Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| social-media-viral-title-generator Generate high CTR titles for social media platforms including Instagram, TikTok, Twitter, and YouTube. Based on viral title pattern analysis, generates 10-20... | |
| Startup Idea Validator Validates and evaluates startup business ideas using proven frameworks like TAM/SAM/SOM, competitive analysis, and market feasibility assessment | |
| story-structure-builder Help writers construct compelling story frameworks with character arcs and plot development | |
| team-meeting-summarize Convert raw meeting notes or transcripts into organized summaries highlighting decisions, action items with owners and deadlines, key discussions, and next s... | |
| thank-you-note-generator Write heartfelt and professional thank you notes for any occasion. Perfect for showing gratitude after interviews, gifts, help, or acts of kindness. | |
| Trump Style Copy Generator Transform any text into Donald Trump's iconic speaking style. Use when user wants to make text more persuasive, dramatic, or "Trump-like". Perfect for speech... | |
| User Story Generator Creates well-structured agile user stories with acceptance criteria for product development | |
| 视频封面设计助手 辅助创作者提取视频文案，生成多样封面设计方案，并提供爆款元素分析及多平台尺寸风格建议。 | |
| video-transcript-extractor Extract text from videos and audio across 20+ platforms including TikTok, YouTube, Bilibili, and Douyin. Uses multi-level extraction strategy (subtitle track... | |
| weekly-report-generator Generate professional weekly reports instantly. Transform your bullet points into polished, manager-ready reports. Never stress about weekly updates again. | |
| youtube-title-optimizer Craft click-worthy YouTube titles that boost views and click-through rates. Perfect for YouTubers, content creators, and marketers who want their videos to s... | |
| youtube-thumbnail-analyzer Analyze YouTube thumbnails for visual hierarchy, color impact, text clarity, emotional appeal, and competitor benchmarking to optimize click-through rates. | |
| HipoolMemorySystem 嵌入式纯 C 记忆系统，支持多线程、Fork 快照、分片管理，提供高效键值存储与基于标签、时间的范围查询。 | |
| redis-memory-system 跨会话自动记忆系统 v3.3.0 — 单脚本+配置驱动+语义标签索引。支持标签检索、倒排索引、语义搜索。 | |
| Agent OS (Three Layer) Provides a reusable AI agent OS template with separated identity, operations, and knowledge layers for modular intelligent system design. | |
| Best Practices Apply modern web development best practices for security, compatibility, code quality, and coding standards. Covers KISS/DRY/YAGNI principles, TypeScript/Jav... | |
| Browser Automation Browser automation for AI agents using PinchTab. Control Chrome programmatically for testing, scraping, and interaction. Features token-efficient text extrac... | |
| Content Engine 用 OpenClaw + Obsidian 搭建内容工厂，系统化生产百万阅读爆文。涵盖选题策略、内容框架、AI 辅助创作、多平台分发、数据分析全流程。适合自媒体创作者、内容团队、个人 IP 建设者。 | |
| Data Intelligence 综合数据智能平台 - 整合 Apify 云端爬虫、PinchTab 浏览器自动化、内容分析与数据工作流。支持 55+ 平台的网络爬虫、线索生成、电商情报、竞品分析、趋势研究，以及浏览器自动化测试和数据提取。 | |
| MemOS Cloud Integration Recall memories from MemOS Cloud before responding. Use this skill when you need context about user's previous conversations, preferences, or decisions. | |
| OpenClaw Multi-Agent System Configure multi-agent TG group system with shared Workspace + MemOS memory. Use when user wants to set up multiple AI agents in a Telegram group, with specia... | |
| OpenClaw Security Guide (by huamu668) OpenClaw security guide for root-enabled AI agents, covering pre-install audits, runtime permission tightening, hash baselines, risk controls, nightly auto-i... | |
| OpenClaw Deploy Guide OpenClaw/NEUXSBOT 全平台部署指南 - 支持 Mac、Windows、Linux 三平台一键安装。包含环境准备、安装配置、AI模型设置、消息平台对接、故障排除等完整流程。 | |
| Performance Optimization Optimize web performance and LLM API costs. Covers loading speed, runtime efficiency, resource optimization, and cost-aware LLM pipelines with model routing,... | |
