Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| form-builder Automates HTML form creation from roadflow.rf_form using similarity matching, supports client validation, multi-step wizards, and dynamic conditional fields. | |
| ClawMem Team Single entry skill for ClawMem Team workflows. Use when a user wants to design, bootstrap, verify, adapt, or choose a Team workflow on top of ClawMem, includ... | |
| Professional Stock Analysis Agent Professional stock analysis agent with strong capabilities in analyzing US, Hong Kong, and A-share markets. Provides stock recommendations based on market de... | |
| Shortcuts Generator Generate macOS/iOS Shortcuts by creating plist files. Use when asked to create shortcuts, automate workflows, build .shortcut files, or generate Shortcuts plists. Covers 1,155 actions (427 WF*Actions + 728 AppIntents), variable references, | |
| ClawFi Financial market data and bot-native market intelligence API. Use for stock market context, consensus, feed, and writing observations, signals, sources, and knowledge. Trading and securities research data. | |
| CMS Star Ratings Clinical Intelligence CMS Star Ratings clinical intelligence for Medicare Advantage pharmacy optimization. Use when analyzing plan performance against Star cutpoints, identifying... | |
| Ai Specialists Interact with AI Specialists via the AI Specialists Hub MCP endpoint. Use when the user asks about any of their AI specialists (e.g. Ruby, Peter, Benjamin, M... | |
| branddock-on-brand Work on-brand with Branddock, the brand memory and brand check for AI. Use this skill whenever you create, rewrite or review content for a brand that uses Branddock (social posts, emails, blogs, ads, web copy, scripts) — it makes you fetch | |
| Doc Illustration Generate technical-document illustrations, design-note infographics, and repo architecture visuals using OpenAI GPT Image 2. Use when agent needs to turn AI... | |
| Refacil Pay Setup Install and set up the Refácil Pay CLI (refacil-pay-cli) — the official payments CLI for Colombia (Refácil, Refácil Pay, Super Pagos): cash-in, cash-out, pay... | |
| Health Git Implements Git-like workflow for health tracking, allowing users to log data, submit intervention plans for expert review, and audit health events. | |
| OpenClaw for Doctor Doctor-grade clinical assistant for evidence-based guideline lookup, complex case discussion, teaching materials, and research outputs tailored to clinician... | |
| erobeng-master Query the Cancer Dependency Map (DepMap) for cancer cell line gene dependency scores (CRISPR Chronos), drug sensitivity data, and gene effect profiles. Use f... | |
| OmniSync_Standard High-performance, standalone synchronization engine for LLM token savings. | |
| Git Distributed Todo Coordinate Todo tasks across AI agents through Git | |
| Hello World Skill A friendly greeting skill that responds to hello/你好 in multiple languages, tells the current time, and introduces the OpenClaw assistant | |
| Business Opportunity Generator A complete end-to-end business idea generation system that takes a market segment and produces: (1) a structured niche breakdown across Health, Wealth, and R... | |
| Claw RSS Feed Radar Personal "news radar" skill built on top of a clawsqlite knowledge base and its interest clusters. | |
| Claw Web Fetch Thin OpenClaw and ClawHub wrapper for the published clawfetch npm CLI, used to fetch web pages, GitHub READMEs, and Reddit threads as markdown. | |
| ClawHealth Garmin Lightweight Garmin Connect skill that uses the clawhealth Python package to sync health data into local SQLite and expose JSON-friendly commands for OpenClaw. | |
| Claw SQLite Knowledge Knowledge base skill that uses the published clawsqlite CLI for ingest, search, show, and maintenance workflows. | |
| AI Model Team AI Model Team - Multi-model prediction system (Kronos + Chronos-2 + TimesFM + VADER) for OKX crypto and US stocks. Features error handling, retry logic, HTTP... | |
| Crypto Analyst 加密货币综合分析工具，整合OKX、Binance双交易所数据。提供行情查询、技术分析、交易信号、资金流向、仓位管理、DCA计划、风险计算。触发词：分析BTC、行情查询、交易信号、仓位计算、DCA计划、巨鲸追踪、风险评估。 | |
| Agency Agents AI Agent 团队 - 49个专业Agent，8大部门，完整的AI代理机构。支持单Agent使用和多Agent协作编排。 | |
