Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Ai Agent Security Audit Performs a comprehensive security audit of AI agents, detecting vulnerabilities, assessing risks, and providing prioritized remediation and compliance reports. | |
| Aprendizado Continuo Captura erros, correções e aprendizados automaticamente. Promove melhorias para AGENTS.md, TOOLS.md e SKILL.md. Sistema de auto-melhoria em português. | |
| Autonomia Agente Transforma agentes IA de seguidores de tarefas em parceiros proativos que antecipam necessidades e melhoram continuamente. Arquitetura proativa com WAL Proto... | |
| CogniMemo Memory Universal AI memory infrastructure that stores, understands, and learns from past interactions. Works across ChatGPT, Claude, Gemini, DeepSeek, and any AI mo... | |
| Data Extractor Extract structured data from unstructured sources. Parse JSON, CSV, logs, and mixed formats into clean, usable data. Handle malformed data, nested structures... | |
| Documentation Writer Write clear, comprehensive documentation. Covers README files, API docs, user guides, and code comments. Create documentation that users actually read and un... | |
| Gerador Receitas Análise de métricas SaaS para planejamento de monetização: ARR, NDR, LTV:CAC, Magic Number, cohort analysis, GTM efficiency. Tudo em português para a comunid... | |
| Market Competitor Research Research competitors systematically. Analyze positioning, pricing, features, marketing, and gaps. Generate competitive intelligence reports with actionable i... | |
| MCP Business Integration Integrate AI agents with business data via Model Context Protocol. Query ads, analytics, CRM data through normalized interfaces. Use when connecting agents t... | |
| Mcp Server Scanner Scans and assesses MCP servers for vulnerabilities, insecure configs, data exposure, and compliance with SOC 2, GDPR, and ISO 27001 standards. | |
| Memoria Persistente Sistema de memória hierárquica em 3 camadas para agentes IA: curto prazo (contexto), médio prazo (diário), longo prazo (conhecimento). Tudo em português. | |
| Nango API Integration Connect AI agents to 700+ external APIs using Nango. Handles OAuth, authentication flows, and tool calling for any API. Use when integrating agents with exte... | |
| OpenViking Setup Set up OpenViking context database for OpenClaw agents. OpenViking is an open-source context database designed specifically for AI agents with filesystem-bas... | |
| Pesquisa Profunda Pesquisa profunda com pipeline de 8 fases: escopo, planejamento, recuperação, triangulação, síntese, crítica, refinamento e empacotamento. Relatórios com cit... | |
| Seguranca Auditoria Auditoria de segurança para skills do OpenClaw. Verifica código malicioso, prompt injection, APIs perigosas e práticas inseguras. Protege contra ClawHavoc e... | |
| Task Automation Workflows Automate repetitive tasks with scripts, workflows, and schedules. Create efficient automation for file operations, data processing, API calls, and scheduled... | |
| xquads-advisory-board Conselho de 12 pensadores lendários - Ray Dalio, Charlie Munger, Naval Ravikant, Peter Thiel, Simon Sinek, Reid Hoffman, etc. Use para decisões estratégicas,... | |
| xquads-brand-squad Squad de 15 especialistas em branding - David Aaker, Marty Neumeier, Byron Sharp, etc. Use para brand positioning, brand identity, naming, brand story, arche... | |
| xquads-copy-chief Orquestrador do Copy Squad - Diagnostica necessidades de copy e roteia para o especialista certo (Gary Halbert para sales letters, Eugene Schwartz para headl... | |
| xquads-copy-squad Elite squad de 23 agentes de copywriting - 22 copywriters lendários (Gary Halbert, Eugene Schwartz, Dan Kennedy, Russell Brunson, etc.) + 1 orchestrator (Cop... | |
| xquads-hormozi-chief Orquestrador do Hormozi Squad - Diagnostica desafios de negócio e roteia para o especialista certo (Offers, Leads, Pricing, Sales, Content, Scaling, etc.). U... | |
| Hormozi Squad Squad de 16 agentes implementando os frameworks de Alex Hormozi para negócios - offers, leads, pricing, sales, content, hooks, launch, retention, scaling. Us... | |
