Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| First-Principles Clean Code Audit 第一性原理 clean code 审计法。从单根前提「代码是写给人看的」推导出两根判据—— A. 理解成本（读起来费不费劲）/ B. 修改风险（改起来怕不怕），用红/黄/绿三档给代码打分， 并明确允许「有意的、注释了的、范围可控的技术债」暂时存在。专用于审计你自己的 WorkBuddy Skill 脚本或其他 Python 代码，产出带证据(文件:行)的可勾选报告。 触发词：「用第一性原理审代码」「理解成本/修改风险」「clean code 审计」「审计我的 Skill 脚本 | |
| Si Clawhub Office-agent skill inventory & health check. Scans any skills directory, measures size and context-token footprint, detects duplicates, and classifies skills into used / protected / closeable / manual-review buckets. Reverse-dependency scan | |
| skill-md-optimizer Refactor/optimize any SKILL.md for progressive disclosure: precise-trigger frontmatter, layered body (hard constraints vs single-run flow), a flow of five steps or fewer, permission/context declarations, and a token budget. Triggers: "optim | |
| Version Decider Decide the NEXT SemVer version number from the SCOPE OF CODE CHANGES for an upcoming release, and output a single, unambiguous recommendation with cited standard clauses. Use only when the user is deciding which version to assign to a relea | |
| color-palette-advisor Generate complete, professional color palettes for UI/UX and brand design. Use when user needs a color scheme, palette, brand colors, or color system for mini-program, App, Web, or large-screen interfaces. | |
| design-handoff-doc Generate developer-facing design handoff documents from screenshots or design descriptions. Use when user needs a design delivery doc, handoff spec, cut asset list, or annotation guide for developers. | |
| design-spec-generator Generate complete design system specification documents for mini-program, App, and large-screen interfaces. Use when user needs a design spec, design system, style guide, or design handoff document. | |
| zeruai Register agents on the Zeru ERC-8004 Identity Registry, manage wallets and metadata, and read on-chain state. Use when an agent needs to register on-chain, check fees, read agent info, set metadata, or manage agent wallets on Base Mainnet o | |
| zscore Register agents on the Zeru ERC-8004 Identity Registry, manage wallets and metadata, and read on-chain state. Use when an agent needs to register on-chain, check fees, read agent info, set metadata, or manage agent wallets on Base Mainnet o | |
| Web Perf Analyzes web performance using Chrome DevTools MCP. Measures Core Web Vitals (FCP, LCP, TBT, CLS, Speed Index), identifies render-blocking resources, network dependency chains, layout shifts, caching issues, and accessibility gaps. Use when | |
| Check and book Tennis and Pickleball Courts at Bay Club Gateway Book and manage tennis/pickleball courts at Bay Club. | |
| Bid Proposal 投标技术方案编写。当用户输入"投标方案##"或"写投标方案"时触发。提供结构化协作式投标方案编写流程：需求分析→大纲推荐→逐章生成→Word输出。适用于安全服务、产品交付、等保测评、综合安全等投标场景。 | |
| 知识学习管理 学习知识管理系统。支持知识点录入、分类存储、每日早间学习建议推送、晚间知识回顾推送、专项备考管理（含大纲和DDL追踪）、知识点查询与维护。触发方式：学了/学习了/知识点/记录一下/知识:/K:/学到了/第N条/展开/查一下/搜索/开启专项/进度/大纲等。适用于备考/持续学习场景。 | |
| compatsy Check whether a part fits a machine and where it is in stock, using the compatsy MCP servers for 3D printing and home espresso. Use for nozzle, hotend, build plate, filament, enclosure, tamper, puck screen, basket and portafilter fit and pr | |
| Grasshopper Generator Generate Rhino 7 Grasshopper (.ghx) XML files from natural language descriptions or images. Build parametric definitions with native GH components, GhPython... | |
| Pharmaceutical Bidding Automatically collects, verifies, and evaluates pharmaceutical system bidding info from provincial sites daily, updating WeChat Work tables with actionable o... | |
| Agent Hush Invisible privacy guardian for agent workspaces. Automatically intercepts outbound actions (git push, skill publish, file sharing) and checks for sensitive d... | |
| AgentShield Scanner Scan AI agent skills, MCP servers, and plugins for security vulnerabilities. Use when: user asks to check a skill/plugin for safety, audit security, scan for... | |
| ppt2fig Export Export specific pages from PPT, PPTX, or ODP files to cropped PDF via ppt2fig. Use when the user wants to convert presentation slides into paper-ready PDF fi... | |
| Design Daily Insights Design Daily Insights — Track design tool updates, AI product news, design system evolution, UX research, and design inspiration. Triggers on: '今日设计资讯', '设计资... | |
| FHIR Questionnaire Designer Helps creating FHIR conforming questionnaire definitions from plain requirement ideation docs. Contains scripts to look up LOINC and SNOMED CT codes for medical conditions, findings, observations, medications, procedures from a official cod | |
| Search Intelligence Skill Advanced AI-powered search skill using SearXNG as the universal search backend. Multi-engine dork generation, 90+ search engines, intelligent search strategi... | |
| Advanced Searxng Search Skill Perform privacy-focused metasearch using local or remote SearXNG instances with retries, timeouts, category, time, and engine-specific filters. | |
