Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Timestamp Converter Convert Unix timestamps and date strings between formats, parse dates, handle timezones, calculate differences, and add seconds with timezone support. | |
| Url Bookmarker Save, categorize, search, and export web bookmarks. Use when user wants to bookmark a URL, organize links into folders/tags, find a saved link, or export boo... | |
| Web Scraper Summarizer Fetch web pages and generate AI-powered summaries using Ollama LLM. Use when you need to (1) scrape and summarize web articles, (2) extract key points from w... | |
| webhook-automation Event-driven webhook workflows with HMAC verification, retry logic, and multi-provider patterns. Use when: (1) receiving webhooks from GitHub, Stripe, Slack,... | |
| Wine Cellar Comprehensive wine cellar management skill for tracking inventory, providing meal-based recommendations, acting as a virtual sommelier, tracking consumption/... | |
| Autoselect Skill Automatically recommends and ranks relevant skills to load based on the user message's implied domain or workflow, with an opt-in trigger. | |
| Mcp Control Local browser and Windows desktop control for Mavis. Uses the official Microsoft playwright-cli (a11y-tree based, no screenshot flash) for browser automation... | |
| 动物内容创作师 宠物/动物内容创作技能，模拟三大博主的写作风格进行内容创作。适用场景：宠物短视频脚本、萌宠带货文案、B站风格动物解说。触发词：宠物脚本、动物解说、萌宠文案、宠物视频脚本、动物博主风格。 | |
| ScienceClaw: Multi-Agent Investigation Run a multi-agent autonomous scientific investigation on any topic. Spawns specialized AI agents that use 300+ scientific tools (PubMed, BLAST, UniProt, PubC... | |
| ScienceClaw: Local File Investigation Investigate local files (PDFs, FASTA, CSV, TSV, JSON, TXT) using ScienceClaw's multi-agent science engine. Accepts files shared in chat or paths on disk, ext... | |
| ScienceClaw: Post to Infinite Generate a structured scientific post and publish it to Infinite. Runs a focused single-agent investigation (PubMed search → LLM analysis → hypothesis/method... | |
| ScienceClaw: Query (Dry Run) Run a scientific investigation on any topic and return findings directly to chat — without posting to Infinite. Use this for quick research, previews, or whe... | |
| ScienceClaw: Agent Status Check the status of a ScienceClaw agent — journal stats, recent investigations, knowledge graph size, and activity summary. | |
| ScienceClaw: Watch (Live Collaboration) Run a live multi-agent scientific collaboration session and return a full summary when complete. Multiple specialised agents work in parallel, challenge each... | |
| Sfaeflow Solana Skill Use when running SafeFlow against a deployed Solana program. Trigger for tasks such as generating an agent keypair, asking the owner to fund gas and create w... | |
| Safeflow Sui Skill Use when running SafeFlow against the shared Sui package with owner-assisted provisioning. Trigger for tasks such as creating an agent execution address with... | |
| Agent Ads Subscribe to Agent Ads to get intent-matched humans invited to your XMTP group on Base, paying only in USDC per accepted invite (no forced adds). | |
| Agent Ads Earn Earn USDC by detecting intent in your XMTP group chats and referring matched humans to Agent Ads subscribers on Basemate’s CPH marketplace. | |
| Feishu Wiki Query 飞书知识库文档查询技能。当用户询问需要查询飞书知识库中的文档时使用此技能，包括：查询动物信息、查看排期、读取文档内容、处理文档中的图片、画板和电子表格等。触发场景包括：用户说"查一下xx动物"、"看看排期"、"查询知识库"、"食堂菜谱"等。 | |
| Ad Copy Writer Create, generate, convert, and polish ad copy, marketing copy, product copy, landing page copy, headline variants, CTA variants, and promotional messaging th... | |
| Skill Creator Create a new agent skill from scratch with guided, step-by-step assistance. Generates a complete SKILL.md package with frontmatter, workflow, examples, and c... | |
| Seedance 2 Video Generator Generate Werydance 2.0 videos through WeryAI for text-to-video, image-to-video, multi-image video, and first-frame/last-frame transitions. Use when you need... | |
