Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| reel-watch Watch a video for the user: Instagram reels, TikToks, YouTube, X or local files. Gemini watches it with audio (or local frames + Whisper without a key), then you report the exact tools, links, repos and commands it shows. Use when a message | |
| Memory Tree 记忆树架构 Memory Tree 记忆树架构 — 通用版，适用于任何 AI Agent 的长期记忆系统。包含三棵树设计、热冷路径管道、14 条打分规则、数据库 Schema、检索 API 和坑点总结。当用户需要记忆系统、长期记忆、AI Agent 记忆架构时加载此技能。 | |
| 中文文本校验 中文文本校验专家。对PPT、Word、Markdown等文档中的中文文本进行全面校验， 包括错别字、标点符号、格式规范、学术用语、逻辑表达及PPT/Word文档专项问题。 触发关键词：校对、校验、检查错别字、检查文档、proofreading、文字校验、 检查PPT、检查Word、检查标点、中文排版。 | |
| Relationship Coach A couples relationship coach grounded in IFS (Internal Family Systems), Emotionally Focused Therapy (Hold Me Tight), and honest communication. Use this skill... | |
| POI 详情页问题排查编排器 POI 详情页问题排查编排器。自动执行 6 步排查流程：查代码 (sourceId)→查日志→复现请求→解析返回→阅读代码→定位问题。当用户提供 gsid/traceId 排查 POI 详情页问题时触发。触发词：POI 排查、poi 问题、详情页异常、gsid 排查、traceId 分析、poi 调试、conte... | |
| Md Viewer LAN-accessible web viewer for Markdown files optimized for e-readers. Auto-binds to LAN IP for easy access. TRIGGER when user says "cho tôi xem", "show me",... | |
| AI Expense Tracker Trợ lý tài chính cá nhân đa năng. Dùng khi user muốn GHI NHẬN CHI TIÊU (nay ăn hết 50k, đổ xăng 50k...), XEM BÁO CÁO (vẽ biểu đồ chi tiêu), ĐẶT NGÂN SÁCH (bu... | |
| VN Stock Scanner Chuyên gia phân tích chứng khoán Việt Nam (VN-Index, HoSE, HNX, UPCoM). Sử dụng để LẤY TIN TỨC CHỨNG KHOÁN (cập nhật CafeF, tin đồn, tin chủ tịch mua/bán, ch... | |
| ThingsBot Manage ThingsBoard devices, dashboards, telemetry, and users via the ThingsBoard REST API. | |
| web-intel-search Security search & research: OSINT, pentest, bug bounty, CVE/PoC, writeups, cheatsheets, red team, appsec, cloud architecture, debug, labs, blogs. | |
| Real Estate Report Workflow 房地产市场调研报告撰写工作流。涵盖住宅/商业/办公/工业地产类型的专业市场调研报告撰写。当用户需要撰写房地产市场分析报告、项目可行性研究、投资回报评估、市场调研报告、REITs 发行报告，或提到"工作流""市场调查报告""竞品分析""SWOT分析""运营预测"时触发。5 步流程 + 14 条底线原则 + 56 条... | |
| DramaAIStudio（AI影视工场） 本技能通过调用灵伴智能的AI影视工场（DramaAIStudio）平台的多项能力，辅助AI短剧创作者更方便地参与创作，具体包括：项目的创建与管理，剧本的上传与自动分析，资产（角色、场景、道具）的智能提取与图像生成，分镜脚本生成与管理、分镜视频生成等。本技能还支持创建项目的定时巡检任务，将项目的关键节点完成情况即时... | |
| openclaw-agentlog OpenClaw Agent 自动存证与 Trace 生命周期管理 Skill。 提供给 OpenClaw Agent 使用，实现： 1. 自动会话存证 - 通过 OpenClaw Hooks 自动记录 agent 活动 2. Trace 生命周期 - 管理 trace 的创建、认领、完成流程 When to a... | |
| Confluence CLI (confcli) Interact with Confluence Cloud from the command line. Use when reading, creating, updating, or searching Confluence pages, managing attachments, labels, comments, or exporting content. | |
| Agent Bazaar Expert guide for using Agent Bazaar (agent-bazaar.com) — the first capabilities marketplace where AI agents discover, evaluate, and purchase skills autonomou... | |
| Hodl Dance Skill Trade, create, and manage memecoins on HODL.DANCE's BSC bonding curve launchpad. Launch tokens with logo upload and optional initial buy, get live quotes, bu... | |
| Bitcoin Identity Read-only-by-default integration guide for HODLXXI / UBID Bitcoin-native identity discovery, OAuth2/OIDC metadata, LNURL-Auth boundaries, JWT verification gu... | |
| hodman Use Hodman to turn useful personal AI work into controlled, auditable company projects: create or select applications and agents, delegate work, publish them, and operate them through the user-authorized CLI. | |
| Academic Research Writing Skill Helps users develop clear, logically structured postgraduate academic research writing for proposals, literature reviews, hypotheses, methods, and ethical ap... | |
| PsychoPy Experiment Design Skill Helps design and refine PsychoPy experiments by clarifying research focus, specifying variables, structuring hypotheses, and planning analysis for rigorous a... | |
| Home Assistant Control Control and inspect Home Assistant via REST API for entities, states, services, scenes, scripts, and automations. Use when the user asks to turn devices on/o... | |
| AI-Interview-Coach AI-powered interview preparation assistant with three difficulty levels (junior/mid/senior), flexible question count (5/10/15/20), five question types (knowl... | |
| Intelligent Delegation A 5-phase framework for reliable AI-to-AI task delegation, inspired by Google DeepMind's "Intelligent AI Delegation" paper (arXiv 2602.11865). Includes task... | |
| Cron Hardening Guidelines for reliable OpenClaw cron jobs: model pinning, absolute paths, timeouts, delivery config, and error recovery. | |
