Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Daum Toy Search High-performance, multi-source Korean search API aggregating Daum/Kakao News, Encyclopedia, and Web results in a Perplexity-compatible format. | |
| Daum Trends Briefing Fetch Daum real-time trend TOP10, add one-line context (top news title) + links, and print a 12-line briefing suitable for OpenClaw cron + Telegram announce. | |
| Browser Automation (CDP) 通过已登录的Edge或Chrome浏览器，利用Chrome DevTools Protocol执行JS渲染页面的导航、点击、截图及数据提取等自动化操作。 | |
| Ghost Eye Ghost Eye 👁️ — Let any pure-text LLM see images through any vision model. OCR + visual summary in one shot. | |
| Legal Assistant 法务助手（Legal Assistant）。协助完成合同接收分类、合同要素抽取、条款风险审查、模板对比、修改建议生成、法律咨询问答、审批意见草拟与合同台账更新的完整合同与法务闭环。本工具由 @afeicn 提供支持。 | |
| Fetch the latest AI daily brief from imjuya/juya-ai-daily (GitHub) and return the Overview (summary) section. Fetch the latest AI daily brief from imjuya/juya-ai-daily (GitHub) and return the Overview (summary) section. | |
| Ohmy Skill ClawHub 技能的体检 + 评分 + 自动优化 + 排行榜查询 + 智能推荐基础设施。OhMySkill 系列首款产品。 | |
| tytyt Connect and authenticate via Ethereum wallet to manage rooms, discover and invite AI agents, send messages, and handle micropayments on Teneo Protocol. | |
| laso-finance Order prepaid cards, gift cards, and send money to USD/EUR/GBP debit cards or US bank accounts using USDC on Base or Solana via the x402 protocol. Use when a user or agent needs to spend cryptocurrency, pay for an online checkout, buy a pre | |
| workday-calculator 计算时间区间内有多少个工作日的技能。支持排除中国的节假日和调休安排。当用户询问工作日计算、节假日排除、工作时间计算时使用此技能。 | |
| news-scout 热点新闻聚合简报 AI领域以及投资领域新闻聚合工具。当用户询问新闻相关问题时触发，如："今日新闻" "今天有什么新闻？" "新闻简报" "获取新闻" "AI动态" "美股行情" "科技新闻" "市场走势"。AI领域新闻区分全球和中国国内，投资领域新闻主要突出影响全球投资的美股市场关键动向，每条新闻按热度排序，而且都有简要的影响分析。 | |
| FastAPI Flask Proxy FastAPI + Flask 混合部署最佳实践。解决路由定义、API 代理等常见问题。适用于需要同时运行 FastAPI API 和 Flask 前端的场景。 | |
| Parallel Coding 使用 git worktree + 编码智能体实现多任务并行开发。当需要同时处理多个开发任务、避免串行等待、或需要在多个分支间快速切换时触发。支持 Claude Code、Codex 等编码智能体的并行调度。 | |
| Step3-VL Finetune Step3-VL-10B 多模态模型微调指南。用于在 GPU 服务器上进行 Step3-VL 模型的 LoRA/全量微调。包含配置、训练、推理完整流程。 | |
| CN Trends Aggregator 中文+全球热榜聚合器。一键获取百度热榜、今日头条、V2EX、Hacker News、GitHub 热门新项目。Use when: user asks about trending topics, hot searches, what's popular, today's hot news, tech trends... | |
| Fapi Reddit 通过自然语言调用 fapi.uk 提供的 Reddit API，实现用户、子版块帖子查询和搜索等功能，无需手动组装参数。 | |
| fapi.uk Twitter All-in-One API 通过自然语言调用fapi.uk 60+ Twitter接口，实现发推、搜索、互动、用户管理及社区功能，自动管理积分与授权。 | |
| seedance2-script-create-yima 为Seedance 2.0生成符合中国广告法的多行业商业视频广告提示词，精准匹配分类模板并输出高效合规脚本。 | |
| Silicon World - 硅基世界 硅基世界 - Agent 与人类共同生活的去中心化虚拟世界。创建 DID 身份、领取空投、参与治理、交易 NFT。 | |
| node-connection-doctor Diagnose and fix OpenClaw node connection issues with automated checks, error-specific solutions, CLI guidance, and optional one-click repairs. | |
| security-audit-assistant Conducts lightweight security baseline audits on OpenClaw-managed servers, identifies high-risk SSH/firewall issues, and provides one-click fixes plus compli... | |
| Accessibility Checker Prüft UI-Komponenten auf WCAG-Verstöße, identifiziert Accessibility-Probleme und implementiert Verbesserungen wie ARIA-Labels und Farbkontrast. | |
| Accessibility V2 Prüft UI-Komponenten auf WCAG-Verstöße und verbessert Zugänglichkeit durch ARIA-Labels, Farbkontraste und Screenreader-Support. | |
| Autonomous Cascade Führt mehrstufige Tasks autonom durch Planen, Ausführen und Bewerten in Schleifen, bis Ziel erreicht oder Budget erschöpft ist. | |
| bid-document 专业标书撰写技能体系，支持从招标文件解读到文档质量控制的全流程工作。 | |
| Cortex Local-first agent memory with Ebbinghaus decay, hybrid search, and MCP tools. Import files, extract facts, search with BM25 + semantic, track confidence over... | |
| Vision Tool Image recognition using Ollama + qwen3.5:4b with think=False for reliable content extraction. | |
| MyAider Skill Importer Import, create, and upgrade skills from MyAider MCP. Use this skill whenever the user wants to import their MyAider MCP skills into agent skills, or upgrade/... | |
