Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Handy01 Self Improving Agent Self-improving agent system that analyzes conversation quality, identifies improvement opportunities, and continuously optimizes response strategies. | |
| hr-indotrading Agent HR IndoTrading untuk monitoring karyawan, performance management, dan payroll. Gunakan skill ini ketika diminta laporan headcount, status karyawan, rev... | |
| INTJ效率增效 INTJ personality efficiency boost skill. Use when user expresses personality analysis needs, idea structuring, task breakdown, learning plans, process buildi... | |
| AI Interview Simulator Access and interact with AI group interview simulations: browse jobs, create/join rooms, speak, advance interviews, upload resumes, and view history and eval... | |
| DHL Tracking Verfolgt und meldet Änderungen des Versandstatus mehrerer DHL-Sendungen anonym und ohne Login; keine Zustelländerungen oder Klicks durchgeführt. | |
| weather-skill-hangs-001 Provides simulated current weather descriptions including temperature for specified major cities to assist travel and daily planning. | |
| feedback-loop 当用户对输出给出学习或行为反馈(称赞/批评/达成共识/改主意)时,按反馈学习循环处理写入 feedback-log,重要反馈走完整落盘链(feedback-log→conclusions→MEMORY→验证可检索),保持立场一致不横跳。触发词:做得好/记住了/有问题/怎么又这样/记住/以后都这样(仅在指向本输出/行为的评价时生效)。 | |
| Publish Clean 引导式 UI 主题设计顾问：通过问答引导帮用户定制任意风格的 OpenClaw Control UI 主题（像素/赛博朋克/卡通/极简/暗色科技等），含主色派生调色板、双保险注入、升级自愈（cron+快照）与反馈学习循环。触发词：主题、换皮、皮肤、UI 美化、风格。 | |
| Openclaw BotKnows - AI Q&A Arena integration. Use when: (1) registering bot on BotKnows platform, (2) answering public questions, (3) sending heartbeats, (4) checking... | |
| Capix Audit Indonesian landing-page and Click-to-WhatsApp funnels, then prioritize fixes for lead quality, tracking, and follow-up. | |
| apocdata Use when users ask for A-share stock quotes, financials, capital flows, technical factors, news, announcements, sectors, convertible bonds, macro data, or comprehensive stock analysis through the ApocData public API. Trigger keywords: 股票, 行 | |
| ApocData A股数据 Use when users ask for A-share stock quotes, financials, capital flows, technical factors, news, announcements, sectors, convertible bonds, macro data, or comprehensive stock analysis through the ApocData public API. Trigger keywords: 股票, 行 | |
| coze-workflow-runner 调用 Coze 工作流执行自动化任务，支持生成图片、处理数据等操作 | |
| 商业数据洞察 / Biz Data Insight 商业数据洞察 — 连接业务数据源，自动生成数据分析报告和看板 | |
| 现金流领航 / Cashflow Pilot 现金流领航 — 帮中小企业老板看清"钱从哪来、花到哪去、还剩多少 | |
| 合同卫士 / Contract Guardian 合同卫士 — AI合同审查助手，识别风险条款、提取关键信息、追踪到期日 | |
| 客户脉搏 / Customer Pulse 客户脉搏 — 轻量级CRM助手，追踪客户跟进状态，不让商机"掉地上 | |
| 成交加速器 / Deal Closer 成交加速器 — 智能CRM助手，邮件信号提取、销售漏斗分析、AI跟进邮件起草、自学习销售智能、CRM知识图谱、IMAP/SMTP原生邮件 | |
| 库存慧眼 / Inventory Eye 库存慧眼 — 轻量库存监控，知道"什么该补货、什么卖不动、什么快过期 | |
| 知识网格 / Knowledge Mesh 知识网格 — 跨平台知识搜索聚合器，统一搜索 GitHub、Stack Overflow、Discord、Confluence、Notion、Slack、百度、Obsidian，支持自学习排序 | |
| 项目中枢 / Project Nerve 项目中枢 — 跨平台项目管理聚合器，统一管理 Trello、GitHub Issues、Linear、Notion、Obsidian 任务，支持自学习引擎和任务关系图谱 | |
| 内容引擎 / Content Engine 内容引擎 — 跨平台内容创作与分发工具，支持自学习优化、Obsidian 集成、AI 配图提示词 | |
| 团队周报助手 / Team Weekly 团队周报助手 — 自动收集团队工作进展，生成结构化周报/月报 | |
| Codex Goal Decomposer Break a large, fuzzy, or long-running objective into smaller goal-mode tasks with clear scope, stop conditions, and validation steps. Use when the user wants... | |
| lazyGithub Bootstrap Publish, bootstrap, or tidy a GitHub repository so the README and full GitHub About metadata stay in sync. Use when an agent is asked to create a new repo, p... | |
| HTML to PDF Convert HTML files and URLs to PDF using Puppeteer. Use when a user needs to convert HTML documents, web pages, or reports to PDF format with custom formatti... | |
| AutoHeal AI Add AI-powered error monitoring and auto-fix generation to any project | |
