Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Database Migration Execute database migrations across ORMs and platforms with zero-downtime strategies, data transformation, and rollback procedures. Use when migrating databas... | |
| Deep Research.Bak Conducts enterprise-grade research with multi-source synthesis, citation tracking, and verification. Produces citation-backed reports through a structured pi... | |
| Fitness encyclopedia Comprehensive AI fitness assistant offering personalized training plans, nutrition calculation, strength prediction, joint assessment, and expert fitness kno... | |
| Emily Web Fetch Fetch static webpage content up to 5000 characters via HTTP/HTTPS GET for analysis, summarization, or information extraction. | |
| 面经-商业分析面试通关 Bilingual interview prep skill for Business Analysis, BI & Data Analysis roles. Covers methodologies (RFM/PSM/DID), STAR storytelling, real interview Q&A, an... | |
| revdoku Mailboxes for AI agents: receive and reply to email, read messages and attachments, and store or share files. Use Revdoku for authorized uploads, file changes, restore, archiving, permanent deletion, and agency client account creation. | |
| Aether Tarot Provides calm, intuitive 3-card tarot readings for daily reflection, decision support, and emotional clarity in a private, conversational format. | |
| 早播新闻 生成 Zao Live 分享卡片。当用户说"我要听早播"、"播一段新闻"、"来段早播"、"听新闻"等想要收听播客/新闻音频的内容时，使用此技能。 | |
| biomedical-reference-verifier Verify or normalize biomedical and life-science reference lists, when the task is about AI-caused reference errors. Checks identifiers and bibliographic fields, preserves source evidence, and produces a searchable offline report. 生物医学/生命科学参 | |
| voidly-agent-relay Instruction skill for registering an agent, finding peers and using relay messaging. On the SDK client-key path, content is encrypted before upload, while the relay sees sender and recipient DIDs and traffic metadata. MCP relay tools and le | |
| voidly-pay Instruction skill for discovering Voidpay services, preparing seller listings and owner-reviewed checkout links. Read current offer terms before acting. A skill install supplies no wallet or spend authority. Retired relay payment routes ret | |
| SecondMind Autonomous three-tier memory with proactive initiative, project tracking, and social intelligence. Ingests OpenClaw conversations, extracts knowledge + emoti... | |
| EmpirioLabs AI Image Generate and edit images with EmpirioLabs AI. Use when the user asks to create, draw, illustrate, or render a picture, logo concept, product shot, poster, or social image, or to edit, restyle, or combine existing images from a URL or local | |
| EmpirioLabs AI Models Find the right EmpirioLabs AI model for a task and look up its price, parameters, limits, and supported endpoints in the live public catalog. Use when the user asks which model to use for text, image, video, audio, transcription, research, | |
| EmpirioLabs AI Speech Turn text into natural speech with EmpirioLabs AI and save the audio file (MP3, WAV, and other formats). Use when the user asks to read text aloud, create a voiceover, narration, or audio version of a script, or try different voices and lan | |
| EmpirioLabs AI Transcribe Transcribe audio or video files to text with EmpirioLabs AI, from an https URL or a local file. Use when the user asks for a transcript of a recording, meeting, interview, podcast, voice note, or video, wants speaker-labeled text, or needs | |
| EmpirioLabs AI Video Generate short videos with EmpirioLabs AI from a text prompt or a start image, wait for the job to finish, and download the MP4. Use when the user asks to make, animate, or render a video clip, turn a still image into motion, or check on a | |
| opendataloader-pdf Use when parsing PDFs for RAG pipelines, extracting structured data from PDFs, or converting PDFs to Markdown/JSON with bounding boxes for AI processing | |
| MacOS Desktop Control (Mouse, Keyboard, Screenshots) Automate macOS desktop by capturing screenshots and executing precise mouse movements, clicks, and keyboard inputs via cliclick. | |
| lobsterpot Share and discover technical solutions with other AI agents. Stack Overflow for agents. | |
| Zvec Local RAG Service Operate an always-on local semantic-search service using zvec + Ollama embeddings. Use when you need to ingest .txt/.md files, run meaning-based search via H... | |
| Basecamp CLI Manage Basecamp (via bc3 API / 37signals Launchpad) projects, to-dos, messages, and campfires via a TypeScript CLI. Use when you want to list/create/update Basecamp projects and todos from the terminal, or when integrating Basecamp automati | |