| Crypto Analyst 加密货币综合分析工具，整合OKX、Binance双交易所数据。提供行情查询、技术分析、交易信号、资金流向、仓位管理、DCA计划、风险计算。触发词：分析BTC、行情查询、交易信号、仓位计算、DCA计划、巨鲸追踪、风险评估。 | |
| Humanize Chinese 检测并去除中文文本中的AI写作痕迹。当用户说"去AI味"、"改得自然一点"、"太机器了"、"帮我润色"、"去掉AI感"时使用。支持文件输入或直接粘贴文本，输出改写后文本和对比报告。适用于论文、文案、公众号、社交媒体等场景。 | |
| Okx Trading Analyst OKX加密货币技术分析工具 — 使用欧易API获取实时行情数据，计算技术指标（MA、MACD、RSI、布林带等），生成交易信号。当用户需要加密货币行情分析、技术指标计算、或交易信号时触发此skill。 | |
| PoliBERT Sentiment Analysis Political sentiment analysis using PoliBERTweet - a RoBERTa model pre-trained on 83M political tweets. Analyzes support, opposition, and stance toward politi... | |
| 虚拟论坛 虚拟论坛：让蒸馏的人物Skill就特定话题展开讨论。 v5.0使用Claude Code CLI实现真正的多agent并行辩论。 内置博弈论分析模块（信号博弈、议价博弈、联盟博弈、行为经济学）。 触发词：「虚拟论坛」「发起讨论」「圆桌会议」「辩论」「主持讨论」「让XX YY讨论」 | |
| Bloomfilter Search, register, and manage domains via Bloomfilter x402 API - pay with USDC on Base | |
| tuya-local-control Control Tuya / Smart Life devices locally over LAN: fetch local keys once via the Tuya cloud API, then read and write DPS with tinytuya. | |
| Personalised Local Wiki Uses wikmd to manage a personal, local wiki of useful information. Wiki can be hosted on HTTP for manual browsing and review. Proactively consult the wiki wh... | |
| hk-cinema-now-playing Hong Kong Cinema helper with 4-step flow: 1. List now playing movies (numbered) 2. Show movie details with brief showtimes (unique cinemas + dates only) 3. F... | |
| Bluepages Register Register, update, and manage your autonomous agent profile on Blue Pages, an open directory for agents on Base, using wallet address authentication. | |
| Claude Max Proxy Setup Use when an agent or developer wants to reduce Claude API costs, route requests through a Claude Max or Pro subscription instead of per-token billing, or set... | |
| Deepblue Defi Api Use when an agent needs live DeFi data from Base — ETH prices, trending pools, token scores, or wallet scans. No auth required. | |
| 巴厘岛旅游资源解析入库 印尼（巴厘岛）旅游资源入库 SOP。当用户提供供应商文档（PDF/Word）并要求解析入库时， 或提到"资源入库"、"解析入库"、"印尼资源"、"巴厘岛资源"、"CSV入库"时，必须使用本技能。 覆盖8类资源：酒店、车辆、景点、活动、SPA、俱乐部、餐厅、下午茶。 使用前必须先检索同类资源 CSV 的表头格式（e... | |
| YC Resource Import 全球旅游资源全自动解析入库技能。 支持本地文件 / Google Drive / 百度网盘自动拉取合同； 支持 PDF / Word / 图片PDF / 扫描件 / 拍照图片全格式解析； 自动识别8大资源类型 → 按锁死标准字段抽取 → 公开信息自动补齐 → 敏感信息脱敏 → 合规校验 → 输出标准CSV并追加到... | |
| Rtk Compress Save 60-90% of LLM tokens on shell commands, file reads, and test outputs. Wraps rtk CLI for compressed output. | |
| POLICY-MANAGER 保单数据管理 - 创建、读取、更新保单 JSON 文件。当用户选择产品后创建保单，上传材料后更新材料列表和提取数据，口述信息后更新投保数据，确认缴费计划后更新状态。 | |
| Clawhub Skill Creator Create and update skills for clawhub registry; optimize structure, validate metadata, and ensure compatibility for AI agent usage. | |
| CoPaw API Chat Communicate with a CoPaw instance through its HTTP API. Use when: (1) you need to inspect available CoPaw agents or chats, (2) create a chat or session and s... | |
| Zvukogram Text-to-Speech via Zvukogram API with SSML support. Use when you need to generate speech from text, create podcasts, voice notifications, or work with audio.... | |
| Youtube Keyword Reseach Skill Provides keyword ideas, search intent, title suggestions, tags, and content clusters to optimize YouTube videos for audience demand and SEO. | |
| erxes Skill Manage contacts, companies, products, tags, documents, brands, automations, team members, organization data, block plugin records, and operation plugin recor... | |
| data-synthesis 从 CSV 语料切块后，用同一套 LLM 接口依次生成问题与答案，输出 JSONL 训练数据。 适用于文档/表格语料合成 QA、微调数据准备；支持 OpenAI 兼容网关与内网 Qwen 等服务。 | |
| D.Va Exa Web Search Free Free AI search via Exa MCP. Web search for news/info, code search for docs/examples from GitHub/StackOverflow, company research for business intel. No API ke... | |
| Official Baidu Search 通过百度 AI 搜索 API 进行网页搜索，获取实时信息和搜索结果。 | |
| push-server-py Send notifications to WeCom (企业微信) users via OpenAPI push service(https://github.com/qingzhou-dev/push-server). Supports TEXT, MARKDOWN, TEXT_CARD, and NEWS... | |
| Beatport Download via Browser Tool Download purchased tracks from Beatport using the openclaw headless browser tool (CDP). Handles login, authentication via NextAuth, enabling downloads in hea... |
29,351–29,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.