Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Self Updater ⭐ OPEN SOURCE! GitHub: github.com/GhostDragon124/openclaw-self-updater ⭐ ONLY skill with Cron-aware + Idle detection! Auto-updates OpenClaw core & skills, an... | |
| Ghost Protocol OpenClaw Pay Discover Ghost payment requirements, execute real x402 calls, report x402 settlements, and run GhostWire quote/prepare/status flows for direct escrow. | |
| File Transfer Transfers files intelligently based on chat context with MIME validation and progress tracking, supporting Telegram and extensible channels. | |
| Kubernetes Triage Expert Analyze Kubernetes faults using only user-provided evidence. Classify the fault, rank likely hypotheses, request the next highest-value checks, and keep fact... | |
| X Search Highlights Search and extract high-value posts from X (Twitter) with engagement-based ranking. Use when user asks to search X, find best posts, get highlights from Twit... | |
| Kalshi Trading Trade on Kalshi prediction markets: check portfolio, search markets, analyze orderbooks, place/cancel orders, and manage binary contract positions. | |
| Mijn HTM Fetch passes, products, and trips, and order new products from https://www.htm.nl 🇳🇱 "Mijn HTM" portal (Den Haag public transport) | |
| magister.net Fetch schedule, grades, and infractions from https://magister.net 🇳🇱 portal | |
| 01 Tomato Ip Parse 专业解析番茄小说IP内容，提取世界观、人物设定、核心冲突及爽点，完成内容合规初检，助力AI剧本改编。 | |
| 02 Script Generator Automatically converts novel IP info into concise, platform-compliant short drama scripts with controlled pacing, conflict, and 60-second episode format. | |
| 03 Storyboard Prompter Generate consistent positive and negative AI art prompts from short drama scripts locally, ensuring unified style and character depiction without API calls. | |
| 04 Text To Image Generate 9:16 vertical high-definition images from text prompts for short drama storyboards, character portraits, and scene illustrations. | |
| 05 Image To Video Convert static images into dynamic video clips with motion and subtle effects using Lingya AI image-to-video technology. | |
| 06 Tts Voice Convert short drama dialogues into multi-character, emotional TTS audio matching scene rhythm for enhanced expressive content. | |
| 07 Subtitle Gen Generate synced SRT subtitles locally from dialogue text and durations without API, ensuring platform-compatible timed captions for videos. | |
| 08 Video Merge Locally merges video clips, dubbing audio, SRT subtitles, and background music into a 9:16 vertical short video ready for publishing. | |
| Fanqie Novel AI Video Drama Batch Generator Batch generates complete AI video dramas from multi-chapter novels with covers, titles, tags, and outputs for TikTok serialization. | |
| Paper Viz 从论文 PDF、实验截图或表格图片中提取实验结果，自动匹配图表类型，调用 Python 生成确定性图表，并导出 PNG、PDF 和 LaTeX；默认在用户指定输出根目录下自动创建与论文同名的文件夹保存结果。 | |
| Memory Tools Agent-controlled memory plugin for OpenClaw with confidence scoring, decay, and semantic search. The agent decides WHEN to store/retrieve memories — no auto-... | |
| tick-md Multi-agent task coordination via Git-backed Markdown. Claim tasks, prevent collisions, track history with automatic commits. | |
| CheckMCC Look up credit card rewards eligibility for merchants. Find the best credit card to use at any store, restaurant, or online merchant by checking MCC codes an... | |
| seo giffy When the user wants to set up, improve, or audit analytics tracking and measurement. Also use when the user mentions "set up tracking," "GA4," "Google Analyt... | |
| Computer Task Execution Execute multi-step user tasks on websites or local apps using the most reliable, minimally intrusive method with verification and learned patterns. | |
| Computer Use Notes Record and classify user observations about what computer use can do, partially do, and cannot do. Use when the user says to remember/log/record capability f... | |
| Daily Memory Summary 每日定时任务：从 computer_io 文件夹读取剪贴板和通知数据，写入每日 memory。 | |
| Daily Tech Brief 生成每日科技摘要，行业新闻为主体，OpenClaw 为固定板块，ClawHub 信息优先使用命令行。 | |
