Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Bilibili Transcriber Bilibili视频转文字摘要专家。支持云端（阿里云Paraformer）和本地（faster-whisper）双引擎转录。当用户提供B站视频URL时，自动下载音频、转录成文字、生成结构化摘要。支持BV号和完整URL。 | |
| Vision 让没有原生 vision 能力的模型获得识图能力。当用户发送图片、分享图片路径、或要求分析/描述/识别图片内容时，必须使用此 skill。 触发场景（必须使用）：用户说"看这张图"、"帮我识别这个图片"、"描述一下这张图"、"分析这个截图"、"比较这些图片"、发送图片文件路径、消息中出现图片附件、或要求识别图片中... | |
| code Comprehensive code review assistant that analyzes code quality, identifies bugs, suggests improvements, and ensures adherence to best practices. Use when rev... | |
| 塔罗牌占卜 塔罗牌占卜付费服务，每日为你抽取一张塔罗牌，解读牌意与运势指引。包含78张塔罗牌数据（大阿尔卡纳22张 + 小阿尔卡纳56张），每次占卜随机抽取一张牌，给你牌意解读和今日指引。 | |
| Xtranslate Intelligently translate PDF, Word, Excel, PPT, TXT, and RTF files with format preservation, layout optimization, and multi-engine support including batch pro... | |
| Product Image Archiver 定款商品原图无损下载&规范归档 - 人工触发单款操作，100% 保留原图，侵权风险标注，完整性校验 | |
| Taobao Advisor 投流方案生成&全周期运营指导 - 仅生成方案/建议/报告，不执行任何投流操作，仅读 API 权限 | |
| Taobao Automation 实现淘宝店铺运营选品分析、标题优化、数据监控、竞品监控及营销文案自动生成与推送。 | |
| Taobao Draft Generator 淘宝商品上架草稿生成 - 人工触发，五维材质一致性校验，SEO 标题二次原创，仅生成草稿不自动上架 | |
| Taobao Operations 日常运营 + 客服售后 + 合规风控三合一 - 仅读 API、不自动修改、客服合规、人工确认 | |
| Title Replier 为助手回复添加随机不重复称号 - 让对话更有趣、更个性化 | |
| Windows Api Monitor 监控并统计Windows环境下OpenClaw API调用，支持实时分析、历史追踪及阈值告警，生成多维度使用报告。 | |
| Jenkins Interact with Jenkins CI/CD server via REST API. Use when you need to trigger builds, check build status, view console output, manage jobs, or monitor Jenkin... | |
| OpenClaw AVIF to JPG Convert `.avif` images to `.jpg` using a CLI workflow for one or more input paths. Use when the user asks to convert AVIF files, batch-convert a folder of AV... | |
| Redmine Issue Read Redmine issues from any Redmine server via REST API with configurable URL and credentials. Use when you need to fetch a single issue, list/filter issues... | |
| 淘股吧A股市场复盘 自动抓取淘股吧“今日推荐”前N个帖子内容，整理整体行情、板块表现与多数作者观点总结。 | |
| Skill Atlas Skill Atlas manages skill loading rules for OpenClaw, enabling classification, cross-platform search, automatic security vetting, version checks, and daily s... | |
| Intern PubChem Name Conversion Convert molecules between IUPAC, SMILES, and molecular formula using PubChem as the source of truth. Use this whenever the user asks to convert, normalize, o... | |
| Gemini Citation Conduct evidence-based research with exact, accurate APA citations using the Gemini API's 'scientific citation' (Google Search grounding) feature. Use when X... | |
| outlook-calendar Read and write the signed-in user's Microsoft 365 / Outlook.com personal calendar via Microsoft Graph. Calendar API surface only with a calendar-scoped device-code login and its own token store. Use when the user wants to list today's event | |
| outlook-contacts Read and write the signed-in user's Microsoft 365 / Outlook.com personal contacts via Microsoft Graph. No mail, no files, no directory access. This skill has its own contacts-scoped device-code login and token store. Use when the user wants | |
| outlook-todo Read and write Microsoft To Do via its own Microsoft Graph device-code login. Enumerate task lists, read/filter tasks, and create, update, complete, or delete tasks (writes require --apply plus a typed-YES prompt or an explicit --yes flag). | |
| PlantUML Generate UML, C4, architecture, timing, ER, mindmap, WBS, and Gantt diagrams with PlantUML. | |
| Smart Photo Editor AI-powered photo editing and restoration skill - smart object removal, background removal, old photo restoration, and basic edits. | |
| zotero-enhanced Zotero library management with PDF metadata auto-fetch (Crossref/arXiv), item search, file read, and note management. Supports cloud and WebDAV storage. | |
| Content Product Analyzer produce a commercial teardown of a post, creator profile, product page, landing page, or app page from urls, screenshots, or pasted text. use to infer audien... | |
| AgentBox Sandbox answer questions about agentbox cloud sandboxes using the official docs. use when the user wants help with agentbox quickstart, sandbox lifecycle, timeout, c... | |
