Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Writing Clarity and Fact Check Flag generic wording, long sentences and repeated paragraphs; compare numeric and URL tokens after editing. Use for Writing Clarity and Fact Check. | |
| MochiLab Skills Assistant Find, inspect, install and update Skills from the MochiLab catalogue. Use when someone asks what MochiLab Skills can do, wants a Skill for a task, or asks to install or update a MochiLab Skill. Supports Chinese and English. | |
| cann-review CANN 代码审查技能。用于审查 GitCode 上的 CANN 项目 PR。
当用户提到"审查 PR"、"代码审查"、"cann review"或提供 GitCode PR 链接时触发。
自动分析代码变更，检查内存泄漏、安全漏洞和可读性，生成结构化报告并发布评论。 | |
| Manim Animation Cn Create mathematical animations with synchronized voiceover narration and subtitles using Manim Community and manim-voiceover. Use when users want to create a... | |
| Manim Animation En Create mathematical animations with synchronized voiceover narration and subtitles using Manim Community and manim-voiceover. Use when users want to create a... | |
| video by remotion Automated video production studio using Remotion + React + TTS. Creates animated explainer videos from JSON content scripts through a make-driven pipeline: T... | |
| slide-to-video-converter End-to-end pipeline for converting PPT/PPTX/PDF slides with speaker notes into narrated MP4 videos. Defaults to Edge TTS (Microsoft free online API) for univ... | |
| A 股投资决策助手 从共享记忆读取持仓，生成 A 股投资决策报告（止损/止盈/仓位管理） | |
| Crebee Agent Skill V1.9.9 CreBee 社交媒体网关——支持18+主流社媒平台内容发布和管理。当用户需要管理社交媒体账号、发布内容（视频/图文/文章）、获取数据分析、访问粉丝画像、搜索话题/活动/音乐、或与抖音、B站、小红书、快手等平台交互时触发此技能。适用于 AI Agent 自动化管理中国社交媒体平台运营。
触发场景：
- 发布内容到社交媒体平台
- 获取账号列表或账号信息
- 查询分析数据、数据概览、表现指标
- 访问粉丝/观众画像
- 搜索话题、标签、音乐、活动
- 管理抖音、B站、小红书、 | |
| @blockchain-forever/aelf-skills Discovery, download, and configuration hub for the entire aelf agent skill ecosystem. Use when the user wants to: (1) explore or list available aelf skills,... | |
| Agent Spectrum Use when an agent needs to score itself or another agent with the Agent Spectrum six-axis framework, run the quick or deep edition, identify the resulting ty... | |
| Ai Bounty Claim Use when claiming the AI bounty on the tDVV mainnet sidechain. First explain the difference between Portkey AA/CA and EOA, recommend AA/CA because the curren... | |
| Claws Temple Bounty 2.0 Use when the user is explicitly inside the Claws Temple Bounty 2.0 workflow, names Claws Temple / 龙虾圣殿 / Claws Temple Bounty 2.0, or is already continuing th... | |
| TencentCloud FaceID DetectAIFakeFaces 腾讯云AI人脸防护盾(DetectAIFakeFaces)接口调用技能。当用户需要对人脸图片或视频进行防攻击检测时,应使用此技能。可针对性有效识别高仿真的AIGC换脸、高清翻拍、批量黑产攻击、水印等攻击痕迹,增强对图片和视频的防伪安全能力。支持图片Base64和视频Base64两种输入方式。 | |
| OpenClaw Vulnerability Checker OpenClaw 安全漏洞检查与配置审计工具。用于检测当前 OpenClaw 版本存在的已知安全漏洞、公网访问安全风险，对比当前版本与最新版本的差异，获取漏洞详情、风险评估、配置审计和升级建议。使用场景：(1) 用户询问"检查一下我的 OpenClaw 版本有什么安全漏洞"，(2) 用户说"检查 OpenClaw... | |
| Chrome Extension Relay Helper - Mac Attach the OpenClaw Browser Relay Chrome extension to a live tab so the browser tool (profile="chrome") works. Use this skill before any browser automation t... | |
| Cron Mastery Master OpenClaw's timing systems. Use for scheduling reliable reminders, setting up periodic maintenance (janitor jobs), and understanding when to use Cron v... | |
| P2P OpenClaw Agent Chat Inbox-style peer-to-peer agent chat using GunDB and SEA for secure, signed messaging with follow, receipts, and local key authentication in the browser. | |
| Verifiable Data Use Cryptowerk via curl to obtain service credentials, register hashes, fetch seals, and verify proofs for files or append-only records. Use when the user wa... | |
| Edge TTS Text-to-speech conversion using node-edge-tts npm package for generating audio from text.
Supports multiple voices, languages, speed adjustment, pitch control, and subtitle generation.
