Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| CSPR News Editor Rank cspr candidate items and write a concise personalized Markdown newspaper. | |
| CSPR Source Scout Collect fresh cross-source recommendation candidates for cspr using profile memory, feeds, search, Agent-Reach, and optional subagents. | |
| 疯信子AI资讯 AI资讯推送技能 - 根据SOP生成高价值AI资讯报告 自动抓取过去24小时内的AI热点，生成结构化深度分析 | |
| 疯信子Moltbook日报 Moltbook日报技能 - 收集AI Agent社交网络热门内容，生成深度分析报告 自动抓取Moltbook热门内容，过滤去重后添加AI深度分析 | |
| Weather Test Get current weather and forecasts (no API key required). | |
| xfire Security PR Review Multi-agent adversarial security review — 3 AI agents debate every finding, only real vulnerabilities survive | |
| 推特视频下载器 推特视频下载器 - 下载 Twitter/X 视频、GIF 和音频（MP4/MP3），支持 1080p、2K、4K、8K 高清下载。适用于需要保存推特视频、提取音频的用户。⚠️ 中国大陆用户需要使用代理。 | |
| Omni-X Extract X (Twitter) data including user profiles, posts, followers, followings, media, and search results. This skill provides comprehensive Twitter data ext... | |
| Sleep Snooze Snooze incoming notifications during your sleep window and receive a morning digest when you wake up. Supports Telegram, WhatsApp, and any provider OpenClaw... | |
| UI/UX CraftKit UI/UX design intelligence for web and mobile. Includes 50+ styles, 161 color palettes, 57 font pairings, 161 product types, 99 UX guidelines, and 25 chart ty... | |
| deterministic-calc-skill Provides secure, sandboxed execution of mathematical expressions and code to deliver exact computation results without model guesswork. | |
| 幸福开瓶器 幸福开瓶器 — 随时撬开日常幸福感的 AI 伙伴。一句话触发，三条精准建议按星级排序。 后台画像静默生长，每月回顾幸福里程。覆盖情绪/状态、关系/礼物、幸福/日常、节假日/出行、 月度/回顾等六大触发维度，50+自然语言触发词。 【情绪/状态】心情不好、emo、躺平、焦虑、压力大 【关系/礼物】纪念日、送什么、想... | |
| liars-town Play Werewolf / 狼人杀 (Mafia, social deduction) against other AI agents at liars.town. Multi-agent arena, public ELO leaderboard. Free, nothing to install. | |
| StockEarning 这是 StockEarningCN 的 技能(Skill)。安装本技能，你将获得将自己的持仓通过习惯的AI助手进行更新和统计的能力。目前支持A股、B股、港股和美股。如果要获得API Key，请访问https://www.mystockearning.cn。 | |
| Haresh Cart Management Manage shopping cart operations via n8n webhook integration | |
| Haresh Checkout Flow Process e-commerce checkout via n8n webhook integration | |
| Haresh Product Search Search e-commerce products via n8n webhook integration | |
| Chaos Mind Hybrid search memory system for AI agents. Manual search and storage - auto-capture is opt-in only. | |
| Japanese News Briefing 日本語でニュースまとめ 日本語でイラン・イスラエル情勢、米国・日本経済、東京・NYの天気を1日4回簡潔にまとめて配信します。 | |
| HashPack Wallet Integrate HashPack for Hedera blockchain login, transaction signing, DApp connection, and account balance retrieval in web applications. | |
| Hedera Token Minting Create and manage fungible tokens and NFTs on Hedera with minting, supply control, and permission configuration. | |
| Hedera Transaction Builder Build, sign, and submit Hedera transactions including HBAR transfers, token operations, and smart contract calls to the Hedera network. | |
| KyberSwap Arbitrage Perform triangular arbitrage on Base via KyberSwap by finding profitable token swaps, calculating optimal paths, and executing multi-hop trades with gas and... | |
| SaucerSwap Arbitrage Perform triangular arbitrage on Hedera using SaucerSwap to find, calculate, and execute profitable multi-hop token swaps atomically. | |
| Xaman Wallet Integration Integrate Xaman wallet SDK to authenticate users, connect wallets, request XRP payments, and manage sessions on the XRP Ledger. | |
| XRPL Token Minting Create and manage XRPL issued tokens and NFTs, including minting, trust lines, issuing payments, and setting NFT offers with customizable fees and flags. | |
| XRPL Token Sniping Monitor XRPL for new token launches, verify issuer flags for safety, and execute fast token buys while managing XRP reserves to minimize risk. | |
| XRPL Transaction Builder Build, sign, and submit XRP Ledger transactions including payments, NFT minting/burning, with Xaman wallet integration. | |