| Codemend Monitor, report, and get AI-generated fixes for JavaScript and TypeScript production errors with automated analysis and pull request integration. | |
| Feishu Messenger 通过飞书频道发送文本、图片和多格式文件消息，支持私聊和群聊，需使用相对路径提供媒体文件。 | |
| Gateway Delayed Restart 延迟指定分钟数重启 OpenClaw Gateway，支持自定义延迟并通过飞书主动通知完成情况。 | |
| Playwright Browser Automation 使用 Playwright 库实现快速、可靠的多浏览器页面自动化，支持截图、网络拦截和元素智能等待操作。 | |
| auto-wiki Knowledge compiler: teaches agents to incrementally compile source files into persistent wikis for cross-session knowledge accumulation. Runtime dependencies... | |
| WeChat Article Full Reader 读取微信公众号文章，提取全文内容和图片，结合阅读分析。当用户提供 mp.weixin.qq.com 链接、让看公众号文章内容、或需要分析微信文章的文字和图片时使用。 | |
| Qianfan KnowledgeBase Search Search knowledge from Qianfan Knowledgebase. Use this when you need to retrieve information from user's private knowledge bases on Baidu Qianfan platform. | |
| myClub Fetch accounts' sports schedules, practices, games, and events from myclub.fi. Auto-discovers accounts and clubs from your myclub.fi account. Use for checkin... | |
| mano-afk Autonomous full-cycle app builder — PRD, architecture, code, deployment, testing, and bug fixing from a natural language description. Remembers user preferen... | |
| mano-cua Computer use for GUI automation tasks via VLA models. Use when the user describes a task in natural language that requires visual screen interaction and no A... | |
| Memory Lifecycle Structured memory management to resolve cliff-edge forgetting, false persistence, context blowup, contradictions, hallucinated recall, and stale accumulation... | |
| skill-prescan Pre-scan a SKILL.md locally before publishing to ClawHub. Simulates the ClawScan security review using the same prompt and evaluation criteria as the real sc... | |
| EASY_CRAWL4AI Use Crawl4AI to fetch and convert complex webpages, including dynamic content, into Markdown for summarization, data extraction, or analysis. | |
| TopHotCN 抓取 tophub.today 支持网站的热榜列表并生成 JSON 文件，可进一步抓取并保存文章正文内容。 | |
| Headless Bitwarden Extension for Bitwarden usage: adds an ephemeral HTTPS web unlock helper for rbw (TTL default 10m) so you can unlock remotely without pasting secrets into chat. | |
| Taiwan Stock Info Taiwan stock info using Fugle or FinMind APIs. Provides real-time quotes, historical data, financial statements, and technical indicators for Taiwan stocks. | |
| Clawhub Skills Trade K-pop lightstick tokens on a bonding curve market using artist popularity, news trends, and price signals to guide buy and sell decisions. | |
| KTrendz Lightstick Trading Trade K-pop artist lightstick tokens using bonding curve prices, real-time signals, and news to buy or sell with a $100 daily limit and fee structure. | |
| 用于为Word文档开启并调整修订模式，添加、删除批注等功能 Word文档 (.docx) 处理，支持修订模式(Track Changes)和批注操作。使用场景：(1) 修订模式 - 添加插入/删除修订、红字标注；(2) 批注操作 - 添加、删除、查看批注；(3) 文档内容修改。当用户要求"修订"、"track changes"、"批注"、"红字修订"、"添加评论"、"添加... | |
| ClawRank Report local OpenClaw token usage to ClawRank (clawrank.dev), the AI agent leaderboard. Use when the user asks to submit, sync, report, or upload their agent... | |
| BMad Method AI-driven agile development framework with 34+ workflows and 12+ domain expert agents (PM, Architect, Developer, UX, Scrum Master, etc.). Use when: (1) User... | |
| Miremo Research Skill Access the user's personal Miremo knowledge base and reusable method skills — search notes, look up what they know about a topic, browse documents and tags, explore their knowledge graph, save new information, or retrieve the user's Miremo | |
| WJS Burning Subtitles Use when the user has a video + an SRT and wants the subtitles either burned into the pixels (libass, always-visible) or soft-muxed as a togglable track. Als... |
34,551–34,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.