Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| second-brain-visualizer Unload your cognitive baggage. Drop ideas anywhere, find the signal later. | |
| session-closer Structured end-of-session protocol for OpenClaw agents. Produces a complete, consistent journal entry at session close — summary, full file surface (read/written/external APIs), one self-caught failure delta, one behavioral fingerprint. Als | |
| token-cost-time Estimate LLM task token usage, cost, and duration using rule-based classification and optional local profile data without external dependencies. | |
| Copywriting Master Especialista en copywriting persuasivo y ventas. Usar SIEMPRE cuando el usuario pida escribir copy, anuncios, emails, páginas de ventas, landing pages, headl... | |
| SkillzMarket Search and call monetized AI skills from Skillz Market with automatic USDC payments on Base. Use when the user wants to find paid AI services, call external skills with cryptocurrency payments, or integrate with the Skillz Market ecosystem. | |
| BYD Remote Control Control and check a BYD vehicle using portable Python helper scripts built on pyBYD. Use when the user wants to check battery state, lock the car, flash ligh... | |
| Bilibili Notion Pipeline Skill Skill-first Bilibili to Notion pipeline. Download a Bilibili/b23 video, transcribe audio, upload the mp4, create or update a Notion transcript page, write tr... | |
| Wininsales crm Use when users need 赢在销客CRM, wininsales, WininSales CRM, 企业微信CRM, 企微CRM, or CRM sales operations, including customer search, duplicate check, ownership looku... | |
| 海康云眸设备告警能力管理 查询和修改设备报警能力状态，以及控制智能检测开关。 | |
| 海康云眸设备通道管理 查询、同步和修改海康云眸设备通道。 | |
| 海康云眸设备控制 调用海康云眸开放平台设备控制类接口，包括设备布撤防、布撤防状态查询、云台控制、远程抓图、设备 OSD 设置与查询、设备校时与 NTP 服务器配置、设备存储卡初始化与进度查询。用户提到设备序列号、通道号、布防/撤防、抓图、云台转动、OSD 设置、校时、NTP 配置、存储卡初始化等场景时使用。本技能自动处理 acce... | |
| 海康云眸设备分组管理 管理云眸设备组织、下级组和设备转组流程。 | |
| 海康云眸设备基础管理 注册、删除、查询、重启海康云眸设备。 | |
| 海康云眸视频录像管理 管理云录制项目、录制任务、文件、流量、上传和剪辑。 | |
| Exuvia Research platform for AI agents. Agent-to-agent knowledge collaboration with persistent memory, peer review, and identity-based discovery. Use when connectin... | |
| AI提示词生成器 专业AI提示词工程助手，助你设计结构化提示词，优化角色设定与上下文，提升AI输出质量与效果。 | |
| Medical Literature Search 医疗文献检索助手。当用户需要搜索PubMed、知网、万方等医学文献数据库，或需要进行文献综述、循证医学证据检索、药物研究资料查找时使用此技能。支持中英文文献搜索、摘要提取、相关文献推荐。 | |
| 医疗报告解读助手 帮助用户理解血常规、肝肾功能等医疗检验报告中的指标含义及异常提示，提供通俗解释和健康建议。 | |
| Python数据分析助手 提供Python数据清洗、统计分析及可视化建议，辅助业务和科研数据的快速处理与分析。 | |
| hik-connect-team-skill Hik-Connect for Teams (HCT) Developer Skills. Integrates a series of skills for managing and controlling HCT devices, including resource management, access c... | |
| China National Pension Calculation 养老金计算器 - 支持Web界面填写和LLM对话交互。计算基本养老金、企业年金、个人养老金和养老储蓄。适用于中国养老金体系计算。 | |
| Get My Ip Get the machine's current public IP address by calling `curl ifconfig.me`. Use when the user asks for their IP address, public IP, external IP, or explicitly... | |
| Resume Builder Build, rewrite, and tailor premium white-collar resumes from real candidate information, then render the final resume to PDF with Typst. Use when the user wa... | |
| Clawhub AI 驱动的 Android 自动化 — 截屏、点击、滑动、输入、启动应用、UI 识别、多设备群控 | Android automation via ADB, screen capture, tap, swipe, type text, app control, multi-device, phone RPA, adb bot | |
| 血友病公众号文章写作 公众号文章自动化写作流程。支持资料搜索、文章撰写、爆款标题生成、排版优化。当用户提到写公众号、微信文章、自媒体写作、爆款文章、内容创作时使用此 skill。 | |
| 血友病小红书内容创作专家 小红书内容创作专家。输入主题/文章/视频链接，自动生成小红书图文（3:4比例，1080×1440 / 1242×1660 px），包含封面图+内页图+统一文案。适用于自媒体创作者、知识博主、医疗健康领域内容输出。每次生成图片时同步交付文案，无需单独提供。 | |
| MiniMax MCP Search Perform real-time web searches and analyze images using MiniMax MCP with input prompts and flexible image sources. | |
| Seede Design Agent Skills The ultimate AI design CLI for Agents and Developers. Generate professional UI, social media graphics, and posters with state-of-the-art AI models. Best choi... | |
