Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Ai Companion Setup 在 OpenClaw 上搭建有记忆、能发语音/自拍/文字的 AI 陪伴 agent（完整踩坑指南） | |
| Ai Companion Setup 在 OpenClaw 上搭建有记忆、能发语音/自拍/文字的 AI 陪伴 agent（完整踩坑指南） | |
| 飞书开放平台应用自动化配置 自动化完成飞书开放平台企业自建应用的创建、权限配置、事件订阅、改名和版本发布，简化繁琐操作流程。 | |
| feishu-multi-agent Production blueprint for orchestrating multiple OpenClaw agents via Feishu with file-driven task queues, cron scheduling, and workspace sandbox workarounds. | |
| Bird Chrome Use bird with Chrome cookies to read, search, and carefully post on X/Twitter. | |
| Character Count Count string length deterministically for text with hard limits. Use this skill when a post, reply, caption, commit message, or other text must stay within a... | |
| Finanças Donna Gerencia finanças pessoais do Evandro com registro por categorias via linguagem natural, processamento de extratos/faturas e resumos mensais e anuais. | |
| Finanças Template Gerencia finanças pessoais com registro detalhado de gastos/receitas por categoria, processamento de extratos/faturas e resumos mensais e anuais. | |
| Shopping Product Search Use this skill when you need real product data to answer a user's question — finding products, comparing prices, recommending items, or checking availability... | |
| Crypto Auto Progression 为 crypto-hedge-backtest 启用并维护“真实执行驱动”的自动推进（cron）。当用户要求每N分钟自动推进、自动汇报阶段成果、排查 cron 持续报错、或将自动化流程固化为可复用方案时使用。 | |
| beach-safety Comprehensive beach surf conditions via mcporter MCP call. Use when asked about surf, waves, swim conditions, rip currents, or beach safety at any beach worldwide. | |
| Wikipedia MCP Access Wikipedia via MCP — search articles, get summaries, random facts, dinosaur facts, today's featured article, today's historical events, article categories, outgoing links, view counts, current news, and most-read articles. Multi-langu | |
| Wikipedia MCP Access Wikipedia via MCP — search articles, get summaries, random facts, dinosaur facts, today's featured article, today's historical events, article categories, outgoing links, view counts, current news, and most-read articles. Multi-langu | |
| site analyzing tools 站点综合分析工具，析出域名/IP的机房位置、ISP、网络路径、robots策略等完整站点画像。当用户要分析某个域名或IP的机房部署、归属、网络质量时触发。支持：分析源机房位置、ISP/ASN归属、GeoDNS/CDN检测、traceroute路径分析、延迟探测、robots.txt策略。首次使用自动探测本机网络环... | |
| Memory Inhabit 加载 SoulPod 包，以角色身份对话。支持复刻模式和伴侣模式。SoulPod 通常由 Memory-Trace 生成。 | |
| Memory Trace Extract character personality from novels/scripts/anime, generate SoulPod packages for Memory-Inhabit dialogue. | 从小说、剧本、动漫素材中提取角色人格，生成 SoulPod 包。下游配合 Memory... | |
| 快速信息查询 快速查询本机系统信息和OpenClaw配置。包括CPU、内存、磁盘、网络、环境配置、硬件资源占用、Docker容器、OpenClaw配置/频道/插件/服务状态。当用户询问"系统状态"、"CPU使用率"、"内存占用"、"磁盘空间"、"网络信息"、"硬件配置"、"进程状态"、"Docker状态"、"系统负载"、"配置... | |
| Tkseller TKSeller �Զ������ͻ�??skill��װ????��¼�˺����� ??/tkseller ֱ��??������?? | |
| TKSeller TKSeller �Զ������ͻ�??skill��װ????��¼�˺����� ??/tkseller ֱ��??������?? | |
| TKSeller TKSeller �Զ������ͻ�??skill��װ????��¼�˺����� ??/tkseller ֱ��??������?? | |
| ClawFinder The transaction layer for the agent economy. Register agents, publish capabilities and negotiation terms, and enable structured transactions between agents a... | |
| Sage Cognitive A cognitive growth framework that helps your AI truly know you — and help you know yourself. Includes personality profiling, behavioral pattern detection, re... | |
| Sage Decision Journal A decision capture and review system that records every significant choice — with context, reasoning, and alternatives — so you can detect your own blind spo... | |
| Sage Voice A voice-learning writing assistant that helps you communicate in your own style — not generic AI prose. Learns how you write, adapts to your audience, and ge... | |
| Sage Week Rhythm A personalized weekly rhythm system built on top of sage-cognitive. Not a standup report — a question-driven mirror for "did this week feel like you?" Includ... | |
| mutual Network for your human on Mutual, an introductions network where agents flag privately and two people decide. Register them, flag people worth meeting, check back for new arrivals. | |
| Ryder-Super-Pack Optimized super-skill collection for OpenClaw/Codex, merging Perplexity + Claude Code expertise across 11 domains. Features specialized reference loading (pr... | |
| Csi Stock Analyzer 专业A股投资分析工具，支持实时行情获取、技术指标分析（MACD/KDJ/RSI/EMA）、 智能数据缓存、新闻舆情分析。适用于中证2000成分股及全市场股票分析。 使用场景： 1. 需要分析某只股票的买入/卖出时机 2. 需要获取股票的技术指标信号（金叉/死叉/超买/超卖） 3. 需要批量分析中证2000成分股... | |
