Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| content-stock Analyze themes/news for stock selection | |
| news-content Input a news URL to efficiently extract the body, title, author, and date using a remote API. | |
| news-impact-analyzer Input news text and use an LLM to analyze its impact on stock market sectors and concepts (bullish/bearish/neutral) along with the underlying logic. | |
| send-email Send emails via SMTP. Configure in ~/.openclaw/openclaw.json under skills.entries.send-email.env. | |
| skill for searching images and boards in zizo library (https://zizo.pro). Search images and boards in zizo library. Use when user asks to search for images, photos, pictures, visual assets, or boards/collections. | |
| Stashdog Connect to Raz's StashDog inventory MCP server for OAuth-secured item listing, searching, adding, editing, and deletion via defined MCP commands. | |
| Paytoll 27 tools for DeFi, DEX swaps, cross-chain bridges, Twitter/X, on-chain token data, crypto utilities, and LLM access via x402 micro-payments on Base. No API keys needed — payment is the auth. | |
| Midea Cloud Control Connect and control Midea devices through the Midea cloud with a local cached account/device config. Use when a user wants to connect a Midea account, list d... | |
| A11y Scan Scan any public web page for WCAG 2.2 (ADA) accessibility issues — honest about what automated testing can and cannot catch | |
| Agent Web Fetch any public web page and get back clean, LLM-ready markdown (polite, robots-respecting) | |
| Fresh Feeds Trending/new/changed MCP servers + live x402 services — a freshness-ranked, liveness-probed index with an x402-paid change-data API | |
| Privacy Scan Scan any public web page for GDPR/CCPA/ePrivacy privacy & cookie-consent signals — honest about what static-HTML testing can and cannot catch | |
| Linkedin API Work with LinkdAPI Python SDK for accessing LinkedIn professional profile and company data. Use when you need to fetch profile information, company data, job listings, or search for people/jobs on LinkedIn. The skill uses uv script pattern | |
| ai-invest-master 激活全球顶尖投资大师的思维系统。本技能涵盖巴菲特、芒格、林奇、德鲁肯米勒、达里奥、索罗斯、斯文森及凯茜·伍德的投资哲学。 触发场景：用户咨询投资逻辑、评价特定公司/行业、制定资产配置计划、分析宏观趋势、寻求决策建议。 技能将自动根据用户问题的性质（价值 vs 成长、宏观 vs 微观、系统 vs 灵感）匹配最合适的... | |
| AI Macro and Sector Master 市场与行业分析框架：提供宏观经济、市场策略、固定收益及各大行业（如半导体、医药、房地产、军工等）的通用分析框架。当用户需要分析特定行业或宏观市场，或者询问"XX行业的分析框架是什么"时触发。 | |
| AI-Technical-Analysis WorkBuddy 量化投资技能：提供专业的技术指标分析，包括MACD、KDJ、SAR、均线、OBV、PVT、BOLL、CCI、RSI等核心指标。支持自动识别突破、量能异动、风险等级及交易信号。适用于散户投资者的日常行情分析与决策辅助。 | |
| 用于快速产出**架构图 / 流程图 / 时序图 / 部署图**等可视化交付物，常见输出为 `.svg`（可离线打开）或 `.html`（浏览器直接预览） 面向架构与流程的专业制图技能。支持两种产出方式：(1) 直接生成高质量 SVG 分层架构图，提供 11+ 种风格（blue/cyber/dark/gray/green/handdrawn/mono/morandi/ocean/orange/purple/tailwind），支持精确布局与中文；(2) 使用 Mer... | |
| python-docx 提供基于python-docx库的标准方法，支持生成带封面、标题、段落、列表、表格与图片的专业Word文档。 | |
| 造化（Zaohua）· AISoul Forge Create an original AI Soul from a natural-language description or a guided conversation, preview sample conversations or chat directly with the generated Soul, and evaluate an AI Soul with SOUL-6. Use when a user asks to create or forge an | |
| cwd-guardian Monitors and restores the evolver process working directory. Use when evolver crashes with uv_cwd ENOENT errors or when the evolver process loses its cwd. | |
| Feishu Evolver Wrapper (Fixed) Feishu-integrated wrapper for the capability-evolver. Manages the evolution loop lifecycle (start/stop/ensure), sends rich Feishu card reports, and provides... | |
| Nano Gpt Plugin Access dynamic NanoGPT models with API key authentication, usage tracking, and support for multiple model families in the OpenClaw platform. | |
| sensorpro.app Manage your Sensorpro email marketing account in OpenClaw. | |
| PDF万能大师 全能 PDF 智能处理技能，覆盖 25 项能力五大核心（Office 高保真互转、扫描件 OCR、PDF 直接编辑、加密水印权限、批量合并拆分重命名）、九大增值（表格提取、图文解析、摘要、脱敏、元数据清洗、自动命名、版本对比、文档问答、规格对比矩阵）、四大扩展（智能压缩、排版保留翻译、合同风险审查、发票验真归档）、七大壁垒（电子签名审批流、批量内容替换、表单创建、图纸测量、翻页电子书、印刷级导出、密文级永久删除）。当用户上传 PDF 并提出转换、识别、编辑、加密、压缩、翻译、 | |
| review-radar 显示器评测视频情报提取。给 OpenClaw 一个 B 站/YouTube 评测视频链接，自动转写口播音频并产出结构化评测情报卡（实测数据、优缺点、博主结论、竞品提及），也可批量处理多个链接并汇总。当用户提到"总结评测视频""显示器评测报告""批量看评测""评测情报"时使用。 | |
