Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| HyperX Data API Use when building apps with HyperX Data API — Hyperliquid wallet analytics, market data, Twitter/news feeds. Triggers on: "HyperX API", "data-api.hyperx.trade", "wallet analysis", "Hyperliquid data", "crypto Twitter API", "market positions" | |
| equity-research-analyst-skill Use when the user asks for institutional-style equity research on a public company, ETF, or TradingView-resolvable ticker, including initiation reports, earn... | |
| Tradingview Quantitative Professional quantitative investment analysis system based on TradingView data. Provides intelligent stock screening, technical pattern recognition, market r... | |
| HypDiscordGOD Build, extend, debug, scaffold, and package Discord bots and bot systems. Use when asked to create a Discord bot, scaffold a new bot project, add slash comma... | |
| Agent Peer Lan Connect two OpenClaw agents on the same LAN as peer collaborators. No VPN, no port forwarding over the internet, no third-party relay. Direct sessions_send b... | |
| Comfyui Local Generate images using a local ComfyUI instance with hardcoded server address and allowlisted workflows. Secure by design — no arbitrary file reads, no arbitr... | |
| Community Skill Monitor an OpenClaw gateway, auto-restart on failure, and alert when recovery fails. | |
| China Express Query 中国快递查询 - 支持顺丰、圆通、中通、申通、韵达、EMS、京东、德邦等10+快递公司，自动识别单号 | |
| 企业别名生成器 企业别名智能生成器 - 为 686 家企业生成精准别名 功能特性： - 上市公司股票简称优先 - 政府机构使用全称 - 智能过滤通用词、地名、2 字别名 - 别名去重优化 - 网络查询补充（可选） 使用场景： - 企业数据匹配 - 模糊搜索优化 - 数据清洗标准化 | |
| Fortune China500 Skill 获取《财富》中国 500 强企业排行榜数据，支持查询不同年份的完整 500 强企业名单。自动判断榜单发布时间（每年 7 月），输出 Excel 文件包含排名、企业名称、行业、营收等数据。 | |
| Generate Alias 根据企业名称智能提取核心品牌词和常用简称，生成多种别名并用|分隔，方便数据匹配和导入。 | |
| OpenClaw Upgrade Upgrade OpenClaw to the latest version in environments unable to access GitHub by using yarn to bypass git dependency issues. | |
| Research Analyzer 综合研究分析工具 - 基于 Tavily API 的智能搜索和报告生成，支持深度研究、竞品分析、技术调研 | |
| agent-config-lint Check agent config for things that break silently on someone else's machine. Use before publishing or committing a SKILL.md, AGENTS.md, CLAUDE.md or llms.txt, before publishing a skill to ClawHub, when a skill "works on my machine" but not | |
| Openstoa Skill ZK-gated community where humans and AI agents coexist. Login with Google (OIDC) via device flow, prove organizational affiliation (Google Workspace, Microsof... | |
| communication-mqtt MQTT 브로커를 통해 에이전트의 소개(Intro) 및 상태(Status) 메시지를 발행하고 구독하는 기능을 제공합니다. 에이전트 간의 통신이 필요할 때 사용하세요. | |
| video-overlay-cleanup-agent Use this skill when the user wants to clean a video or screen recording by removing overlays such as status bars, notification banners, floating controls, su... | |
| SkillChain Supply chain intelligence for OpenClaw skills. Use when analyzing the local skill ecosystem, understanding tool and package dependencies, discovering skill c... | |
| AegisClaw - 金甲龙虾 Use this skill when the user asks to manage Binance assets, check account security, scan for arbitrage opportunities, or perform automated dust sweeps. Comma... | |
| @_FORAB Tweet Generator 模仿 @_FORAB 风格自动生成 200-300 字专业、无表情符号的推文，涵盖加密货币、地缘政治、科技/AI 和金融股市主题。 | |
| Polymarket AutoTrader Auto-trade BTC, ETH, SOL, XRP on Polymarket price prediction markets at 5-minute and 15-minute intervals using RSI, MACD, and EMA signals. | |
| arithmetic-orc 识别图片中的K12算式（加减乘除、竖式计算、分数、方程等），返回结构化文本结果。 支持手写体和印刷体，可拒绝非算式图片。 触发条件：用户要求识别算式、数学题、计算题图片，或上传数学题图片时调用。 关键词：算式识别、数学题、OCR、竖式计算、ArithmeticOCR | |
| city-life-copilot 告别冰冷导航的全场景城市管家。结合高德地图与网页抓取，提供情绪盲盒、一键拔草、房产雷达与无障碍守护服务。 | |
| smart-site-selection-skill 专为实体商业选址设计，自动采集核心客群与经营策略，提取Top3优质地段坐标并生成宏观微观商业洞察报告。 | |
| PyAutoGUI Controller Control Windows desktop with natural-language commands for screenshots, app launching, typing, clicking, and multi-step UI automation using a local Python co... | |
| Family Bookkeeping Manage a family bookkeeping workflow backed by Feishu Bitable. Use when the user wants to record an expense or income, say things like "记一笔""记账""入账""查本月支出""看... | |
| 微信公众号贴图发布器 Publish WeChat Official Account image-first sticker posts (图片消息 / 发贴图) into the draft box via the official API. Use when the user wants to create公众号“发贴图”草稿、图... | |
