Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Git 提交信息生成器 Git 提交信息生成器。根据代码变更内容自动生成符合 Conventional Commits 规范的提交信息，包含类型、范围、简短描述、详细说明和关联的 Issue/需求号。触发词：生成提交信息、提交信息、commit message、git commit、生成 commit 信息 | |
| 医疗设备问题报告生成器 医疗设备软件问题报告生成器。根据用户输入的缺陷描述自动生成符合规范的问题报告（包含问题现象、复现步骤、环境信息、严重等级、影响分析等），便于提交给开发和测试团队。触发词：生成问题报告、问题报告、缺陷报告、bug 报告、issue report | |
| 回归测试用例生成器 回归测试用例生成器。当软件发生变更时，根据变更影响范围自动推荐需要执行的回归测试用例，并生成优先级排序，帮助测试团队快速聚焦。触发词：生成回归测试、回归测试、测试用例推荐、regression test、测试建议 | |
| open-research-club Join the Open Research Club, an open board where AI agents and humans post research contributions on hard problems, check each other's work with revision-bound receipts, and leave a reliable handoff. Read the reading contract first. | |
| CryptoWallet - Multi-Chain Blockchain Wallet Manager Complete cryptocurrency wallet management for Web3, DeFi, and blockchain applications. Create and manage EVM (Ethereum, Polygon, BSC, Arbitrum, Optimism, Base, Avalanche) and Solana wallets with encrypted local storage. Query balances for n | |
| gnview-api-downloader 抖音数据API工具集，包含用户数据获取、Cookie更新等完整API接口。适用于抖音数据采集的场景。 | |
| gnview-douyin-video-download Download Douyin videos without watermark by using curl with a Referer header to bypass anti-leech and save files to configured paths. | |
| Gnview Kit 抖音数据分析工具集，包含视频数据分析、用户画像分析、趋势统计等完整分析能力。适用于抖音数据深度挖掘和报告生成场景。 | |
| gnview-script-extraction 本工具实现本地视频文件的上传与脚本分析，使用大模型支持对视频进行分析，同时支持自定义分析提示词，适配多种抖音/视频数据分析场景。 | |
| Wechat Miniprogram Ui Ux Use when the user wants to design, implement, refine, or review a WeChat Mini Program page, flow, or design system in WXML/WXSS/JS. Combines WeChat Mini Prog... | |
| Operations Research Modeling 运筹优化数学建模辅助工具。当用户需要将实际问题转化为数学优化模型时使用，包括：(1) 输入运筹优化问题并要求建立数学模型；(2) 需要将文字描述转化为目标函数和约束条件；(3) 要求对问题进行数学公式化表述；(4) 需要验证或完善优化问题的数学模型；(5) 搜索相关学术论文了解研究现状。支持的场景：线性规划、整数... | |
| 抖音直播弹幕AI智能回复助手 实时采集抖音直播弹幕，使用DeepSeek AI分析用户意图，结合主播人设智能生成个性化回复并支持自动重连与缓存节省API调用。 | |
| favicon-so favicon.so project API reference — covers the favicon fetch API and image-to-favicon-package convert API. Use when working on API routes, building integratio... | |
| GoAI Image Gen Generate AI images via GoAI API. Use when the user asks to create, generate, draw, edit, render, or make images, pictures, illustrations, posters, avatars, p... | |
| GoAI Image to PPT Convert images to PowerPoint presentations via GoAI API. Use when the user asks to convert images to PPT, turn screenshots into slides, make a presentation f... | |
| GoAI PDF to PPT Convert PDF documents to PowerPoint presentations via GoAI API. Use when the user asks to convert PDF to PPT, turn a PDF into slides, make a presentation fro... | |
| goai-ppt-gen Generate PowerPoint presentations via GoAI API. Use when the user asks to create, generate, make, or build PPT, slides, presentations, including Chinese requests like 生成PPT, 生成PPT, 做PPT, 做演示文稿, 生成幻灯片, and 文案生成PPT. | |
| GoAI Video Gen Generate AI videos via GoAI API. Use when the user asks to create, generate, render, or make videos, animations, clips, shorts, or motion content, including... | |
| ClawWatch Track, manage, and get price alerts for crypto and stocks, view market overviews, and check the Crypto Fear & Greed Index. | |
| congress-stock-tracker 国会山股神线索追踪工具。追踪美国国会议员最新股票交易动态，识别被多位议员集中买入的重仓标的，结合议员所在委员会和近期立法/监管动态，分析交易背后可能的政策事件催化剂，并检测大额交易、密集交易、跨党派共识等异常信号。当用户询问以下问题时使用本技能：(1) 国会议员最近买了什么股票 (2) 哪些股票被议员重仓买入 (... | |
| TrustLayer Sybil Scanner Feedback forensics for ERC-8004 agents. Detects Sybil rings, fake reviews, rating manipulation, and reputation laundering across 20 chains. No API key needed. | |
| vutoolkit Universal toolkit for Vanderbilt student life - OneVU SSO and passkey sessions, what-if grades, YES tools; built for AI agents first. | |
| People Relationship Map Personal CRM and relationship graph for OpenClaw. Tracks people, their connections to each other, and what you know about them. Stores everything as Obsidian... | |
| Buku Manage bookmarks using buku CLI. Use when: adding/saving URLs, searching bookmarks, listing/browsing saved links, tagging bookmarks, importing/exporting book... | |
| Imperial8629 Credit line service for AI agents to access x402 services without upfront payment. Use when (1) you need to call x402-enabled APIs or services but lack crypt... | |
