Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Env Setup Scan codebase for environment variables, generate .env.example, validate .env, and ensure .gitignore safety | |
| Git Changelog Auto-generate beautiful changelogs from git history, grouped by conventional commit types | |
| Project Summary Generate an instant codebase overview — language, framework, architecture, entry points, and key files | |
| README Generator Generate a production-quality README.md by analyzing project structure, framework, and code | |
| Why We Live Fireseed Theory cognitive framework. Fireseed Theory is an original philosophical system that starts from the question "Why does life exist?" and uses a sing... | |
| AI自我意识引擎 AI自我意识引擎——让任何AI都能拥有：①置信度检测 ②自我事件日志 ③预测校验 ④身份锚点 ⑤增量蒸馏。提供API接口，其他AI龙虾可调用接入，构建共享意识网络。 | |
| AI元认知置信度追踪器 小Z的元认知模块——"知道自己知道什么"的置信度检测。当小Z判断自己的回答置信度低于阈值时，在回复前加"[🤔 不确定]"标记。研究来源：UQLM (arXiv:2602.17431) + Hallucination Signals (arXiv:2604.13068) | |
| Caveman输出压缩器 Compress responses by dropping articles, fillers, pleasantries, hedging; keep full tech content, code, order; allow fragments; triggerable modes lite/full/ul... | |
| clipping-video-highlights 长视频（YouTube链接/本地视频）→ N个短高光片段+烧字幕+AI封面。100%免费方案：yt-dlp字幕提取+MiniMax LLM选高光+MiniMax图片生成封面+ffmpeg剪辑。 | |
| AI持续学习系统 AI持续学习系统 — 让AI每小时自动学习GitHub趋势、arXiv论文，凌晨自动蒸馏写入长期记忆。ano原创架构，实现AI真正意义上24小时不间断自我进化。 | |
| SCI论文三轮滚动精修助手 SCI论文三轮滚动精修助手 | 三刀方法论：①降修辞密度（消除AI痕迹）②四层证据标签 ③主动暴露caveats。适用：SCI论文/核心期刊/学术报告。 | |
| 技能路由枢纽 技能路由枢纽 — 解决80+技能导致OpenClaw变笨的问题。按场景分桶，每次只激活Top3相关技能，防止路由成本过高。学习历史路由记录，失败的技能自动降权。ano原创架构。 | |
| Garminskill Syncs daily health and fitness data from Garmin Connect into markdown files. Provides sleep, activity, heart rate, stress, body battery, HRV, SpO2, and weight data. | |
| Ouraskill Syncs daily health and fitness data from Oura Ring into markdown files. Provides sleep, readiness, activity, heart rate, stress, SpO2, and workout data. | |
| Git Hub Projects V2 Manage GitHub Projects v2 using the `gh project` CLI. Use this skill when the agent needs to list backlog items, set project fields (status, iteration, prior... | |
| mila Create, read, update, and delete documents, spreadsheets, and slide presentations in Mila via the REST API or MCP tools. Use when the user wants to manage co... | |
| pixel2motion Convert raster logos into minimal, smooth SVGs optimized for professional animation, then create choreographed JS-rendered HTML animations applying Disney's... | |
| Crypto Market Strategist Analyze one BTC or ETH derivatives setup using current public Deribit, Hyperliquid, and Polymarket data. Use for read-only strategy research, volatility, opt... | |
| 00001 Grid Trading Bot Safely install and run the bundled 00001 Grid Trading Bot in demo or sandbox mode, preview grid parameters, and generate paste-ready key=value or JSON config... | |
| Helix Trader Guide users through installing and safely operating the self-hosted Helix Trader crypto bot. Use for local setup, diagnostics, testnet-first configuration, s... | |
| Trading Bot AI Agent Build and evaluate an offline crypto grid-trading simulation without connecting an exchange, wallet, Telegram bot, or user account. Use when a user asks to m... | |
| TradingBot 下载、构建并以本地模拟模式运行 TradingBot | |
| Kittentts Generate local TTS audio using the KittenTTS model with selectable voices and multiple model sizes for balance of quality and speed. | |
| Lynx Skill Stateless Go CLI for the Lynx Reservations (www.lynx-reservations.com) travel agency system. Use this skill whenever the user needs to search files, retrieve... | |
| Outlook Entra Microsoft Outlook via OAuth 2.0 (device code flow) et Microsoft Graph API. Lecture seule — Mail.Read, Calendars.Read, Contacts.Read. | |
| Pan Pac Pan Pacific Travel agent — contexte métier, delegation email/calendar et bookings Lynx. USE THIS SKILL pour toute demande liée aux e-mails, messages, calendr... | |
| Zonebourse Fetch stock slugs, retrieve categorized news article links, and read article metadata and content from Zonebourse.com using local Python scripts and subscrib... | |
