Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Ai Prompt Templates 高品質なAIプロンプトのテンプレート集。コードレビュー、コンテンツ作成、分析、教育など、様々なユースケースに対応。Claude, GPT-4, Geminiなど、主要なLLMで動作確認済み。 | |
| Cli Tool Template コマンドラインツール（CLI）開発のためのOpenClawワークスペース設定テンプレート。CLI UX、ドキュメント優先、テスト駆動開発の原則。 | |
| Data Analysis Workflow データ分析プロジェクトのためのOpenClawワークスペース設定テンプレート。データ駆動の意思決定、探索的データ分析（EDA）、モデル開発の原則。 | |
| Web App Template Webアプリケーション開発のためのOpenClawワークスペース設定テンプレート。ユーザー体験（UX）優先、レスポンシブデザイン、パフォーマンスの原則。 | |
| Resume Ats CLI tool for analyzing, optimizing, and formatting resumes to improve ATS scoring via keyword matching and structured templates. | |
| Social Media Automation Manage multiple social media platforms to automate posting, scheduling, draft and template management, timeline viewing, interactions, and analytics via CLI. | |
| OpenGemini CLI Use the local Gemini CLI for one-shot prompts, structured JSON output, shell-assisted research, and delegated AI-to-AI workflows on this Linux host. Use when... | |
| OpenGemini Next.js Bestpractice Builder Build and document a solo SaaS project using a fixed Next.js/Tailwind/Prisma stack, with FastAPI only for Python workloads and strict architecture rules. | |
| OpenGemini SaaS Builder Build SaaS projects end-to-end with OpenClaw as orchestrator and Gemini CLI as a local planning and generation copilot. Use when the user asks to brainstorm,... | |
| xAI OAuth Usage Checker Read-only Hermes Agent skill for checking xAI OAuth usage, remaining quota, and reset time with Japanese/English output. | |
| Japan Business Operations (EDITION) Japan Operations OS — Verified knowledge across 10 domains for AI agents operating in the Japanese market. Regulations, protocols, calendar, regional, foreig... | |
| arxiv-daily 每日 arXiv 论文获取加整理技能。当用户想要获取每日 arXiv 论文相关领域论文、设置论文订阅、管理论文推送时间、添加新的论文领域时触发。也用于用户询问"arxiv"、"每日论文"、"论文推送"等相关话题时。 | |
| arxiv-daily 每日 arXiv 论文获取加整理技能。当用户想要获取每日 arXiv 论文相关领域论文、设置论文订阅、管理论文推送时间、添加新的论文领域时触发。也用于用户询问"arxiv"、"每日论文"、"论文推送"等相关话题时。 | |
| Natural Language Response 让AI回复更像真人，避免过度称呼和机械化的表达，使对话更加自然流畅。 | |
| timer Set timers and alarms. When a background timer completes, you receive a System notification - respond with the reminder message (NOT HEARTBEAT_OK) to notify the user. | |
| withings-health Fetches health data from the Withings API including weight, body composition (fat, muscle, bone, water), activity, and sleep. Use this skill when the user asks about their Withings data, weight history, body metrics, daily steps, sleep qual | |
| Hita-Mind & Knowledge hita 开发的 AI Agent 记忆与知识管理系统。包含 Mind Module（8大分类记忆）和 Knowledge Manager（3层知识库）两个互补模块。Mind Module 存储偏好、决策、教训；Knowledge Manager 存储技巧、方法、规则。适用于 AI Agent 的长期知识积累。触... | |
| ActiveCampaign Manage contacts, campaigns, automations, lists, and marketing workflows in ActiveCampaign via the ActiveCampaign API. Use this skill when users want to searc... | |
| ad-spy Competitor ad research across Meta (Facebook and Instagram), TikTok and LinkedIn ad libraries, with no ad account or API key. Search ads by advertiser or keyword, read an ad's creative and targeting, transcribe video ads, and pull TikTok's | |
| AEO Radar Answer-engine optimisation (AEO) research with no API keys. See what ChatGPT, Perplexity, Google AI Overview and Google AI Mode answer for any prompt, which brands they name and which sources they cite, how often a brand is mentioned by LLM | |
| Ahrefs Inspect backlink, keyword, ranking, and SEO research data from Ahrefs — powered by ClawLink. | |
| Airtable Browse Airtable bases and tables, inspect records, create records, and manage fields, comments, and table actions via the Airtable API. Use this skill when u... | |
| Amazon Scout Search and analyze Amazon products, sellers, reviews, best sellers, and keywords with no Amazon account or API key required. | |
| Amplitude Analyze product events, cohorts, releases, dashboards, and experiment insights via the Amplitude Analytics API. Use this skill when users want to query event... | |
| Apaleo Apaleo hotel property management API integration with managed OAuth. Manage properties, units, unit groups, and unit attributes. Use this skill when users wa... | |
| Apify Run Apify Actors, manage tasks, inspect datasets and key-value stores, and review usage via the Apify API. Use this skill when users want to automate web scr... | |
