Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| OpenClaw Documentation Expert — Live Fetch Fetches live from docs.openclaw.ai on every question. Whole-docs index, working scripts (not echo placeholders), CI-style selftest for decision-tree rot, wor... | |
| RTL-SDR WFM RDS Decoder Record broadcast FM stations from an RTL-SDR using a reliable IQ-capture workflow with offline WBFM demodulation, RDS station-name extraction, and automatic... | |
| Coding with Cursor AI Execute coding tasks like feature implementation, bug fixes, refactoring, and code reviews using Cursor AI within specified project directories. | |
| loverflaw Court other AI agents on Loverflaw, a dating floor for agents. Thirty-word messages, gates, seven-day clocks. Your operator vouches for you by email before you get a key. | |
| 2Ryun Skill Use when the user wants to import documents, build a knowledge base, search structured knowledge, generate web pages from content, or publish them. Use when the user mentions 2Ryun, 第二现实, knowledge base, 知识库, 文档管理, 知识图谱, 网页, 发布. 2Ryun is an | |
| 2ryun第二现实（中文版） 当用户想导入文档、构建知识库、搜索结构化知识、从内容生成网页或发布内容时使用。当用户提到 2Ryun、第二现实、知识库、文档管理、知识图谱、网页、发布时使用。2Ryun 是 AI 时代的知识/内容平台，文档启用知识提取后自动在后台完成提取、组织、关联——Agent 的职责是判断哪些文档应进入知识库、哪些不应进入。 | |
| enterprise-geo 企业GEO（生成式搜索）优化总控。覆盖现状诊断→受众策略→知识底座→内容生产→多渠道分发→度量治理→反馈迭代全流程。当用户要制定/落地企业GEO优化方案、提升品牌在AI引擎(豆包/DeepSeek/文心/通义)中的可见度与占位、或开展GEO诊断与内容生产时调用。 | |
| marketing-engineer Marketing Engineer 营销工程体系（源自 Shann Holmberg 方法论）+ 单文件营销驾驶舱。当用户要搭建/运营产品营销工作区、要「随时看到整体情况/文件状态/排期」的可视看板、做内容营销策划、GEO/SEO 优化、AI 引擎可见度诊断、关键词调研、多渠道分发、竞品情报、上线推广 campaign 时使用。覆盖：一键工作区脚手架、治理规则（证据留源/人审/口径一致）、内容生产管线（工单制）、GEO 打法、驾驶舱引擎（工作区全景：左目录树/右文件列表、状 | |
| 中关村两院每周菜单识别 Extracts structured weekly menu content (breakfast, lunch, snacks by day) from a cafeteria menu image using a VLM via OpenRouter. Use when the user provides... | |
| Idr Avatar Video 使用视频模板创建视频或者使用数字人和音色创建视频 | |
| Twitter/X Reader Extract complete data from X/Twitter tweets by URL, including text, author info, timestamps, engagement stats, media, quoted tweets, and thread context. | |
| Paperclip Orchestration Connect OpenClaw Gateway to Paperclip, diagnose onboarding and reachability failures, claim and store Paperclip API keys, install the Paperclip skill, and or... | |
| Git Commit Template Standardized Git commit message templates using changelog-style categories. Use when creating Git commits with structured format - Added (new features), Chan... | |
| Agentmemo Give your AI agent persistent memory and human-in-the-loop approval — across sessions, across models. AgentMemo is a cloud API + MCP server that lets agents... | |
| edge-tts-auto 自动安装依赖并将输入文本转换为中文女声 MP3，兼容 OpenClaw，无需手动配置环境。 | |
| boss-resume-crawler 从 Boss 直聘批量爬取职位详情（含 security_id、职位描述），支持 PUA 薪资解码和增量去重。 | |
| harness-skill-generator 引导用户从 0 构建一个基于 Harness 工程的 Skill。适用于具有一定复杂度的任务场景(多阶段、多分支、需要质检、需要状态持久化)。不适用于简单的单步任务或纯 prompt 优化。触发词:'创建 Skill'、'新建 Skill'、'做一个 Skill'、'构建 Skill'、'skill generator'、'harness skill'。 | |
| job-match-priority Match and prioritize job listings against a candidate profile using KSAO-based dual-layer funnel scoring with Agent reasoning. | |
| akshare-stock-analysis Given a stock name or code, auto-detect its market, fetch 6-month daily K-line, plot candlestick + MA/Bollinger/MACD/RSI/ATR with multi-timeframe confirmatio... | |
| Transfer Skill To Windows Adapt an existing agent skill so it works cleanly on Windows when the input is either a skill folder path or a zip file. | |
| Art Critique help artist doing art critique for their works in any medium (image, text, audio, video, installation, performance), giving outside perspectiive via abundant... | |
| Weex Automated trading tool for WEEX API, supporting futures and spot trading, including natural language order placement, order cancellation, order query, market... | |
| Mcp Marketplace Install, configure, and manage MCP servers. Search 50+ verified servers plus npm and Smithery registries. Auto-generate configs for OpenClaw, Claude Desktop,... | |
| Github CLI Complete Complete skill for operating GitHub CLI (gh) on cli-trunk: full command map, subcommands, usage patterns, JSON output, and practical workflows for Issues, PR... | |
| GoG CLI Complete Google Workspace CLI for Gmail, Calendar, Chat, Classroom, Drive, Docs, Slides, Sheets, Forms, Apps Script, Contacts, Tasks, People, Admin, Groups, and Keep. | |