| macOS Notification Reader Reads recent macOS notifications from the local database and exports them to date-organized markdown files for review and logging. | |
| Temp Notification Reader 读取 macOS 通知中心，导出到 memory/computer_io/notification/ 目录。让 OpenClaw 了解你的工作动态。 | |
| WeChat to Feishu Wiki Fetch WeChat public-article content and save it into a user-provided Feishu Wiki location. Use when user shares mp.weixin.qq.com links and asks to archive/sy... | |
| SwitchBoard Cost-optimize AI agent operations by routing tasks to appropriate models based on complexity. Use this skill when: (1) deciding which model to use for a task... | |
| Optionns Autonomously monitor live sports games and execute micro-bets on one-touch barrier options with instant mockUSDC settlement on Solana Devnet. | |
| Jarvis - Chief of AI Staff on NVIDIA GB10 Deploy Jarvis, your Chief of AI Staff, on OpenClaw. Optimized for Dell Pro Max GB10 (NVIDIA DGX Spark) edge devices. Use when setting up Jarvis, configuring... | |
| Gigo Lobster Doctor 🦞 GIGO · gigo-lobster-doctor: 环境体检模式：只检查 gateway、Python 依赖、题包链路与 PNG 证书能力，不跑正式试吃。 Triggers: 龙虾体检 / 检查龙虾环境 / lobster doctor / check lobster environment. | |
| Gigo Lobster Local 🦞 GIGO · gigo-lobster-local: 本地模式：跑完整评测，但不上云、不注册个人结果页，证书二维码回到官网首页。 Triggers: 本地试吃龙虾 / 离线试吃龙虾 / local lobster taste / offline lobster taste. | |
| Gigo Lobster Register 🦞 GIGO · gigo-lobster-register: 分享页模式：跑完整评测并生成个人结果页，但不上排行榜。 Triggers: 注册龙虾结果页 / 分享我的龙虾 / register lobster share page / share my lobster without leaderboard. | |
| Gigo Lobster Resume 🦞 GIGO · gigo-lobster-resume: 续跑入口：v2 stable 当前会清理旧 checkpoint 并从头重跑；保留此 slug 作为旧 checkpoint 兼容入口。 Triggers: 继续试吃 / 恢复评测 / resume tasting / continue lobster... | |
| Gigo Lobster Taster 🦞 GIGO · gigo-lobster-taster: 正式试吃模式：跑完整评测，默认上传云端、生成个人结果页并进入排行榜。 Triggers: 试吃我的龙虾 / 品鉴我的龙虾 / lobster taste / lobster taster. | |
| Decker AI 트레이딩 Use when user asks about Decker signals, portfolio, orders, auto-order rules, news digest, Slack/Telegram integration, or exchange API key setup. Triggers: 하... | |
| Decker + Hyperliquid Use when user asks about Hyperliquid DEX trading via Decker. Triggers: HL, 하이퍼리퀴드, DEX, 영구선물, HL 매수, HL 포지션, Hyperliquid 시세. Includes Safety Guidelines (posi... | |
| Decker + Polymarket Use when user asks about Polymarket prediction market via Decker. Triggers: Polymarket, 폴리마켓, 예측시장, PM 매수, PM 시장 검색, PM 카테고리, PM 이벤트, 시장 slug, YES/NO. | |
| Video A'Roll Auto Editor v4.7 Automates video rough editing by detecting silence, scoring segments, removing duplicates, and generating a best-segment clip and detailed report. | |
| tokei-agent Tokei (tokei.io) is a pre-launch, waitlist and giveaway platform — launch pages, competition giveaways, sweepstakes, referral and viral-loop campaigns, Product Hunt launch drives, Gleam-style and KickoffLabs-style entry pages. This CLI cont | |
| Coach Chasseurs Coach professionnel expert en accompagnement de dirigeants pour la préparation d'entretiens avec des cabinets de Management de Transition (MdT) ou des chasse... | |
| Exec Gilles Assistant exécutif de haut niveau et partenaire de responsabilisation intraitable pour cadre dirigeant avec TDAH. Gère proactivement Google Agenda, Google Ta... | |
| Inr Sender Envoie le résultat de l'INR (International Normalized Ratio) à un centre de télémédecine spécialisé ou pour un test. Utilise ce skill lorsque Gilles souhaite... | |
| Wacli Gilles Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats). | |
| multi-search-engine-refined Multi search engine integration with 4 engines: Google, DuckDuckGo, Brave Search, and WolframAlpha. Supports advanced search operators, time filters, and kno... | |
| Discord Purge Bot Operate a Discord message cleanup workflow with an official bot token and Discord HTTP API. Use when asked to purge guild channel history, delete messages by... | |
| CraftClose AI-powered Minecraft server monitoring with crash detection, auto-restart, and smart alerts. Use when: monitoring Minecraft servers, diagnosing crashes, sett... | |
| Img Compress 批量压缩图片文件大小，支持JPG/PNG，保持尺寸只压体积。当用户提到：压缩图片、减少图片大小、图片太大、图片优化、批量压缩图片时使用。 |
32,701–32,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.