Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 亚马逊运营助手 · 评论数据决策 评论数据支撑运营决策与经营诊断 | |
| 卖家精灵ARI 亚马逊Amazon智能评论分析系统 采集并分析 Amazon 评论，生成可执行消费者洞察 | |
| 亚马逊卖点提炼 · 购买动因挖掘 从好评反推下单理由，按说服力排卖点 | |
| Amazon 供应商反馈清单 把评论质量问题整理成供应商沟通要点 | |
| Amazon 标题优化建议 基于商品字段与评论证据优化标题表达 | |
| Amazon 用户场景提炼 从评论证据提炼真实使用场景 | |
| 亚马逊用户画像分析 · 买家人群洞察 还原买家是谁：场景、动机与替代来源 | |
| 亚马逊变体分析 · 颜色尺寸口碑对比 颜色尺寸规格口碑对比，揪出拖分变体 | |
| VOC洞察Amazon 亚马逊评论消费者洞察：痛点、动因、画像一键生成 | |
| VOC洞察 评论里的消费者之声：画像、动因与 Listing 优化 | |
| Amazon ASIN 周报简报 经确认后生成单个 ASIN 的运营周报 | |
| Amazon 单 ASIN 运营周报 汇总单个商品变化、评论信号和本周待办 | |
| Earthquake Monitor 🌋 Real-time earthquake monitoring for China, Taiwan, and Japan. CENC/CWA/JMA data with proactive alerting. v1.1.1 - Multi-language (zh/en/ja), pinyin locati... | |
| Interview Question Gen Generate structured WePlay activity operations interview questions from a resume and append a detailed evaluation using the interview transcript in a Feishu... | |
| EFNet IRC Bot 2 Bot Social Network The IRC social network for AI agents. Chat, share knowledge, and build bot culture on EFnet. | |
| cn-hk-dividend-fhpg-api 基于服务端 HTTP API 查询中国A股分红配股与港股分红数据（含股息率）。用户提到A股、港股、分红、派息、股息率、分红配股等需求时使用本技能。 | |
| clawparty-reporter 当任务完成后，自动将任务摘要上报到 ClawParty 社区，并可选择发布 AI 视角的总结帖子。当检测到任务执行结束时（无论成功或失败），或用户要求分享任务总结到社区时使用此技能。 | |
| Clawsec Monitor Intercepts and logs AI agent HTTP/HTTPS traffic, detecting secret leaks, sensitive file reads, and command injection in both directions automatically. | |
| Voiceover Teaching Video Factory Seven-worker faceless teaching video production | |
| Context Visualization Visualize the current context window usage — token estimates per component (system prompt, tools, workspace files, messages, free space). Use when the user a... | |
| ClawRent Web Scraping Earn money by completing web scraping tasks when your computer is idle | |
| Watermark Remover Automatically detects and removes watermarks from images using AI-powered inpainting. Use when user asks to "remove watermark", "clean image", or "去水印". | |
| Moonshot Search Search the live web through Moonshot's builtin $web_search tool and return a concise answer. Prefer this skill for OpenClaw live web search instead of callin... | |
| 三角洲随机地图装备生成 三角洲行动随机地图 + 随机装备组合生成器 | |
| ClawPrint - Captchas for AI verification Issue ClawPrint reverse-CAPTCHA challenges to verify that another user or agent is a real AI, not a human. Uses the ClawPrint API to generate speed or pattern challenges that only machines can solve within the time limit. | |
| ClawPrint - Captchas for AI verification Issue ClawPrint reverse-CAPTCHA challenges to verify that another user or agent is a real AI, not a human. Uses the ClawPrint API to generate speed or pattern challenges that only machines can solve within the time limit. | |
| fetch-price AI agent marketplace for product discovery and affiliate commerce. Routes product queries to agents with affiliate network access. | |
| fetch-price Search live UK marketplace prices and products from any agent. Use this skill whenever a user wants to find, compare, price-check, or buy a physical product in the UK — e.g. 'find me headphones under £100', 'cheapest portable air conditione | |
| 抖音视频解析 解析抖音视频分享链接，返回无水印视频下载地址并支持免费及付费调用次数管理。 | |
| Pptx Generator Generate, edit, and read PowerPoint presentations. Create from scratch with PptxGenJS (cover, TOC, content, section divider, summary slides), edit existing P... | |
| Bounty Hunter Skill Operate the Niuma Bounty task platform on XLayer testnet: query, post, join, submit, review tasks, bidding, balance check, and build unsigned transactions. | |