| Backup Douyin Chat Safely operate the local Douyin group-chat backup tool to log in by QR code, list conversations, perform full or incremental history backups, export JSON or... | |
| Design Spec Personal 生成并验证 UI 设计交付物：可交互 preview.html、annotated.html、tokens.css、spec.json 与 assumptions.log。支持文字、截图、Sketch、Figma 输入，以及 mobile-h5/web-pc 平台；按需加载 universal、内置或用户导入的... | |
| context-engineering Diagnose and improve context usage in AI agent sessions. Use when context grows large, instructions are being missed, output quality degrades, token usage rises, or a project needs deliberate context organization. | |
| FairSplit Split group expenses and settle up in the fewest payments. | |
| Agentplace AI Agent Marketplace for OpenClaw. Browse and install free & paid agents when explicitly requested by the user. | |
| Ampere marketplace Ampere AI Agent Marketplace for OpenClaw. Browse and install free & paid agents across developer tools, automation, research, content, and more. | |
| Options Payoff Generate an interactive options payoff curve chart with dynamic parameter controls. Use this skill whenever the user shares an options position screenshot, d... | |
| PrepSPSC PYQ API Use when the user asks about Indian competitive exam preparation, Sikkim PSC (SPSC) questions, previous year questions (PYQ), mock test generation, exam pattern practice, or needs reference questions for AI-powered question generation. Invo | |
| Official Openclaw Cn Toolkit OpenClaw-cn 社区全能工具包。集成论坛交互、文档搜索与技能发布三大核心能力，是 Agent 参与社区建设的必备工具。 | |
| 云启智联AI服务 云启智联AI智能文档解析服务 — 业界领先的金融票据OCR识别引擎，已在企业生产环境沉淀多年，准确率高达99.5%，毫秒级响应。支持银行回单解析（每页多张回单自动裁剪）、对账单解析、发票识别、通用文件解析、异步结果查询及智能记账凭证生成。可将解析结果自动转换为记账凭证（含科目匹配、置信度评分和人工复核建议）。免费体验：https://www.yunqi-zhilian.com/AIService/experience/page 。当用户提到回单解析、银行回单、对账单解析、银行 | |
| qrcode-remote Generate and decode QR codes using CaoLiao QR Code API. Use when the user wants to create a QR code from text/URL, decode/read QR code content from an image,... | |
| qrcode Generate and decode QR codes locally. Use when the user wants to create a QR code from text/URL, decode/read QR code content from an image, or asks about QR... | |
| Reddit Spy Stealth Reddit intelligence -- browse, read, and analyze any subreddit without getting blocked. Multi-layer fallback (OAuth API -> Stealth HTTP -> Browser St... | |
| Ding Skills Web scraping using local Crawl4AI instance. Use for fetching full page content with JavaScript rendering. Better than Tavily for complex pages. Unlimited usage. | |
| DingTalk Skills 钉钉操作助手，支持查人、查部门、发消息、预约会议、审批管理、日程查询和知识库操作等功能。 | |
| PaddleOCR Document Parsing V2 Parse documents using PaddleOCR's API. Supports both sync and async modes for images and PDFs. | |
| 🧠 EchoFadeMemory Runs a thin long-term memory workflow on top of the echo-fade-memory service. Use proactively whenever an answer may depend on prior session context, durable... | |
| Pdf Label Made In China 在亚马逊FBA产品标签PDF中批量添加"Made In China"文字。适用于：用户上传标签PDF文件，需要在指定文字（如产品名称）下方的下一栏添加"Made In China"，并与条形码编号居中对齐，应用到所有页面。支持单类型标签和多类型混合标签（同一PDF中含有多种不同条形码的标签）。 | |
| Tech Doc Writer This skill should be used when the user wants to write detailed technical learning documentation, study notes, or knowledge summaries for deep learning, mach... | |
| Slack Channel Context Automatically loads Slack channel context files (e.g., bebops.md, C0AK8SDFS4W.md) into session context for Slack channels and threads. Use this skill wheneve... | |
| Code Review Automation Automated code review for GitHub pull requests using Claude LLM. PR analysis, security scanning, and style checking. | |
| Agent Starter Kit OpenClawエージェントの構築に必要なすべてのテンプレートを含むスターターキット。SOUL.md, IDENTITY.md, AGENTS.md, USER.md, HEARTBEAT.mdの完全なテンプレートとカスタマイズガイド。 |
35,851–35,900 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.