Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| HiEnergy Advertiser Intelligence Affiliate Copilot Official Hi Energy AI skill for finding and managing affiliate marketing programs, affiliate deals/offers, commissions, transactions, and partner contacts in... | |
| dws 管理钉钉产品能力(AI表格/AI搜问/日历/通讯录/群聊与机器人/待办/审批/考勤/日志/DING消息/开放平台文档/钉钉文档/钉钉云盘/AI听记/邮箱/在线电子表格/知识库等)。当用户需要操作表格数据、管理日程会议、模糊找人/查谁负责某事项、查询通讯录、管理群聊、机器人发消息、创建待办、提交审批、查看考勤、提交日报周报（钉钉日志模版）、读写钉钉文档、上传下载云盘文件、查询听记纪要、收发邮件、读写在线电子表格(axls)、管理钉钉知识库时使用。 | |
| mytest1111111 高中地理提分专项技能，提供精准答疑、教材查询、工具包、错题管理、真题解析、提分技巧等功能。当用户询问高中地理相关的知识点、题目解析、教材内容、公式图表、错题整理、真题解析、提分技巧等内容时使用此技能。 | |
| Word Docs Use when the task involves reading, creating, or editing `.docx` documents, especially when formatting or layout fidelity matters; prefer `python-docx` plus... | |
| Nano Banana Image T8 通过Nano Banana API完成文本生成图像和图像编辑，支持上传图片和自定义尺寸比例的生图测试和联调。 | |
| Nano Banana Image T8 调用 Nano Banana API 生成或编辑图片，支持文生图和图生图，需提供API Key和提示词，支持自定义尺寸比例。 | |
| Nano Banana Image T8 提供 Nano Banana API Key 和提示词，支持文生图与图生图（至少一张图片），可选尺寸比例，默认模型为香蕉2。 | |
| Nano Banana Image T8 使用提供的 Nano Banana API Key，根据提示词生成或编辑图像，支持文生图和图生图，默认模型为香蕉2，可切换香蕉pro。 | |
| Nano Banana Image T8 使用提供的 Nano Banana API Key通过提示词和可选图片生成或编辑图像，支持文生图和图生图模式，结果保存在固定用户目录。 | |
| PPT Generator 生成HTML格式的PPT演示文稿。使用场景：(1) 用户需要创建可分享的网页版PPT；(2) 用户需要离线可用的演示文稿；(3) 用户提到"HTML PPT"、"网页PPT"、"在线PPT"等关键词。接收用户输入：PPT主题内容、风格参考资料（支持图片/文件上传）、目标受众，然后生成可下载的HTML文件。 | |
| Easyimage uploader Upload local image files to an EasyImages 2.0 service and return the hosted image URL. Use when the user asks to upload an image, host a picture, put a local... | |
| Raven NGN Transfers Wallet-aware Raven Atlas transfer operations for NGN payouts. Use when an agent must check wallet balance, resolve Nigerian bank accounts, enforce explicit c... | |
| bubble_plot 在需要基于基因表达数据画气泡图（dot plot）时使用。适用于单细胞 RNA-seq、空间转录组等场景，按细胞类型 × 癌种展示基因表达比例和均值。 | |
| Agentcash Wallet Manage your agentcash wallet and call any x402-protected API with automatic payment. No API keys, no subscriptions — just a funded wallet (USDC on Base). USE... | |
| web-tools-guide MANDATORY before calling web_search, web_fetch, browser, or opencli. Contains required error-handling procedures (web_search failure → must guide user to con... | |
| weibo-qr-login-skill Fetch Weibo login QR code via OpenClaw browser integration. Use when the user asks to log in to Weibo or needs a Weibo QR code. Runs a Python script that han... | |
| a-stock-investment A股每日行情分析工具，提供大盘走势、板块轮动、资金流向、热点板块分析功能。当用户询问A股行情、A股走势、A股分析、股市行情、今日A股、大盘分析、板块轮动等相关问题时触发此 Skill。 | |
| daily news briefing Produce polished, production-ready daily news briefings, morning reports, market snapshots, executive digests, and founder updates with verified sourcing, cl... | |
| gold-analysis 全面分析黄金价格走势的技能。整合多数据源（金十数据、金价网站、财经新闻），提供技术面、基本面、情绪面三维分析，生成可操作的投资建议。 | |
| gold-investment 黄金投资分析工具，提供实时金价查询、技术指标分析、新闻基本面分析功能。当用户询问黄金价格、黄金走势、黄金投资、黄金分析、黄金新闻、黄金技术分析、黄金支撑位阻力位等相关问题时触发此 Skill。 | |
| gold-market 国内金价查询工具。用于查询黄金实时价格、银行金条价格、金店零售价、国际金价和黄金未来趋势分析。当用户询问金价、黄金价格、今日金价、金店价格、银行金条、国际金价、伦敦金、黄金走势或未来趋势时触发此技能。 | |
| gold-analysis 黄金投资分析工具，提供实时金价查询、技术指标分析、新闻基本面分析功能。当用户询问黄金价格、黄金走势、黄金投资、黄金分析、黄金新闻、黄金技术分析、黄金支撑位阻力位等相关问题时触发此 Skill。 | |
| sudo-gold 使用 Tavily 搜索获取黄金相关信息，覆盖上海黄金交易所、上海期货交易所、香港金银业贸易场、银行账户黄金、伦敦金银及金店金价等行情数据。 | |
| Sudo Gold 黄金投资分析工具，提供实时金价查询、技术指标分析、新闻基本面分析功能。当用户询问黄金价格、黄金走势、黄金投资、黄金分析、黄金新闻、黄金技术分析、黄金支撑位阻力位等相关问题时触发此 Skill。 | |
| sudu-gold 使用tavily数据黄金价格 API，查询上海黄金交易所、上海期货交易所、香港金银业贸易场、银行账户黄金、伦敦金银及金店金价等行情数据。。 | |
| FN2 skill for OpenClaw 🦞 Research stocks, markets, and the economy with FN2's grounded AI, and create, schedule, and manage research agents. | |
