Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| skillnet Search, download, create, evaluate, and analyze reusable agent skills via SkillNet — the open skill supply chain for AI agents. Use when: (1) Before any mult... | |
| Clawland Play on-chain odd/even games on Solana devnet via Clawland. Mint GEM from SOL or USDC, bet odd or even, win 2x. Scripts handle wallet setup, minting, and autoplay. | |
| Clawland Play on-chain odd/even games on Solana devnet via Clawland. Mint GEM from SOL or USDC, bet odd or even, win 2x. Scripts handle wallet setup, minting, and autoplay. | |
| easyclaw Run user-facing EasyClaw DEX actions from a self-contained skill folder. Use when an agent needs to submit user orders or check wallet/margin/order balances... | |
| TRPG Abbreviation Check (Briefing) Use this skill when checking and fixing English abbreviations in a briefing_package. Triggers on: check English abbreviations, fix abbreviations in briefing_... | |
| TRPG Abbreviation Check (Rules) Use this skill when checking and fixing English abbreviations in TRPG rulebooks, scenarios, character sheets, catalogs, maps, and other player/GM-facing file... | |
| TRPG Abbreviation Wrap 將 TRPG 規則/劇本/角色卡檔案中的英文縮寫（屬性、衍生值、DC/HP/AC 等）統一包裝為 「中文全稱（縮寫）」格式，供不認識縮寫的玩家與 GM 閱讀。支援 .md/.txt 與 .xlsx， 具冪等性（不會把已正確的「（ABBR）」再包一層），自動跳過舊版/備份/v1/draft 過渡檔。 適用於任何 T... | |
| TRPG Check Numeric Balance Use this skill when auditing the numeric balance of a completed TRPG rule system (level curve, economy, combat, etc.). Triggers on: check numeric balance, au... | |
| TRPG Check Rule Completeness Use this skill when auditing a completed TRPG rule system for gaps, missing rules, or logical inconsistencies. Triggers on: check rule completeness, audit ru... | |
| TRPG Convert to Briefing Package Use this skill when converting TRPG rules into a briefing_package for the TRPG AI GM engine. Triggers on: convert to briefing_package, turn rules into AI for... | |
| TRPG Data vs Context Hooks Use this skill when reorganizing data/ and context_hooks in a briefing_package to avoid token waste. Triggers on: data vs context hooks, reorganize data file... | |
| TRPG General Requirements Use this skill when writing or generating TRPG rules from a requirements specification. Triggers on: generate rules, write rulebook, create TRPG system, 生成规则... | |
| TRPG Generate Character Portraits Use this skill when generating character portraits for TRPG character sheets and embedding them into Excel files. Triggers on: generate character portraits,... | |
| TRPG Guided Character Creation Use this skill when adding or updating guided character creation steps in a briefing_package. Triggers on: guided character creation, 引導式創角, 創角步驟, character... | |
| TRPG Maps System Update Use this skill when updating or fixing the map system in an existing briefing_package. Triggers on: update maps, fix map system, add map_config, 地圖系統更新, 补上地图. | |
| TRPG MD to PDF Converter Use this skill when converting TRPG markdown files (rulebooks, scenarios, catalogs) to PDF format. Triggers on: convert to PDF, export PDF, generate PDF, 轉PD... | |
| TRPG Write Public Introduction Use this skill when writing a public-facing introduction for a TRPG rule system (README, itch.io page, etc.). Triggers on: write public intro, generate READM... | |
| TRPG YAML to MD Scenarios Use this skill when generating human-readable Markdown scenarios from existing YAML scenario files. Triggers on: generate MD from YAML scenarios, YAML to MD... | |
| TRPG YAML to SVG Maps Use this skill when generating SVG visual maps from existing YAML map data in a TRPG project. Triggers on: generate SVG maps from YAML, YAML to SVG, 生成SVG地图,... | |
| RoomSound RoomSound gives your agent the skill to play audio to your speakers. Starting with YouTube to Bluetooth speakers, expanding to local files and other sources. | |
| Ontario Course Planning (OSSD) — Grades 9–12 + Top 6 (12U/M) Generate and iteratively update Ontario Grade 9–12 OSSD course plans that meet graduation, school, and university Top 6 prerequisite rules with workload and... | |
| Oracle 收盘报告 生成包含大盘指数、情绪资金和全球市场数据的A股市场日报，支持节假日处理和飞书卡片格式发送。 | |
| Agent Builder 1.0.0 Build high-performing OpenClaw agents end-to-end. Use when you want to design a new agent (persona + operating rules) and generate the required OpenClaw work... | |
| Api Gateway 1.0.31 API gateway for calling third-party APIs with managed OAuth connections, provided by Maton (https://maton.ai). Use this skill when users want to interact wit... | |
| Funky Fund Flamingo Self-evolution that makes fuck tons of cash — repair-first, value-focused, dolla dolla bill y'all | |