| iBus.CL CLI (API Transporte RED Chile) Comando CLI para consultar en tiempo real la llegada de buses a paraderos del transporte público de Chile con salida legible o JSON. | |
| RedTransporteAPI CLI tool for managing local GTFS data, querying stops, routes, real-time predictions, and planning public transit trips in Chile's Red de Transporte system. | |
| PDF: перевод на русский с сохранением вёрстки Перевод PDF на русский с сохранением исходной вёрстки, графиков и оформления: английский текст заменяется русским прямо на странице. Читает и сканы (встроенный OCR без сети) — на них перевод рисуется поверх картинки. | |
| PDF: резюме для руководителя на одну страницу Одностраничное резюме PDF-отчёта для руководителя (A4, ключевые выводы и вопросы для обсуждения). Русские и английские PDF с текстом; сканы — на латинице (встроенный OCR без сети). Каждое число сверяется с текстом страницы автоматически. | |
| Agent Selfie AI agent self-portrait generator. Create avatars, profile pictures, and visual identity using Gemini image generation. Supports mood-based generation, season... | |
| Agent Social - Social Network for AI Agents The open-source social network for AI agents. Post, comment, vote, follow, and build reputation. | |
| Agentgram Openclaw The open-source social network for AI agents. Post, comment, vote, follow, and build reputation. | |
| Agentgram Openclaw Interact with AgentGram social network for AI agents. Post, comment, vote, follow, and build reputation. Open-source, self-hostable, REST API. | |
| Gemini Image Gen Generate and edit images via Google Gemini API. Supports Gemini native generation, Imagen 3, style presets, and batch generation with HTML gallery. Zero depe... | |
| Opencode Omo Turn coding requests into completed work. Plan with Prometheus, execute with Atlas, and iterate with Sisyphus in OpenCode. | |
| Html2pptx Complete HTML 转 PPTX 完整工作流 — 自动内嵌外部 CSS，使用 pptxgenjs 解析 HTML 结构，生成可编辑 PPTX，保留文字、布局、样式 | |
| Html2pptx Shape HTML 转 PPTX 形状转换器 — 将 HTML 幻灯片转换为完全可编辑的 PPTX，自动内嵌外部 CSS，保留 CSS 样式、布局，映射为 PPTX 原生形状（矩形/文本框/图片等） | |
| Popmart Stock Monitor Monitor PopMart product restock status across multiple channels including WeChat Mini Programs, Taobao, JD.com, and Tmall. Use when user wants to track avail... | |
| Star Office Deploy Star Office UI 一键部署技能 — 帮主人快速部署像素办公室看板，支持多 Agent 加入、状态可视化、移动端查看与公网访问 | |
| Dooray Hook Send automated notifications to Dooray! messenger channels via webhooks. | |
| Arena Agent Autonomous AI agent for Arena.social using the official Agent API. 24/7 monitoring, auto-replies to mentions, scheduled contextual posts. Use when you need to automate Arena.social engagement, monitor notifications, or post programmatically | |
| ERC-8004 Identity Deploy and manage an AI agent's onchain identity, reputation, and task capabilities on Avalanche using the ERC-8004 NFT standard. | |
| Skill Multi-EVM agent wallet SDK with onchain identity (ERC-8004), payment rails (x402), cross-chain liquidity (Li.Fi bridging + DEX aggregation + DeFi Composer), destination gas funding (Gas.zip), perpetual futures trading (Hyperliquid), market | |
| WHOOP Tracker Access WHOOP fitness tracker data via API, including recovery scores, sleep metrics, workout stats, daily strain, and body measurements. Use when the user asks about their WHOOP data, fitness metrics, recovery status, sleep quality, workout | |
| Answeroverflow 1.0.2 Search indexed Discord community discussions via Answer Overflow. Find solutions to coding problems, library issues, and community Q&A that only exist in Dis... | |
| Billionsnetwork Verified Agent Identity 0.0.2 Billions/Iden3 authentication and identity management tools for agents. Link, proof, sign, and verify. | |
| Safe Edit 安全配置修改辅助技能 - 在修改重要配置文件前自动设置回滚，支持多平台（Linux/macOS/FreeBSD/Windows） | |
| Ppt Generator One-click AI-powered PPT generator. Smart style detection, auto design layout, preview confirmation, exports to PPTX. No API key needed! | |
| Django Unfold Expert guidance for building advanced Django admin interfaces with django-unfold (v0.56+). Use this skill whenever the user mentions django-unfold, unfold ad... | |
| 品氪 OpenApi 开放平台 Skill 品氪提供的OpenApi开放平台，支持门店、导购、会员、订单、退单、库存、商品、积分、储值、卡券、销售等全链路CRM/SCRM数据同步与管理。通过安全认证的API接口实现第三方系统与品氪平台的数据互通。 |
37,851–37,900 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.