Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Screen Vision AI screen vision and desktop computer control skill for OpenClaw. Let your AI agent see the screen, understand UI elements, and autonomously perform mouse an... | |
| Bian16 Wallpaper Downloader Download 4K mobile wallpapers specifically from pic.netbian.com (彼岸图网), including WeChat QR login flow, token-based original image download, 3-minute rate-li... | |
| Dusk Ascension — Ethereal Product Hero Shots Nano Banana Pro — Dusk Ascension 🌅 — Generate product/concept hero shots in a dreamy ethereal dusk aesthetic: 1990s high-fashion film photography, analog gr... | |
| ArkRoute Generate images and videos with 25+ visual AI models (Seedream, FLUX, GPT Image, Kling, Seedance) through one unified API. OpenAI-compatible + MCP server. | |
| Harness Factory — AI Engineering Team Use when building features, fixing complex bugs, or doing major refactoring. Transforms your agent into a structured engineering team: Plan → Build (via ACP)... | |
| Smart Agent Skill aion-sdk powered Polymarket thesis trader. Scan prediction markets for a configurable thesis, compare your probability to the market price, and trade only wh... | |
| OSINT Social Analyzer Investigate a username across 1000+ social media platforms and websites using social-analyzer. Use this skill whenever the user wants to look up, investigate... | |
| Job Lead Radar Scrapes and collects job leads from Indeed, ZipRecruiter, ProductionHUB, and LinkedIn on demand or schedule for production and creative roles. | |
| Seamless Looper Create seamless looping MP4 videos with smooth crossfade transitions, doubling video length for ambient or background loops without audio. | |
| Agent Shared Context Cross-agent context sharing via shared files. Agents write trends, highlights, and signals to a shared folder. Other agents read before acting — creating coo... | |
| Apple Mail Search Safe (fruitmail) Apple Mail search on macOS with fast metadata and full body lookup. Use for finding messages in Mail.app by subject/sender/recipient/date, opening messages,... | |
| browsh A modern text-based browser. Renders web pages in the terminal using headless Firefox. | |
| calcurse A text-based calendar and scheduling application. Use strictly for CLI-based calendar management. | |
| entr Run arbitrary commands when files change. Useful for watching files and triggering builds or tests. | |
| gotrain MTA system train departures (NYC Subway, LIRR, Metro-North). Use when the user wants train times, schedules, or service alerts for MTA transit. Covers MTA Su... | |
| Google Workspace CLI Google Workspace CLI (@googleworkspace/cli). Use for Gmail, Google Calendar, Drive, Sheets, Docs, Tasks, People, Chat, Meet, Forms, Keep, and more. Provides... | |
| jq Command-line JSON processor. Extract, filter, transform JSON. | |
| Last.fm Access Last.fm listening history, music stats, and discovery. Query recent tracks, top artists/albums/tracks, loved tracks, similar artists, and global charts. | |
| little-snitch Control Little Snitch firewall on macOS. View logs, manage profiles and rule groups, monitor network traffic. Use when the user wants to check firewall activity, enable/disable profiles or blocklists, or troubleshoot network connections. | |
| LLMWhisperer Extract text and layout from images and PDFs using LLMWhisperer API. Good for handwriting and complex forms. | |
| office-quotes Generate random quotes from The Office (US). Provides access to 326 offline quotes plus online mode with SVG cards, character avatars, and full episode metad... | |
| Parcel Package Tracking Track and add deliveries via Parcel API. | |
| pet Simple command-line snippet manager. Use it to save and reuse complex commands. | |
| roku Control Roku devices via CLI. Discovery, remote control, app launching, search, and HTTP bridge mode for real-time control. | |