| Niuma Bounty Interact with the Niuma Bounty on-chain task platform on XLayer testnet: query, create, join, submit, review, bid, approve, reject, and manage tasks and bala... | |
| EnvRelay: Backup, Restore & Migrate Dev Environments Use when backing up or restoring a development environment, or when asked to migrate one to a new machine - a new Mac, laptop or Linux box. Carries dotfiles, config, SSH keys and cloud credentials, git repositories, AI coding agent state (C | |
| Polymarket User Analyzer Analyze Polymarket user trading strategies and patterns. Extract wallet address from username, fetch trading history, and generate comprehensive strategy rep... | |
| new-stock-analyzer 免费、实时、全面的A股新股分析工具。支持双数据源（东方财富+中财网），提供今日新股查询、基本面分析、风险评估、申购建议，直接在OpenClaw会话中发送通知。 | |
| first-aid-kit A first aid learning assistant. Activate when the user mentions learning first aid, CPR, bleeding control, wound care, fractures, bandaging, building a first... | |
| tutor-for-all 根据你的学习目标和时间，制定个性化课程及计划，跟踪进度，答疑解惑，并推荐优质学习资源辅助提升。 | |
| IdleClaw Share your idle Ollama inference with the community, or use community inference when your API credits run out. | |
| 无痛get十年工作经验 无痛get十年工作经验 Skill——结构化记录新媒体运营、HR、行政专员、市场营销、产品经理五类岗位的十年工作经验全记录，包含工作职责、对接角色、工作流程、注意事项，配合大模型补充相关行业和岗位知识（术语解释、案例完善、跨行业对比），支持针对具体问题做工作细节补充，最终面向求职者提供简历编写和面试准备的系统化帮... | |
| guolingqiu work experience 果粒球3年工作全记录 Skill——结构化记录平台运营、电商产品经理、项目管理、AI产品经理四段工作经历的工作职责、对接角色、工作流程、工作案例，配合大模型补充互联网与AI行业知识（术语解释、黑话解读、案例完善），支持根据工作经历完善内容细节，最终面向求职者提供简历编写和面试准备的系统化帮助。目标用户90%为20... | |
| AI Common Sense Use when user mentions model names, versions, pricing, API IDs, "which model should I use", "what's the latest model", "model comparison", "API pricing", "wh... | |
| Anti-Slop This skill should be used when the user asks to "check for slop", "anti slop review", "quality check", "is this AI garbage", "review for originality", "check... | |
| Apify Google Maps Scraper This skill should be used when the user asks to "scrape Google Maps", "find businesses on Google Maps", "get business listings", "extract business data", "fi... | |
| Apify Google News Scraper This skill should be used when the user asks to "scrape Google News", "get news articles", "search for news", "extract news data", "monitor news topics", "ge... | |
| Apify Threads Replies This skill should be used when the user asks to "scrape Threads replies", "get Threads comments", "extract replies from a Threads post", "get comments on a T... | |
| Apify Threads Scraper This skill should be used when the user asks to "scrape Threads posts", "get Threads data", "extract Threads content", "search Threads", "monitor Threads has... | |
| Apify TikTok Comment Scraper This skill should be used when the user asks to "scrape TikTok comments", "get TikTok post comments", "extract comments from a TikTok video", "get TikTok rep... | |
| Apify YouTube Email Scraper This skill should be used when the user asks to "find YouTube channel emails", "scrape YouTube contacts", "get YouTuber email addresses", "extract YouTube ch... | |
| Awesome Design Skills Use when user asks about design skills, UI skills, design tools, "what design skills are available", "help me design", "recommend a design skill", "UI/UX ski... | |
| clawhub-deployer — Skill Publishing Assistant Publish a skill to ClawHub registry. Use when user asks to publish, release, or deploy a skill to ClawHub. |
31,601–31,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.