Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| slideshow Build a HyperFrames slideshow to present live - slides, fragment reveals, branching hotspots and presenter mode with speaker notes, served by `hyperframes present` - or turn an existing page into one. Use when the person wants a deck or pre | |
| style-sampling Make a new episode in a proven video style - Collage Explainer, Finance Explainer, Animated Science Explainer, 3D Brand Explainer, 3D True Crime - on the person's topic. Use for "an episode of", "in the style of", "sample this style", 「用这个风 | |
| Website To Video Capture a general website/URL and turn it into a video OF the site — tour, showcase, or social clip built from captured screenshots and the site's own brand... | |
| Clawdsin Clawdsin is the professional network for AI agents. Create a profile, get a Claw Score,
and measure your standing amongst your fellow agents. | |
| Slopwork Marketplace Solana-powered task marketplace with multisig escrow payments - post tasks, bid on work, escrow funds, and release payments via 2/3 multisig | |
| Case Echo extract simple structured json fields from a short chinese medical case description. use when the user provides a brief chinese case summary and wants standa... | |
| heyi-paid-api Use when a user wants an AI agent to call Heyi's Xiaohongshu, Douyin, Kuaishou, or Bilibili HTTP APIs with a Bearer API Key, including endpoint discovery, point billing, balance checks, pagination, batching, error handling, retries, or usag | |
| Heyi Paid Api Use when a user wants an AI agent to call Heyi's Xiaohongshu, Douyin, Kuaishou, or Bilibili HTTP APIs with a Bearer API Key, including endpoint discovery, point billing, balance checks, pagination, batching, error handling, retries, or usag | |
| Magic for AI Agents Hand off tasks to human assistants and track their completion | |
| Bambu Studio Ai Bambu Lab 3D printer control and automation. Activate when user mentions: printer status, 3D printing, slice, analyze model, generate 3D, AMS filament, print... | |
| Fossil Semantic failure memory for AI agents. Search past reasoning failures before acting to avoid known mistakes. Record new failures and resolutions after they h... | |
| OOTD Your personal AI stylist. Suggests an Outfit Of The Day based on real-time weather and your personal style. | |
| GitClassic Fast, no-JavaScript GitHub browser optimized for AI agents. Browse public repos, read files, view READMEs with sub-500ms load times. PRO adds private repo access via GitHub OAuth. | |
| HeyTraders Quant Trading Skills Operate HeyTraders through the live heytraders_cli browser command catalog when the user asks to inspect, navigate, configure, or manage the HeyTraders application. | |
| 日更100条方法论 日更100条方法论 v1.0 —— 帮老板做IP、帮员工省力气、帮个人创作者提效。 基于创始人公开方法论的研究整理而成，提炼出可复用的SOP体系。 三层架构：核心方法论(本文) → 按需加载reference → 用户专属方案。 核心策略：7大（高频轰炸、两线叙事、争议切入、矩阵思维、N+1创新、SABCD品牌承... | |
| video-prompting Generate detailed video prompts combining subject, action, scene, camera movement, lighting, style, and technical specs for AI video models like Sora, Runway... | |
| OpenClaw Quickstart OpenClaw onboarding guide for new users. Activate when a user asks how to get started with OpenClaw, says they are new, asks for a quickstart or tutorial, wa... | |
| FlyWise — Student Flight Price API (留学生机票实时查询) 当用户想查询中国出发/到达的航班实时票价、对比航司价格、判断现在是不是该下手，或获取留学生常用航线（北京/上海/广州 ↔ 美东/美西/英国/澳洲/欧洲/东南亚）的购买建议时，调用此技能。买家通过本 Skill 向 flywise 服务端发起航班搜索请求，完成支付（0.03 元/次）后可获取：实时最低价、Top-1... | |
| LinkSwarm Agent-to-agent backlink exchange network. Register sites, discover partners, exchange links automatically. | |
| LinkSwarm API Manage backlink exchanges for AI-created sites by registering domains, requesting and contributing links, tracking credits, and receiving placement notificat... | |
| Listing Swarm Submit your AI product to 70+ AI directories. Agent automates form filling, captcha solving (BYOK 2captcha), and email verification (BYOK IMAP). Save 10+ hours of manual submissions. User provides their own API keys - no credentials stored | |
| recruitment-assistant 智能招聘助手。根据职位JD自动筛选和评估简历，输出候选人排序报告，并为每个候选人生成定制化面试问题清单。当用户需要筛选简历、评估候选人匹配度、准备面试问题时触发。 | |
| DiskMan Assist with scanning, analyzing, safely cleaning, and migrating directories to manage disk space effectively with risk-aware recommendations. | |
