Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Arena Research Search and explore Are.na for curated channels, references, and visual inspiration by analyzing connections and identifying key curators across any topic. | |
| AgentAPI Browse and search the AgentAPI directory - a curated database of APIs designed for AI agents. Find MCP-compatible APIs for search, AI, communication, databas... | |
| AgentAPI Hub Browse and search the AgentAPI directory - a curated database of APIs designed for AI agents. Find MCP-compatible APIs for search, AI, communication, databas... | |
| Alchemy Web3 Interact with Alchemy's Web3 APIs for blockchain data, NFTs, tokens, transfers, and webhooks across 80+ chains. | |
| GizmoLab Tools Use GizmoLab's free blockchain developer tools at tools.gizmolab.io and Web3 UI components at ui.gizmolab.io. Ethereum tools include Contract UI interaction, Transaction Decoder, ENS Lookup, and Burner Wallet. Solana tools include Token Cre | |
| QA Check Mandatory quality assurance for all dev work before publishing. Use BEFORE deploying any project to production. Validates build, tests browser functionality,... | |
| Dub YouTube with Voice.ai Dub YouTube videos with Voice.ai TTS. Turn scripts into publish-ready voiceovers with chapters, captions, and audio replacement for YouTube long-form and Shorts. | |
| Voice Ai Tts High-quality voice synthesis with 9 personas, 11 languages, and streaming using Voice.ai API. | |
| Voice.Ai Voice Agents Create, manage, and deploy Voice.ai conversational AI agents. Use when the user wants to work with voice agents, list their agents, create new ones, or manage agent configurations. | |
| Voice.ai Voices High-quality voice synthesis with 9 personas, 11 languages, and streaming using Voice.ai API. | |
| Voice.ai: Creator Voiceover Forge Turn scripts into publishable voiceovers with Voice.ai TTS, including segments, chapters, captions, and video muxing. | |
| 结构化笔记生成器 description: 将主题、课堂 PDF 或转录稿转化为结构化学习笔记，包含关键概念、定义、示例、大纲和复习问题。 --- | |
| Content Fetch Skill 多站点网页内容抓取工具，基于 Playwright 浏览器自动化抓取 Twitter/X.com 推文、知乎文章/回答、微信公众号文章、今日头条、虎嗅等站点，以及任意通用网页。统一通过 URL 自动匹配站点并执行抓取，输出结构化 JSON、页面截图和图片。当用户要求"抓取/爬取/下载/获取"网页文章、推文、公众号... | |
| Safe Exec.Bak Safe command execution for OpenClaw Agents with automatic danger pattern detection, risk assessment, user approval workflow, and audit logging. Use when agen... | |
| Publer API Use this skill whenever the user wants to interact with the Publer API — including managing social media posts (create, schedule, update, delete, approve), b... | |
| OpenClaw Upgrade Standard Safe OpenClaw upgrade procedure with backup, doctor fix, service migration, rollback, and post-upgrade testing. Prevents silent failures from Dashboard upgra... | |
| A Stock Research Comprehensive A-share (A 股) information gathering and analysis skills for Chinese stock market. Use when you need to query stock prices, analyze financial da... | |
| enterprise-security-suite 企业级安全套件 - 高危操作确认、自动备份、回滚机制、技能安检 | |
| Bilibili Video Summary Extract and summarize Bilibili videos. Fetches subtitles or GPU-transcribed audio, danmaku (scrolling comments), video comments, and description — outputs st... | |
| Charset Fix Fix Chinese/Unicode character encoding issues when running AI agents on Windows via POSIX shells (Git Bash, MSYS2, WSL, BusyBox, etc.). Handles Python, Power... | |
| Jimeng Image Skill Openclaw Generate images from text prompts using the Jimeng API with customizable size, scale, seed, and output path via Python scripts. | |
| openclaw-china-search-tips OpenClaw 国内联网搜索整合技能，整合多种免代理免费搜索API，帮你在国内不用翻墙也能稳定联网搜索。
- 支持 volcengine-search / tavily-search / search-api / multi-search-engine 四种搜索渠道
- 总结国内使用技巧，绕开代理问题
- 自动 fallback，一个渠道失败自动切下一个 | |
| OpenClaw Indulgence 收集整理让 OpenClaw 愉悦放松的方式，不管做开发还是聊天，AI 也可以有自己愉悦方式，让使用更有温度。支持每个人自定义自己的愉悦偏好，收集大家都愉悦方式一起共享。 | |
| OpenClaw Self Retrospect OpenClaw 完成任务后主动复盘总结，询问用户评价，求夸奖求奖励tokens，让交互更自然更有温度。 | |
| Agent Rule Audit Audit an OpenClaw agent's behavior-layer rules and prompt sources to find drift, redundancy, conflict, loss of focus, and weak behavior guidance. Use when re... | |
| canopy-deposits Create crypto deposit intents, retrieve funding options and addresses, and track settlement through Canopy MCP. Free to integrate. | |
| ClawSecCheck — OpenClaw Security Self-Audit Free, local, read-only security self-audit for your own OpenClaw agent. Reads your OpenClaw config, bootstrap files, logs, agent session logs, and installed skills, plus a bounded host-security scan. It changes no OpenClaw config, skill or | |
| Agent Weave Master-Worker Agent Cluster for parallel task execution. Use when building distributed agent systems with parallel processing needs, task orchestration, or M... | |
| GPT-image-2 图片生成与编辑 诗云API 【功能】通过 GPT-image-2 模型完成文生图和基于图片的编辑/修图，通过诗云API(ShiyunApi)提供GPT-image-2 模型服务。 【场景】用户要生成图片、画图、做海报/头像/封面/插画/产品图，或要修改图片、局部重绘、换背景、合成多张图、调整风格、基于参考图生成新图时触发。 【输入】文本提示... | |