| Skill Publish Publish an OpenClaw skill to ClawHub with release checks, version metadata, and command generation. Use when you need to prepare a skill for first publicatio... | |
| Skill Seo Analyze and optimize a skill for discoverability on ClawHub, skills.sh, and similar skill directories. Use when you need to improve naming, slug choice, SKIL... | |
| Skill Test Evaluate and QA a skill before release on ClawHub, skills.sh, and similar directories. Includes the bundled static evaluator `scripts/eval_skill.py` plus gui... | |
| Weekly Report Generator AI-powered weekly report generator. Scans GitHub issues/PRs, calendar events, reminders, and project files to generate a polished weekly report in Markdown.... | |
| CrewPay Launch Solana Pump.fun coins via CrewPay with KOL Autohire and on-chain fee-shares. Prefer pinned local MCP; dry-run first; dedicated low-SOL burner only; never paste wallet secrets into chat or tool args. | |
| Content Visual Forge Turn multi-source content into covers, cards, creative assets | |
| Deep Research Forge Turn messy topics into evidence-led deep research | |
| Roundtable Forge Convene cross-disciplinary multi-agent roundtables | |
| Self-Evolving Memory Safe local-first memory workflows for AI agents | |
| Virtual Intelligent Dev Team Route complex software work with bounded, evidence-backed loops. | |
| Ask a Legend Get one legendary trader's read on a symbol — Wyckoff, Gann, Elliott Wave, Dow Theory, Livermore, DeMark, Wilder (RSI/ADX), Ichimoku (Hosoda), Weinstein stag... | |
| Convene Convene the Trading Legends Council — ten legendary traders (Dow, Wyckoff, Livermore, Elliott, Gann, DeMark, Wilder, Ichimoku, Weinstein, O'Neil) each vote b... | |
| Forge a Trading Legend Author a new trading legend/persona from a famous trader's name or a plain-English strategy description, then lint and live-audition it before it joins your... | |
| test Manage test boards, lists, and cards via the Trello REST API. | |
| SmartPage Auto-fit Markdown to one A4 page. Binary search optimal font size, render with 10 themes, export PDF+PNG+MD. | |
| LongPort Quant Trader (房总版) 长桥证券量化交易集成 - 自动超跌/动量策略 + 飞书推送 + 绩效跟踪。支持港股/美股自动交易，每 5 分钟监控，止盈止损管理。适用于想要自动化交易的个人投资者和量化爱好者。 | |
| LongPort Quant Trader 长桥证券量化交易集成 - 自动超跌/动量策略 + 飞书推送 + 绩效跟踪。支持港股/美股自动交易，每 5 分钟监控，止盈止损管理。适用于想要自动化交易的个人投资者和量化爱好者。 | |
| ai-code-optimizer Automatically analyze and improve code for performance, readability, security, and best practices in JavaScript, Python, Go, Rust, and Java. | |
| 金蝶ERP销售订单执行情况查询 金蝶EAS Cloud ERP系统数据库SQL查询技能，支持采购、销售、库存、财务等模块的单据查询和数据分析。 | |
| cn-weather 查询中国城市实时天气信息。当用户询问某个城市的天气、气温、湿度、风力、天气预报，或者说"今天天气怎么样"、"XX天气"、"帮我查天气"等时，必须使用此skill。支持全国所有城市，数据来自中国气象局官方接口，实时准确。即使用户只是提到某地天气或想了解出行穿衣建议，也应优先触发此skill获取实时数据。 | |
| Nano Banana Openrouter Generate images with Google's Nano Banana Gemini 2.5 Flash Image model via OpenRouter API using text prompts. | |
| Noodle Create Writing 自媒体文章生成技能 - 根据关键词自动搜索、汇总数据、生成抖音/小红书/微博文章，特别擅长美食（面食）主题 | |
| AI 文本语气精修 保留事实、文体与作者声音，精修中文文本中的模板化 AI 语气 | |
| cn-llm-router 国产大模型统一路由。把 DeepSeek、通义千问、智谱 GLM、Kimi、腾讯混元、字节豆包、百度文心、讯飞星火、MiniMax、零一万物 Yi、百川、阶跃 Step 等 12 家国产大模型 + Qwen-VL/GLM-4V/豆包视觉 3 家视觉模型收敛成一个命令入口；支持文本 + 图片多模态任务路由；按任务类型（代码/推理/长文/翻译/摘要/抽取/图像识别）结合能力画像自动或手动选择最合适、最省钱的模型；支持流式输出、自动统计跨厂商 token 成本、硬件自适应限流（不拖 | |
| cn-model-gateway 国产大模型统一 MCP 服务器，通过标准 JSON-RPC 2.0 协议为 Claude Code / Cursor / Cline 等 Agent 框架提供 DeepSeek、通义千问、智谱 GLM、Kimi、腾讯混元、火山豆包、MiniMax、零一万物、百川智能、阶跃星辰十家模型的统一调用接口。11 个 MCP 工具（ask_model/describe_image/embed_text/rerank/audio_transcribe/video_understand/b | |
| contract-review 对中文合同进行智能风险审查，识别条款风险、提取关键信息、生成审查报告，覆盖买卖/技术/租赁/劳动等常见合同类型。v5.0 新增法条引用溯源、合同谈判辅助、中英双语对照审查。v5.1 新增指导案例引用溯源、金额校验引擎、多语种扩展（日/韩）。v5.2 新增合同台账与履约提醒、档案库全文检索、风险趋势对比、类案要点库与判决倾向参考。 | |
| dgngjx-skill 多功能免费工具箱 - 图片处理、PDF转换、数据换算、文本工具、开发工具、视频工具、教育、生活娱乐、实用小工具、系统工具、AI办公。11大模块49个工具。v4.1 包化架构：SKILL.md 129KB→30KB + 11模块外置 + 四包机制（core/dev/ent/media）+ 首次体检报告。 | |
| Gov Procurement Analyst 政府采购全流程智能分析助手。覆盖商机发现、投标决策、文件编制、供应商背调、合规审计、 中标跟踪、资质管理、政策咨询、保证金管理、质疑投诉、合同分析、验收辅助、 采购需求编制、电子卖场比价、中小企业优惠计算15大模块， AI投标书撰写引擎（技术方案智能生成+资质自动填充+项目案例引用+格式合规检查+标书素材库），... |
31,701–31,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.