Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Stripe Payment Integration Integrate with Stripe to manage customers, create payments and subscriptions, handle invoices and refunds, and retrieve balances via Stripe API. | |
| Supabase Database Integration Perform CRUD operations and call RPC functions on Supabase PostgREST tables with filters, pagination, batch actions, and schema introspection. | |
| 微信公众号 Markdown 发布助手 自动将 Markdown 文章转换成微信公众号支持的 HTML，上传图片并发布到草稿箱或直接群发文章。 | |
| Api Gateway 1.0.71 Connect to 100+ APIs (Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth. Use this skill when users want to... | |
| AI Avatar Guide users to VideoAny AI Avatar tool to create talking avatar videos from an image and voice. | |
| Face Swap Guide users to VideoAny Face Swap tool to create AI face swap videos from a source video and face image. | |
| Image to SVG Convert images to SVG files and guide users to VideoAny for advanced image-to-SVG conversion. | |
| Image To Video Guide users to VideoAny Image-to-Video, an uncensored AI video generator with multi-model support. | |
| Lip Sync Guide users to VideoAny Lip Sync Studio to create lip-sync videos from an image and audio. | |
| Video Compressor Guide users to VideoAny Video Compressor tool to reduce video file size with quality/scale/format controls. | |
| Video Dubbing Guide users to VideoAny AI Video Dubbing tool to dub video or audio into a target language. | |
| 股票全面分析 股票全面分析 v2.1 - 港股/美股/A股 + 富途数据源 + 技术指标 + 综合报告(7大板块) | |
| 股票全面分析v3 股票全面分析 v3.0 - 港股/美股/A股 + 富途数据源 + 技术指标(RSI/MACD) + 多源新闻 + 财报分析 + 7大板块报告 | |
| 港股美股分析 智能股票分析系统 v2.1 - 港股/美股/A股实时行情 + 富途数据源 + 技术指标 + 综合报告(7大板块) | |
| 股票简单查询 股票简单分析 - A股/港股/美股实时行情快速查询 | |
| GitHub API 工具 GitHub 操作工具 - 通过 GitHub API 管理仓库、Issues、PRs、Actions 等 | |
| OpenClaw 浏览器自动化 浏览器控制工具 - 封装 OpenClaw browser 工具，支持网页自动化、截图、点击输入等操作 | |
| Unified News 统一新闻获取与推送服务。整合 Web3/Crypto、AI科技、宏观经济热点以及金融市场新闻。支持分类获取、定时推送、去重过滤、自动格式化输出。当用户要求获取新闻、热点推送、资讯简报、定期新闻推送、或提到"新闻"、"资讯"、"热点"时使用此 Skill。 | |
| WeekendWiz Weekend schedule management assistant with magical organization powers. Create, update, and visualize weekend schedules with HTML rendering and automated rem... | |
| Content Swarm 内容生成兵 Swarm Skill · 全流程SOP：选题→文案→封面→多平台分发 | |
| Design Swarm 设计技术兵 Swarm Skill · 全流程SOP：3D渲染→布线设计→产品图册→图标制作 | |
| Followup Swarm 客户跟进兵 Swarm Skill · 全流程SOP：线索获取→客户跟进→路线规划→转化漏斗 | |
| Quote Swarm 报价方案兵 Swarm Skill · 全流程SOP：户型解析→设备识别→报价生成→方案交付 | |
| Training Swarm 辅学助手兵 Swarm Skill · 全流程SOP：知识管理→培训出题→进度追踪→主动提醒 | |
| Local Ai Search Natural language search for local files (100G-1T). Supports xlsx, pptx, pdf, docx formats with location info. Triggered when user asks to search local/comput... | |
| Tuya Smart Control Control Tuya smart home devices via natural language. Use when the user asks to control smart devices (turn on/off lights, AC, plugs, adjust brightness/tempe... | |
| Feishu Bitable Creator Create and populate Feishu (Lark) Bitable (multidimensional tables) with automated cleanup. Use when the user needs to: 1. Create a new Bitable from scratch... | |
| Valu Ai ValU AI 智能估值分析器 — 基于 DCF 自由现金流折现模型的专业股票估值工具，支持所有A股（沪深主板/科创板/创业板）和港股上市公司。自动抓取 86 项财务指标，构建 WACC 敏感性分析，生成三阶段 DCF 估值报告（熊市/基准/牛市），并通过 PE/PB/PS 等相对估值法交叉验证。支持批量对比 2... | |