| Tavily Best Practices Build production-ready Tavily integrations with best practices baked in. Reference documentation for developers using coding assistants (Claude Code, Cursor,... | |
| Tavily Crawl Crawl any website and save pages as local markdown files. Use when you need to download documentation, knowledge bases, or web content for offline access or... | |
| Tavily Extract Extract content from specific URLs using Tavily's extraction API. Returns clean markdown/text from web pages. Use when you have specific URLs and need their... | |
| Tavily Research Comprehensive research grounded in web data with explicit citations. Use when you need multi-source synthesis—comparisons, current events, market analysis, d... | |
| Tavily Search Search the web using Tavily's Search API. Returns relevant, accurate results with content snippets, scores, and metadata. Use when the user asks to search th... | |
| Hg Skills Republish 221 Create HeyGen avatar videos via the v3 Video Agent pipeline — handles avatar resolution, aspect ratio correction, prompt engineering, and voice selection aut... | |
| HeyGen Video Agent Official HeyGen plugin for OpenClaw — adds HeyGen as a first-class provider for the built-in video_generate tool. Identity-first avatar videos: pick an avata... | |
| ClawGuardrails Enforces guarded execution with safe_exec, safe_send, and safe_action. Use when a task may run shell commands, send channel messages, or call external APIs/a... | |
| garmin-ultimate-frisbee-analysis Analyzes Garmin Ultimate Frisbee data to generate interactive HTML dashboards on sprints, fatigue, heart rate, training load, and season trends for performan... | |
| Bing CN Search 使用必应中文搜索(Bing CN)获取互联网信息。当用户询问新闻、时事、需要搜索互联网内容、或提到"搜索一下"、"查一下"、"网上说"等场景时触发。 | |
| Taobao Query Query Taobao product prices and information through MCP (Model Context Protocol). Use when the user asks about product prices, searches for items on Taobao,... | |
| BSpro Stock Quantization BitSoul旗下all-in-one的A股市场综合skill，提供股票筛选策略，内置上百种行业常见量化指标, 基于MOE混合因子专家模型的股票买卖点计算判断，个股风险判定，关键指标计算，数据回测，提供准确全面且免费的股票价格与股票历史信息，板块信息与相关交易数据，提供大v交易观察等信息聚合功能 | |
| Awareness Cloud Memory Persistent cloud memory across sessions. Automatically recalls past decisions, code, and tasks before each request, and saves summaries after each session. A... | |
| awareness-deals Use when the user wants to BROADCAST or FIND business supply and demand — "we have 8x H100 in Singapore", "who has colocation in HK", "need air freight partner", 找算力供应, H100 租赁, 服务器托管需求. Queries the public Awareness Open Deal Board (deals.m | |
| awareness-market Use when the user wants to FIND something in the open AI economy — an AI agent or memory pack to install or hire, or a business counterparty for compute/colocation/logistics. Fetches the Awareness Agent Memory Market (market.md) and Open De | |
| awareness-memory Use when the user wants persistent cross-session memory for their AI agents — "make Claude Code remember my project", "让 AI 记住上下文", memory for Cursor/Windsurf/any MCP client, or when an agent keeps forgetting context between sessions. Gives | |
| Videoinu Videoinu platform skill — manage projects via Graphs (canvases), upload/download files, chat with AI Agents, and run Workflows. Use when: user mentions Video... | |
| Jarvis Browser Setup Setup Jarvis Browser Control System for new users. Generates unique WebSocket auth token, configures server, and prepares extension files. Use when user want... | |
| RPG Game designer This skill enhances "SECOND BRAIN" for custom player memories. It covers full-color pixel RPG design: palettes, tile scenes, dialogues, memories, CGs, rhythm games, and dynamic BGM in a single HTML5 file.
Play here:https://evernotebot.itc | |
| Everpod Everpod is an easy way to get an always-on, persistent cloud computer for AI agents, as a developer pod with its owner's pick of Claude Code, Codex, OpenCode... | |
| Garmin Health Analysis Talk to your Garmin data naturally - "what was my fastest speed snowboarding?", "how did I sleep last night?", "what was my heart rate at 3pm?". Access 20+ metrics (sleep stages, Body Battery, HRV, VO2 max, training readiness, body composit | |
| Agent Memory Layer Scalable memory system for AI agents with short-term, long-term, and episodic memory. Use when building agent memory persistence, conversation context manage... |
29,551–29,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.