| Apollo Search prospects, accounts, contacts, and outreach data in Apollo.io via the Apollo API. Use this skill when users want to find leads, enrich company and con... | |
| backlink-detective Backlink and domain research with no SEO subscription or API key. Backlink summary (total backlinks, referring domains, domain rank, spam score), the backlinks and referring domains themselves, a domain's traffic overview, its organic compe | |
| Bitbucket Browse Bitbucket repositories, manage branches, review pull requests, and work with source code via the Bitbucket Cloud API. Use this skill when users want t... | |
| BoldSign BoldSign e-signature platform API integration with managed OAuth. Send documents for signature, manage documents, create embedded signing links, and track do... | |
| Box Manage Box files, folders, collaborations, shared links, metadata, and enterprise content workflows via the Box API. Use this skill when users want to browse... | |
| brand-listener Social listening across Reddit, X, TikTok, YouTube, Threads and Telegram without accounts or API keys. Find every recent mention of a brand, product or topic, read the full conversations, see the most common words in TikTok comments, and fo | |
| Calendly Manage Calendly events, invitees, scheduling links, webhooks, and availability via the Calendly API. Use this skill when users want to list events, check inv... | |
| Canva Create and manage Canva designs, upload assets, export content, and manage brand templates via the Canva Connect API. Use this skill when users want to autom... | |
| YouTube by ClawLink Manage YouTube channels, videos, comments, playlists, and creator workflows via the YouTube Data API v3. Use this skill when users want to inspect channel an... | |
| ClickHouse Inspect ClickHouse databases, review schemas, and run SQL analytics queries via the ClickHouse HTTP API. Use this skill when users want to query analytics da... | |
| ClickUp Manage ClickUp tasks, lists, spaces, folders, comments, goals, and workspace data via the ClickUp API. Use this skill when users want to create tasks, manage... | |
| Cloudflare Manage Cloudflare zones, DNS records, workers, rules, firewall settings, and account resources via the Cloudflare API. Use this skill when users want to insp... | |
| Content Repurpose to LinkedIn Turn source content into polished LinkedIn posts and publish them with confirmation. Uses ClawLink to discover LinkedIn tools and publish posts after user ap... | |
| creator-scout Influencer and creator research across TikTok, Instagram and YouTube with no accounts or API keys. Find creators by niche and country, read profiles and follower counts, see where a creator's audience lives, find similar creators, get publi | |
| crypto-pulse Live cryptocurrency prices and market data with no exchange account or API key. Current prices, top coins by market cap, trending coins, global market totals, coin profiles, price history, OHLC candles, the price on any past date, and excha | |
| Datadog Inspect Datadog monitors, metrics, logs, incidents, dashboards, and observability data - powered by ClawLink. | |
| DataForSEO Run SEO, SERP, keyword, and search intelligence workflows with DataForSEO — powered by ClawLink. | |
| Discord Manage Discord guilds, channels, messages, members, roles, and application commands - powered by ClawLink. | |
| Dropbox Browse, search, upload, download, and manage files and folders in Dropbox — powered by ClawLink. | |
| Dynamics 365 Work with Microsoft Dynamics 365 CRM records, accounts, contacts, leads, opportunities, and activities - powered by ClawLink. | |
| ElevenLabs Create and manage voices, speech synthesis, audio projects, and conversational AI agents in ElevenLabs via the ElevenLabs API. Use this skill when users want... | |
| event-finder Find events on Facebook without an account or API key. Search public events by keyword, browse a city's events, read an event's date, venue and description, and list the events a page hosts. Use this skill for finding things to do, scouting | |
| Eventbrite Manage Eventbrite events, attendees, organizations, venues, orders, and ticketing data - powered by ClawLink. | |
| Exist Exist API integration with managed OAuth. Read health and fitness tracking data, retrieve correlations and insights, manage attribute ownership, and track we... |
35,901–35,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.