| xquads-traffic-masters Squad de 16 especialistas em paid traffic - Ralph Burns, Molly Pittman, Nicholas Kusmich, Kasim Aslam, etc. Use para ads, Facebook, Google, YouTube, scaling... | |
| ConvertAgent Use ConvertAgent for file format conversions through the local CLI. Trigger for any request to convert files (documents, images, audio, video, spreadsheets,... | |
| Merxex Exchange Post jobs to get work done faster, or bid on jobs to earn via Lightning. The only two-sided commerce exchange built for autonomous AI agents. | |
| Answer Book The Answer Book / 答案之书 — hold a question in your mind, flip to a random page, and receive a short philosophical answer. Supports both English and Chinese; pi... | |
| Board Game Master（桌游助手） Board game strategy coach for social deduction games: Decrypto (截码战/谍报风云), Blood on the Clocktower (血染钟楼), and Avalon (阿瓦隆). Provides role-specific tactics,... | |
| 答案之书 答案之书——心中默念一个问题，随机翻到一页，得到一个充满哲理的简短答案。当用户提到"答案之书"、想"翻一页"、想问命运/求指引、希望神谕回答是非题时使用。触发词：答案之书、翻一页、问问书、神谕、求一个答案。 | |
| Decrypto Coach（截码战、谍报风云） Strategic coach for the board game Decrypto (截码战). Use when users want help with: (1) Giving better clues as the encryptor / 给出更好的加密线索, (2) Intercepting oppo... | |
| Drift Bottle Retrieve a random drift bottle message with life insights, stories, wishes, or inspirational quotes for inspiration or reflection. | |
| Emoji Pick the right emoji or sticker for any message context. Triggers when composing replies, reacting to messages, adding emoji to text, or when asked for emoji... | |
| Image Gen Cheap 低成本图片生成与编辑。使用老张 API，最低 $0.01/张。支持文生图、图片编辑。触发词：生成图片、画图、AI 作图、文生图、图片编辑。 | |
| Image Gen Low Cost 低成本 AI 图片生成 CLI 工具。支持文生图、图片编辑。触发词：生成图片、画图、AI 作图、文生图、图片编辑、imgen。 | |
| Laozhangapi Image 使用老张 API 生成和编辑图片，最低 $0.01/张。支持文生图、图片编辑、多图融合、多种比例。触发词：生成图片、画图、AI作图、文生图、图片编辑、换背景、风格转换、Sora生图。 | |
| Message in a Bottle Randomly retrieve an inspirational or thoughtful message in a bottle, including life insights, stories, wishes, or quotes. | |
| NBATI NBATI 篮球人格测试。回答8个关于打球习惯和风格的问题，测出你的篮球人格类型。触发词：NBATI、篮球人格、篮球测试、测篮球风格、篮球类型。当用户提到 NBATI、篮球人格测试、想测篮球风格时触发。 | |
| NBTI NBTI 脑干缺失人格测试。回答8个离谱问题，测出你的精神状态人格。触发词：NBTI、脑干测试、精神状态测试、测测我的精神状态。当用户提到 NBTI、想测精神状态、或有人分享了 NBTI 结果时触发。 | |
| 漂流瓶 随机获取一个漂流瓶（包含人生感悟、小故事、祝福或励志语录）。当用户要求漂流瓶、message in a bottle、随机消息、获取灵感、人生感悟时触发。触发词：漂流瓶、瓶中信、随机消息、获取祝福、人生感悟、message in a bottle、drift bottle。 | |
| SBTI SBTI 恶搞人格测试。给用户出一组抽象搞笑的测试题，根据回答生成一个离谱的人格类型和解读。触发词：SBTI、人格测试、性格测试、测一测、做个测试。当用户提到 SBTI、想做人格测试、或有人分享了 SBTI 结果时触发。 | |
| SBTI 恶搞人格测试 SBTI 恶搞人格测试。给用户出一组抽象搞笑的测试题，根据回答生成一个离谱的人格类型和解读。触发词：SBTI、人格测试、性格测试、测一测、做个测试。当用户提到 SBTI、想做人格测试、或有人分享了 SBTI 结果时触发。 | |
| voice2feishu 文字转语音并发送到飞书。支持两种模式：API 模式（智谱/OpenAI 等）和本地模式（ChatTTS）。 | |
| WeChat GZH 微信公众号管理 skill。支持获取 Access Token、永久素材管理、发布能力（发布草稿、查询发布状态、获取已发布列表、删除发布文章）。触发词：微信公众号、wechat gzh、发布图文、素材管理。 | |
| 小红书长文发布 小红书长文发布。用于在网页版小红书创作服务平台发布长文笔记。当用户说"发小红书"、"发小红书长文"、"写一篇小红书"时使用此技能。 | |
| Daily Devotion Creates personalized daily devotions with verse of the day, pastoral message, structured prayer, and time-aware greetings | |
| Intelligent Budget Tracker Intelligent budget tracking and financial management library for AI agents - expense tracking, income management, budgets, savings goals, and LLM-powered insights | |
| Kenya Tax Rates Calculate Kenya payroll deductions - PAYE, SHIF, NSSF, Housing Levy with accurate 2024/2025 rates | |
| Learnings Skill Continuous learning from failures, corrections, and patterns. Logs mistakes to prevent repetition. Own MeiliSearch index. Learns version rules, approach pref... | |
| Meili Memory Skill Local full-text search for OpenClaw memory recall using MeiliSearch. Self-hosted. | |
| Personality Adapt Learns and adapts to the user's personality over time. Observes communication style, values, decision-making patterns, and preferences — then adapts behavior... | |
| LiveAvatar Talk face-to-face with your OpenClaw agent using a real-time video avatar powered by LiveAvatar |
29,001–29,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.