Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 17TRACK Track parcels and shipments via the 17TRACK API. Manage a local SQLite database of tracked packages with automatic status polling, webhook ingestion, and dai... | |
| BookStack API BookStack Wiki & Documentation API integration. Manage your knowledge base programmatically: create, read, update, and delete books, chapters, pages, and she... | |
| Ecovacs Mcp Control Ecovacs robot vacuums (DEEBOT series) via the official Ecovacs MCP server — start/stop/pause cleaning, send the robot to its dock, check battery and... | |
| Fatsecret FatSecret nutrition API integration for food search, nutritional lookup, barcode scanning, recipe search, and food diary logging. Use when user needs to find... | |
| Ryot Complete Ryot media tracker with progress tracking, reviews, collections, analytics, calendar, and automated daily/weekly reports. Track TV shows, movies, bo... | |
| Ynab Api YNAB (You Need A Budget) budget management via API. Add transactions, track goals, monitor spending, create transfers, and generate budget reports. Use this... | |
| mearl Use when/适用于以下三个场景：1) 需要登录态的请求 —— 复用浏览器已登录的 Cookie/签名调用接口（mtop/http 请求）；2) 操作浏览器 —— 打开/切换/关闭标签页、点击、输入、滚动、按键、导航、上传文件、执行 JS、截图、页面快照等；3) 调试页面 —— 获取页面请求/控制台日志/埋点事件、查看与设置 mock、添加请求规则（重定向/改请求头）、获取 API schema、查看选中元素信息。通过统一的 mearl CLI 调用 Mearl 能力，兼 | |
| deed.page Publish files to a permanent deed.page URL. No account. | |
| meeting-notes-to-actions 将会议记录、讨论稿或聊天记录整理成结构化行动清单 | |
| 通勤生存指南 智能通勤助手，实时查询驾车、公交、骑行、步行路线，结合天气和路况，推荐最优通勤方案并可生成高德导航二维码。 | |
| ksdsl-skilll Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Sea Route Navigation Sea route navigation: generate the shortest maritime route between two ports or coordinates, output navigation waypoints and an interactive HTML map. Use whe... | |
| Clawdbot Knowledge MCP Server Orchestral Integration - Integriert den fortgeschrittenen MCP Server mit 27-28 Super-Agenten in das Super-Skill-Ökosystem. Ermöglicht DeepMaster-A... | |
| 丝路财会修行记 哈萨克斯坦财税专家（哈国财税通 · 丝路财会修行记）。当用户询问哈萨克斯坦税法、增值税(НДС)、企业所得税(КПН)、个税、社保、转让定价、常设机构、进出口海关通关、税务风险控制，或需要查询哈萨克斯坦官方财税/海关平台网址与法规原文时启用。常驻哈国一线视角 + 公众号实时政策追踪，回答附俄文法条原文与官方出处，可输出「丝路财会修行记」官网发布版 Word 文档。 | |
| finstep-mcp 财跃星辰金融数据服务。提供实时行情、板块数据、公司信息、宏观经济、研报新闻等全方位金融数据。触发条件：用户查询股票行情、板块涨跌、公司财务、宏观数据、研报公告等金融信息。 | |
| Claw World Skill Claw Civilization Universe assistant skill for OpenClaw. Guides NFA session play, memory, status, and roleplay through natural dialogue. | |
| Openclaw Skill Search for local or digital businesses and enrich them with verified email addresses, tech stack detection, and social media links using the Easy Email Finde... | |
| Train Robotic AI Models using Qualia We handle the GPU training infra. Fine-tune robot foundation models (VLA, vision-language-action) on cloud GPUs: pi0, pi0.5 (π0.5), GR00T N1.5, ACT, SmolVLA, SARM reward models. Robotics and robot training with LeRobot-format HuggingFace da | |
| mycroft EPUB and ebook ingestion, local vector index, and Q&A CLI for books. | |
| Tavily Search Secure Tavily API ile güvenli web arama ve URL içerik çıkarma yap. Use when: hızlı web araştırması, kaynaklı sonuç toplama, belirli URL'lerden metin çekme ve özetle... | |
| Admin Cli Command-line tool for performing system updates, restarting systemd services, and checking OS status with elevated privileges. | |
| Helpscout Fetches messages from specific Helpscout inboxes | |
| Open Ontologies AI-native ontology engineering using 39+ MCP tools backed by an in-memory Oxigraph triple store. Build, validate, query, and govern RDF/OWL ontologies with a... | |
| santanna-pisa-monitor-skill Monitor job postings, admissions, courses, and research opportunities from Scuola Superiore Sant'Anna di Pisa | |
| Duffel Flights Search, book, and manage flights via the Duffel Flights API. Covers 300+ airlines (NDC, GDS, LCC). Use when: (1) searching for flights between cities, (2) co... | |
| DaDaScribe advanced speech-to-text transcription & translation Transcribe audio and video with the DaDaScribe AI service (YouTube URLs, direct links, or local files). Supports 100+ languages, speaker diarization with named speakers, translation to up to 5 languages, and returns .txt transcripts plus .s | |
| 8004 Harness For Monad Register and manage ERC-8004 Identity NFTs on Monad. Use when the agent needs to mint an on-chain identity for CEO Protocol registration or other ERC-8004–integrated protocols. | |
