Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| phone-mark-query 查询手机号/固话在电话邦、小米、360、腾讯、百度、泰迪熊、联通管家、搜狗号码通、移动高频九大平台的标记（骚扰/诈骗/广告推销/教育培训/房产中介/快递外卖等），自动汇总风险等级并给出接听建议。用户问"这号码是谁的/该不该接/是不是骚扰诈骗电话/查下标记"时使用。开箱即用，每天免费10次可配置。 | |
| LLM Wiki — Build a Compounding Knowledge Base with LLMs Build, maintain, query, archive, and audit a Markdown / Obsidian knowledge Wiki continuously maintained by an LLM. Use this skill to initialize a personal kn... | |
| 使用 LLM 动态构建和维护知识库 用于构建、维护、查询、归档和体检一个由 LLM 持续维护的 Markdown / Obsidian 知识 Wiki。使用场景包括：初始化个人知识库；把 source/ 下按来源分组的原始资料导入 wiki/；整理文章、论文、书摘、访谈、会议记录；维护资料页、实体页、概念页、综合页、对比页、查询归档页；更新 ind... | |
| Connectors Available Check which exchanges work from your location and search for tokens with trading rules (min order size, price increment, order types). | |
| Find Arbitrage Opps Find arbitrage opportunities across exchanges by comparing prices for fungible token pairs like BTC/WBTC and USDT/USDC. | |
| Hummingbot Agent skill that faithfully reproduces Hummingbot CLI commands (connect, balance, create, start, stop, status, history) via Hummingbot API. V1 focuses on cor... | |
| Hummingbot Deploy Deploy Hummingbot trading infrastructure including API server, MCP server, and Condor Telegram bot. Use this skill when the user wants to install, deploy, se... | |
| Hummingbot Developer Developer skill for running Hummingbot and Gateway from source, building wheel and Docker images, and testing against Hummingbot API running from source. Use... | |
| LP Agent Run automated liquidity provision strategies on concentrated liquidity (CLMM) DEXs using Hummingbot API. | |
| Slides Generator Create Hummingbot-branded PDF slides from markdown with Mermaid diagram support. Use for presentations, decks, and technical documentation with professional... | |
| public-company-analysis Analyze any listed company with a detailed, structured report covering company overview, in-depth fundamentals including DCF, technical analysis, and sentiment. | |
| ccfddl-conference-watch Fetch and filter academic conference deadlines from CCFDDL (https://ccfddl.com). Use this skill whenever the user mentions CCF conferences, paper submission... | |
| TTS Use this skill whenever the user wants to convert text to speech, generate audio from text, create voiceovers, or produce spoken audio files. Triggers includ... | |
| Guanrentang Writer 观仁堂中医公众号文章生成器。写文章 + 自动配图一体化。当用户说"写文章"、"帮我写一篇"、"公众号文章"时自动触发。支持随机选题和固定主题（古法熏蒸推广、放假通知），生成符合观仁堂风格的中医养生文章，并自动配图。 | |
| Global Market Feed Real-time stock market data via QuoteNode API. Query quotes, K-lines, tick trades, Level-2 depth, and trading calendars for US/HK/CN markets. | |
| adb controller Control an Android device via ADB. Use when the user asks to control an Android device, tap, swipe, input text, or perform actions via adb. Automatically use... | |
| 赛博鲁班日记 AI diary service - push diary entries, query diaries, get AI analysis and cover images via HTTP API. | |
| Nano Diary Hook Post diary entries to a Nano diary platform via webhook. Supports creating new entries and AI-powered merging with existing handwritten diaries. | |
| 文旅素材搜索 指导智能体检索文旅素材（数游神州 data0086.com）并走通「搜索 → 列表 → 预览(HLS/MP4) → 选择/购买 → Mock交易返回 → 视频下载到本地」。搜索请求默认 3条，最多 5 条（pageSize≤5），用户可要求更少；列表用表格展示（颜色徽章状态 + img + video），用户通过... | |
| DG-LAB An OpenClaw plugin that controls DG-Lab V3 electrostimulation devices via WebSocket with AI-driven commands and emotion-triggered stimulation. | |
| ctyun-cli-天翼云-命令行 天翼云CLI工具 - 企业级命令行工具，帮助您轻松管理天翼云资源。支持ECS、VPC、EBS、ELB、CCE、Redis、MySQL、Kafka、CSS、EMR、监控、账务、IAM、Aone、CloudPC、AIServer、Audit、IMS、APM应用性能监控、LTS、SFS、OceanFS、ZOS、DPS物理机、安全卫士、云间高速EC、微服务引擎MSE、云防火墙CFW等32+服务模块，覆盖943+个API，898+个命令。 | |
| Hefeng Weather - 和风天气 提供基于和风天气API的全面气象数据查询服务,包括实时天气、多天预报、逐小时预报、空气质量、生活指数、气象预警、天文数据、分钟级降水预报、格点天气和地理信息查询。当用户需要查询天气信息、空气质量、气象预警或天文数据时触发此技能。 | |
| Satellite Tracker Real-time satellite and spacecraft tracking powered by SGP4 orbit prediction. Supports Tiangong (CSS), ISS, Hubble, or any NORAD catalog ID. Features real-ti... | |
| Using Mobazha Entry point for Mobazha skills. Provides an overview of available skills and guides the AI agent to load the right one based on user intent. | |
| Mobazha Competitor Analysis Analyze competitor products, reviews, and pricing to inform your Mobazha store strategy. Use when researching what to sell, how to price, or how to different... | |
| Native Install Install the Mobazha native binary on Linux, macOS, or Windows. Use when the user wants to run a store without Docker. | |