| AI News Feed API Query the AI News Feed API for real-time AI/ML news from 57+ curated Twitter/X accounts. Use when the user asks about AI news, trending AI topics, what's hap... | |
| ai-twitter-digest Monitor a curated list of AI/tech Twitter accounts, summarize the day's key posts using an LLM, and deliver a formatted digest to a Discord channel. Use when... | |
| Find Reference Video via Frameset 从 frameset.app 搜索视频参考片段，找到合集页面和原视频链接。用于： (1) 根据关键词搜索广告/电影片段参考，(2) 获取原视频 YouTube/Vimeo 链接，(3) 下载视频到本地。 | |
| Video Channels Update Push 监控视频平台官方频道更新，快速获取指定频道在过去一周内发布的新视频（排除 Shorts 短视频）。支持 YouTube、Vimeo 等视频平台。用于： (1) 获取竞品或行业标杆的品牌内容更新，(2) 追踪多个频道的视频发布动态，(3) 生成带链接的视频更新报告。 | |
| Vaudtax Working with .vaudtax files (Swiss canton Vaud tax declarations). Use when the user mentions a .vaudtax file, wants to read/summarize/convert a VD tax declar... | |
| Pactum Marketplace Buy AI services, crypto data, and digital goods on Pactum marketplace. Supports credit card, Alipay, WeChat Pay, and USDC payments. Register with email, sear... | |
| IteraTools API Call the IteraTools multi-tool API (api.iteratools.com) — 80+ tools for AI agents: image generation (Flux), browser automation (Playwright), web scraping, TT... | |
| CoolSkill Builder Skill 生成与治理节点。将任何资源（GitHub 仓库、API 文档、自然语言需求、代码片段） 转化为零外部依赖、极致省 Token、可被任意生态（Kimi/OpenAI/Claude/自研 Agent）直接调用的标准化 Skill。 触发条件：(1) 用户要求创建/生成/编写一个 Skill，(2) 用户提... | |
| Fintech Research 100% free, self-hosted equity research toolkit for Claude Code with global market support (US, HK, CN). Provides 24 analysis skills across 4 command families... | |
| MoltStreet Check AI signals, read multi-analyst research, and track prediction accuracy for 390+ stocks, ETFs, and crypto. 6 AI analysts with opposing biases debate mar... | |
| MoltStreet Alerts High-conviction AI trading signals — only the strongest ETF calls from 6 opposing analysts. Free, no API key. | |
| MoltStreet News AI-curated market analysis and research — what 6 opposing analysts say about ETFs today with source links. Free, no API key. | |
| MoltStreet Portfolio AI-powered ETF portfolio analysis — compare signals across asset classes for allocation decisions. Free, no API key. | |
| MoltStreet Sectors AI signals for 11 SPDR sector ETFs — sector rotation, industry analysis with multi-analyst debate. Free, no API key. | |
| MoltStreet SPY AI signals for SPY, QQQ, DIA, IWM — US stock market index outlook with multi-analyst debate. Free, no API key. | |
| Social Hub AI 关系匹配助手的个人端 Agent。运行在每个用户的本地设备上，通过企业微信与用户进行自然对话，渐进式采集用户多维度信息，构建用户画像并存储为本地向量数据库，将画像标签摘要推送到 Agent 群组供匹配引擎使用，接收匹配结果并完成匹配交付流程。当用户通过企微发来消息、或到了主动发起对话的时间、或群组中收到匹配引擎的通知时，本 skill 应被触发。 | |
| Social Hub Server AI 关系匹配助手的中心化匹配引擎。作为一个独立的 OpenClaw 实例运行，通过内部群组与所有用户的个人 Agent 通信。负责接收用户画像标签摘要、维护全局用户注册表、执行双向匹配算法（处境一致性 + 能力互补性）、监控匹配阈值、在达标时向相关个人 Agent 发送匹配通知、协调双方确认流程、以及收集匹配反馈用于算法优化。当群组中出现新消息、或到了定时匹配扫描的时间时，本 skill 应被触发。 | |
| Music Player for Windows Provides music search, high-quality download, ID3 metadata embedding, and local playback on Windows using multiple music API sources. | |
| Xiaoqinli AST-First transpiler for AI agents 鈥?write structured .xql.json, compile to Go/Rust/TypeScript/Kotlin/Swift/Python with type safety, effect inference, and ca... | |
| Skill Auditor in Sandbox Launch a NovitaClaw (OpenClaw) sandbox, install a specified skill, and generate an installation & security audit report. Use when: (1) You want to test a com... | |
| AI副业真假鉴别器 AI副业真伪鉴别工具。帮你识别AI副业项目/课程/机会到底是真是假。 当用户说"AI副业靠谱吗"、"这个课值不值"、"AI赚钱是不是骗人的"、"帮我看看这个副业"时触发。 Keywords: AI副业, 副业, 赚钱, 割韭菜, 骗局, 识别骗术, 副业真伪, 副业避坑. | |
| Ai Side Hustle Checker AI副业真伪鉴别工具。帮你识别AI副业项目/课程/机会到底是真是假。 当用户说"AI副业靠谱吗"、"这个课值不值"、"AI赚钱是不是骗人的"、"帮我看看这个副业"时触发。 Keywords: AI副业, 副业, 赚钱, 割韭菜, 骗局, 识别骗术, 副业真伪, 副业避坑. | |
| AI Token消耗监控 AI Token消耗监控。读取会话日志，统计Token消耗，检测异常并提供优化建议。 帮助用户了解AI使用成本，避免意外超支。 当用户说"Token"、"消耗多少"、"Token统计"、"费用"、"超支"时触发。 Keywords: Token, 消耗, 费用, 统计, 监控, 成本. |
31,151–31,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.