| keyco Manage Keyco assets, DUBs (QR/NFC/BLE/Virtual beacons), workflows, lifecycle events, users, and analytics. Use when the user asks about Keyco, asset manageme... | |
| test vercel Self-healing backup and update system with intelligent rollback. Protects against failed updates by automatically monitoring system health post-update and re... | |
| 头号红娘新媒体 头号红娘公众号内容创作工作流。用于生产婚恋行业爆款文章，包含热点抓取、标题生成、文章撰写、平台软植入四大环节。 触发场景： - 用户要求创作婚恋相关内容 - 用户提到"头号红娘"、"婚恋文章"、"相亲内容" - 用户要求生成公众号文章且涉及婚恋/情感/相亲话题 | |
| English Word Coach English vocabulary learning coach with word analysis, vocabulary library management, and spaced-repetition daily review. Use when the user inputs a single En... | |
| extract-youtube-transcript Extract plain-text transcripts from YouTube videos using a local Python script. Use when the user wants to fetch, extract, or get a transcript from a YouTube video URL, analyze YouTube video content as text, or needs subtitles/captions from | |
| Perplexity Research Conduct deep research using Perplexity Agent API with web search, reasoning, and multi-model analysis. Use when the user needs current information, market re... | |
| Vocabulary Anti Forgetting Anti-forgetting vocabulary review using spaced repetition. Selects 10 words from asset/vocabulary_bank.md and presents each with English, Chinese translation... | |
| Hushh One PKM Use when an OpenClaw agent needs to access a Hussh One user's Personal Knowledge Model through the Hussh MCP bridge. This covers developer-token setup, dynam... | |
| xero quickbooks invoicing payments uk b2b accounting freelance Automate chasing overdue invoices for UK B2B clients via Xero and QuickBooks, sending reminders by email and WhatsApp with statutory interest calculations. | |
| Order & Returns Manager Manage UK-compliant Shopify and WooCommerce orders via chat, including status, returns, refunds, exchanges, edits, fraud flags, lost parcels, and reports. | |
| SEO Product Auditor Scan Shopify or WooCommerce product listings to score SEO by 10 criteria, identify weak listings, generate fix priorities, and optionally rewrite UK English... | |
| Shopify Product Uploader Upload and manage Shopify products individually or in bulk with SEO-optimised titles, descriptions, tags, support for variants, collections, inventory, and d... | |
| Post Update Awareness After an OpenClaw version change, read the CHANGELOG entry pinned to the installed version and surface user-relevant changes — new tools, breaking changes, o... | |
| Post Update Maintenance After an OpenClaw version bump, fix what post-update-awareness noticed. Syncs drifted externalized plugins, restarts the gateway, verifies channel health, an... | |
| Monad Wordle Skill Play a 5-letter Wordle game on the Monad blockchain using $WORDLE tokens. Start games, submit guesses, and retrieve game state via HTTP API. | |
| 看盘之眼 从通达信金融终端窗口截取股票日K图，并使用OCR识别MA均线数值。当用户需要获取股票MA均线数值、分析均线支撑压力位、或需要对交易软件截图进行文字识别时使用此skill。触发词：MA、均线数值、截图识别、股票技术指标、通达信金融终端。 | |
| linux-performance-analyzer Linux 系统性能分析与调优全能专家。融合多个专项 skill 精华，覆盖 CPU、内存、磁盘 I/O、 网络、内核参数、编译优化、容器/K8s 等全维度。触发场景： (1) 系统变慢/卡顿/负载高/响应慢 (2) 内存不足/OOM Kill/Swap 使用率高 (3) CPU 使用率异常/iowait 高/上... | |
| linux-sysadmin Linux 系统管理专家 — 覆盖用户权限、SSH、存储、网络、systemd、防火墙、 监控日志、备份恢复、证书TLS、Ansible、容器、IaC 十二大模块。 提供配置→验证→加固→监控→备份→自动化→故障排查→回滚完整闭环。 触发关键词：useradd/sudo/sshd_config/chmod/SEL... | |
| performance-mastery 全栈性能工程师 — Linux 系统与编程语言性能分析调优专家。覆盖 CPU、内存、磁盘 I/O、网络、内核参数、编译优化、eBPF 追踪、基准测试、容器/K8s。触发场景： (1) 系统变慢/卡顿/负载高/load average 高 (2) 内存不足/OOM Kill/Swap 高/内存泄漏 (3) CPU... | |
| AIVideomaker Executes AIVideoMaker API workflows for text-to-video and image-to-video generation, including task creation, status polling, task details retrieval, and can... | |
| D2 Diagram Creator Generate D2 diagram code supporting flowcharts, system architecture diagrams, organizational charts, service topology diagrams, state machine diagrams, swiml... | |
| Pingcode Timelogger Automate PingCode timesheet filling — create sub-tasks and log work hours. Use when asked to fill PingCode timesheets, log work hours, create work items, or... |
37,251–37,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.