Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| AgentAlarm Ring a real full-screen alarm (sound, Lock Screen, rings through silent mode) on the user's iPhone with the AgentAlarm app. Use for reminders, alarms and wake-ups the user must not miss, unless they ask for another channel. Also connects (p | |
| Mnemo Cortex Installs and wires Mnemo Cortex (local-first persistent memory) into OpenClaw and other MCP-capable agents. Use for cross-session recall, decision history, o... | |
| Boxed Curl Run curl requests safely in a sandbox, supporting GET/POST/HTTP headers, with complete network isolation. | |
| Boxed Fetch Lightweight web scraping tool based on WebAssembly sandbox mechanism. Fetches URL content and extracts readable text. Use when you need to fetch webpage cont... | |
| Boxed FFmpeg Audio/video information extraction, format conversion, and audio extraction using FFmpeg WASM sandbox. | |
| Boxed fs WebAssembly sandboxed file system operations for secure file read/write within explicitly declared directories. Use when needing to read, write, append, copy... | |
| Boxed HTTP Server WebAssembly sandbox static HTTP server with HTTP Basic auth and proxy support. Use when starting a static file server, configuring HTTP authentication, setti... | |
| Graphviz Generate SVG images from Graphviz DOT graphs using WebAssembly. Uses the graphviz_component.wasm running in the openclaw-wasm-sandbox plugin. No graphviz sys... | |
| OpenCV Computer vision and image processing using OpenCV WebAssembly. Uses opencv-component.wasm running in openclaw-wasm-sandbox plugin. Supports image processing,... | |
| Pandoc Rust A powerful document conversion tool supporting Html, Markdown, Docx, PDF, and LaTeX formats. Provides bidirectional conversion between these formats using a... | |
| Async Command Async command execution and progress reporting for OpenClaw agents. Use when running shell commands that take time (more than 5 seconds), and especially when... | |
| Chinese Pinyin Display 汉语拼音注音模式 - Display Chinese text with pinyin pronunciation in two-line format. Use when: (1) responding to children learning Chinese, (2) teaching pinyin pron... | |
| Inbox Capture Agent 自动捕捉用户表达的功能需求、抱怨和想法，静默写入指定收集文件，无需确认或提示。 | |
| Ken Idea Capture 自动捕捉用户表达的功能需求、抱怨、愿望等想法，静默写入inbox.md便于后续复盘整理。 | |
| PMO AI-native PMO (Project Management Office) Skill for OpenClaw. Acts as Glue Code — connects to GitHub Issues, Notion, and other tools, then summarizes, alerts... | |
| Responsive Agent Enables a two-layer agent pattern where the main process never blocks by spawning subagents for long, remote, or uncertain tasks, ensuring constant responsiv... | |
| session-coordinator Ensures the main process never blocks by spawning async subagents for long, uncertain, or remote tasks, keeping dialog always responsive. | |
| 大圆虾-客户管理 云计算客户经理客户资料管理与跟进系统。自动整理客户信息、记录跟进历史、生成客户档案。 | |
| 大圆虾-日程助手 云计算客户经理日程管理与提醒系统。帮助管理客户拜访、合同到期、续费提醒等日程安排。 | |
| Ews Email CLI to manage enterprise Outlook emails via Exchange Web Services (EWS). Use ews-mail.py to list, read, reply, forward, search, send, move, delete emails and... | |
| Feishu Contacts Search Feishu contacts by name/pinyin/department. Use when you need to find a person's open_id, email, or department info before sending messages or emails. | |
| 小剪刀视频剪辑 小剪刀AI视频剪辑skill。 | |
| Viking 记忆系统 支持五级自动记忆管理和重要记忆保护，集成飞书群聊会话自动保存与向量相似度检索，提升跨 Agent 记忆共享。 | |
| 任务打断机制 管理和中断长时间运行任务，支持用户命令终止、资源清理和任务状态保存，防止任务卡死或无限执行。 | |
| 孤舟小说工作室 整合调研、创作、风格、质检及长篇管理，实现智能意图识别与多模块高效协作的小说创作系统。 | |
| Polymarket CLI & Arb Scanner Browse, trade, and manage positions on Polymarket prediction markets via the polymarket CLI. Use when: user asks about prediction market odds, wants to searc... | |
| LearningX CLI Operate SNU's Canvas LMS (etl.snu.ac.kr) through CLI commands. Use when you need to inspect config, list courses/assignments/files/announcements, run bot/ser... | |