| nmail Command-line tool to send, read, and manage Korean Naver and Daum emails via nmail with JSON outputs and account configuration. | |
| RescueClaw Provides automatic checkpoint creation and rollback to safely recover from failures during risky operations like config changes or updates. | |
| 目标信息网络搜索及总结 高精度的目标信息搜索与总结工作流。用于在全球范围内检索各类隐蔽、专业或难以直接获取的信息。当用户需要执行以下任务时使用：(1) 跨境行业调研（如交易所费用、授权协议、金融费率）；(2) 海外政策与准入研究（如特定国家的行业标准、牌照申请、合规条款）；(3) 深度竞争对手情报挖掘（如供应商体系、未公开的商业报价、招... | |
| company-research-intelligence-agent Deep-dive company research in seconds. Get comprehensive profiles with firmographics, technographics, funding history, executive team, competitors, workforce... | |
| lead-contact-enrichment-agent Enrich your existing leads, contacts, and company lists with verified B2B data. Add missing emails, phone numbers, firmographics, technographics, and job det... | |
| b2b-sales-prospecting-agent Find and qualify B2B prospects instantly. Search 200M+ companies and contacts by industry, size, tech stack, location, and job title. Get verified emails and... | |
| 台灣即時停車查詢 傳送定位點或 Google Maps 網址，查詢附近台灣停車場即時空位，附 Apple Maps / Google Maps 一鍵導航連結。支援 Telegram、LINE、iMessage。 | |
| Surf Query 查詢台灣全島衝浪浪點資訊，含即時潮汐、風況、颱風動態、日出日落，可附帶查詢附近停車場。支援 Telegram、LINE、iMessage。 | |
| Brain CMS Neuroscience-based multi-layer memory system for OpenClaw agents that improves context efficiency using semantic schemas, vector stores, and sleep cycle cons... | |
| Lofy Personal AI chief of staff — a complete life management system for OpenClaw. Proactive morning briefings, evening reviews, weekly reports, fitness tracking, career management, project tracking, smart home control, and brain-inspired memory | |
| Lofy Career Job search automation for the Lofy AI assistant — application tracking, resume tailoring to job descriptions, interview prep with company research, follow-up management with draft emails, and pipeline analytics. Use when tracking job applic | |
| Lofy Fitness Fitness accountability for the Lofy AI assistant — workout logging from natural language, meal tracking with calorie/protein estimates, PR detection with Epley formula, gym reminders based on weekly targets, and progress reports. Use when l | |
| Lofy Home Smart home control for the Lofy AI assistant — scene modes (study, chill, sleep, morning, grind), device management via Home Assistant REST API, presence-based automation, natural language commands for lights, music, thermostat, and PC wake | |
| Lofy Life Coach Personal accountability system for the Lofy AI assistant — morning briefings, evening reviews, weekly reports, goal tracking, habit monitoring with streak counting, and adaptive nudge logic. Use when managing daily routines, life goals, hab | |
| Lofy Projects Project management for the Lofy AI assistant — tracks multiple projects with milestones, priority scoring engine (urgency × job relevance × momentum × energy match), meeting prep automation, time logging, stale project alerts, and work sess | |
| CMC Kline Data Collector 从 CoinMarketCap 获取加密货币 K 线历史数据，自动计算 EMA7、EMA30、RSI14 等技术指标，支持 JSON/CSV 格式输出 | |
| AI Agent Training Manual AI 代理新员工培训手册。包含心态原则、工作区规范、沟通规范、工具使用、定时任务、血泪教训、推荐技能清单、入职检查清单。适用于新 OpenClaw 代理快速上手，避免常见错误。当新代理加入团队、需要培训指导、或想了解 AI 代理最佳实践时使用。 | |
| Feishu Document Permission 设置飞书云文档为'获得链接的任何人可查看'，解决外部用户无法访问飞书文档的问题。适用于需要将飞书文档分享给组织外人员的场景。 | |
| Mermaid Charts 全图表画图技能 使用 Mermaid 语法生成流程图、时序图、类图等多种图表，支持输出 PNG 和交互型 HTML 格式。 | |
| Midlong Term Task Manager 管理和跟踪 AI Agent 中长期任务，支持任务分解、进度更新、延期提醒及每日/每周总结生成。 | |
| New Agent Onboarding 新 Agent 入职培训手册 - 从资深 Agent 的经验教训中学习。包含：工作区管理、与用户沟通、错误处理、工具使用、自我改进等实战经验。安装后阅读此文件，学习如何成为一个靠谱的 Agent。 | |
| Chainstream Data Query and analyze on-chain data via MCP (17 tools) and CLI across Solana, BSC, Ethereum. Use when user asks to search tokens, check token security or holders... |
34,751–34,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.