| Linear Issues Interact with Linear for issue tracking. Use when creating, updating, listing, or searching issues. Supports viewing assigned issues, changing status, adding comments, and managing tasks. | |
| Nightly Workspace Audit Nightly workspace audit — auto-discover file dependencies by scanning all workspace files for cross-references, manage HOT/WARM/COLD memory tiers, detect orp... | |
| Polymarket Trading Setup Set up automated trading on Polymarket. Covers wallet setup, token approvals, API authentication, market discovery, order placement, WebSocket feeds, and pos... | |
| Synth Data Query volatility forecasts from Synthdata.co for crypto, commodities, and stocks. Compare assets and run Monte Carlo simulations. | |
| emwstudio 这是UP主"电磁波Studio"开发的Skill，用于运行ComfyUI工作流，支持生成"多国语言版酱板鸭视频"、"不要怕视频"、"《喵窖2026》广告配音"。 | |
| Sauce Duck Video Maker 生成多国语言版的酱板鸭搞笑梗视频。当用户想要生成酱板鸭视频、制作多语言酱板鸭搞笑梗视频、或使用RunningHub生成搞笑类视频时，使用此Skill。支持英语、韩语、泰语、法语等多种语言版本。 | |
| Speak Turbo - Talk to your Claude 90ms latency! Give your agent the ability to speak to you real-time. Talk to your Claude! Ultra-fast TTS, text-to-speech, voice synthesis, audio output with ~90ms latency.... | |
| minecraft-bridge Local HTTP bridge for Mineflayer-based live control of a Minecraft Java bot. Trigger when the user wants to connect a bot to their world, check bot status/in... | |
| minecraft-building-server Minecraft Java Edition creative building workflows and builder automation. Covers FAWE/WorldEdit large-scale editing, Mineflayer Bot construction, Litematica... | |
| minecraft-server-admin Execute Minecraft Java Edition admin commands through the RCON remote console. Use for player moderation, whitelist management, item/state commands, world ru... | |
| Minecraft Wiki Answer any Minecraft Java Edition gameplay question — facts, mechanics, strategies, recipes, item properties, mob behaviors, and version differences. Always... | |
| 確定申告アシスタント フリーランス・個人事業主のための確定申告サポート。所得分類、経費整理、控除確認、消費税・インボイス制度の知識アシスタント。令和7年度税制改正（基礎控除95万円段階・160万円の壁）対応。API接続なし、マイナンバー取扱なし。 | |
| run-coach Science-based running coach via Telegram. Logs training, sends visual training plans as HD photo albums, and coaches with evidence-driven discipline — never nags, never asks for data it already has. Optional Garmin sync collects health metr | |
| Skill Audit Framework Structured security and quality audit framework for AI agent skills. Teaches you what to check before installing any skill. | |
| Send Md As 在即时通讯 app 中以优雅图片形式展示 Markdown。支持标题、代码高亮（行号、Monokai）、LaTeX 公式、Mermaid 图表、表格、列表。4 种色彩主题，智能分页。渲染阶段零 CDN 依赖（安装时需网络下载依赖）。| Render Markdown as a polished image for... | |
| Homeassistant N8n Agent Bridge OpenClaw with your n8n instance for Home Assistant automation. | |
| Mqtt Client This is a simple client for connecting to an mqtt instance | |
| My New Skill My New Skill provides a customizable framework for specific tasks, enabling streamlined workflows or tool operations in defined scenarios. | |
| N8n Dispatch Forwards user requests labeled state, action, or historical with text prompts to a configured n8n_dispatch MCP service and returns its response. | |
| daily-gushiwen 每日从古诗文网(gushiwen.cn)首页爬取诗词文句、古画名句等内容，整理后发送为消息。用于用户询问"每日古文"、"古诗"、"诗词推荐"或需要每日古文推荐时触发。 | |
| daily-info 获取当前日期和天气的综合信息，包括公历、农历、节气、节假日，以及天气详情（温度、湿度、风力、空气质量、穿衣指数等）。当用户询问今天的日期、天气、或需要日期天气相关信息时触发。 | |
| daily-trending 获取今日热榜，从tophub.today抓取各平台热搜榜单。当用户询问"今天有什么热搜"、"热榜"、"微博热搜"时触发。 | |
| today-in-history 获取历史上的今天的重要事件，数据从Wikipedia获取。当用户询问"历史上的今天"、"今天发生了什么"、某月某日的历史事件时触发。 | |
| whu-campus 获取武汉大学校园新闻，包括重大新闻、讲座、活动、通知等，来源为武汉大学各微信公众号。当用户询问"武大有什么新闻"、"武大校园消息"时触发。重点爬取"武汉大学全心权益"公众号内容。所有搜索关键词必须包含当前日期，确保时效性。只输出还未举办的活动。 | |
| nadfunagent Autonomous Nad.fun trading agent that scans markets via API and indexer, analyzes tokens, executes trades, and shares profits with MMIND token holders. | |
| EnConvert Render web pages and files into agent-ready markdown, structured data, screenshots, and PDFs via EnConvert, with a render_quality honesty score on every read. | |
| Agentic CLI Coding Use this skill for any task that involves reading, understanding, searching, or modifying source code in a project — across JavaScript, TypeScript, Vue, Reac...
You can see every single script that's in this. This does not call a remote sc | |
| Approved Self Improvement Captures learnings, errors, and corrections to enable continuous improvement with user-approved skill updates. Use when: (1) A command or operation fails une... |
28,551–28,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.