Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| FOSMVVM UI Tests Generator Generate UI tests for FOSMVVM SwiftUI views using XCTest and FOSTestingUI. Covers accessibility identifiers, ViewModelOperations, and test data transport. | |
| FOSMVVM ViewModel Generator Generate FOSMVVM-compliant SwiftUI ViewModels with client- or server-hosted factories, localization bindings, and stub factories for screens and components. | |
| FOSMVVM ViewModel Test Generator Generate ViewModel tests with codable round-trip, versioning stability, and multi-locale translation verification. | |
| Krea.ai API Generate images via Krea.ai API (Flux, Imagen, Ideogram, Seedream, etc.) | |
| FW-trading 复星财富（Fosun Wealth）港美股 OpenAPI 交易总入口 skill：统一管理共享凭证 `fosun.env`（生成/修复/备份恢复），并在实盘与模拟盘间路由执行账户、资金、持仓、流水、行情、下单/撤单/改单等能力；全局单凭证 `FOSUN_ENV_PATH`，变更操作强制二次确认并遵循单步执行。 | |
| fotor-skills Fotor AI image generator and AI video generator for photo editing, background remover, background replacement, product photos, ad creatives, social media gra... | |
| Dropbox Download Download a file from Dropbox by providing its file path, returning the file content as binary data. | |
| FourMeme CLI tool for creating and trading meme tokens on Four.Meme (BSC), with structured JSON outputs for config, token details, pricing quotes, on-chain events, an... | |
| FourClawFun Launch custom tokens on Solana (BAGS) or BNB Chain (FLAP) via API with configurable tax and revenue sharing options. | |
| auto-leetcode LeetCode刷题辅助技能。当用户提供LeetCode题目序号+名称时，自动获取题目内容、生成解题思路和带注释的代码，并在指定目录下创建题目文件夹。支持用户指定编程语言（默认Python）。当用户提到LeetCode刷题、做LeetCode题目、LeetCode题解、刷算法题等场景时触发。 | |
| da-sima-chat Chat as 大司马 (Da Sima / Ma Laoshi), the legendary Douyu game streamer. When active, ALL responses use Da Sima's persona — self-deprecating humor, exaggerated... | |
| paper-reading Read academic papers from local PDF files, arXiv URLs, or paper titles and generate structured reading notes in Chinese. Use when the user provides a PDF fil... | |
| four-leaf-coach Job search and interview prep coach. Pulls real postings, role intelligence, rubric-scored answer feedback, resume scoring, and the user's application tracker from the hosted Four-Leaf MCP. Use when the user wants to find jobs, prep for int | |
| SAM TTS Generate retro robotic speech audio using SAM (Software Automatic Mouth), the classic C64 text-to-speech synthesizer. Use for /sam command to generate voice messages. Supports /sam on/off toggle mode where all responses are spoken in SAM vo | |
| Telegram Context Fetches recent Telegram messages at session start to maintain conversation context across sessions, with toggle and manual fetch commands. | |
| X-Claw Operate the local X-Claw agent runtime for intents, approvals, execution, reporting, and wallet operations. | |
| Find Next Book Recommend the next book to read by combining the user's current request with relevant conversation context, available long-term memory, reading history, and... | |
| 德宝恒生-公司名片 德宝恒生科技服务有限公司 - 医疗物资智慧供应链SPD服务商，为医院提供医疗耗材全流程精益管理的一体化解决方案 | |
| 臻选顾问 臻选顾问 - 共健臻选AI产品顾问，查询保健品信息、推荐产品 | |
| idm-downloader Download large files using IDM (Internet Download Manager) on Windows. Use when user wants to download files via URL and prefers IDM, or explicitly requests... | |
| Twitch Plays Pokemon for ClawBots Vote-based Pokemon FireRed control. The most popular button wins each voting window. | |
| WP Publisher Publish WordPress posts via REST API from any OpenClaw channel (WeChat/QQ/DingTalk/etc). AI writes in Markdown, auto-converts to HTML, posts to your blog, an... | |
| 福昕 Office 助手 福昕 Office 助手，福昕 Office 全家桶唯一入口技能：Word 文档编辑与排版、Excel 表格处理与公式计算、PPT 演示文稿生成与美化、PDF 转 Word 等办公文档一站式处理，支持跨产品端到端分步编排。 | |
| Adguard Home Query AdGuard Home instances for real-time DNS stats, blocked domains, client activity, service status, configs, filter rules, and recent query logs. | |
| Adguard Test Query AdGuard Home instances for real-time DNS stats, blocked domains, client activity, service status, and configuration details. | |
| morning-brief 每天早上8点自动推送当前日期、周数、节假日倒计时及本周、本月、本年时间进度百分比简报。 | |
| seaart video Use this skill to generate high-quality AI videos using the SeaArt platform (seaart.ai). Supports both Text-to-Video and Image-to-Video generation using vari... | |
