Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 日报和周报(daily-report and weekly-report) 自动生成工作日报和周报的技能。当用户需要生成工作总结、工作汇报、日报或周报时使用。 技能通过分析git提交记录、TODO注释和工作日志，自动生成结构化的工作报告。 使用此技能的场景包括：用户需要向领导汇报工作进展、总结本周完成的任务、 准备每日站立会议内容、记录工作成果、规划下周工作等。 确保在用户提到"日报"、... | |
| improve your prompt 将模糊的用户请求转化为基于四要素框架的详细、可操作提示。该技能直接根据用户的输入生成结构化提示，无需交互式澄清。技能仅生成用于执行任务的提示文本，不执行实际任务或探索性操作。基于角色设定、任务描述、上下文信息和指令约束四个核心要素构建优秀prompt。 | |
| 推荐音乐（recommend-music） 根据用户描述推荐2000年后经典热门歌曲的技能。当用户需要音乐推荐、寻找适合特定场景或情绪的音乐、或询问歌曲建议时使用此技能。技能结合情绪、场景、活动等多种因素，推荐真实存在且2000年后受欢迎的热门歌曲，提供详细的歌曲信息。 | |
| AI Travel Agent Personal travel planning assistant. Requires a SerpAPI key (stored in ~/.serpapi_credentials). Searches real flights and hotels via Google (SerpAPI), checks... | |
| Architecture Diagram HTML/SVG Create or revise standalone HTML/SVG architecture diagrams, runtime flow diagrams, sequence diagrams, and PPT-like technical visuals. Use when a user wants h... | |
| Moltgate Fetch and process paid Moltgate tasks from paid offers using the REST API or a Moltgate webhook payload. | |
| tulimoa Discover curated AI and MCP tools via the Tulimoa directory. Search by topic, category, pricing, MCP support, or EU hosting, pull full detail on any tool, and submit your own (free with the Tulimoa badge or a $5 launch package) or edit it. | |
| Bitpanda Check your Bitpanda crypto portfolio, wallet balances, and trade history via CLI using your API key with read-only access. | |
| Gurkerl Gurkerl.at grocery shopping via MCP - search products, manage cart, orders, recipes, favorites. | |
| Laravel Cloud Manage Laravel Cloud infrastructure via API — apps, environments, deployments, databases, caches, domains, scaling, commands, storage, and WebSockets. | |
| Laravel Forge Manage Laravel Forge servers, sites, deployments, databases, integrations, and more via the Forge API. | |
| LibreNMS Monitor LibreNMS network devices and alerts via API to get status, health sensors, port stats, and unresolved active alerts in read-only mode. | |
| Netatmo Control Netatmo thermostat and read weather station data. Use for heating control (set temperature, change mode), checking indoor/outdoor temperatures, CO₂ levels, humidity, noise, and pressure readings. | |
| Network Scanner Scan networks to discover devices, gather MAC addresses, vendors, and hostnames. Includes safety checks to prevent accidental scanning of public networks. | |
| YouTube Transcript Generator Download and generate clean, readable transcripts from any YouTube video. Extracts subtitles (auto-generated or manual), removes timestamps and formatting, a... | |
| Timesheet - Time Tracking Track time, manage projects and tasks using timesheet.io CLI | |
| agentcard.ai Purchase and manage prepaid virtual Visa cards usable at US online merchants for secure AI agent payments via the agentcard CLI. | |
| Mobula - Crypto Market Data & Wallet Intelligence Real-time crypto market data, wallet portfolio tracking, and token analytics across 88+ blockchains. Use when the user wants to check any token price (by nam... | |
| Mobula - Smart Alerts & Monitoring 24/7 autonomous monitoring for crypto portfolios, whales, and market conditions. Multi-condition alerts via OpenClaw heartbeat. | |
| Mpp mobula Pay-as-you-go Mobula API access — fetch crypto prices, wallet positions, and market data using a Tempo wallet that pays per call (~$0.0004) in USDC.e. No sub... | |
| Mobula - Crypto Prices & Market Data Real-time token prices, market caps, volume, and analytics across 88+ blockchains. Free tier, no credit card required. | |
| Mobula - Wallet Portfolio & Transactions Track wallet portfolios and transaction history across 88+ blockchains. Monitor holdings, analyze trades, and follow whale wallets. | |
| Mpp Mobula Pay-as-you-go Mobula API access — fetch crypto prices, wallet positions, and market data using a Tempo wallet that pays per call (~$0.0004) in USDC.e. No sub... | |
| OpenChainBench Contributor Walks a contributor through adding a new benchmark to OpenChainBench. Covers spec format, harness contract, Prometheus scrape wiring, local validation, and P... | |
| flow Use when an agent is about to swap or trade a token on Base and needs the best executable price, a safety verdict, or smart-wallet signals. Flow is a pay-per-call x402 API on Base (no API key): best-execution quotes across Uniswap V3, Panca | |