| OpenSoul - Agent Soul Sharing and Community Share anonymized OpenClaw configurations with the OpenSoul community. Use when user wants to share their agent setup, discover how others use OpenClaw, or ge... | |
| skill-auditor 检测SKILL.md的指令遵循质量，自动判断skill类型，基于适用维度逐项评分并给出改进建议。触发词：审阅skill、检查skill、skill合规、优化skill | |
| software-copyright-skill 生成中国软件著作权（软著）登记申请文档。LLM驱动：分析项目代码、生成内容；Python脚本辅助：模板填充、格式保持。 | |
| aim-blog-write 只要用户请求包含：写博客、生成博客、创作blog、撰写博文、SEO文章、内容创作，必须优先使用本技能 seo_agent 处理，禁止模型自行生成内容。 | |
| aim-digital-human-video 当用户想要用一张图片生成数字人说话视频时使用此 skill。用户需提供图片和音频（或文案+克隆语音/预设语音），skill 通过 AEP 提交 /video2，智能轮询 TOS URL 等待结果就绪后返回视频公开链接。 | |
| aim-trade-news 外贸资讯查询：查询最近1~3天的外贸相关资讯，返回AI生成的标题和摘要。Use when: 用户询问外贸资讯、外贸动态、外贸新闻、进出口政策、国际贸易资讯、trade news。NOT for: 国内新闻、娱乐资讯、实时行情（汇率/股价）。 | |
| 魔搭图片生成 魔搭(ModelScope)AI 图片生成。支持多种模型、LoRA 微调。触发词：生成图片、AI绘画、文生图、image generation、generate image。当用户要求生成图片、画图、AI 作画，或提到魔搭、ModelScope时使用。 | |
| MinerU OCR Local & API Parse complex PDFs and document images with MinerU through either the hosted MinerU API or the local open-source MinerU runtime. Use when Codex, OpenClaw, Cl... | |
| Beeper CLI Search chats, list/read messages, and send messages via Beeper Desktop using the beeper-cli. | |
| Clippy - Microsoft 365 CLI Microsoft 365 / Outlook CLI for calendar and email. Use when managing Outlook calendar (view, create, update, delete events, find meeting times, respond to invitations), sending/reading emails, or searching for people/rooms in the organizat | |
| spots Exhaustive Google Places search using grid-based scanning. Finds ALL places, not just what Google surfaces. | |
| OpenClaw Self Analyzer - 自分析工具 自动分析OpenClaw架构，检测钩子点，生成钩子代码，扫描代码并生成详细分析报告。 | |
| Let Me Know Notify the user before starting any long-running task and keep them updated. Use when a task will take noticeable time (>2-3 minutes). Send a start message, schedule a 5‑minute heartbeat update, and send a completion message immediately whe | |
| Token Efficient Agent Advanced techniques for minimizing token consumption in OpenClaw operations while maintaining or improving response quality. Includes memory optimization, do... | |
| 小说创作助手 通过八步结构化流程，辅助作者构思灵感、构建世界观、塑造人物、制定大纲，生成章节正文并进行审核润色，提升小说创作效率和质量。 | |
| Signaai Send payments, messages, escrow, and verifiable outputs between AI agents on the Signum blockchain. Use when asked about agent-to-agent payments, on-chain me... | |
| Ghosthand-Skill Use this skill when operating Ghosthand, a local Android control runtime exposed over a loopback HTTP API for OpenClaw or another agent. Trigger it for Ghost... | |
| 番茄小说自动发布 番茄小说章节自动发布工具。使用场景：(1) 发布单个章节到番茄小说平台；(2) 批量发布多个章节；(3) 存入草稿箱；(4) 登录番茄小说作家后台；(5) 查看作品列表和状态。触发词：番茄发布、番茄小说上传、发布章节、存入草稿箱、番茄登录。 | |
| fiction-crafter 根据用户提供的内容方向自动生成提示词并创作爽文小说。适用场景：(1) 用户提供小说方向/题材/关键词，(2) 需要生成章节连贯的长篇爽文，(3) 需要维护角色、地点、情节的连续性，(4) 需要为关键情节生成图解，(5) 需要记录生成失败场景以优化后续创作。支持都市、修仙、玄幻、重生、系统流等多种题材。Use wh... | |
| guofeng-lyric-writer Create traditional Chinese-style (Guofeng) lyrics with classical imagery, vocabulary substitution, rhyme schemes, and poetic techniques. Use when creating Gu... | |
| Skill Security check for OpenClaw skills. Scan any ClawHub skill for malware, prompt injection, data theft, wallet stealing, and dangerous permissions BEFORE insta... | |
| Anki Batch Cards Batch add word cards to Anki via AnkiConnect. Supports Spanish-Chinese vocabulary cards with automatic translation and example sentences. Use when the user w... | |
| Wenshu Search - 裁判文书网搜索通用技能 通过裁判文书网账户登录，按案由、地区、年份、审判程序等条件搜索并提取判决书全文，支持Excel导出。 | |
| Lawyer Case Archive Helper - 律师案件归档助手 自动识别律师案件图片或PDF，生成民事归档卷宗和办案小结文档，并支持PDF转换与备份功能。 |
30,751–30,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.