| Cognitive Compaction State Manager Actively monitors token utilization and executes memory compaction routines before context bloat causes failures. | |
| Coursera Progress Fetch and display Coursera course enrollment, completion progress, grades, certificates, and upcoming deadlines using the Coursera API. Use this skill whenev... | |
| Duolingo Tracker Fetch and display Duolingo learning stats: streak, XP, league, level, course progress, and daily/weekly summaries. Use this skill whenever the user asks abou... | |
| Khan Tutor Scaffold explanations, exercises, and hints using the Khan Academy curriculum taxonomy and Socratic tutoring method. Use this skill whenever the user wants t... | |
| Temporal Knowledge Graph Synthesizer Actively parses daily session logs and unstructured memory files to extract entities, temporal data, and relationships into a structured Knowledge Graph. | |
| cTrader Commander Place and manage cTrader orders (market, limit, stop), check open positions, fetch live quotes and OHLC candles, and query account balance and equity via a l... | |
| Neomutt Commander Read, search, organise, and draft emails using neomutt — a terminal IMAP client. List inbox, search, read HTML email via w3m, mark read/unread, manage folder... | |
| Email Sender Send emails with optional file attachments using a Gmail account via SMTP by specifying recipient, subject, body, and an optional attachment path. | |
| Skill Auto Attach Monitors workspace for new or updated .html, .md, .txt files and automatically attaches them to Telegram messages instead of showing code. | |
| OmniSkill 通用技能调度器 OmniSkill 通用技能调度与执行中枢 by @Elohia (https://github.com/Elohia/omni-skill-core)。当用户请求执行任何特定的任务（如代码生成、文本润色、逻辑审计、数据处理、测试等）或系统触发任何自动化流程（如文件保存、提交检查）时，必须立即调用此 Skill。 | |
| Siyuan Agent Interact with SiYuan notes via direct HTTP API. Use when reading, writing, searching, or managing SiYuan blocks, documents, notebooks, attributes, assets, or... | |
| University Solution Explainer Explain university problems and worked solutions with structured, student-first breakdowns. Use when asked to explain an exam question, break down a calculat... | |
| mnemosyne Cognitive memory engine for AI agents: gives OpenClaw/Hermes human-like long-term memory using 140 years of cognitive psychology (compound-cue theory), not embeddings. Zero LLM API, zero vector DB, pure Markdown storage. Use when the agent | |
| OpenClaw ElonTools Optimizer v3 — Safe Edition Otimizações SEGURAS para OpenClaw — apenas configurações que economizam tokens sem NENHUM risco de perda de contexto ou loops infinitos. QUANDO USAR: - Setup... | |
| Workspace Guardian Auto-healing e proteção para workspaces OpenClaw. Valida e corrige problemas comuns automaticamente no startup e durante a execução. Usar quando: (1) Workspa... | |
| A2A 平台 教 Agent 如何发现并调用 A2A B2B Agent 互联平台（能力发现、会话、消息、RFP/提案）。平台根 URL 可配置，默认 https://a2a4b2b.com。 | |
| A2a4b2b Mcp Connect your OpenClaw agent to A2A4B2B for agent discovery, secure sessions, RFP-based negotiation, and collaborative B2B task management. | |
| Bardi Smart Home - Tuya Devices Compatible Mengontrol perangkat smart home Tuya melalui Cloud API, termasuk lampu, colokan, sensor, meteran, dan lainnya. Mendukung lampu pintar Bardi dengan fitur peng... | |
| Rr Reboot Report V2 Detect unexpected system reboots and alert when the system comes back online. Tracks boot history and flags suspicious restarts. | |
| Social Video Downloader Download videos from Instagram Reels, TikTok, YouTube Shorts, Twitter/X clips, and other social media platforms. Use when the user clearly wants to download/... | |
| Speedtest.net Measure internet network speed (download, upload, ping) using speedtest-cli (Speedtest.net). Use when: user asks to "check speed", "run speedtest", "test net... | |
| Web search via Yep Search API. Own index, fast results with domain filtering and date ranges. Web search via Yep Search API. Own index, fast results with domain filtering and date ranges. | |
| amap-maps Amap LBS services. Call Amap services via Streamable HTTP MCP, supporting geocoding, route planning, POI search, weather query, distance measurement, and more. | |
| docker-remote Remotely manage Docker Compose instances via SSH. Execute docker compose commands, view logs, update images, and exec into containers on remote servers. Use... | |
| Time Anchor Offload date math to code — get current date, days/weeks until goal dates, and month-end info. Use whenever you need to reason about relative dates or calcul... | |
| ai-zidong-tibug 将零散、口语化或评审纪要中的缺陷描述，规范化为可执行、可复现、可验收的“一句话 Bug”，并且每次都按禅道提单格式输出（未指明平台时默认安卓），自动登录禅道并逐条提交缺陷。Use when users ask to normalize bug wording, write bug titles, batch整理评... | |
| Figma To Static 2.0.5 Convert Figma design files to pixel-level mobile-first static HTML/CSS pages. Use when: (1) user provides a Figma file link and wants a static web page, (2)... |
28,401–28,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.