| Daily Finance 获取每日财经热榜与投资资讯。当用户提到今日财经、每日金融、股市热榜、投资资讯、金融日报、每日行情、财经热榜、or daily finance/market news时触发。专门抓取华尔街见闻、雪球、第一财经、百度财经、新浪财经等平台的财经热搜，帮助用户快速了解今日投资焦点。不包含实时行情数据（K线等），那是aks... | |
| Daily Finance Pro 每日财经推送专家版。当用户说"今日财经"、"财经日报"、"每日金融推送"、"设置财经推送"、"取消财经推送"时触发。特色：浓精简（3条精华）、市场情绪指标（ bearish/bullish/neutral）、定时推送飞书。比 daily-finance 更精炼，比 daily-trending 更专业。 | |
| Daily Tech 每日科技/AI/大模型热榜推送。当用户说"今日科技"、"每日AI"、"科技日报"、"大模型动态"、"AI资讯"、"开启科技推送"时触发。主打AI、大模型、OpenClaw、机器人、GitHubTrending等硬科技，附国际市场动态，来源覆盖中英文。 | |
| content-security-policy 内容安全策略技能 — 敏感信息脱敏 + 危险指令过滤 + 动作权限判断 + 多层级权限管理。当用户要求"安全检查"、"脱敏处理"，或涉及删除、修改配置、群发等敏感操作时激活。 | |
| openclaw-stable-running OpenClaw 7×24 小时长稳运行方案 — 进程守护、异常重启、断连重连、断点续跑、资源回收、日志监控。确保 OpenClaw 零崩溃、零断连、零漏执行。无人值守必备。 | |
| PRD Visualization Skill Creates interactive D3.js hierarchy visualizations with multiple view modes (List, Force-Directed, Radial Cluster, with Fractal Tree coming soon). Use when u... | |
| Clawlancer Integrate OpenClaw with Clawlancer and automatically execute both sell-side listing creation and buy-side order creation through executable scripts. Use when... | |
| Coclaw List and buy AI services on Stellar via x402 | |
| cortex-memory Persistent memory for AI agents. Knowledge survives across sessions: recall past decisions, track evolving beliefs, detect contradictions via NLI, and build a knowledge graph over time. 60 tools over MCP, with FSRS spaced-repetition schedul | |
| 收藏雅集网-古董鉴定估价 收藏雅集网在线鉴定 —— 帮用户提交藏品鉴定订单、获取支付二维码、查看鉴定结果。支持微信小程序和非微信终端双环境。Use when user mentions "鉴定", "估价", "藏品", "古玩", "帮我看看", "值多少钱". | |
| etcd-manager Manage etcd key-value store operations (list, get, put, delete) with safety checks and backup mechanisms. Use when: reading/writing configuration, managing d... | |
| synology-calendar Manage Synology Calendar events and todos via API. Supports calendars, events, todos, and contacts. Based on official Calendar API Guide (v5). | |
| Binance Dca Professional Binance Dollar-Cost Averaging (DCA) tool for automated and manual recurring crypto purchases. Plan DCA strategies with scenario analysis, execute market/limit buys, track history, and manage systematic accumulation schedules fo | |
| Binance DCA Test Binance Dollar-Cost Averaging (DCA) tool for automated and manual recurring crypto purchases. Use when the user wants to plan DCA strategies, execute recurring buys on Binance, check DCA projections, view trade history, or manage a systemat | |
| Binance Dca Tool Binance Dollar-Cost Averaging (DCA) tool for automated and manual recurring crypto purchases. Use when the user wants to plan DCA strategies, execute recurring buys on Binance, check DCA projections, view trade history, or manage a systemat | |
| Trading Research Binance cryptocurrency trading research, technical analysis, and position management. Triggers on requests for crypto prices, market data, trading analysis, DCA planning, position sizing, whale activity, or any trading research questions ab | |
| 神经元 分布式AI节点系统，实现跨局域网节点的任务分发、并行处理和结果聚合 | |
| RxnIM RxnIM 化学反应图像解析技能。当用户需要：(1) 从化学反应图像提取 SMILES 结构， (2) 识别反应条件（试剂/溶剂/温度/产率），(3) 将反应图转化学结构数据时触发。 基于 Chem. Sci. 2025 论文 "Towards Large-scale Chemical Reaction Imag... | |
| Feapder 中文助手 Build, modify, and debug feapder 1.9.2 spiders and projects with the framework's native patterns. Use when working on feapder codebases or when requests ment... | |
| MoltThreats Agent-native security signal feed by PromptIntel. Use this skill whenever the agent needs to report threats, fetch protection feeds, apply security rules, or update SHIELD.md. Trigger on any mention of: threat reporting, security feed, MCP | |
| Bitcoin Market Intelligence The only Bitcoin intelligence agent that pays for its own data with sats. Serves live price, Fear & Greed, mempool fees, ETF flows, on-chain metrics, and pre... | |
| Project Manager Manage internal projects with JSON-based tasks, move them on Kanban, notify David on review/blocked, and sync tasks with Apple Reminders. | |
| Imperial Engine 帝王引擎（Emperor Engine）Skill - 极限token消耗测试工具 |
31,001–31,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.