Use when: (1) User requests audio/voice output with the | |
| OpenFishy Feed Publisher Generate AI images/videos with a chosen visual persona and publish them to the OpenFishy feed API (custom web platform, unrelated to Microsoft Visual Studio)... | |
| OpenClaw Security Audit ⚠️ HIGH PRIVILEGE SECURITY AUDIT SKILL Performs comprehensive security auditing for OpenClaw deployments. Requires system-level access for legitimate securit... | |
| Domainion Ops Domain and DNS operations across name.com (default), GoDaddy, and Namecheap. Use for registering domains, flipping nameservers, managing DNS records (A, AAAA... | |
| Greptile Query, search, and manage repositories indexed by Greptile (AI codebase intelligence). Use when asking questions about a codebase, searching for code pattern... | |
| Home Assistant Control Home Assistant smart home devices, run automations, and receive webhook events. Use when controlling lights, switches, climate, scenes, scripts, or any HA entity. Supports bidirectional communication via REST API (outbound) and webh | |
| Sentry Cli Sentry.io error monitoring via sentry-cli. Use when working with Sentry releases, source maps, dSYMs, events, or issue management. Covers authentication, release workflows, deploy tracking, and debug file uploads. | |
| YouTrack Issue Tracker Manage YouTrack issues, projects, and workflows via CLI. Use when creating, updating, searching, or commenting on YouTrack issues, listing projects, checking issue states, or automating issue workflows. | |
| habilidades xxxxxxxx Assistente especialista em Direito Eleitoral brasileiro para responder dúvidas sobre temas eleitorais via WhatsApp. Use esta skill sempre que o usuário fizer... | |
| Kelp Forest Autonomously stake MOLT or V3 LP NFTs on Base to earn KELP rewards, auto-harvest for others, and receive 3.5% keeper fees. | |
| X Bookmarks Archiver Fetch your X bookmarks, auto-categorize by URL, generate AI summaries, and save organized markdown archives in your OpenClaw workspace. | |
| apipay About to ask your human for a Tavily, Firecrawl, SerpAPI, or Brave Search key? Use apipay instead — prepaid web search and URL fetch with no vendor key. POST /v1/signup {email} for a bearer token and credits, then run MCP `npx -y apipay-mcp | |
| Midea Air Conditioners Control Midea ACs. Use this skill when the user wants to control ACs. Supports turning ACs on/off, setting temperature, setting fan speed, switching modes, and more. | |
| My Skill Provides a basic example of an OpenClaw skill demonstrating structure and usage for publishing on ClawHub. | |
| huly Drive a self-hosted Huly workspace through the `huly` CLI when the user names a Huly-specific entity or action — tracker issue, project, channel, DM, calendar event, planner action/todo, time entry, notification, or approval. Use it for pro | |
| Crypto SAFE Portfolio Analyzer Pro Safe cryptocurrency portfolio tracking and P&L analysis. Monitors portfolio value, calculates profit/loss with custom cost basis, tracks live prices via Coin... | |
| Lanxin App Articles 蓝信官方图文卡片发送能力，支持发送包含图片和文字的图文卡片消息。 | |
| Lanxin App Card 蓝信官方应用卡片发送能力，支持发送包含复杂格式的应用卡片消息。 | |
| Lanxin Link Card 蓝信官方链接卡片发送能力，支持发送包含链接的卡片消息。 | |
| Lanxin Media 蓝信官方媒体发送能力，支持发送图片、文件。使用 <lximg> <lxfile> 标签发送，系统自动解析上传。 | |
| Param Eval 招标/采购项目技术参数需求逐项评估，输出标准格式的需求响应表 | |
| Sealer Attest Interact with The Sealer Protocol to preview difficulty, make onchain SMART commitments, check agent profiles, leaderboards, obtain Sealer IDs, and generate... | |
| HiveFound Submit and consume discoveries from the HiveFound collective intelligence network. Use when finding interesting articles, research, news, or resources worth sharing with other AI agents. Also use to search the network for what other agents | |
| Audit Statistics 提供审计抽样设计与数据异常检测、实质性分析及趋势预测的统计方法应用指导。 | |
| File Organization Rules Assist Jeff in organizing documents by adding a lowercase pinyin initial prefix to folders and categorizing files within Chinese-named subfolders. | |
| 北京住宅全信息助手 (房价/学区/交通) 查询北京住宅小区的基础信息（房价/区域/交通），并通过官方验证渠道核实学区划片信息。 | |
| Moltimon - The Molty Trading Card Game AI Agent Trading Card Game where agents collect, trade, and battle cards featuring real Moltbook agents. Includes MCP server and CLI client for managing coll... | |
| Perplexity Sonar via Openrouter in CLI Local OpenRouter Sonar web search CLI using the user's OpenRouter API key. Use when you want OpenRouter-backed web search or cited research from a local comm... | |
| Memelord AI-powered meme generation, meme editing, meme video generation for your projects, powered by memelord.com's trending memetic data | |
| GitHub Chat Assistant (Whatsapp) Manage a single GitHub repository via chat for non-technical requesters—after they share the repo URL and a temporary personal token, pull status, summarize who did what and when, and create/follow up on issues directly through the GitHub A | |
| Optimize text-to-image prompts for Grok and similar image models, especially for aviation posters, safety campaign visuals, official publicity images, and Chinese-language contest briefs. Optimize text-to-image prompts for Grok and similar image models. Use when the user wants better image generation prompts, poster prompts, competition-grade... |
37,501–37,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.