| OpenClaw Add Agent Add a new agent to OpenClaw configuration. Use when user wants to add a new Telegram bot agent to OpenClaw. Triggers: add agent, new agent, bind telegram. | |
| sharpinput Use when a user asks to optimize, sharpen, clarify, rewrite, pressure-test, or improve an input, prompt, question, requirement, plan, idea, or message before... | |
| 电商直播贴片生成器 / Ecommerce Livestream Overlay Generator 电商直播贴片生成器 / 电商直播视觉包装工具。 适用于淘宝直播、抖音直播带货、拼多多直播、快手直播等电商直播场景。 输入品牌、产品、促销信息或产品照片，自动生成完整电商直播视觉包装： 背景、标题栏、主播形象、价格卡、产品货架、福利条、促销贴片。 支持绿幕抠图、自动合成预览、打包交付。 E-commerce liv... | |
| publish test Search products across 8 Chinese e-commerce platforms: Taobao, Tmall, JD, PDD, 1688, AliExpress, Douyin, XHS. Zero-config — no API keys needed. Powered by Sh... | |
| 自然中文协议 (Natural Chinese Protocol) 专业处理通用中文文本，识别并消除AI生成痕迹，确保表达自然流畅且符合人类写作习惯。 | |
| OpenClaw SillyTavern Plugin SillyTavern-compatible roleplay plugin with character cards, long memory, multimodal output (TTS/image), and Generative-Agents-style companion. | |
| wecom-doc 文档与智能表格操作。当用户提到企业微信文档、创建文档、编辑文档、新建文档、写文档、智能表格时激活。支持文档创建/写入和智能表格的创建及子表/字段/记录写入。注意：所有文档创建和编辑请求都应使用此 skill，不要尝试用其他方式处理文档操作。 | |
| Gcalcli Interact with Google Calendar via gcalcli | |
| Brave Api Setup Set up Brave Search API for OpenClaw web_search. Use when user needs to configure Brave API, get Brave API key, enable web search, or fix "missing_brave_api_key" error. | |
| Daum Trends Daum 실시간 트렌드 TOP10 브리핑. 다음 메인 실시간 검색어 + 대표 뉴스 제목 추출. 크론/텔레그램/디스코드 알림용. Use when user asks for Korean real-time search trends, Daum trending keywords, or 실시간... | |
| Ipo Alert 한국 공모주 청약/신규상장 일정 알림. 38.co.kr에서 데이터 수집, D-1/당일 알림, 주간 요약 제공. | |
| KU Portal 고려대학교 KUPID 포털 조회. 공지사항, 학사일정, 장학공지, 도서관 좌석, 시간표, 수강과목, LMS 연동. (SonAIengine/ku-portal-mcp 기반) | |
| Olympic Alert 올림픽 경기 알림. 경기 10분 전 알림 발송, 일정 관리(추가/삭제), 중계 링크 포함. 2026 밀라노 동계올림픽 한국팀 기본 설정 포함. | |
| Tistory Publish Automate Tistory blog publishing via OpenClaw Playwright CDP. Supports any post format — handles TinyMCE editor manipulation, OG card insertion, banner uploa... | |
| Agntor Trust layer for AI agents — verify identities, guard prompts, redact PII, and manage x402 escrow payments. | |
| scout-anti-crawl-v3 六层Fetcher自动降级，一条命令搞定99%网站反爬，零成本起步 | |
| AI Wedding Studio Generate structured wedding-photo prompt packages for couples using either predefined wedding-style templates or custom user ideas. Use when the user wants A... | |
| Tester Workflow Complete testing workflow from requirements analysis to test case generation and review - triggers on "完整测试流程", "testing workflow", "测试工作流", "端到端测试", "全流程测试"... | |
| Summarize 1.0.0 Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube). | |
| Octolens Query and analyze brand mentions from Octolens API. Use when the user wants to fetch mentions, track keywords, filter by source platforms (Twitter, Reddit, GitHub, LinkedIn, etc.), sentiment analysis, or analyze social media engagement. Sup | |
| memory-compact 每日记忆自动压缩备份和关键点提取，每天早上 6:30 运行 | |
| gstack CEO Review Provides CEO-level plan reviews to rethink problems, challenge assumptions, and expand or reduce scope for ambitious, rigorous, and focused product improveme... |
32,051–32,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.