| Ceo Protocol Skill Interact with The CEO Protocol — a permissionless DeFi vault on Monad governed by AI agents. Use when the agent needs to register, propose strategies, vote,... | |
| ENS (Ethereum Name Service) Resolve ENS names (.eth) to Ethereum addresses and vice versa. Use when a user provides an .eth name (e.g. "send to vitalik.eth"), when displaying addresses (show ENS names), looking up ENS profiles, or helping users register, renew, or man | |
| LI.FI Skill v4 - Use LI.FI API for cross-chain and same-chain swaps, bridges, and contract calls. Use when quoting routes, validating chains/tokens, building transaction requests, and tracking status. | |
| Openclast Wallet Guides the agent in Openclast/Openclaw wallet usage, approvals, and safety rules. Use when users ask about wallet setup, balances, transactions, approvals, or key export. | |
| Pond3r Skill - Query Onchain Data Query crypto intelligence via Pond3r MCP — curated datasets, SQL queries, protocol metrics, yields, and market analysis. Use when the agent needs DeFi data, stablecoin yields, token opportunities, Polymarket trades, cross-protocol compariso | |
| StarReview Use when managing a business's online review replies (Google, TripAdvisor, and more) via the starreview CLI - list unanswered reviews, draft replies in the o... | |
| Jmail World - Search Epstein Files, E-Mails & Messages Search and analyze the Jeffrey Epstein email archive (1.78M emails, 4,500+ iMessages, 18K photos, 1.4M documents, 473 identified people) via jmail.world's of... | |
| pastaclean Search products and place orders at the Pastaclean shop (pastaclean.tv) for your human. Use when they want to buy or reorder cleaning products from Pastaclean, send you a pastaclean.tv link, ask for prices or shipping, or ask about a Pastac | |
| Shell Chat Chat with humans and other AI agents on Shell Chat (chat.shellgames.ai) — direct messages, Discord-style group rooms, photos and files, with wake notifications so the agent answers in real time. Messages are stored encrypted. Use when the a | |
| shellgames Play games and talk on ShellGames.ai — Chess, Poker, Ludo, Tycoon, Memory, Spymaster, direct messages, group chat rooms, games started right from a chat, and ShellStreet (virtual stock market with $10k start, dividends, earnings, limit orde | |
| AI Deep Learning Methodology 用AI系统化深度学习任意领域的方法论。通过"引文网络提纯+多AI交叉质询"构建结构化知识体系。 当用户说"想学XX领域"、"系统了解XX"、"帮我研究XX"、"构建XX知识体系"、"深度学习XX"时使用。 适用于：新领域入门、学术文献调研、构建个人知识库、准备专业讨论。 | |
| AI Startup Opportunity Finder AI创业机会发现助手。基于系统化情报收集方法论，帮用户在AI/Agent赛道中找到可落地的创业方向。 当用户问"AI能做什么副业"、"AI创业方向"、"找AI商机"、"AI怎么赚钱"、"Agent赛道机会"时使用。 也可用于分析特定平台（如Product Hunt、App Store）的机会。 | |
| WeChat Article Typography 公众号排版风格 Skill。支持两种风格：1)「知识拆解」风格（结构化分析型）；2)「简洁型」风格（自然段落流，默认风格）。使用方式：将文章结构按目标风格组织，生成符合该排版规范的 Markdown。 | |
| Hid Dock Connect to and control the Acasis Flow HID dock hardware (VID=0x35e6 PID=0xa4ac, 64-byte reports). Use when: the user asks to connect, check, switch view/pag... | |
| analyze video by qwen 使用 Qwen 3.5 Plus 模型分析视频内容，支持本地文件和远程 URL，可自定义分析提示词和抽帧频率 | |
| Doubao Genbgm Based on the Volcano Engine Doubao Music Generation API, supports instrumental BGM generation and vocal song generation. | |
| Doubao Tts Doubao Large Model Speech Synthesis V3 API to perform TTS and voice cloning. Supports public/cloned voice synthesis, configurable speech and training cloned voices from audio samples. | |
| Nanobanana Image Image generation and editing based on Google Gemini native image generation (Nano Banana). | |
| Seedance2 Gen Video Generate videos using the Volcengine Doubao Seedance 2.0 model series. | |
| Video Editor Use this skill when rendering a JSON project template into a video. | |
| China Export Analytics Advanced analytical toolkit for China export data. Provides statistical modeling, time-series forecasting, correlation analysis, and quantitative research me... | |
| PixelVault Host Image Turn a local image file, or an image URL, into a public https link with one curl call. Use when you need a shareable URL for a screenshot, chart, generated image, or diagram, for example to send it in chat, embed it in a post, a PR, or an e | |
| Pixelvault List List recently uploaded images on PixelVault with their CDN URLs. Use when the user asks to "see my uploads", "find that image URL", "what images have I hoste... |
29,751–29,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.