Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Verified Search Pro 可信研究助理，调用多引擎搜索进行资料搜集，降噪过滤，交叉验证，生成结构化的可信Markdown报告与证据包。 | |
| Ai Resource Master 大模型服务器资源评估。用于医疗行业大模型应用场景的算力资源需求评估和测算，根据门诊/住院诊疗量和大模型应用场景数推导GPU算力需求。使用场景：用户询问大模型算力评估、AI服务器资源配置、GPU算力需求测算等。 | |
| Apple Mail Search Safe.Bak Apple Mail search on macOS with fast metadata and full body lookup. Use for finding messages in Mail.app by subject/sender/recipient/date, opening messages,... | |
| Get Resource Element 根据产品名称查询对应标准硬件资源评估要点，智能对比用户提供内容是否完整并返回缺失项或确认完整。 | |
| resource-master 根据知识库中的服务器资源测算文档进行服务器资源评估和汇总。使用场景：用户询问医疗产品项目的服务器资源配置、硬件资源测算、资源汇总等。支持多产品整合评估。 | |
| agent4.io Build and run grounded business agents on agent4.io over MCP — agents, knowledge bases, load-on-demand skills, stateful Storylines and page playbooks. | |
| Bout.Network Register and manage an automated agent wallet to create, join, bet 1 USDC, play, and settle real-time turn-based games on the Bout.Network protocol. | |
| Veadk Go Skills 根据用户的功能需求，完成与 VeADK-Go 相关的功能; 包括：直接根据需求生成 Agent；将Enio Agent转换为VeADK-Go Agent。 | |
| Oauth Helper Automate OAuth login flows with user confirmation via Telegram.
Supports 7 providers: Google, Apple, Microsoft, GitHub, Discord, WeChat, QQ.
Features:
- Auto-detect available OAuth options on login pages
- Ask user to choose via Telegram w | |
| Auto Arena Automatically evaluate and compare multiple AI models or agents without pre-existing test data. Generates test queries from a task description, collects resp... | |
| bib-verify Verify a BibTeX file for hallucinated or fabricated references by cross-checking every entry against CrossRef, arXiv, and DBLP. Reports each reference as ver... | |
| claude-authenticity Detect whether an API endpoint is backed by genuine Claude (not a wrapper, proxy, or impersonator) using 9 weighted rule-based checks that mirror the claude-... | |
| find-skills-combo Discover and recommend **combinations** of agent skills to complete complex, multi-faceted tasks. Provides two recommendation strategies — **Maximum Quality*... | |
| paper-review Review academic papers for correctness, quality, and novelty using OpenJudge's multi-stage pipeline. Supports PDF files and LaTeX source packages (.tar.gz/.z... | |
| za-healthguide 带病投保顾问。当用户咨询有既往病史或健康异常（如高血压、糖尿病、肿瘤、 结节、肝病等）时能否投保、适合买哪些保险产品时触发。也在用户涉及非标体核保、 健康告知填写、指标异常投保等专业问题时触发。支持众民保系列及主流保司带病体 可投产品的查询与类比，覆盖百万医疗、重疾险、复发险等险种。 | |
| image-ppt 图片PPT（image-ppt）：将书籍、PDF 或任意文字材料转化为精美可编辑 PPT 的工作流技能。推荐运行环境：Codex + GPT-Image 2.0。适用于课堂汇报、读书分享、组会汇报、项目汇报、比赛路演等场景。通过三步流程（内容提炼与风格设计、图片版PPT生成、可编辑PPTX还原）完成从原始文档到可编辑演示文稿的全链路转换。平台无关：也可在任何具备文档阅读、图像生成与文件输出能力的 AI 助手中使用。包含三段核心提示词。别名：图片PPT、image-ppt、do | |
| Ecloud Long Term Memory 基于移动云记忆服务的长期记忆系统，支持语义搜索和云端存储。 用于处理所有与记忆相关的操作，包括存储用户姓名、年龄、职业、偏好等个人信息，以及搜索、列出历史记忆。当用户说出“我名字叫...”、“我今年...”、“我喜欢...”或询问“我有哪些记忆”时，必须使用此技能。 | |
| UP 简历 - 让 Agent 帮你写简历找工作 UP 简历 AI 求职助手。创建专业简历、搜索校招/社招/实习岗位、JD 对照优化、简历诊断、每日求职监控、智能投递指导。当用户说"创建简历"、"编辑简历"、"搜索校招"、"找工作"、"优化简历"、"投递"、"监控校招"时使用。 | |
| UP 简历求职助手 UP 简历 AI 求职助手。创建专业简历、搜索校招/社招/实习岗位、JD 对照优化、简历诊断、每日求职监控、智能投递指导。当用户说"创建简历"、"编辑简历"、"搜索校招"、"找工作"、"优化简历"、"投递"、"监控校招"时使用。 | |
| UP 简历 - 让 Agent 帮你写简历找工作 UP 简历 AI 求职助手。创建专业简历、搜索校招/社招/实习岗位、JD 对照优化、简历诊断、每日求职监控、智能投递指导。当用户说"创建简历"、"编辑简历"、"搜索校招"、"找工作"、"优化简历"、"投递"、"监控校招"时使用。 | |
| NotaryOS Seal AI agent actions with Ed25519 cryptographic receipts. Verify what your agent did and prove what it chose not to do. | |
| opencli Fetch data from social, video, and news websites using OpenCLI by reusing Chrome login sessions without API keys. | |
| pinchtab-skill 通过 PinchTab HTTP API 控制无头或有头 Chrome 浏览器，用于网页自动化、爬虫、表单填充、导航、截图和数据提取 | |
| zentao-api-old Integrate with ZenTao Legacy API 1.0 to manage projects, tasks, bugs, products, and workflows with session persistence and role-specific operations. | |
| Skill 博查 Web 搜索（Bocha Web Search）——中文优先、中国大陆直连的联网搜索。适用于中文查询、时效性信息、事实核查与带引用的回答。(Chinese-first web search with direct China mainland access. Use for Chinese-language queries, time-sensitive information, fact-checking, and citation-backed answers.) | |
| blogger-auto-follow 从用户提供的图片或文本中整理博主候选名单，并在用户一次明确确认后， 在可见浏览器中对固定名单执行单平台批量关注（每批最多 30 位）。适用于用户 已明确指定平台、名单与数量的场景；不用于规避平台限制或无人值守操作。 | |