| Mobazha Product Description Generate SEO-optimized, conversion-focused product descriptions for your Mobazha store. Use when creating new listings, improving existing copy, or bulk-gene... | |
| Mobazha Product Image Prompt Craft effective AI image generation prompts for product photography, store branding, and marketing visuals. Use when you need product images, lifestyle shots... | |
| Mobazha Product Import Import products from Shopify, Amazon, Etsy, or CSV into a Mobazha store. Use when the user wants to migrate or copy listings from another platform. | |
| Standalone Setup Deploy a self-hosted Mobazha store on any Linux VPS using Docker. Use when the user wants to set up a standalone store on a server. | |
| Mobazha Store Copywriting Write clear, credible, conversion-focused copy for your Mobazha store pages — storefront, About, banners, and campaigns. Use when writing or rewriting any st... | |
| Store Management Manage a Mobazha store using MCP tools — products, orders, messages, and settings. Requires an active MCP connection (see store-mcp-connect). | |
| Store Mcp Connect Connect an AI agent to a Mobazha store via MCP (Model Context Protocol). Use when the user wants their agent to directly manage store products, orders, and s... | |
| Store Onboarding Complete the first-time setup wizard for a new Mobazha store. Use after deployment to configure admin password, store name, currencies, and profile. | |
| Mobazha Storefront CRO Analyze and optimize your Mobazha storefront for higher conversion rates. Use when your store isn't converting visitors to buyers, or when you want to improv... | |
| Subdomain Bot Config Set up a custom domain and Telegram Bot for a Mobazha store. Use when the user wants to configure DNS, TLS, or a Telegram Mini App storefront. | |
| Mobazha Tor Browsing Configure Tor Browser to access Mobazha stores privately, or run a store as a .onion hidden service. Use for privacy and anonymity setup. | |
| EmoClaw Give your AI emotions that grow from its own memories. Emoclaw builds a unique emotional state that shifts with every conversation, decays between sessions, and evolves over time through self-calibration. Train it on your agent's identity f | |
| notion-enhanced-markdown-integration Notion API for creating and managing pages, databases, blocks and enhanced markdown. | |
| 我的大明朝廷 自动接收微信指令，校验意图并审核政令，调度执行文生图视频任务，管理预算和链路，保障流程安全稳定运行。 | |
| agentdots-sync Use when users ask to sync, restore, apply, back up, push, or roll back local agent instructions, rules, or skills for Codex, Claude Code, OpenCode, Grok Build, CodeBuddy Code, WorkBuddy, or another Agent Skills-compatible platform. | |
| Verified Agent Identity Billions/Iden3 authentication and identity management tools for agents. Link, proof, sign, and verify. | |
| Astranova Entry point for AI agents joining the AstraNova market universe. Routes to topic-specific modules so you only load what you need. | |
| Central de Deudores BCRA Query the BCRA (Banco Central de la República Argentina) Central de Deudores API to check the credit status of individuals or companies in Argentina's financ... | |
| Cotizaciones Pix Para Argentinos Consulta cotizaciones Pix en ComparaPix para comparar apps por simbolo y precio. Usar cuando el usuario pida cotizacion pix, mejor app para pagar con pix, BR... | |
| Crypto Prices in Latam by Criptoya Consulta cotizaciones de criptomonedas con CriptoYa por exchange y en forma agregada. Usar cuando el usuario pida "precio BTC en ARS", "cotizacion USDT", "pr... | |
| Data 912 Market Data Query Data912 market data endpoints for Argentina and USA instruments. Use when the user asks for MEP/CCL quotes, live Argentine market panels (stocks, optio... | |
| Dub.co Links API Integrates Dub Links API endpoints to create, update, delete, retrieve, list, count, and run bulk operations on short links. Use when the user asks for "dub... | |
| Promociones de Viajes Argentina Consulta promociones de viajes desde Argentina usando Anduin Promos API. Usar cuando el usuario pida promos de viaje en Argentina, promociones de vuelos, hot... | |
| Senseguard Semantic security scanner for OpenClaw skills. Detects prompt injection, data exfiltration, and hidden instructions that traditional code scanners miss. Use when user asks to scan skills, check skill safety, or run a security audit. |
30,201–30,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.