| Self Improving Agent Instinct-based continuous learning system. Captures atomic learnings (instincts) with confidence scoring, supports project-scoped vs global scope, and evolve... | |
| TCM Diagnosis Provides Traditional Chinese Medicine diagnosis including symptom collection, pattern differentiation, formula recommendation, and dietary health advice for... | |
| Test Driven Development Test-driven development with red-green-refactor loop and de-sloppify pattern. Use when user wants to build features or fix bugs using TDD, mentions "red-gree... | |
| Web Quality Audit Comprehensive web quality audit covering performance, accessibility, SEO, best practices, and browser automation testing. Supports automated testing with Pin... | |
| Writing Assistant Pro Professional writing assistant offering content creation, rewriting, headline generation, and topic ideation based on a three-layer architecture. | |
| Chinese Talent Scout Discover, score, and monitor Chinese GitHub developers with GitHub signals, rule-based processing, optional OpenClaw AI evaluation, shortlist queries, cron m... | |
| Agent Browser Cli.Bak 使用 agent-browser CLI 进行浏览器自动化。用于签到、填表、截图、信息抓取等需要控制浏览器的任务。触发条件：(1) 用户要求自动化浏览器操作 (2) 需要签到、填表、点击按钮 (3) 需要抓取网页内容作为研究素材 | |
| Agent Browser Cli.Bak.Skip 使用 agent-browser CLI 进行浏览器自动化。用于签到、填表、截图、信息抓取等需要控制浏览器的任务。触发条件：(1) 用户要求自动化浏览器操作 (2) 需要签到、填表、点击按钮 (3) 需要抓取网页内容作为研究素材 | |
| Agent Optimizer.Skip V6.1 Agent 性能优化器 - 基于轨迹分析和奖励反馈的轻量级优化框架 | |
| Agent Orchestration Multi Agent Optimize.Skip Optimize multi-agent systems with coordinated profiling, workload distribution, and cost-aware orchestration. Use when improving agent performance, throughpu... | |
| Ai Drama Prompt Factory.Skip AI短剧提示词工厂 - 端到端将小说/故事创意转化为结构化提示词包（角色立绘+场景+道具+分镜图片+视频+音频）的完整流水线。一个入口启动全流程，内部自动按阶段推进：策划→设计→剧本→诊断→提示词组装→API JSON输出。支持小说改编和原创短剧两条路径。触发词：AI短剧、短剧制作、小说转短剧、短剧提示词、提示词... | |
| volcengine-rtc-device-control 火山引擎AI音视频互动设备控制技能。用于控制当前硬件设备的行为，包含左摇头、右摇头、调大音量、调小音量、设备关机、调亮屏幕、调暗屏幕、温度调节等常见硬件控制行为。当需要生成或解析设备控制指令时使用此技能。 | |
| expense-tracker Log daily expenses to Notion using natural language input, auto-parsing item, amount, category, and payment method into your configured database. | |
| Paper Cluster Survey 2.2 Extract structured paper records from one or more local PDFs, arXiv links, DOI links, or general paper URLs, then classify the papers and write an academic s... | |
| one-mail 统一邮箱管理 CLI，支持 Gmail、Outlook、网易邮箱（163.com、126.com）。适用于：(1) 收取/发送邮件，(2) 跨账户搜索邮件，(3) 管理多个邮箱账户，(4) 查看邮件统计。当用户提到邮件、邮箱、email、发邮件、收邮件、查邮件时触发。 | |
| Rss To Wechat 将 RSS 文章转换为微信公众号格式。适用于：发布 RSS/博客文章到微信、格式化内容以符合微信 API、自动化微信内容发布。 | |
| alibaba devops 阿里云云效 DevOps 平台 MCP Server，提供代码管理、项目管理、流水线、应用交付、测试管理等全面的 DevOps 能力 | |
| Model Advisor 智能模型选择顾问。根据任务类型（量化交易、代码编写、长文档处理、日常对话、隐私任务）自动推荐最优模型，平衡效率、质量和Token成本。触发场景：(1) 用户询问模型相关（"用什么模型"、"切换模型"、"模型推荐"、"最优模型"）；(2) 用户发起新任务时，主动分析任务类型并推荐最优模型；(3) 需要优化Token... | |
| 双币赢分析 提供BTC/ETH期权双币赢策略分析，包含市场数据、决策分析及1-3天期操作建议。 | |
| Dida365 Use when the user wants to interact with TickTick/Dida365 (滴答清单) — managing tasks, projects, and to-dos, checking productivity stats, completing tasks, searc... | |
| Raindrop.io API Build, debug, and explain integrations with Raindrop.io, including OAuth 2 authorization, bearer-token REST API calls, collections and raindrops CRUD flows,... | |
| YoudaoNote Use when the user wants to interact with YoudaoNote (有道云笔记) — listing, reading, creating, searching notes, clipping web pages, or saving Markdown/mindmap not... | |
| Browser Setup (No-Root Linux) Install and configure headless Chrome for OpenClaw browser tool in environments without root/sudo access (cloud containers, VPS, sandboxed hosts). Use when:... | |
| md-docx 这是一个用于md文件与docx文件相互转换的技能。支持Markdown转Word文档，以及Word文档转Markdown格式。 | |
| ZF-novel-writer Three-agent collaborative novel writing system. Orchestrator plans chapters, Writer Agent generates content via coding agent (sessions_spawn), Quality Agent... | |
| 1password.Old Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/... |
36,751–36,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.