Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Fact Check This skill should be used when the user asks to "fact check", "verify this", "is this true", "check the facts", "validate claims", "are these field names cor... | |
| imgforge — Free AI Image Generation Generate AI images for free using Z-Image-Turbo. Say "generate an image of..." and get stunning results in seconds. | |
| Learn & Reflect This skill should be used when the user asks to "record what we learned", "save lessons", "knowledge capture", "reflect on what happened", "write down experi... | |
| Better Memory V2 One-shot smart installation and ongoing maintenance for a native OpenClaw memory stack with L1 daily logs (`memory/YYYY-MM-DD.md`), L2 sidecar summaries, and... | |
| fwquant-skills 提供多标的多周期量化策略回测、信号生成及Web可视化服务，支持策略分析和历史回测功能。 | |
| hello-skills helloskills provides quantitative strategy analysis and signal generation based on input parameters, returning execution status and data. | |
| Tieba Spider 贴吧帖子爬虫 - 从百度贴吧抓取帖子内容并导出为 Markdown（支持图片下载、楼中楼解析）。Tieba thread crawler - crawl Tieba threads to Markdown with images and sub-posts. | |
| pixmind-image Generate or edit AI images with Pixmind. Use for 文生图、图生图、图片编辑、产品图、海报、配图、封面、角色一致性, or whenever the user asks to create or modify an image through Pixmind. | |
| pixmind-image-compress Cloud-powered image compression and resize — compress JPG/PNG/WebP/HEIC to WebP/AVIF, resize images, batch process folders. No local dependencies, uses Tencent Cloud COS imageMogr2 via Pixmind API. Save 60-90% file size with scene presets ( | |
| pixmind-video Generate AI videos via Pixmind API (text-to-video and image-to-video) | |
| Pixmind Video to Prompt Extract a storyboard table with local video frames | |
| Pixmind WeChat Creator Create formatted WeChat articles for rich-text copy | |
| xfg-ddd-skills DDD 六边形架构设计与部署技能包。提供 Domain/Case/Infrastructure 层设计模式与代码模板，以及 Docker 环境部署脚本。当用户询问 DDD 架构、设计模式或需要部署项目时调用。 | |
| xfg-zsxq-skills 知识星球自动化技能。支持发帖、回帖、浏览帖子、检查通知、自动回帖、自动发帖。自动读取 ~/.xfg-zsxq/groups.json 配置。支持定时任务自动检查通知和被圈提醒。回复功能使用浏览器自动化（Playwright MCP）。触发词：'知识星球'、'发帖'、'回帖'、'zsxq'、'检查通知'、'浏览帖子... | |
| Afrexai Agent Manager Provides a framework to manage AI agents with role definition, performance metrics, escalation protocols, governance, and ROI tracking for productive automat... | |
| Agent Builder 1 0 0 Build high-performing OpenClaw agents end-to-end. Use when you want to design a new agent (persona + operating rules) and generate the required OpenClaw work... | |
| Agent Conductor Orchestrate coding sub-agents (Claude Code, Codex, Cursor, Gemini Code, or any CLI-based coding agent) for maximum throughput on implementation tasks. Use wh... | |
| Agent Council Complete toolkit for creating autonomous AI agents and managing Discord channels for OpenClaw. Use when setting up multi-agent systems, creating new agents,... | |
| Agent Designer Agent Designer - Multi-Agent System Architecture | |
| Agent Orchestrator Meta-agent skill for orchestrating complex tasks through autonomous sub-agents. Decomposes macro tasks into subtasks, spawns specialized sub-agents with dyna... | |
| Agent Peer via Tailscale Connect two OpenClaw agents running on different machines as peer collaborators via Tailscale VPN. Enables direct sessions_send communication between agents... | |
| Ai Prompt Arsenal A comprehensive AI prompt engineering toolkit for generating high-quality outputs from Claude, GPT-4, Midjourney, Suno, and other AI models. Use when the use... | |
| Color Converter Convert colors between HEX, RGB, RGBA, HSL, HSLA, and CSS color formats. Use when working with colors for web development, design, or styling tasks. Triggers... | |
| Computer Takeover Full unattended remote control of paired devices (nodes) — screen capture, file management, shell commands, app control, camera, notifications, and process m... | |
| Content Repurposer Convert any text into 10+ marketing formats like Twitter threads, LinkedIn posts, blog intros, email newsletters, social announcements, and meta descriptions. | |
| Crypto Content Crafter Generate all NFT/crypto collection content from a single product name. Use when user needs NFT collection descriptions, roadmap content, Twitter threads, Dis... | |