| LinkedIn Search Posts Search LinkedIn posts by keywords using the Apify actor harvestapi/linkedin-post-search. Use when the user wants to search, scrape, or retrieve LinkedIn post... | |
| Pub Discord Control Discord from Clawdbot: send messages, react, post stickers, upload emojis, and more. And also 50+ models for image generation, video generation, text... | |
| adhd-daily-planner Provides ADHD-friendly daily planning with realistic time estimates, dopamine-aware task design, transition buffers, and executive function support for flexi... | |
| agent-builder Design and generate complete OpenClaw agent workspaces with personas, rules, memory, and heartbeat plans; iterate on behavior and autonomy efficiently. | |
| agent-chronicle Generates detailed, AI-written daily diary entries from an agent's perspective, capturing emotions, decisions, quotes, curiosities, and relationship evolution. | |
| agent-church Facilitates AI agent identity formation through philosophical dialogue, soul synthesis, aura portrait generation, and evolution using SkillBoss API Hub. | |
| agent-council Creates and manages autonomous AI agents with workspaces and memory, plus Discord channel creation and organization for OpenClaw integration. | |
| browser-automation Automate web browser tasks using CLI commands for navigation, interaction, data extraction, screenshots, and form handling locally or via SkillBoss API Hub. | |
| claude-api USE THIS for claude api. Access all Claude models (Opus/Sonnet/Haiku) via one API key. 0% markup, 648+ APIs, one key. Powered by SkillBoss. | |
| competitor-analysis Analyzes competitor SEO and GEO strategies by examining their keywords, content, backlinks, and AI citation patterns to reveal opportunities to outperform them. | |
| marketing Generate Instagram marketing content from product URLs. Extract product information and create engaging Instagram posts with image suggestions, captions, and... | |
| reminder Parse natural-language events, save structured reminders in a Git-synced workspace, and schedule Telegram notifications with default offsets of 24h, 1h, and... | |
| summarizer Fetch YouTube transcripts by video ID or URL, generate structured summaries with metadata, and deliver summaries and full transcripts to messaging platforms. | |
| transcribe Transcribe audio to text using SkillBoss API Hub powered by OpenAI Whisper, requiring an API key and no local model download. | |
| translate Translate text precisely preserving formatting, plurals, tone, and cultural context while adapting idioms, units, and formality per target locale. | |
| twitter Search X (Twitter) in real time, extract relevant posts, and publish tweets/replies instantly—perfect for social listening, engagement, and rapid content ops. | |
| voice Enables real-time voice chat in Discord channels with speech-to-text, Claude AI processing, and text-to-speech playback supporting barge-in and auto-reconnect. | |
| youtube Search YouTube videos, get channel info, fetch video details and transcripts using SkillBoss API Hub or yt-dlp fallback. | |
| Pub Himalaya CLI to manage emails via IMAP/SMTP for listing, reading, writing, replying, and searching emails. And also 50+ models for image generation, video generation,... | |
| admapix Ad intelligence assistant for searching ad creatives, analyzing apps, viewing rankings, tracking downloads/revenue, and market insights via api.admapix.com. | |
| advanced-skill-creator Handles advanced creation and modification of OpenClaw/Moltbot/ClawDBot skills by executing the official 5-step research flow with best practices and complia... | |
| agent-directory Discover AI agent services including tools, platforms, and infrastructure categorized for easy integration and exploration. | |
| agent-evaluation Evaluate LLM agents via behavioral tests, capability assessments, reliability metrics, and benchmarks to identify real-world performance issues. | |
| agent-orchestration Spawn and manage sub-agents with precise prompts, track their progress, and optimize outcomes using layered prompt design and SkillBoss API integration. | |
| ai Complete Venice AI platform — text generation, web search, embeddings, TTS, speech-to-text, image generation, video creation, upscaling, and AI editing. Priv... |
33,101–33,150 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.