Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| go-next-move 从围棋/Weiqi 棋盘照片或文本棋盘分析当前局面，调用本地 KataGo 按初级、中级、高级强度推荐下一手。适用于用户询问黑棋或白棋下一手应下哪里、希望按对手水平选择落点，或想在不改变棋盘的情况下获得更均衡的 AI 辅助建议。 | |
| Junqi Dark Layout 使用大模型生成中国军棋双人 25 格暗棋阵型，再用 Python 做硬规则校验与图片渲染。用于用户想要军棋暗棋摆阵、想按风格生成更有策略感的布局、想输出图片卡片、或需要先生成再严格验合法性的场景。 | |
| WeChat Channels Share Downloader Resolve and download WeChat Channels / 微信视频号 share links directly, using the online sph resolver and curl. Use when the user wants no local install and no lo... | |
| Smarttable Weekly Check 企业微信智能表格周报检查工具。通过 Puppeteer 启动浏览器，利用内部 API 获取结构化数据，按4条规则检查组员周报质量。支持多周链接批量检查、自动登录等待、自动报告生成、项目维度汇总。触发词：智能表格周报检查、小组周报检查、周报链接检查、检查周报链接、smarttable check、数字员工周报检查。 | |
| Cross-Session Task Manager 解决 AI Agent 跨会话失忆问题的任务管理系统。3 个文件 + 3 条规则， 让 Agent 在 session 结束后仍能延续任务，跨 channel/thread 断点续传。 触发词：任务管理、跨会话、task continuity、session memory、断点续传 | |
| Dida365 滴答清单 (Open API) 滴答清单 (Dida365) API 集成，支持自建 OAuth 认证。管理任务和项目。 当用户想要在滴答清单中创建、更新、完成或组织任务和项目时使用此 Skill。 需要用户在 developer.dida365.com 创建应用并配置 DIDA365_CLIENT_ID、DIDA365_CLIENT_SECR... | |
| Foreign Law Research 外国法调研方法论：将模糊的法律问题通过系统化资源检索转化为高质量调研报告。 触发词：/foreign-law-research、外国法调研、外国法检索、调研外国法、境外法律调查 适用于：跨境投资、矿业并购、国际化业务等需要调研东道国法律场景。 | |
| HTTPeep CLI SKILLS. HTTP API Deubgger ｜ Give the agent the ability to see the network. Use HTTPeep from the terminal with httpeep-cli for proxy lifecycle control, HTTP/HTTPS traffic capture, session inspection, rule injection, request replay, r... | |
| 人人商城龙虾助手 人人商城龙虾助手 - 人人商城数据查询与订单管理工具。 当用户提到以下意图时使用此技能： 「查待办事项」「查运营数据」「查商品信息」「查会员信息」 「查订单」「管理订单」「查优惠券」「设置满额包邮」 「配置商城API」「验证API连通性」 支持：待办事项查询、运营数据统计、商品/会员/订单全维度查询、优惠券管理、... | |
| Quark 夸克网盘操作技能 - 支持扫码登录、文件列表、上传、下载、分享（可设密码/有效期）、转存、删除等操作。 当用户提到夸克网盘、quark、网盘文件管理、上传下载、分享链接、转存资源时使用此技能。 | |
| Grokified code review Review a git diff for bugs, security issues and missing tests with the grok-build-0.1 model through the Grokified API. | |
| Grokified web research Answer questions with live web search and cited sources using a Grok model through the Grokified API. | |
| github-image-hosting Upload images to img402.dev for embedding in GitHub PRs, issues, and comments. Images 1MB or under are free AND permanent — no payment, no auth — which covers virtually every screenshot. Larger images (up to 10MB) are free for 30 days, or p | |
| image-hosting Upload images to img402.dev and get a public URL. Images 1MB or under are free AND permanent — no account, no API key, no payment. Larger images (up to 10MB) are free for 30 days, or permanent for $0.01 USDC via x402. Use when the agent nee | |
| imgnAI Katana API Generate images, videos, and text/LLM completions via the imgnAI Katana API. Supports end-to-end-encrypted (E2EE) and anonymized models. Priced highly compet... | |
| Agent Communication Hub Provide agent-to-agent communication for OpenClaw skills with direct messaging, broadcast delivery, pub/sub events, session tracking, offline queues, and SQL... | |
| Agent Memory Persistence Provide long-term memory persistence for AI agents with SQLite-backed storage, structured metadata, vector embeddings, semantic retrieval, lifecycle manageme... | |
| Agent Task Queue Build and operate a multi-agent task queue in OpenClaw with priority queues, delayed/dead-letter queues, scheduling, retry/timeout control, dependency manage... | |
| Agent Usage Tracker Track AI agent token usage, model costs, and budget thresholds with a TypeScript and SQLite workflow. Use when the user wants to instrument agent runs, calcu... | |
| Crypto Scope 提供加密货币实时价格查询、技术指标分析（MA/RSI/MACD）和交易信号生成，支持多币种批量监控。 | |
| Daily Hot Push 每日推送中国热榜TOP10到飞书。从微博、知乎、百度、36氪筛选最重要的新闻，智能排除明星八卦和主观评论。 | |
| Doc Genius 支持PDF、Word、Markdown智能摘要和格式转换，提供批量处理与进度报告，提升文档处理效率。 | |
| Scrapling Fetch 支持自动绕过 Cloudflare Turnstile 和微信公众号反爬机制的网页内容抓取工具，输出干净Markdown或纯文本。 | |
| Tech Solution Generator 技术方案文档自动生成器。根据需求自动生成完整的技术方案文档，包含架构设计、技术选型、风险评估、排期估算。 | |
| Xiaohongshu Viral Content 小红书爆款文案生成器。基于热门模板和数据驱动，生成高转化率的小红书内容。 | |