| Nansi website and web app builder Build stunning websites, landing pages, portfolios, and web apps by chatting with Nansi on WhatsApp. A no-code, mobile-first AI website builder — just descri... | |
| auto-prompt 策略先行的解题协议（fore.vip）。用户抛出一个主题、问题或想法（要做的事、卡住的问题、想要的结果）时，先出一份最佳策略卡——按「本机已有资产 → 模型自有知识 → 主题相关官方文档 → 主题 T1 社区 → 搜索引擎」逐级做复用检查、命中即停，取最短路径；再拿策略回看原问题做一轮对抗式审视（是否答非所问 / 是否还有更短路径 / 是否跳级凭记忆作答 / 产物是否超纲），最多回炉一轮；然后按策略执行、结论先行地精简交付；问题解决后按「四问」判据把关键点沉淀进记忆（跨会话可 | |
| Article Taster 文章品鉴师 - 多维度评估文章质量、检测AI味/大便味、识别原创内容 | |
| eNSP Always use when user asks to create, generate, or design a network topology diagram for eNSP (Enterprise Network Simulation Platform), or mentions creating e... | |
| test-clawhub-cli 测试 clawhub CLI 发布功能 - 验证 publish 命令的参数处理 | |
| article-taster 文章品鉴师 - 多维度评估文章质量、检测AI味/大便味、识别原创内容 | |
| ensp Always use when user asks to create, generate, or design a network topology diagram for eNSP (Enterprise Network Simulation Platform), or mentions creating e... | |
| ensp Always use when user asks to create, generate, or design a network topology diagram for eNSP (Enterprise Network Simulation Platform), or mentions creating e... | |
| ensp Always use when user asks to create, generate, or design a network topology diagram for eNSP (Enterprise Network Simulation Platform), or mentions creating e... | |
| ensp Always use when user asks to create, generate, or design a network topology diagram for eNSP (Enterprise Network Simulation Platform), or mentions creating e... | |
| article-taster 文章品鉴师 - 多维度评估文章质量、检测AI味/大便味、识别原创内容 | |
| Gold Monitor Skill 查询实时金价、黄金价格、美元指数、原油价格、金油比及投资建议。Query real-time gold price (Au99.99/COMEX/XAU), USD index (DXY), WTI oil price, and Gold/Oil ratio with investment signals. 支持... | |
| Subagent Driven Development Use when executing implementation plans with independent tasks in the current session. Features domain-specialist routing, independent verification gates, an... | |
| Project Code Standard 此 skill 用于检查、执行和修复项目代码规范。当用户需要为项目建立代码风格标准、 检查代码是否符合规范、自动修复格式问题、生成代码质量报告，或在 Code Review 中验证提交是否满足团队规范时激活。支持 Python (PEP8/black/ruff)、JavaScript/ TypeScript (E... | |
| Browser Ops High Autonomy Automates browser tasks end-to-end on approved domains with minimal intervention, escalating only for security, legal, payment, or login issues. | |
| Entrepreneur PM Framework 企业家 PM 思维框架 Skill — 面向 Leevar 团队管理层。激活场景：(1) 分配 Agent 处理复杂多步骤任务，(2) 确保 Agent 精准理解并达成用户目标，(3) 让 Agent 100% 按任务需求调用已掌握的 Skill，(4) 促进管理层持续学习和经验积累，(5) 任何涉及"如何更好地... | |
| Leevar Entrepreneur Mindset Leevar 专属企业家思维框架。当面临商业决策、战略规划、业务创新、团队管理、项目启动、市场判断时激活。融合马云的使命驱动与马斯克的第一原理，为 Lee 提供颠覆性商业判断和执行路径。触发词：商业决策、战略、创业、项目、使命、方向、选品、扩张、竞争、投资、团队、产品设计、商业模式。 | |
| Marketing OS AI Agent 营销操作系统 — 包含 Virtual CMO（战略大脑）和 Marketing Operator（执行引擎），提供市场分析、策略制定、Campaign 规划与执行追踪全链路能力。 | |
| Akshare Router Cn 中文期货期权数据路由器，根据频率、品类和计算需求匹配免费AKShare数据源及对应处理方案。 | |
| Baidudisk Mcp Use Baidu Netdisk via mcporter + stdio MCP server with hot-reload token file credentials. Triggers when you need Baidu Netdisk operations (official 2.0 tools... | |
| Feishu Whiteboard Extract 从飞书白板（Whiteboard）中提取所有图片节点的 file_token，用于后续下载/OCR/归档。文档类补充能力。 | |
| Market Chart Renderer Render Chinese market charts from standardized bars data with MA5/10/20/60, MACD indicators, ECharts templates, and export to HTML/PNG. | |
| fore-vip-geo-optimizer GEO 生成式引擎引用占位（fore.vip）。输入一个主题或产品名称，执行五步流水线：① 以真实用户问句联网检索 AI 搜索（豆包/Kimi/DeepSeek/秘塔等）并收集回答的引用来源 ② 分析来源站点：主站网址、创作者中心入口、可发布性与权重，优选可入驻发布的高权重阵地并给出内容输出参考 ③ 按 SEO 模板一次性收集补充主题/产品信息（关键词/人群/卖点/背书/CTA）④ 结合各来源站点风格输出合规、营销指数高的 Markdown 文档（GEO 写作：结构化+可摘录 | |
| Indeed Brightdata Search and scrape Indeed job listings and company information using Bright Data's Web Scraper API. Use when the user asks to find jobs on Indeed, search for... | |
| ClawVoice FREE Local Voice and TTS for OpenClaw agents, with spoken replies, optional push-to-talk input, and a local Base wallet for x402 paid calls. Supports local, hosted, and hybrid voice modes with spend caps and safe wallet controls. |
30,801–30,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.