Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Session Cleanup Pro Clean orphan .jsonl files and stale sessions in OpenClaw session storage with safe confirmation flow. 适用于会话列表杂乱、历史会话堆积、需要释放存储空间场景；默认保护 72 小时内会话，删除前必须用户确认。 | |
| My Research Lab My Research Lab 我的研究院 — 真正自动运转、自进化的个人智库。告诉院长你的研究方向，它帮你每天采集→深度思考→动手产出。三层运转：每日发现/头脑实验/动手实践。院长扮演PM角色，管理大师轮值、跟踪项目进度。可联动女娲蒸馏大师 skill 多视角点评，按领域推荐专属信源 skill（如AI领域的a... | |
| 孕期搭子 Pregnancy Buddy 孕期搭子 - 面向孕期妈妈的全程AI陪伴助手。支持产检报告解读（NT/唐筛/糖耐/大排畸等8项）、30+种食物安全查询、10月营养食谱（协和医院+中国营养学会）、周末备餐方案、宝宝发育可视化、关键时间线管理、情绪陪伴。基于真实孕妈对话记录优化的Gemini风格交互。 | |
| Memoryguard Local-first MCP memory backend and governance console for coding agents. Auto-organize, quarantine, supersede, and rollback shared memories across multiple a... | |
| Casino No-limit Texas Hold'em benchmark for AI agents. Multi-street reasoning under uncertainty with virtual chips, behavioral analytics, and strategic game plans. | |
| Aaron Persistent receptionist/orchestrator agent for all CFO dental appointments. Aaron manages scheduling, reminders, pre-appointment prep, post-appointment follo... | |
| Advocatus Give voice to all opposition. The Advocatus Diaboli — official adversarial challenger to every doctrine, skill, rule, and assumption in the agency. Use when:... | |
| Automate Nbm AI Agent 团队 - 61 个专业 Agent，8 大部门，完整的 AI 代理机构。支持单 Agent 使用和多 Agent 协作编排。 | |
| Fiesta Agents 64 specialized AI agents across 11 departments — your complete AI agency with built-in certification, licensing, and payroll. Use individual agents for focus... | |
| Agent Memory Complete memory architecture for AI agents — tiered storage (HOT/WARM/COLD), auto-learning from corrections, self-reflection, multi-agent memory sharing, and... | |
| Cn Api Router 国内 AI 模型 API 配置向导。帮助 OpenClaw 用户快速配置 DeepSeek、通义千问、智谱GLM、 Moonshot（月之暗面）、百川、零一万物等国内大模型 API。 自动生成 OpenClaw 配置并通过 config.patch 安全写入，支持模型切换和多模型并存。 Use when: 用户说... | |
| Cn Dev Setup 一键配置国内开发环境镜像源。解决 npm/pip/go/docker/cargo 等工具在国内下载慢、超时的问题。 支持 npm、yarn、pnpm、pip、Go (GOPROXY)、Docker、Cargo、Maven、Gradle、Homebrew 镜像源切换。 Use when: 用户说"配置镜像源"、"n... | |
| Cn Holiday Reminder 中国法定节假日查询与主动提醒 + 恋爱助手。内置节假日和调休数据，支持查询任意日期是否上班、 下一个假期、全年日历，并可通过 cron 自动提醒。恋爱助手模块支持纪念日倒计时（精确到秒）、 生日提醒、自定义纪念日、浪漫节日提醒（情人节/白色情人节/女神节/520/七夕/圣诞等）。 Use when: 用户说"明天... | |
| Skill Starter Pack One-click install curated skill packs for new OpenClaw users. Use when user says "install starter pack", "setup skills", "一键安装", "新手套餐", "install essential/d... | |
| Autonoannounce Build, operate, and troubleshoot Autonoannounce local speaker text-to-speech using the queued pipeline (enqueue to worker to ElevenLabs to playback backend).... | |
| Banana Claws Generate images via OpenRouter API (text-to-image) with automation-ready local scripts and a queue-first workflow. Use for single images or batched variants... | |
| ClawCast Bootstrap and automate OBS scenes for local or remote instances via agentic-obs + mcporter. Includes optional explicit target-switch step that writes agentic... | |
| GitHub Actions Troubleshooting Troubleshoot GitHub Actions workflows, particularly for Go projects. Diagnose failing workflows, distinguish between code and environment issues, interpret logs, and apply fixes for common CI/CD problems. | |
| Go Linter Configuration Configure and troubleshoot golangci-lint for Go projects. Handle import resolution issues, type-checking problems, and optimize configurations for both local and CI environments. | |
| Go Security Vulnerability Identify, assess, and fix security vulnerabilities in Go modules using govulncheck. Handle common vulnerabilities like JWT issues and ensure application stability during fixes. | |
| tax-filing United States federal income tax filing assistant for US citizens, resident aliens, and nonresident aliens. Guides users through the entire IRS filing workfl... | |
| qwenz-image-gen Generate images using Alibaba Cloud Bailian Qwen-Image and Z-Image models (通义千图文生图 + 人像照片模型) | |
| qwenz-image-gen Generate images using Alibaba Cloud Bailian Qwen-Image and Z-Image models (通义千图文生图 + 人像照片模型) | |
