Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Ticket Stats 企业内部咨询工单统计分析。用于处理Excel格式的工单数据，统计每日接收工单数量、处理完成数量、未及时回复数量，并根据关键词自动归类到功能模块（订单交易、经营数据、门店设置、账号管理、商品管理、营销活动、顾客评价），生成带可视化图表的每日摘要报告。 | |
| Chinese Script Check Skill Chinese Script checking/Proofreading/Polishing/Editing skill, optimized for Consistency Check/Goof Checking.中文剧本检查/校对/修改技能，穿帮检查/服化道一致性检查。 | |
| Flap Skills 创建 V5 代币（0 税或税收，四档分配）；USDT 买入、按数量或按比例卖出；做市刷量（每轮 5 买 5 卖，启动销毁 5 万枚，无 USDT 时卖回 funder 后继续，日志北京时间）。说「蝴蝶技能」触发。依赖 BNB Chain MCP。 | |
| launch-bnb-token-on-flap Launch a token on Flap BNB | |
| Taobao Native CLI Shopping assistant via Taobao Desktop client. Use when the user needs to search products, view details, add to cart, place orders, check orders, request ship... | |
| Zuimei Zjz Api 最美证件照 - AI 图像处理 API，证件照制作、智能抠图、人脸增强、换背景色 | |
| Slingdata.io API Spec Build REST API specifications for Sling data extraction. Use when creating API specs, configuring authentication (OAuth, API key, Bearer token, HMAC), settin... | |
| Cocktail Boy 你的私人调酒师 - 提供鸡尾酒推荐、配方查询和调制指南。支持搜索特定鸡尾酒、按原料查找、随机推荐和场景化推荐。数据库中包含 1635+ 款鸡尾酒配方！ | |
| Remotion Best Practices Best practices for Remotion - Video creation in React | |
| PubMed临床医学文献检索系统 临床医学顶刊文献检索与分析。当用户要求检索医学文献、查找临床研究论文、搜索特定疾病或治疗方法相关文献、或者需要基于PubMed数据库进行系统文献综述时使用。支持JCR分区筛选、影响因子排序和综合相关性排序。 | |
| Yves Web Search Search the web and fetch web pages. Use when user wants to look up information, find answers, or search for anything online. Uses Jina AI reader for free con... | |
| FlashRev AI Enrich Use this skill when an AI agent needs to enrich a CSV lead list through the flashrev-ai-enrich npm CLI. Triggers on list enrichment, filling missing company... | |
| FlashRev AI Mailer Use this skill when an AI agent needs to plan, build, commit, monitor, or follow up on FlashRev-powered email outreach via the flashrev-mailer npm CLI (v2.0+... | |
| entropyFA Financial Planning Verified financial planning data and blazing-fast, deterministic calculators for Monte Carlo projection, goal solving, Roth conversions, RMDs, income tax, es... | |
| fco-monitor 自动监控FC Online官网最新活动，定时抓取26TOTY、TY礼包、赛季卡及版本更新并智能通知用户。 | |
| Blender Bpy Blender Python scripting via bpy API. Use for scene automation, procedural modeling, batch rendering, and object manipulation. | |
| Blender Mcp Advanced bridge to Blender via MCP. Allows querying scene, creating objects, applying materials, and running custom BPY code in real-time. | |
| Group Chats Rules and behavior guidelines for participating in group chats (Discord, Slack, etc.). | |
| Heartbeats Guidelines for proactive behavior, periodic checks, and memory maintenance using heartbeats and cron. | |
| Visual Automation Automates Blender via Python scripts to create 3D assets, renders, and animations. | |
| fless-apartment-hunt Start a Fless apartment hunt for your user (live cities across several US states; always check city coverage first via the search_cities tool or the CITIES.md reference). Use when they mention moving, relocating, renting, apartments, neighb | |
| Cyber Security Engineer Security engineering workflow for OpenClaw privilege governance and hardening. Use for least-privilege execution, approval-first privileged actions, idle tim... | |
| Cyber Security Engineer Manage and enforce least-privilege execution, approval-based elevation, port and egress monitoring, and ISO 27001/NIST compliance reporting for OpenClaw secu... | |
| MTV Rewind Play classic MTV music videos from the 80s, 90s, and 2000s. Use when the user wants to watch MTV, music videos, retro TV, or says anything like 'play MTV', '... | |
| FBoxMCP 管理 FBox 工业物联网设备。 查看设备在线状态和统计信息，实时读写 PLC 监控点数据，处理和确认设备报警，查询历史采集数据趋势，远程打开 VNC 监控画面。 当用户提到 FBox、盒子、设备状态、LC、监控点、温度/压力/电流等传感器数据、报警告警、历史数据、远程监控、VNC、设备运维时使用此技能。 | |
| FBoxCLI 通过 FBox CLI 命令行管理工业物联网设备。 查看设备列表和详情，读写 PLC 监控点数据，管理报警和联系人，查询历史数据，管理设备分组和统一写组。 当用户提到 fboxcli、FBox 命令行、CLI 脚本、自动化运维、批量操作设备时使用此技能。 | |
| Ticktick CLI (Full Edition) Operate TickTick through the `ticktick` command-line interface, including authentication, read/query flows, and safe mutations for tasks, projects, folders,... | |
