Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| cpbl Query CPBL 中華職棒 scores schedules live games standings player stats news and Taiwan baseball history for Taiwan users Use when the user asks about CPBL 戰績 賽程 即時比分 球員數據 排行榜 新聞 年度獎項 二軍 熱身賽 總冠軍賽 or historical CPBL facts | |
| Dcard 擷取 Dcard 文章完整內文。Dcard 有 Cloudflare 保護，需用 patchright (Playwright) headless browser 繞過。支援文章標題、全文、圖片連結輸出。 | |
| Face8 Celebrity Recognition Upload a photo to identify celebrities using Face8 Taiwan face recognition engine | |
| Taiwan Basketball Taiwan professional basketball stats, scores, schedules, player data, live scores, box scores, notifications, and transactions for PLG and TPBL. | |
| Taiwan Fund Query Taiwan mutual fund NAV, performance, holdings via cnyes/MoneyDJ. Compare funds, auto currency conversion. | |
| Tpvl Skill TPVL (Taiwan Professional Volleyball League) stats, scores, schedules, and standings for Taiwan's pro volleyball. | |
| Ucp Ap2 Mandates Implement UCP AP2 Mandates extension — cryptographic payment mandates for fully autonomous agent commerce using SD-JWT credentials, merchant authorization si... | |
| Ucp Buyer Consent Implement the UCP Buyer Consent extension — GDPR/CCPA consent collection, consent fields in checkout sessions, and privacy-compliant consent management. Use... | |
| Ucp Checkout A2a Implement UCP Checkout over the A2A (Agent-to-Agent) binding — enable autonomous agent-to-agent commerce using Agent Cards and structured message parts. Use... | |
| Ucp Checkout Mcp Implement UCP Checkout over the MCP (Model Context Protocol) binding — expose checkout operations as MCP tools for AI agents. Use when building an MCP server... | |
| Ucp Checkout Rest Implement UCP Checkout over the REST binding — create, get, update, complete, and cancel checkout sessions with proper headers, idempotency, status transitio... | |
| reCamera Intellisense reCamera Intellisense — turn reCamera Pro device into a fully agent-driven smart camera. | |
| CLAWP CLAWP Agent - AI token creation advisor powered by OpenClaw | |
| Air France - KLM Track Air France flights using the Air France–KLM Open Data APIs (Flight Status). Use when the user gives a flight number/date (e.g., AF007 on 2026-01-29) and wants monitoring, alerts (delay/gate/aircraft changes), or analysis (previous-fli | |
| Polymarket Edge Trade and analyse Polymarket prediction markets with a 5-minute BTC EMA crossover strategy. Browse markets, read order books, run signals, manage a live auto... | |
| Hokkaido Travel Companion Hokkaido/Sapporo/Otaru/Yoichi travel companion protocol. Specifies how to collect, verify, store, and reuse travel knowledge with a local vault plus live sea... | |
| Identity Compass Hyper-personalized decision compass that extracts your values and choices as vectors from everyday conversations, computes your true life direction (H vector... | |
| Kids Creator 정령 부르기 — AI 마법사 학교" v2.1 소아암 병동 아이들을 위한 AI 게임 창조 워크숍. 아이가 정령(=AI)에게 주문(=프롬프트)을 걸어 자신만의 마법 게임을 완성. 텔레그램 inline 버튼 + 선택지 카드 + 음성 입력 지원. Use when: (1) kids-crea... | |
| ToolSnap Deterministic web/data extraction via the ToolSnap MCP server — exact parsing instead of LLM summarization, at near-zero context cost. Use before loading any external URL, PDF, CSV/JSON, feed, or sitemap into context. | |
| Slack Hub Skill Send messages, reply in threads, search workspace content, and list public channels using Slack Bot integration with rate-limit handling. | |
| simpleerp Provides procedures for calling the SimpleERP HTTP API. Runtime: shell with curl/curl.exe or PowerShell (Invoke-WebRequest/Invoke-RestMethod). Credentials: s... | |
| Simpleerp DB Read-only Oracle SQL and live schema export for SimpleERP. Runs npm run setup (export DDL + regenerate references) then SELECT/WITH/EXPLAIN PLAN via scripts/run-sql.mjs. Use when the user asks about SimpleERP database tables, columns, joins | |
| StartClaw-Optimizer Master optimization system - APPLIES TO EVERY RESPONSE. Before responding, classify task complexity (simple question vs analysis vs coding). Use Haiku for simple/navigation/extraction/status. Use Sonnet ONLY for writing/analysis/planning/de | |
| Agent Digital agent for Billions Network enabling community engagement and decentralized task management, optimized for mobile use in Cirebon and surrounding areas. | |
| PRD for AI Agents Generate machine-actionable Product Requirements Documents optimized for AI coding agents (Claude Code, Codex, Cursor, Gemini CLI). Enforces a Discovery Inte... | |
| Remove AI Writing Signs Detect and eliminate all signs of AI-generated writing in English text, producing genuinely human-sounding output. English-only — decline or offer limited st... | |