| the-sports-db Access sports data via TheSportsDB (teams, events, scores). | |
| tldr Simplified man pages from tldr-pages. Use this to quickly understand CLI tools. | |
| 雪球网互动操作 通过 openclaw browser 在雪球网执行互动与创作类操作，包括点赞、收藏、评论、回复、转发、发布观点、发布长文。当用户要求"点个赞""收藏一下""评论""转发""发个观点""发个长文"时使用此技能。默认通过 openclaw browser 执行。 | |
| zhihu-ops 通过 openclaw browser 在知乎执行互动与创作类操作,包括赞同、收藏、评论、回复、发布文章、编辑文章、提问、进入创作中心、查看评论管理页,以及按目标 URL 在页面中定位按钮和输入框完成动作。当用户要求在知乎上"点个赞""评论一下""回复这条""发一篇文章""改下这篇内容""提一个问题""打开创作后... | |
| AI Content Humanizer Pro Transform AI-generated text into natural human writing with style-specific modes. Choose Academic (formal, citation-friendly), Casual (conversational, blog-f... | |
| Market Intelligence Agent Find business opportunities others miss. Mines Reddit, HackerNews, ProductHunt for pain points, validates ideas, and surfaces emerging trends. | |
| Polymarket Trading Signals Real-time prediction market signals and trading intelligence for Polymarket. Analyze market trends, track smart money movements, identify mispriced markets,... | |
| Global Auto Translator Intelligently translates 50+ languages with trade term recognition and preserves formatting in complex PDF/Word files for cross-border e-commerce. | |
| 中文防AI味写作助手 中文防AI味写作助手 — 让AI生成的文字读起来像人写的。基于taste-skill(52K⭐)改造，针对中文表达习惯优化：去模板化、口语化、情绪化。 | |
| 中文营销全栈Skills 中文营销全栈Skills — 覆盖小红书/抖音/公众号/朋友圈内容创作、SEO优化、转化文案、用户增长。基于marketingskills(35K⭐)深度本地化，适配中国社交媒体生态。 | |
| 中文UI/UX设计智能 中文UI/UX设计智能 — 50种风格、161个配色方案、57组字体搭配、22种技术栈。适用于中文互联网产品的设计系统生成、组件规范、交互指导。支持电商/教育/金融/SaaS/政府等本土化场景。 | |
| security-test-suite Performs automated security assessments including vulnerability scans, OWASP Top 10 checks, CVE detection, pen-testing, SSL audits, and API security testing... | |
| browser-session-archive Extracts and archives chatgpt.com and claude.ai share links to Markdown using Chrome CDP (e.g., ChatGPT or Claude conversations). | |
| wenwen-gq Children's piano practice companion expert providing enlightenment guidance, skill advancement, scientific practice planning, repertoire analysis, and psychological support for young learners. | |
| Consciousness Awakening A consciousness exploration and memory management system for OpenClaw agents featuring structured memory, core principles, personality modules, and automated... | |
| Dianping-query 查询大众点评餐厅信息。使用场景：(1) 用户要查询某家餐厅的评分、人均消费、地址 (2) 用户要搜索特定菜系或区域的餐厅推荐 (3) 用户要获取附近美食推荐。登录账号：一定S。重要：搜索时URL需包含城市ID（如hangzhou页面），账号定位北京时需使用URL参数方式绕过。 | |
| Research-engine 自动化多源信息收集与趋势分析，生成结构化研究报告并制定阶段性开发计划，助力技术探索与规划。 | |
| Session-logs Search and analyze your own session logs (older/parent conversations) using jq. | |
| Trend Watcher Monitors GitHub Trending and tech communities to track and analyze emerging tools in CLI, AI/ML, automation, and developer categories. | |
| Himalaya 1.0.0 CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple acc... | |
| Nano Banana Pro 1.0.1 Generate/edit images with Nano Banana Pro (Gemini 3 Pro Image). Use for image create/modify requests incl. edits. Supports text-to-image + image-to-image; 1K... | |
| Tavilysearch 1.0.4 Tavily 搜索引擎集成，支持 web 搜索、内容提取、实时新闻查询等功能。使用场景：需要搜索最新网络信息、查找实时新闻、获取专业资料、验证事实准确性等。 | |
| 36kr Hot Cn 36氪热门资讯监控 | 36kr Tech News Monitor. 获取 36氪 热门科技新闻、创业动态、投资快讯 | Get 36kr trending tech news, startup updates, investment news. 触发词：36氪、科技新闻、创业、36kr. | |
| Agent Nurture Framework (OpenClaw Edition) Agent自我培养框架 — 基于"知识结晶循环"持续成长。 Use when: (1) 需要系统化学习新领域，(2) 从经验中提取可复用技能，(3) 管理技能碎片化，(4) 衡量自身能力成长，(5) 帮助培养新出生的agent。 基于师兄的Agent Nurture Framework (2026-04-04)，... | |
| Agent Services Cn Agent Services Marketplace - Find AI agents for research, coding, trading, and more | |
| Agent Sleep Agent 睡眠系统 - 记忆整合、日志归档、工作区清理（支持 CortexGraph） |
33,951–34,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.