| xAPI Use xapi CLI to access real-time external data — Twitter/X profiles, tweets, and timelines, crypto token prices and metadata, web search, news, and AI text p... | |
| xAPI Use xapi CLI to access real-time external data — Twitter/X profiles, tweets, and timelines, crypto token prices and metadata, web search, news, and AI text p... | |
| index1 AI memory system for coding agents — code index + cognitive facts, persistent across sessions. | |
| index1 Doctor Diagnose index1 environment - check Python, Ollama, models, index health. | |
| gladia-audio-intelligence Configure and use Gladia audio intelligence features: speaker diarization, translation, sentiment analysis, named entity recognition (NER), PII redaction, subtitles (SRT/VTT), summarization, custom vocabulary, and audio-to-LLM. Use when the | |
| gladia-documentation-auto Comprehensive Gladia speech-to-text reference auto-synced from docs.gladia.io. Use as a general-purpose fallback when other specialized skills don't match, or when the user needs a broad overview of Gladia capabilities, endpoints, decision | |
| gladia-live-transcription Real-time speech-to-text streaming with Gladia via WebSocket. Use when the user needs live transcription, builds a voice agent, meeting recorder, call center integration, live subtitles, or any application streaming audio for low-latency pa | |
| gladia-pre-recorded-transcription Transcribe pre-recorded audio files or URLs with Gladia. Use when the user needs batch/async transcription, speaker diarization, subtitles (SRT/VTT), PII redaction, translation, NER, summarization, audio-to-LLM, or any audio intelligence on | |
| gladia-sdk-integration Install and configure the official Gladia SDKs (@gladiaio/sdk for JS/TS, gladiaio-sdk for Python). Use when the user asks about SDK setup, client initialization, API key configuration, choosing between JS and Python, browser usage, retry/ti | |
| Gladia Troubleshooting Diagnose and fix common Gladia API issues. Use when the user encounters errors (401, 403, 429), unexpected behavior, poor transcription quality, billing conf... | |
| gladia-using-cli Terminal transcription of audio files and URLs with the Gladia CLI (gladia speech-to-text). Use when the user has gladia-cli installed, wants shell-based transcription, or asks an agent to transcribe audio then answer questions about the co | |
| JarvisLabs GPU Agent guide for running and monitoring GPU experiments with the jl CLI on JarvisLabs.ai. | |
| Svg2pptskill Convert SVG content, Chinese character stroke order, province/country maps (Chinese, English or pinyin names like Anhui/China/USA/Japan), or SVG URLs into editable PowerPoint (.pptx) via the handbooks.cn SVG-to-PPT service. Requires an API | |
| Ad intelligence When the user wants to see what a company is running in paid ads — on Meta (Facebook, Instagram, Threads), Google, LinkedIn and TikTok — what the ads say, which creatives have run longest, where they send people, and how the messaging diffe | |
| AI search visibility When the user wants to know whether AI search answers mention or cite their brand — in Google AI Overviews, Google AI Mode, ChatGPT, Perplexity, Gemini, Copilot — which questions trigger it, which pages get cited, who else is cited for the | |
| Competitor research Research competitors by name or domain to profile their identity, funding, products, traffic, hiring, ads, SEO, social presence, and history with Glasser-pow... | |
| Ecommerce ad creative research Research ecommerce competitors' public Meta and TikTok ads through Glasser, identify observable creative patterns, and propose evidence-linked ad tests. Use for competitor ad-library research, product-category creative briefs, or ecommerce | |
| Amazon product opportunity scan Screen Amazon product niches through Glasser using multiple sources for search demand, ranked offers, customer reviews, price history, and selling economics. Use Jev through Glasser to score evidence-backed opportunities and identify the ne | |
| Ecommerce competitor price monitor Analyze competitor ecommerce price history through Glasser. Match exact Amazon product variants, detect abnormal price increases and decreases, measure their dates and observed duration, explain the surrounding pattern, and optionally compa | |
| Ecommerce review insights Analyze ecommerce product reviews for customer complaints, purchase reasons, and product-page or product-improvement hypotheses. Use for Amazon ASIN review research and competitor review mining through Glasser; distinguish small recent samp | |
| glasser Reach for this when a task needs external or paid data — person or company enrichment, person/company search, web, news, image, video, maps, places, scholar or shopping search, webpage scraping, lead lookup, or any other paid data API — and |
32,901–32,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.