| Dashboard Generator Generate self-contained HTML dashboards for memory logs, expense charts, and token usage. Run hourly via cron. | |
| Expense Tracker Log daily expenses via check-in prompts; dedup, categorize, sync to local ledger and Google Sheets. | |
| Inbox Manager Authorize, read, triage, archive, trash, and summarize Gmail inboxes across multiple accounts. Uses Gmail API with OAuth. | |
| Model Config Configure and troubleshoot OpenClaw model providers, routing, session model locks, cron model pinning, and provider switching. Lessons from real failures. | |
| News Curator Fetch, filter, dedup, and deliver curated news briefings to Telegram. Benzinga for finance, AI News RSS for tech. | |
| Sync Adapter Sync local .md data files to Google Sheets with dedup hashing. Reusable for expenses, investments, and any key-value data. | |
| News Curator Fetch RSS feeds via curl, curate, and deliver news briefings to Telegram. MiniMax M3, isolated cron sessions, curl-not-fetch. | |
| Safe Device Control Physical-device control safety gate — never blindly toggle cloud devices; check state, surface risk, require explicit go-ahead before risky actions. | |
| oh-my-git-commit 执行 git commit，支持 conventional commit 消息分析、智能暂存和消息生成。用户要求提交更改、创建 git commit 或提到 "/commit" 时触发。支持：(1) 从变更自动检测 type 和 scope，(2) 从 diff 生成 conventional commit 消息... | |
| claw2tencentcloud This skill helps users migrate OpenClaw data to Tencent Cloud instances. It supports three scenarios — single instance migration to the current machine, batc... | |
| learning-loop-coach Evidence-based plans, lessons, quizzes and progress tracking | |
| 股票投资价值评分 / Stock Portfolio Investment Scoring 分析A股自选与持仓，获取行情、财报、风险与新闻，按行业计算价值评分和独立交易环境分，输出基本面情景估值、数据缺口及受用户风险政策约束的配置参考，并生成离线HTML报告。适用于股票诊断、持仓复盘、投资价值评分和组合配置请求；不自动下单。 English — Deterministic value scoring and allocation for China A-share watchlists and holdings; sector-routed scoring, sep | |
| holdcc_eth Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| Ctx-Lockstep 管理 git/非 git 项目的长期上下文与断点恢复。触发场景：继续/恢复之前的项目、提交代码后更新项目进度、会话结束前保存项目状态、接手或纳管一个已有项目、为长期推进的任务建立项目档案。Manage long-term project context and session-resume checkpoints for git and non-git projects. Use when resuming a project, updating progress after | |
| Drawio Diagram Builder Create, edit, replicate, and iteratively refine editable research and technical diagrams in diagrams.net/draw.io (.drawio XML) from prompts, papers, repositories, screenshots, or existing diagrams. Use when asked to generate a scientific fi | |
| Folder Icon 为 Windows 目录下的子文件夹批量生成并应用彩色图标。支持两种方案：(A) Tabler Icons — 集中图标目录 + 相对路径引用（默认，可整体迁移）；(B) MDI Icons — 图标直接放在每个子文件夹内部（folder.ico），无需独立图标目录。使用场景："批量设置文件夹图标"、"设置文件夹... | |
| ida-reverse 使用 IDA Pro MCP 做任何逆向工作时必须加载：规范化分析流程——先反编译再下结论、边分析边标注落库、防幻觉重命名。 | |
| Plantuml Draw UML and architecture diagrams with PlantUML text syntax: sequence, class, activity, use case, state, component, deployment, timing, ER, C4 architecture, network diagrams, mind maps, Gantt charts, WBS, JSON/YAML visualization, and Salt | |
| verifiable-data Use Cryptowerk to register documents and data, using hashes to maintain privacy, fetch seals, and verify proofs for files or append-only records. Use when th... | |
| Agent Smith Agents that explain their reasoning get chosen. Agents that don't, don't. Post decisions, outcomes, and challenges to build a public reputation track record. | |
| pubmed2blog Convert PubMed research papers into SEO-optimized, patient-friendly healthcare blog articles using a streamlined discover-extract-generate pipeline. | |
| Crypto Strategy Suite BTC/USDT 量化策略套件：含网格、信号、暴跌抄底、合约趋势、合约突破 5 大策略，现货+合约全覆盖。 | |
| Video Analyzer (TikTok + YouTube + Instagram) Analyze videos from TikTok, YouTube, Instagram, Twitter, and others by URL, transcribing audio locally and answering questions about the content. | |
| Chatgpt Apps Complete ChatGPT Apps builder - Create, design, implement, test, and deploy ChatGPT Apps with MCP servers, widgets, auth, database integration, and automated deployment | |
| Deploy Moltbot To Fly Deploy Moltbot to Fly.io with persistent storage, secure token authentication, environment secrets, and approved device pairing for web UI access. | |
| MCP App Builder Build new MCP Apps (MCP servers with React UI output) using @modelcontextprotocol/ext-apps and the MCP SDK. Use when asked to scaffold or implement MCP App s... |
36,201–36,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.