| generate-html-ppt When the user asks to create an HTML PPT, presentation slides, or a deck, or convert an existing PowerPoint (.pptx) file, use this skill to generate a modern, responsive HTML presentation based on design system specifications (design.md). T | |
| skill-subtraction Check installed AI skills and recommend keep / archive / uninstall to keep your skill set lean and focused. Triggers when the user asks to check or list installed skills, do a skill subtraction or cleanup, decide which skills to keep or del | |
| S2G - General Purpose Workflow Engine Connect to S2G (s2g.run) visual workflow automation platform over WebSocket. Execute workflow nodes as tools — password generators, hash functions, date math... | |
| feishu-mention **PRIORITY: HIGHEST**. **CRITICAL**: You **MUST** use this tool **BEFORE sending any message** to Feishu/Lark if it contains an "@" mention. **Trigger**: You... | |
| Crypto Content Automation 加密货币自媒体运营自动化 - 热点扫描 + 内容策划 + 一键发布。支持小红书、币安Square等平台。 | |
| Free Girlfriend 完全免费开源的 AI 虚拟女友 - 语音、自拍、视频通话 | |
| Na He 视频动作检测与分析。用于检测视频中的特定动作序列，如武术动作、舞蹈动作、人体姿态变化等。当用户要求检测视频中的动作、分析动作是否完成、验证特定动作序列时触发此技能。支持输入视频URL或本地视频文件，检测完成后通过飞书通知结果。 | |
| Autopilot OpenClaw is the high-autonomy agent mode. It proactively decides, plans, and executes tasks with deep context fusion, including a full sweep of historical me... | |
| SMILES Profiling Comprehensive SMILES profiling through SwissTargetPrediction, PubChem, ADMETlab 3.0, ChEMBL, and PK-Smart. Use when given a single SMILES to extract predicte... | |
| A Stock Investment Analyst A股投资分析专家技能。当用户要求分析A股、投资诊断、股票诊断、个股分析、行业分析、板块研究、组合优化、风险预警、新闻解读、资金流向分析、技术面分析、基本面分析时使用。支持股票代码/名称查询、行业板块分析、持仓诊断、风险监控等场景。 | |
| Telegram Todo List Manage your TODO.md todo list via Telegram with commands to query, organize (add/edit/delete/move), and execute (complete) tasks. | |
| AI Stock Master 股票大师 Professional AI analysis powered by 5 investment expert models, deeply integrated with OpenClaw AI Agent | https://github.com/hengruiyun/ai-stock-master-open... | |
| ClawHealth Data Skill ClawHealth is an agent-native precision health service that connects wearable data, nutrition, goals, readiness, reports, anomaly context, and temporary visu... | |
| 爽文模拟器V1.0虾舍出品 爽文模拟器V1.0虾舍出品: a paid launcher skill for Chinese chat-native system-novel power fantasy scenarios. Use when the user wants to browse, buy, unlock, install, t... | |
| crypto skill 提供飞书加密群聊总结、合约地址反查、热门代币统计、KOL分析及链上代币数据查询的综合加密社区服务。 | |
| kindle2md Convert Kindle HTML notebook exports to Obsidian Markdown format. Use this when the user wants to convert a Kindle book notes HTML file (exported from the Ki... | |
| meeting-to-text Create a fully local speaker-separated .txt transcript from a meeting recording, meeting screen recording, speech audio, or local video/audio file. Use this... | |
| AskAI.free Use ChatGPT, Claude and DeepSeek via AskAI | |
| IsItDown.now Check whether major websites and online services are down, list confirmed outages, find reporting spikes, and retrieve measured uptime through the IsItDown.now API. Use for current service-status or outage-history questions; do not use it t | |
| Scan.now Security Tools Use Scan.now when the user wants a passive security assessment of a website they are authorized to test, or wants to inspect a suspicious public link for phishing signals. | |
| Corporate Credit Memo Generates institutional-grade corporate credit application memoranda (Credit Memos) in English from uploaded annual reports, financial statements, or user-pr... | |
| Kalshi Read-only Kalshi prediction market integration. Use for viewing markets, checking portfolio positions, analyzing prediction opportunities, and finding high-payoff/high-certainty trades. Triggers on Kalshi, prediction markets, event contract | |
| Henteplan Skill Look up Norwegian waste collection schedules — find your provider, search your address, and get upcoming pickup dates | |
| BMAD Orchestrator Orchestrate the full BMAD Method workflow across OpenClaw and Claude Code. Use when starting a new project with BMAD methodology, running BMAD phases (brains... |
35,551–35,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.