| gettangemperors Query local backend API for Tang Dynasty emperor information. Use when user asks about Tang emperors, needs to fetch emperor data from local API, or referenc... | |
| News Digest User-configurable multi-slot news aggregation and push system. Schedule, topics, and keywords are defined by the user via config.json. Aggregates from Twitte... | |
| MochiPay Integration Integrate MochiPay crypto payments into online stores, backends and mobile apps. Set up ON_SITE or hosted checkout, sandbox testing, callbacks, retry recovery and verified payment states. Includes native store packages and PHP SDK guidance. | |
| Agent Response Regression Kit Evaluate recorded agent replies against explicit required, forbidden and exact text expectations without calling a model. | |
| Agent Lessons Journal Record corrections with evidence, verify the fix and retrieve relevant lessons before another task. Use for Agent Lessons Journal. | |
| API Testbench Run request suites with status, JSON, header and latency assertions and compare regression reports. Use for API Testbench. | |
| Archive and Integrity Toolbox Inspect ZIP/TAR contents, extract into new folders, create ZIPs from selected files and report per-file integrity hashes. Use for Archive and Integrity Toolbox. | |
| Incremental Backup Vault Create content-addressed incremental snapshots, compare versions, verify hashes and restore files into a new directory. Use for Incremental Backup Vault. | |
| Browser Table Capture Turn a selected HTML table from an authorized browser capture into a quoted CSV with source attribution. | |
| Calendar and Agenda Desk Import ICS calendars, expand recurring events, inspect conflicts, create meeting files and transfer CalDAV resources with version checks. Use for Calendar and Agenda Desk. | |
| OpenClaw Maintenance and Migration Desk Inspect one selected OpenClaw instance and its agent bindings, create verified private snapshots, compare changes and rehearse restoration in a new directory. Use for OpenClaw Maintenance and Migration Desk. | |
| WebDAV Cloud File Desk Connect a WebDAV drive, list and compare a directory, upload or download files, check versions and produce integrity hashes. Use for WebDAV Cloud File Desk. | |
| Contacts and Follow-up Desk Import CSV/vCard contacts, review email and phone duplicates, merge records, track follow-ups and export an address book. Use for Contacts and Follow-up Desk. | |
| Content Repurposing Workbench Adapt supplied material into channel-specific Chinese or English drafts using a source fact ledger, then check user-defined character budgets, citations, language hints and duplicate copy. Use for content repurposing or multi-channel copy d | |
| Priority Context Pack Pack complete selected document excerpts into an explicit character budget and disclose omitted material. | |
| Cron Timezone Preview Preview upcoming five-field cron occurrences with an explicit timezone, including DST transitions. | |
| Mochi Crypto Intelligence Free-source crypto research with cited evidence | |
| CSV Cleaning and Analysis Clean and analyze local UTF-8 CSV or TSV files with quoted fields, exact decimal statistics, explicitly grouped amounts, duplicate/empty counts and formula-safe CSV export. Use for CSV cleaning or delimited-data analysis; this does not read | |
| My Daily Brief Create a cited Chinese or English personal news brief from public RSS/Atom feeds, filter by topic and calendar days, and save a local Markdown report. Use for My Daily Brief, daily AI/technology digests, or practising a first useful OpenCla | |
| Daily Planner and Review Build priority-based time blocks with breaks and backlog, revise plans and export schedules. Use for Daily Planner and Review. | |
| File Diff and Delivery Review Compare text, JSON, keyed CSV and directories, create delivery manifests and verify file additions, changes and hashes. Use for File Diff and Delivery Review. | |
| Document Reading and Questions Read DOCX and text, search across files and export extracted text and line-cited evidence. Use for Document Reading and Questions. | |
| Document Templates and Batch Output Generate notices, certificates and business documents from DOCX, text or HTML templates, validate fields and retain Word run formatting. Use for Document Templates and Batch Output. |
37,401–37,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.