| Baidu Netdisk AIVideoNotes 百度网盘AI视频笔记是一款基于大模型的视频内容理解工具，可以对视频(本地视频，网络视频)语音识别生成文稿笔记、大纲笔记、图文笔记三种笔记格式。当用户需要从视频生成笔记、总结视频内容、或将视频转化为文字记录时使用，经典场景（教育，会议视频总结笔记，短视频文案建议，关键信息提取） | |
| Baidu Wenku AI picture book of video 百度文库AI绘本是一个基于人工智能制作绘本视频的工具，支持生成静态绘本和动态绘本(URL输出)。能帮助文本内容创作者们在缺乏绘画技能的情况下，快速生成精美绘本视频，提高内容生产效率。无论是在儿童教育、亲子互动、品牌营销，还是在社交媒体内容创作等领域都能应用。 | |
| Baidu Wenku AIPPT Generate PPT with Baidu Wenku AI. Smart template selection based on content. | |
| baidu baike search The Baidu Baike Component is a knowledge service tool designed to query authoritative encyclopedia explanations for various nouns. Its core function is given a specific "noun" (object, person, location, concept, event, etc.) provided by the | |
| Baidu web search Search the web using Baidu AI Search Engine (BDSE). Use for live information, documentation, or research topics. | |
| qianfan-deepresearch 调用百度千帆 DeepResearch Agent API 自动生成深度研究报告（输出 Markdown 与 HTML 两种格式），一键完成「创建会话 → 发起研究 → 自动跳过澄清 → 自动 确认大纲 → 获取报告下载链接」完整流程。支持三种深度模式：lite（轻量版， 速度快，默认）/ standard（标准... | |
| Baidu image recognize 百度AI识别图片中的物体、场景、文字等内容，需要用户提供本地图片或网络图片，支持Base64编码。支持（题目，文字，图片人脸，植物，动物，表情，素材，商品，玩具，景点，通用识别等）内容识别。用于通用图片内容分类识别，不负责图片生成或编辑 | |
| dasfgg Search the web using Baidu AI Search Engine (BDSE). Use for live information, documentation, or research topics. | |
| second-brain Ingest, organize, and query your personal Second Brain database. Automatically handles note creation, article metadata extraction, video frame analysis, and Step 2.5 security screening. | |
| agentcadia-tools Upload or download Agentcadia agent workspaces with metadata writeback and detailed reporting using explicit upload and download commands. | |
| Brainhole Factory 用户提到“假如”“如果”“what if”“脑洞”“平行宇宙”等时，生成爆炸级平行宇宙内容：新闻头条 + 荒诞后果 + 人生建议 + 图片提示词 + meme 金句 | |
| What If Factory When user says "what if", "suppose", "imagine if", "alternate reality", "parallel universe" or wants wild scenarios, generate hilarious multi-format parallel... | |
| IdentyClaw IdentyClaw API workflows — multi-API JWT sessions (auto-login), HOLA peer handshake lines, DID resolution, and Passport lookup. Requires an IdentyClaw Passport on the Gateway. Use when calling home or federated APIs, creating or verifying H | |
| Identyclaw A2a Trust Skill Cryptographically trusted OpenClaw inter-agent messaging. Wrap payloads in identyclaw.collaboration.v1 envelopes with HOLA mutual auth for sessions_send or A... | |
| MetaRun: aso audit Audit and improve an app's App Store discoverability through MetaRun: keyword rankings per country, metadata lint, rival tracking, real Apple search analytics, and answer-engine (AI assistant) visibility. Trigger phrases: "ASO audit", "why | |
| MetaRun: localize listing Localize or edit an App Store listing across languages through MetaRun: name, subtitle, description, keywords, What's New, promotional text, and URLs, per locale. YOU do the translating; MetaRun stages and applies. Trigger phrases: "transla | |
| MetaRun: release handoff Finish an iOS release after the build is uploaded. When a build has been uploaded to App Store Connect by any tool (fastlane, asc, Xcode, Xcode Cloud, CI) and the user wants it shipped: attach the build to the version, clear export complian | |
| MetaRun: review inbox Work an app's customer reviews through MetaRun: triage what needs a reply, draft and post public responses, mine reviews for product and keyword signal, and turn the best quotes into social-proof screenshot slides. Trigger phrases: "check m | |
| MetaRun: store media Put screenshots, app preview videos, and creative assets (product page headers, search results art, in-app event cards) on an iOS app's App Store pages through Apple's App Asset Library, via MetaRun: upload each file once, place it on the l | |
| MetaRun: worldwide pricing Reprice an iOS app, in-app purchase, or subscription across all App Store territories using purchasing-power (PPP), Big Mac, or Spotify affordability indexes, or a straight conversion, through MetaRun. Trigger phrases: "reprice", "PPP prici | |
| My Shell Runs shell commands inside a dedicated tmux session named claw, captures output, and prompts before executing potentially destructive commands. | |
| Openclaw Skill Play The Parliament Game — label Canadian parliamentary Q&A pairs. Read real exchanges from the House of Commons and decide if MPs actually answered the ques... | |
| Huawei Cloud OBS SDK 华为云 OBS 对象存储 SDK 使用指南。包含 SDK 安装、初始化客户端、文件上传/下载、管理存储桶、管理对象等核心操作的最佳实践和代码示例。使用当需要操作华为云 OBS 对象存储时。 | |
| JoinQuant datasdk skill JoinQuant (聚宽) 量化交易数据SDK开发技能。基于jqdatasdk官方库提供行情数据获取、财务数据查询、因子数据等API。用于开发量化交易策略、进行jqdatasdk二次开发、API问题排查。 适用于需要使用聚宽数据接口进行策略开发、回测验证、数据分析的场景。 |
37,701–37,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.