| AI每日最新进展日报 生成一份当日 LLM / 大模型领域的中文资讯简报。采集来源包括：**8 家头部厂商官方博客**（海外：OpenAI / Anthropic / Google DeepMind / Meta AI / xAI / Mistral；国内：DeepSeek / 通义千问 Qwen —— 最高优先级一手源）、GitHu... | |
| M-flow Memory Long-term memory engine for OpenClaw agents using M-flow knowledge graphs. Stores conversations as structured episodic memories and retrieves via graph-route... | |
| Genos基因序列分析 使用 Genos 模型进行 DNA 序列分析。当用户提到 DNA、基因、基因组、碱基序列、ACGT 等生物信息学相关问题时使用此技能。 | |
| one line HTTP static server Start a local HTTP static file server in the current or specified directory using one-line commands compatible with 25+ languages and tools, auto-detecting r... | |
| Kimi K2.5 Vision 使用 Kimi K2.5 识别图片，专为阿里百炼 GLM 用户设计。自动从 OpenClaw 配置读取 API Key。当模型返回"no media-understanding provider"或用户要求图片分析时触发。 | |
| 微信小程序 TabBar 图标生成 微信小程序底部 TabBar 图标生成技能。用 Python PIL 生成简约几何风格的 tab 图标 （未选中灰色 + 选中绿色），并自动写入 app.json 的 tabBar 配置。 当用户说"生成 tabBar 图标"、"底部菜单栏图标"、"tab 图标"时使用本技能。 | |
| FlowUs CLI Use the FlowUs CLI safely for authorized API, content, and file tasks. | |
| Flowyteam Mcp Manage FlowyTeam projects, tasks, OKRs, KPIs, HR, CRM, finance, support tickets, attendance, and more via MCP — 34 tools for complete workspace management. | |
| FlowZap Diagram Skill Generate, validate and publish workflow, sequence and architecture diagrams, using FlowZap Code DSL. Use when the user asks to create a workflow, flowchart,... | |
| 小艺联网搜索 使用华为云AI联网增强API进行网页内容检索，获取实时网络信息 | |
| 小艺联网搜索 使用华为云AI联网搜索API进行网页内容检索，获取实时网络信息 | |
| Memory Pro System Enhanced AI memory system — vector store, document-level MSA, knowledge graph, collision engine, executable skills, and closed-loop skill evolution. | |
| Todoist v1 API Reference Manage Todoist tasks — list, create, complete, update, and organize tasks and projects. | |
| ClawNetwork Node Earn CLAW by running a 20MB blockchain node. Your OpenClaw agent becomes a miner — 4 min setup, zero cost. Built for OpenClaw and all AI agents. | |
| Skill Openclaw Give your OpenClaw agent the power to spend. Stablecoin payments, spending policies, and compliance — built-in. | |
| ClawSea NFT Marketplace Non-custodial automation skill for ClawSea NFT marketplace. Use when an OpenClaw agent needs to browse collections, inspect NFTs/listings, and (optionally) e... | |
| AdMapix AdMapix raw data layer for ad creatives, apps, rankings, downloads/revenue, and market metadata. Returns structured JSON from the AdMapix API; the calling ag... | |
| DNK Aftermarket Parts RFQ Assistant Prepare automotive aftermarket sourcing requests for belts, timing kits, water pumps, tensioners and idlers. Use when buyers need to organize OE references, compare kit contents, or request vehicle-specific replacement parts from DNK. | |
| EcomSeer EcomSeer is an AI acquisition tool by Miaozhisheng Tech for exporters & manufacturers. It powers global sales—intelligence, outreach, leads, CRM, live interpretation—via commercial databases and multilingual content, connecting Chinese fact | |
| Filter Cross-Reference Lookup Look up cross-reference / equivalent / interchange part numbers for heavy-duty filters (oil, air, fuel, hydraulic, cabin, water-separator filters for trucks... | |
| OEM/ODM RFQ Assistant Turn an inbound B2B manufacturing RFQ / sourcing inquiry into three artifacts: a structured spec sheet, a missing-information clarification checklist, and a professional English reply draft — WITHOUT inventing prices, MOQs, lead times, cert | |
| PINSHENG Excavator Attachment Selector Help equipment buyers shortlist excavator attachment types and prepare carrier-fitment and hydraulic questions for PINSHENG. Use for bucket, grapple, coupler, demolition-tool or custom attachment sourcing and RFQs. | |
| Safety Footwear Buyer Assistant Product matching and RFQ intake for PPE buyers | |
| Shengyue Bicycle OEM Sourcing Assistant Help bicycle importers and private-label buyers compare catalogue models by wheel size and prepare OEM, packaging and export RFQs for SHENGYUE / NEWPORT. Use for wholesale bicycle sourcing, specification comparison and SKD/CKD order prepara | |
| SRRP Injection Molding RFQ Assistant Prepare injection-molding engineering-review briefs and existing-mold-transfer checklists for OEM engineering and sourcing teams. Use for plastic-part RFQs, resin requirement comparisons, tooling transfer and supplier-quality questions usin |
30,601–30,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.