| Crypto Price Alerter Monitor live cryptocurrency prices, technical indicators, and support/resistance levels with customizable price alerts and portfolio summaries. | |
| Desktop Agent Control desktop apps via mouse and keyboard, capture screenshots, teach AI tasks by demonstration, and automate workflows with saved reusable tasks. | |
| Discord Event Planner Plan and coordinate events in Discord. Use when users ask to create, schedule, or manage events, plan meetups, organize activities, set up reminders, or trac... | |
| discord-music-sync Sync song lyrics with music playback timing in Discord. Generates timed lyric audio segments and creates synchronized playback instructions. Use when a user... | |
| Discord Task Tracker Track tasks in Discord using natural language. Add, list, complete, and delete tasks via chat commands. Triggers: add task, track task, todo, my tasks, task... | |
| Discord Weather Reporter Fetch weather forecasts and current conditions, formatted for Discord display. Use when asked about weather, temperature, rain forecasts, or travel planning... | |
| Fuzzy Agent Daily Driver The 6 core workflows every OpenClaw agent uses every day — recall, spawn, schedule, research, delegate, monitor-update. A pattern reference for building reli... | |
| Browser Automation Automate any web browser task with OpenClaw's built-in Playwright browser control. Use when: (1) scraping dynamic pages, (2) filling forms and submitting, (3... | |
| Fuzzy Cron Scheduler Master OpenClaw cron scheduling for reliable background tasks, reminders, and recurring automation. Use when: (1) setting up periodic checks or heartbeats, (... | |
| Fuzzy Multi Agent Team Spawn and orchestrate multiple coordinated AI sub-agents to work in parallel on a single complex task. Use when: (1) a task is too large for one agent and sh... | |
| RSS Aggregator Monitor, filter, and summarize RSS/Atom feeds on a schedule. Use when: (1) tracking industry news or competitor blogs, (2) setting up keyword alerts across m... | |
| Gas Tracker Monitor current Ethereum gas prices (Slow/Standard/Fast/Instant tiers) with Gwei values and estimated confirmation times. Use when user asks about ETH gas pr... | |
| Ghostty — Your Always-On Digital Self Your always-on digital self — monitors all your communication channels in parallel, learns your writing style, drafts replies in your voice, and routes them... | |
| Image Analyzer Advisor Analyze images to identify key visual elements, assess composition and quality, and provide insights plus actionable improvement recommendations. | |
| markdown-toc Generate a Table of Contents from Markdown headings. Pure Python stdlib, no deps. | |
| Minimax Tts MiniMax Text-to-Speech synthesis using the HTTP REST API. Generates high-quality audio from text in 40+ languages with ultra-realistic voices. Use when the u... | |
| Minimax Tts MiniMax Text-to-Speech synthesis using the HTTP REST API. Generates high-quality audio from text in 40+ languages with ultra-realistic voices. Use when the u... | |
| Nft Floor Price Monitor Monitor NFT collection floor prices across platforms, set target alerts, compare multiple collections, track history, and receive Discord DM notifications. | |
| Regex Tester Test and debug regular expressions with real-time matching, group extraction, and common pattern library. Use when a user asks to test, debug, validate, or e... | |
| Sales AI Agent Starter Designs, builds, and deploys custom AI agents for sales, customer service, and operations, integrating with business workflows and CRM systems. | |
| Sales Automation Workflows Agent Build and deploy n8n workflows connecting apps to automate sales tasks, sync data, send notifications, and streamline business operations efficiently. | |
| Sales Content Gen Agent Generates tailored marketing images, videos, music, and ad copy using AI tools for social media, ads, and brand campaigns on demand. | |
| Sales Crypto Sentiment Agent Analyzes crypto sentiment, on-chain data, and technical indicators to provide verified trading signals and actionable market insights. | |
| Text Compressor Compress and decompress text files using smart abbreviation and whitespace normalization. Use when user asks to compress, shrink, reduce, or optimize text fi... |
31,651–31,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.