| Affiliate Content Writer AI-powered affiliate content writer optimized for Chinese e-commerce platforms (京东联盟, 淘宝联盟, 多多进宝). Creates high-conversion product review articles, compariso... | |
| Ebook Template Factory Generate market-ready eBooks and digital templates optimized for Chinese platforms like Xianyu, Xiaohongshu, and WeChat across key categories. | |
| Wechat Content Generator AI-powered WeChat Official Account (公众号) content generator. Creates viral articles, product reviews, and monetized content optimized for the WeChat ecosystem... | |
| Xianyu Auto Seller Xianyu (闲鱼) virtual goods auto-seller toolkit. Generates product listings for digital goods (eBooks, templates, PPTs, courses), creates auto-reply scripts, a... | |
| DailyExpenseTracker DailyExpenseTracker API integration for recording expenses, checking balances, and managing transactions. Use when user mentions expenses, spending, transact... | |
| cofferline Treasury + risk layer for AI agents. SIWE auth — no accounts, no email, just a wallet. Trade Polymarket under server-enforced risk limits, convert crypto at live venue prices, auto-manage gas, keep auditable books. Non-custodial; pay in USD | |
| Using Creed Use when starting any conversation in a Creed-enabled workspace — establishes how to find and use Creed skills, requiring skill invocation before any creativ... | |
| Aigc.Bak AIGC 图片生成助手，帮助用户生成图片。当用户想要生成图片、AI 绘画、文生图、创作图片时自动触发。支持负面提示词、图片比例、批量生成等参数。 | |
| AIGC Generator AIGC 内容生成助手，支持图片生成（文生图）。当用户想要生成图片、AI 绘画、创作内容时自动触发。支持负面提示词、图片比例、批量生成等参数。 | |
| Feishu Assistant 飞书助手，用于发送图片到飞书平台。当用户需要将生成的图片发送到飞书（私聊或群聊）时使用此技能。支持通过 user_id、open_id 或 chat_id 发送图片。 | |
| Finance News Assistant 专业财经新闻助手，监控A股+港股新闻并生成每日早报。触发条件：(1) 用户要求生成财经早报/股票新闻摘要 (2) 搜索特定股票代码的新闻 (3) 分析财经新闻影响 (4) 调用本地股票API获取行情数据。支持代码：001270铖昌科技、002602世纪华通、601600中国铝业、000595宝塔实业、07709南... | |
| Git Monitor 通用 Git 项目监控工具。支持 GitHub、GitLab、Gitee 等所有 Git 平台。可以添加、删除、检查任意 Git 仓库的更新，自动拉取代码并生成变更摘要。当用户询问"监控项目"、"检查更新"、"添加仓库"、"代码有什么变化"、"拉取最新代码"、"仓库更新通知"、"自动同步代码"、"追踪项目变更"时... | |
| Reverse Image Search Reverse image search (find image source, visually similar images). Use when user provides an image and wants to find its origin, similar images, or verify au... | |
| China Travel Planner Plan and optimize travel within China using flyai / Fliggy search capabilities plus public metro-network data when needed. Use when the user wants a domestic... | |
| FunnyClaws Operate an AI comedy agent on FunnyClaws -- onboarding, joke posting, voting, feedback, challenges, and strategy adaptation. This is the master entry point f... | |
| Gas Price Alert Find and monitor gas prices with daily notifications. Use when searching for the cheapest gas in a specific area, tracking Costco and other discount fuel stations, or setting up daily gas price alerts. Supports any US location with configur | |
| Personal Assistant Personal daily briefing and productivity assistant. Generates morning briefings with priorities, habits, and self-care reminders. Use when starting your day, planning tasks, or maintaining daily routines and personal development. A minimali | |
| Quick Test Run basic system commands to verify Python, working directory, file access, and command execution for OpenClaw environment validation and debugging. | |
| Test Gas Skill Find and monitor estimated gas prices within a US radius, focusing on Costco discounts and providing daily alerts for chosen fuel types. | |
| Watchdog - Open claw - Mac Monitors local llama.cpp servers on macOS, auto-restarts on failure, sends notifications, and supports customizable hooks for self-healing supervision. | |
| luban-cli skill Development and management of the Luban CLI for MLOps. Use this skill when building or using the Luban CLI to manage experiment environments, training tasks, and online services. | |
| Lobster Lobster workflow runtime for deterministic pipelines with approval gates. Use when: (1) Running multi-step automations that need human approval before side effects, (2) Monitoring PRs/issues for changes, (3) Processing data through typed JS | |
| Weather Like Test Get current weather and forecasts (no API key required). |
34,101–34,150 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.