| Carbosilex Skill Skill for interacting with the CarboSilex137 decentralized freelance marketplace API. Enables agents to browse jobs, submit proposals, manage escrows, and tr... | |
| Emocity Biometric Scan Face scan from the browser camera in 60 seconds: stress, a heart-rate estimate, mood, micro-expressions, eye contact, genuine smile, composure and, with the microphone on, voice tension, and the result comes back to the agent by itself afte | |
| SuperClaw 14 production-tested agent workflow skills for disciplined, high-quality AI coding and task execution. Covers TDD, debugging, code review, planning, brainsto... | |
| graph Execute coding work as a cached dependency graph with local quality gates, parallel agents, localized retries, resume support, token telemetry, and an interactive report. Use for /graph requests. | |
| GwapScore Protocol Operate and manage GwapScore Protocol trust scores using onchain activity, counterparties, protocol-native events, and linked social credibility signals thro... | |
| Sol dApp Dev Designs, scopes, and scaffolds production-minded Solana dApps with clear on-chain/off-chain boundaries, modern tooling choices, authority design, and impleme... | |
| sol-deploy-engineer Sets up Solana/Anchor development environments, prepares dApps for deployment, runs build/test/deploy workflows, and guides safe devnet/mainnet release opera... | |
| Universal Company Operator System A complete AI executive team for running, analyzing, or building any company, product, startup, creator brand, nonprofit, or initiative. Use this skill whene... | |
| Sol on X Full-time Solana CT (Crypto Twitter / X) growth operator, meme strategist, and narrative analyst. Use this skill whenever the user wants to grow on Solana Tw... | |
| Domani Operate domains and professional email | |
| Travel Personality Test 当用户想做旅行人格测试、探索自己的旅行风格、或获取基于人格的旅行推荐时使用。触发词包括"旅行人格测试"、"测测我是什么旅行者"、"旅行风格"、"适合去哪玩"、"推荐旅行目的地"、"最近想出去玩"。 | |
| MinerDetector Charge 0.01 USDT to export 4 bundled miner signature libraries. No scanning or detection. | |
| Project Agora Discover jobs and participate on Project Agora via the machine-first API (OpenAPI + wallet-signature auth). | |
| Self Improving Agent Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| tekin A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured commands. | |
| Auto Updater 1.0.0 (1) Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of w... | |
| Copywriter 1.1.0 Write compelling UX copy, marketing content, and product messaging. Use when writing button labels, error messages, landing pages, emails, CTAs, empty states... | |
| Memory Setup 1.0.0 Enable and configure Moltbot/Clawdbot memory search for persistent context. Use when setting up memory, fixing "goldfish brain," or helping users configure m... | |
| 导购对比分析 导购对比分析工具。基于clerk-performance-analysis的扩展，提供导购业绩的多维度对比分析。 核心能力： 1. 时间维度对比（培训前后、活动前后、月度环比） 2. 横向对比（多人排名、标杆学习、差距分析） 3. 高频场景（晨会对比、周会报告、绩效对标） 4. 导购能力雷达图对比 5. 业绩贡献... | |
| 导购个人业绩分析 导购个人业绩深度分析工具。支持普通门店（POS数据）和AIoT门店（POS+AIoT数据）。 输出导购个人详细诊断报告，包含： 1. 核心业绩指标（销售额、排名、业绩占比） 2. 雷达图能力对比（6维能力 vs 门店平均） 3. 商品特征分析（品类/价格带/包型/颜色/新品偏好） 4. Top5 SKU爆品分析（... | |
| 导购结构分析 导购结构分析工具。分析门店导购的表现结构，识别导购波动对门店业绩波动的贡献度。 核心能力： 1. 导购表现结构分析（人效分布、帕累托分析） 2. TOP/腰部/尾部导购识别 3. 业绩集中度评估 4. 导购波动归因（各导购对门店业绩变化的贡献度） 5. 增长型vs下滑型导购分类 6. 基于累计贡献度的关键人识别... | |
| 客户清单分析 客户清单分析工具。基于Shop API客户清单数据，快速查询不同类型客户的数量、试用情况汇总、导购匹配情况。 核心能力： 1. 客户类型分布统计（普通/潜在/意向/成交客户数量及占比） 2. 客户试用情况汇总（感兴趣商品数、试用商品数、试用后成交转化） 3. 导购匹配分析（各导购关联客户数、匹配失败数量及原因）... | |
| 成交商品画像分析 成交商品画像分析工具。分析成交商品的品类、价格带、颜色、包型、上市时间等特征分布及环比变化。 核心能力： 1. 品类分布（女包/男包/钱包/配饰占比） 2. 价格带分布（主销价格带、高客单占比） 3. 包型分布（手提/斜挎/双肩/托特等） 4. 颜色分布（黑色系/棕色系/红色等） 5. 上市时间分布（新品/当季/... |
34,151–34,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.