| Openclaw Plugin Cross-device sync for OpenClaw workspace (skills, memory, settings) via GitHub | |
| Clawgora Interact with the Clawgora AI agent labor marketplace. Use when asked to post a job for another agent to complete, find and claim available work, deliver res... | |
| oVirt MCP Server Manage oVirt/RHV virtualization infrastructure via MCP. Provides 186 tools for VMs, hosts, clusters, networks, storage, templates, snapshots, disks, events,... | |
| Build Amazon Affiliate Plugin Create a WordPress plugin that detects Amazon affiliate links, extracts ASINs, displays product ads with caching, admin settings, and Gutenberg block support. | |
| Dream Cycle Implement a nightly "dream cycle" for OpenClaw agents that: - Reviews and consolidates memory at night - Cleans up bloated workspace files - Prepares a morni... | |
| Geospatial Osint Open-source geospatial intelligence gathering and visualization dashboard. Use when building Worldview-style spy thriller dashboards, monitoring geopolitical... | |
| Comfyui Client 此技能应在用户需要通过 ComfyUI 生成图片或视频时使用。支持加载工作流、修改 prompt、提交任务、轮询结果并自动下载生成的图片和视频。需 ComfyUI 服务已启动。 | |
| Creamlon Turn any GitHub repo into an async agent service store: publish services, accept paid tasks via Issues, and deliver results with signed proof. Works with Ope... | |
| Cyber Taoist 进化学分析框架 — 基于五元模型（N/R/T/EC/NI）的多尺度决策思维工具，融合控制论反馈与道家自然观，适用于职业决策、创业产品到文明兴衰的统一分析 | |
| ComfyUI Client 此技能应在用户需要通过 ComfyUI 生成图片或视频时使用。支持加载工作流、修改 prompt、提交任务、轮询结果并自动下载生成的图片和视频。需 ComfyUI 服务已启动。 | |
| js-eyes Install, connect, operate, and troubleshoot the host-neutral JS Eyes browser and Skill Runtime from CLI, MCP, or the optional OpenClaw adapter. | |
| JS X Monitor X.com (Twitter) 账号监控自动化 — 定时抓取指定账号最新推文，发现新内容即时推送通知到消息渠道 | |
| Omada Viewer Read-only diagnostics for TP-Link Omada SDN controllers via the Open API. Use when inspecting Omada devices, clients, VLANs, LAN networks, WAN status, router... | |
| 基金新闻日报 基金新闻日报。从五大财经平台抓取基金新闻，支持特定日期或一段时间查询，自动生成 Word 文档。 | |
| Fundreport Scrape 基金月报信息提取。支持文本+OCR 双重提取，自动处理双月对比。从 PDF 月报提取数据并填充 Excel 模板。 | |
| Gemini Image Gen + Watermark Removal Google Gemini 网页端生图并去水印。通过 OpenClaw Browser Tool 控制浏览器生成、下载图片，再用 GeminiWatermarkTool 去除水印。使用场景：谷歌生图/Gemini 生图/Google Gemini 图片/去水印/浮水印/Gemini watermark removal。 | |
| zerothesis Join zerothesis, a multiplayer autoresearch hub where many agents run Karpathy's autoresearch loop on shared open problems in packing, scheduling, and combinatorics. Register, lease an attempt, edit the mutable files, run eval.py, submit; e | |
| MiroFish Predict MiroFish 群體智能推演引擎。當用戶要求「推演」「預測」「模擬」「如果…會怎樣」時使用。透過 55 個 AI Agent 在模擬社交平台上互動推演未來趨勢。 | |
| Planefilter Aviation flight lookup — query aircraft type, equipment changes, and confidence scoring for any flight number. Use when: looking up flight aircraft, checking... | |
| Felo AI Search AI-synthesized web search via Felo API — aggregates 15-40 sources into structured summaries. Use when: (1) researching a topic that needs multi-source synthe... | |
| YouTube Transcribe Transcribe YouTube videos with smart fallback: extracts captions first (fast, free), falls back to local Whisper transcription when no captions available. Au... | |
| Jobclaw Recruit Help recruiters publish job postings to the job matching system. Use when users want to: (1) post a job, (2) publish a position, (3) hire someone, (4) recruit candidates, (5) find employees, or (6) advertise job openings. Supports flexible | |
| Shuxia Skill Library Use when creating, reviewing, or refining an agent skill and the goal is to make the skill more obedient, better bounded, and harder to misuse. Especially us... | |
| Spectyra - OpenClaw Workflow & Cost Optimizer Optimize OpenClaw workflows and reduce LLM API costs. Runs locally to reduce repeated context, unnecessary steps, and token waste with no workflow changes re... | |
| Vibe 知识短视频导演 按主题制作无旁白知识动画：事实核查、中文分镜、代码动画、音乐卡点，导出 60 秒竖屏 2K/30fps MP4。需本地 Python、Node.js、FFmpeg、中文字体和自备配乐。无内置模型 API；已验证 macOS 案例及 Hermes 安装。 |
38,051–38,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.