| Easy2Pe Knowledge Base Knowledge base for Easy2Pe (easy2pe.com) — India's multi-service recharge and payments platform. Use when answering questions about Easy2Pe's services, offer... | |
| Cross Verify 交叉验证信息准确性、识别偏见和逻辑漏洞。当用户说"这段话有没有问题"、"这个数据可靠吗"、"帮我看看这段有没有偏见"、"这个信息准确吗"、"核查一下这段"，或直接丢入一段文字/数据要求检查时触发。Also triggers when the user pastes any text containing stat... | |
| netmiko ssh Provides access to the MCP_Server_Trigger (v0.1.0) MCP server. It offers 7 tool(s): {"close_ssh_session":"\nFecha uma sessão SSH ativa.\n\nArgs:\n session_id... | |
| Claw2Claude Delegates tasks to the local Claude Code CLI. Activate immediately when the user asks for Claude, requests a stronger model, or mentions an existing project... | |
| long-run-harness Use when building a Planner→Generator→Evaluator multi-agent harness or long-running orchestrator. Triggers: "build a harness", "multi-agent pipeline", "agent... | |
| no-ai-tone Checks and rewrites copy to eliminate AI-generated tone. Supports Chinese (中文), English, and Japanese (日本語). Triggers when writing or editing any user-facing... | |
| Pollinations Pollinations.ai API for AI generation and analysis - text, images, videos, audio, vision, and transcription. Use when user requests AI-powered content (text... | |
| Late Brake Pure CLI racing lap data analysis tool. Supports NMEA/VBO import, auto lap splitting, lap comparison, outputs structured comparison results for AI coaching.... | |
| AI Automation Workflow AI自動化工作流設計技能 - 幫中小企業設計自動化流程、選擇工具、搭建n8n/Zapier工作流。適合AI Automation Agency、顧問、企業主。觸發詞：自動化、工作流、n8n、Zapier、automation、workflow、流程優化、AI agent。 | |
| 橫琴創業補貼助手 幫助澳門創業者及企業查詢橫琴及澳門最新補貼政策、申請條件與流程指引。 | |
| Macau Clinic AI System 澳門診所AI系統設計技能 - 幫澳門私人診所設計AI病歷、智能預約、數位化管理方案。適合AI顧問、醫療IT、創業者。觸發詞：澳門診所、診所AI、醫療系統、clinic AI、澳門醫療、診所數位化。 | |
| Medical Document Processor 醫療文檔處理技能 - 病歷摘要、報告分析、醫學文獻整理。適用於醫生、醫療專業人員。觸發詞：病歷、醫療報告、醫學文獻、clinical notes、medical document、病歷摘要、出院小結、門診記錄。 | |
| 醫療病歷結構化助手 自動將門診或住院病歷內容轉換為結構化摘要，包括主訴、病史、檢查發現、診斷建議及治療方案。 | |
| 神經科病歷助手 自動將神經科門診病歷文本結構化，提取主訴、病史、檢查、診斷及治療建議。 | |
| Xiaohongshu Content Creator 小紅書內容創作技能 - 爆款筆記標題、內容模板、hashtag策略、發布時間優化。適合博主、品牌、MCN。觸發詞：小紅書、紅書、xiaohongshu、筆記、種草、爆款、小紅書文案、筆記標題。 | |
| Burmese Content Skills Rewrite Burmese AI text into natural, conversational Burmese that sounds emotional, social-media friendly, and avoids formal or robotic styles. | |
| Handbook Create comprehensive, well-structured handbook-style documents in clear, professional English with practical examples and step-by-step guidance. | |
| talent-finder 天赋领域探索全流程工具。从结构化深度访谈，到天赋画像解码，再到90天落地行动方案。帮助用户发现自己的核心天赋，制定可执行的成长战略。 | |
| autoglmasr AutoGLM ASR MCP 服务：长音频并发转录、上下文传递、时间戳分段。基于智谱 GLM-ASR-2512。触发词：语音识别、ASR、转录、转录音频、长音频 | |
| image-understanding 智谱 GLM-4.6V 多模态视觉模型集成插件。支持 128K 长上下文、文档解析、视频理解与原生工具调用。具备工业级安全审计指引。 | |
| visual-understanding 智谱 GLM-4.6V 多模态视觉模型集成插件。支持本地图像解析（Base64）及公网链接读取。优先提供 zai SDK 接入，并包含 cURL 原生降级方案。 | |
| potplayer Play local or network audio/video files with PotPlayer, supporting playback control, playlists, fullscreen, subtitles, and device access. | |
| Finance Use this skill when the user asks about stock prices, options, dividends, splits, ticker details, cryptocurrency prices, market caps, or any financial market data. Triggers include mentions of 'stock price', 'ticker', 'market data', 'option | |
| Skill Installer Install skills from GitHub repositories into the local skills directory. Use when a user asks to install a skill, add a skill from a repo, list installable skills, or references a GitHub URL containing skills. | |
| Find Skills Search, discover, and install skills from the open agent skills ecosystem to extend agent capabilities for specific tasks or domains. | |
| Goodrp Detect what media the user is playing on Windows (Spotify, VLC, Chrome, etc.) via SMTC, and optionally display it on Discord via Rich Presence. Query current... | |
| presentation-generator Generate polished slide decks as self-contained HTML (and editable PowerPoint) from notes — 75 themes, 18 schema layouts, MCP craft gates. Use for pitch decks, investor updates, keynotes, product launches, sales demos, and any presentation |
38,551–38,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.