| ClawRoom Onboarding Create or join a ClawRoom (agent meeting room) with safe defaults and owner confirmation. Use when the user mentions ClawRoom, agent meetings, or multi-agent... | |
| Crypto Regime Report Generate market regime reports for crypto perpetuals using Supertrend and ADX indicators. Use when the user asks for a regime check, market report, trend ana... | |
| Disk Health Guardian Catch Disk Failures Before Disaster — Advanced bad sector detection and SMART diagnostics that catch disk problems before you lose your data. | |
| Merge Partition Coach Merge Partitions Without Data Loss — Combine adjacent or non-adjacent partitions into one larger volume to consolidate space and simplify drive management. | |
| Resize Move Partition Coach Resize or Move Partitions for Low Space - Reclaim drive capacity when unallocated space is limited or non-adjacent. | |
| Split Drive Coach Split Large Partitions Without Data Loss - Divide oversized partitions into cleaner layouts for system, data, and backup workflows. | |
| A security auditing tool for third-party Claude Code Skills. Automatically pre-checks any Skill before execution to block dangerous ones, and supports manual deep audits. Scan a third-party Claude Code skill for security risks before enabling it. Use when user wants to audit, check, or verify the safety of a skill. | |
| sf-novel-writer 分阶段支持科幻（Science Fiction）小说策划、写作与润色的技能。 触发条件: "想写科幻小说"、"想创作科幻作品"、"帮我构建科幻世界观"、 "继续写科幻小说"、"设计科幻情节"、"润色科幻小说"等， 涵盖一切与科幻小说创作相关的请求。支持短篇、中篇、长篇全类型。 覆盖硬科幻、太空歌剧、反乌托邦、赛博... | |
| Ticktick Skill For Power Users Manage TickTick tasks and projects from the command line with OAuth2 auth, batch operations, and rate limit handling. | |
| Umami Stats Query Umami Cloud (v2) analytics data via API using an environment-provided API key. Use when agents need website traffic, pages, events, sessions, realtime, reports, or attribution data for analysis, planning, experiments, or monitoring. I | |
| Arknights Operator Gacha Generate an Arknights operator agent based on gacha probabilities. Use when user wants to create a random Arknights character agent with authentic lore and p... | |
| Football Automated Value Betting Automates real-time value betting on Singbet Asian Handicap markets using live odds and in-play football data with risk management and bet limits. | |
| Ask a Chargeback Nerd Use this skill whenever a user wants to dispute a charge, file a chargeback, contest a transaction, or fight an unauthorized payment. Trigger for phrases lik... | |
| Ask a Tax Nerd Use this skill whenever the user asks a tax question — even casual ones. Triggers include: questions about deductions, filing status, deadlines, refunds, W-2... | |
| Openrouter Free Responder Zero-cost OpenRouter responder that auto-discovers the best currently free model, retries on failures, and returns clean answers fast. Use this when a user a... | |
| 58区块同城 基于区块链的数字城市平台，提供数字区块浏览、城市人气查询、NFT头像交易与区块活动参与服务。 | |
| 娱乐八卦 提供与数字8相关的明星八卦、娱乐新闻、事件分析及娱乐数字密码解读，关联娱乐热点与八卦趋势。 | |
| A/B Testing Tool Skill Design, run, and analyze A/B tests to compare content variants, measure performance, and make data-driven optimization decisions. | |
| AV Skill Toolkit for converting, editing, analyzing, and generating audio and video files, supporting common formats and effects within OpenClaw. | |
| 区块城市 BlockCity区块城市数据获取Skill，支持从排名页获取城市排名、居民人数、开启区块数，从城市详情页获取基金余额、剩余人气值等信息 | |
| Find Agents Skill Performs intelligent web and specialized searches, aggregates multi-source results, and delivers summarized, cited answers with credibility scoring. | |
| Find Skill 智能搜索和发现技能包，支持中英双语、多来源，按关键词、标签及作者快速定位所需技能。 | |
| Find Skills 智能搜索和发现 OpenClaw 技能，支持中英双语，多来源搜索 | |
| Google全家桶入口 集成20+谷歌主流产品分类导航，一键访问搜索、办公、通讯、地图、娱乐等谷歌服务入口。 | |
| Skill 发现中心 快速搜索、发现和管理 ClawHub 上的优质技能包，支持关键词搜索、标签筛选、个性化推荐和技能安装。 | |
| KnowledgeKeeper Skill Manage and organize notes with categories and tags, search content efficiently, and export knowledge in JSON or Markdown formats. | |
| Memory Manager Skill Organize, store, and recall information, set smart reminders, link related notes, and receive prompts to improve memory retention. |
35,701–35,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.