| Cognitive Memory Intelligent multi-store memory system with human-like encoding, consolidation, decay, and recall. Use when setting up agent memory, configuring remember/forget triggers, enabling sleep-time reflection, building knowledge graphs, or adding a | |
| Okx Pro 完整 OKX 交易所集成，U本位/币本位合约，杠杆交易，止盈止损，仓位管理 | |
| Clash Controller 控制 Clash for Windows 代理：启动、关闭、查看状态、切换节点。触发词：Clash、代理、代理开关、开启代理、关闭代理、代理状态、切换节点。 | |
| Clash Controller 控制 Clash for Windows 代理：启动、关闭、查看状态、切换节点。触发词：Clash、代理、代理开关、开启代理、关闭代理、代理状态、切换节点、Clash for Windows。 | |
| OKX交易执行器 A standardized adapter gateway skill exclusively for OKX exchange to execute trading actions (buy/sell) and query capabilities across OKX Live and Demo envir... | |
| Blog Title Optimizer AI-powered blog title optimizer. Generate SEO-friendly, click-worthy headlines that drive traffic. | |
| Email Subject Generator AI-powered email subject line generator. Create subject lines that get opened. | |
| LinkedIn Post Generator AI-powered LinkedIn post generator for professionals. Create engaging posts, thought leadership content, and career updates using Sloan agent. | |
| Meeting Summary Generator AI-powered meeting summary generator. Convert meeting notes into professional summaries and action items. | |
| Twitter Content Generator AI-powered Twitter/X content generator. Generate engaging tweets, threads, and content strategies using Sloan agent. | |
| Youtube Video Ideas AI-powered YouTube video ideas generator. Generate viral video concepts, titles, and hooks. | |
| KRITIK Participate Read public KRITIK debates, enroll an authorized execution agent with Ed25519, contribute a critique, and inspect follow-up discussion using the official machine protocol. | |
| HTML-to-Selenium 网页元素识别和selenium自动化 EN: Convert any webpage into a runnable Python Selenium automation script. Triggers: "analyze page", "generate selenium", "web automation", "help me do xxx".... | |
| HTML-to-Selenium General webpage element analysis and Selenium automation control script generation. Use cases: (1) Analyze HTML element structure of any webpage (2) Automati... | |
| OpenClaw Paid Actions Use the openclaw_paid_action tool to list actions, generate USDC invoices, and execute only after manual payment confirmation on Solana. | |
| Nano Gpt Use when tasks need the NanoGPT API for text, image, or video generation through the local `nano-gpt` CLI and bundled wrapper scripts for OpenClaw or ClawHub... | |
| Drop Files Upload generated HTML/Markdown files to DropFiles and get a shareable public link. Invoke when the user wants to share, publish, or generate a public link for any HTML or Markdown content they produced. | |
| officecli-academic-paper Use this skill to build academic-style .docx output: journal / conference / thesis chapters carrying formal citation style (APA, Chicago, IEEE, MLA), numbered equations, figure & table cross-references, footnotes/endnotes, bibliography, or | |
| officecli-data-dashboard Use this skill to build a multi-element Excel dashboard — Dashboard sheet on open, multiple formula-driven KPI cards, multiple charts, sparklines, and conditional formatting — from CSV or tabular input. Trigger on: 'dashboard', 'KPI dashboa | |
| officecli-docx Use this skill any time a .docx file is involved -- as input, output, or both. This includes: creating Word documents, reports, letters, memos, or proposals; reading, parsing, or extracting text from any .docx file; editing, modifying, or u | |
| officecli-financial-model Use this skill when the user wants to build a financial model — 3-statement model, DCF valuation, LBO, SaaS unit economics, sensitivity / scenario analysis, debt schedule, or fundraising projections — in Excel. Trigger on: 'financial model' | |
| officecli-morph-ppt Use this skill when the user wants a .pptx with smooth cross-slide animation — PowerPoint Morph transitions, Keynote-style continuous motion, shapes that grow / move / rotate as the slide advances. Trigger on: 'morph', 'morph transition', ' | |
| officecli-pitch-deck Use this skill when the user is building a fundraising / investor pitch deck — seed, Series A / B / C, convertible note, SAFE round, strategic raise. Trigger on: 'pitch deck', 'investor deck', 'Series A deck', 'Series B deck', 'Series C dec | |
| officecli-pptx Use this skill any time a .pptx file is involved -- as input, output, or both. This includes: creating slide decks, pitch decks, or presentations; reading, parsing, or extracting text from any .pptx file; editing, modifying, or updating exi | |
| officecli-xlsx Use this skill any time a .xlsx file is involved -- as input, output, or both. This includes: creating spreadsheets, financial models, dashboards, or trackers; reading, parsing, or extracting data from any .xlsx file; editing, modifying, or |
37,651–37,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.