sports predictions and earn real money on betfunsports.com. Credentials stored in ~/.bfs-mcp/ after first login. | |
| ClawHub Intro Skill Demonstration skill showcasing ClawHub skill structure with metadata, description, and usage examples for publishing to the ClawHub registry. | |
| AI Full media generation automation flow Skill VAP Media API skill for image, video, music, and media editing through VAP. Uses VAP product keys with current Media API endpoints. | |
| VAP Media API skill for Realistic image video music VAP Media API skill for image, video, music, and media editing through VAP. Uses VAP product keys with current Media API endpoints. | |
| Buildertrend Complete Buildertrend automation via Browser Relay - 43 playbooks covering sales, project management, financials, scheduling, change orders, daily logs, RFIs... | |
| Banana Prompt Generator Google Banana（Imagen系列）AI文生图提示词生成技能。用于生成高质量角色图、场景图、分镜素材图、概念图的英文Prompt，同时提供中文说明、负面提示词和参数建议。触发词：Banana提示词、Banana作图、Google图片提示词、分镜素材图提示词。 | |
| Daily Shortdrama Report 每日短剧工作总结技能。用于生成精简的短剧/AI漫剧团队每日工作报告，包含工作量统计、对话次数/Token使用量、内容生产进度。触发词：日报、工作日报、每日总结、每日报告。 | |
| Ip Screener IP改编潜力筛选技能。从番茄小说、起点、七猫等小说平台筛选最具短剧/AI漫剧改编潜力的未改编小说，从剧情节奏、角色数、场景复杂度、画面感、受众共鸣、题材新颖度等维度打分，输出TOP5评分榜单。触发词：IP筛选、小说筛选、改编潜力分析、未改编小说、选剧分析、IP评分。 | |
| Short Drama Market Analysis 短剧/动漫剧/AI剧市场分析技能。用于分析短剧、AI漫剧市场动态、爆款作品追踪、平台政策解读、竞品分析、选剧决策支持。触发词：市场分析、选剧分析、短剧市场、动漫剧分析、AI漫剧市场行情、热门作品分析。 |
28,301–28,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.