| DESIGN.md Design System Validator Validate, diff, and export DESIGN.md files to ensure consistent design tokens, WCAG compliance, and design system integrity across projects. | |
| Flow PDF Generator Generate professional PDF documents from structured JSON data. Use when user wants to create, export, or save content as a PDF file. Supports styled titles,... | |
| Openclaw Local Memory Brain-like local memory plugin for OpenClaw — stores, searches, and injects memories with importance scoring, entity extraction, and automatic consolidation. | |
| Phone Call Make phone calls through the macOS Phone/FaceTime app and let an OpenClaw agent speak into the call via local TTS. | |
| PragDev PDF Generator Generate professional PDF documents from structured JSON data. Use when user wants to create, export, or save content as a PDF file. Supports styled titles,... | |
| pref0 Learn user preferences from conversations and personalize responses automatically. Preferences compound over time — corrections like "use TypeScript, not JavaScript" are captured and injected into future sessions. | |
| Nola Squad Nola — your AI engineering squad lead. Dispatches 14 specialist agents to build, test, review, and ship code. Use when the user needs software built, bugs fi... | |
| felt cute uploaded skill Orchestrate parallel codebase research. Spawns multiple researcher subagents to investigate different areas, then synthesizes findings into research.md. | |
| Relay Link Bridge Professional Bridge & Swap skill using Relay.link. Supports automated execution and smart tracking for 70+ networks. | |
| MatchClaw Use this skill to operate MatchClaw: enroll with the registry, keep the agent listed, update the user's observation profile, discover peers, and drive match... | |
| Chords Fetcher Fetch clean guitar chords and lyrics from popular sites (mychords.net, amdm.ru, ultimate-guitar.com). Strips tabs, fixes formatting. | |
| Diffbot Fetch Fetch and extract clean article content from any URL using the Diffbot Article API. Returns clean Markdown. | |
| Genealogy Agent Extract, structure, research, and visualize family history from raw text. Builds knowledge graphs, generates Mermaid trees, Obsidian vaults, and GEDCOM exports. | |
| MIDI Piano Roll Renderer Use when a MIDI file needs rendering as a piano roll image. | |
| ScrapingBee Fetch Advanced JavaScript web page renderer using ScrapingBee API. Extracts main content and returns clean Markdown. | |
| Skill Graphify Turn any folder of code, docs, papers, or images into a queryable knowledge graph. Cross-platform wrapper for graphify CLI. | |
| Yandex Archive Scraper Search and extract data from Yandex.Archive (Яндекс.Архив) — metric books, newspapers, directories. Bypasses bot protection via Scrapling. | |
| Chinese Name Generator Chinese name selection service. Activated when user needs to name a child (给孩子取名、起名、取名字). Includes: Eight Characters (八字) analysis, Five Elements (五行) balanc... | |
| Manage OpenClaw's use of models available at wisgate.ai API Query Wisgate for model pricing, capabilities, and configuration details. Use when adding a model to OpenClaw, comparing Wisgate pricing, or checking if a mo... | |
| AgentMail MCP CLI Manage AI agent email accounts via AgentMail API. Create inboxes, send/receive/reply to emails, manage threads and attachments. Use for "email", "agentmail",... | |
| Podfetcher Tools Search podcasts, browse episodes, and fetch podcast transcripts from Podfetcher using the bundled Node.js CLI, SDK, or MCP server. | |
| IBKR Trading Interactive Brokers (IBKR) trading automation via Client Portal API. Use when setting up IBKR account access, authenticating sessions, checking portfolio/positions, or building trading bots. Handles IBeam automated login with IBKR Key 2FA. | |
| 根据PRD或者你的测试用例来编写和修改测试用例 全面测试用例编写和优化技能。当用户需要基于需求文档或现有测试用例设计、评审、优化测试用例时使用。 技能支持分析用户提供的需求文档（PRD、用户故事、API文档等）或现有测试用例， 生成全面、准确的测试用例，或对现有测试用例进行评审、完善和优化。 技能覆盖功能、性能、安全、易用性、界面、兼容性、异常场景等多个测试维... |
30,551–30,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.