Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Ascii Video Convert video to ASCII animation with multiple dithering modes, color output, framerate control | |
| Codebase Inspection Advanced codebase analysis with HTML reports, git-aware diffs, trend tracking, SVG badges, CSV export, and CI/CD integration | |
| Company Ops Run a self-improving autonomous company OS from a single CONSTITUTION + confidence-gated autonomy loop. Zero cash. | |
| Cron Doctor Validate and diagnose a scheduled-task file for an agent (parse errors, unsafe cmds). Stdlib. | |
| Dev Prompts 150 curated developer-productivity prompts you can paste into any agent (planning, debugging, code review, docs). | |
| Doc Extractor Extract text from PDF, DOCX, and TXT with encoding detection and page/paragraph structure | |
| Excalidraw Cli Generate Excalidraw diagrams (flowcharts, sequences, architecture) as valid .excalidraw JSON | |
| File Watcher Watch, monitor, and diff file system changes with a polling-based file watcher. Detect creates, modifications, and deletions — no external dependencies. Zero... | |
| Gif Search Search and download GIFs from Tenor API with caching, bulk download, and format conversion | |
| Json Tools Validate, format, query, diff, filter, flatten, merge JSON files with dot-notation paths | |
| Manifest Diff Diff two agent capability manifests and report what changed (caps/deps/status). Stdlib. | |
| Maps Cli Geocode addresses, search points of interest, get routes and directions, and look up timezones — all from the CLI. Uses free OpenStreetMap/OSRM APIs. | |
| Md Linter Lint, check, and auto-fix Markdown files — table of contents, broken links, YAML frontmatter validation, and formatting. Zero dependencies (Python stdlib). | |
| Notion Api Read, create, update, and search Notion pages and databases from the CLI. Manage your workspace programmatically. | |
| Polymarket Cli Command-line tool to browse and query Polymarket prediction markets, view prices, orderbooks, and track positions without needing an API key. | |
| Prompt Lint Lint prompts/SKILL.md for quality (role, goal, output format, vague verbs, jailbreak phrases). Stdlib. | |
| Prompt Templates Cli Render parameterized prompt templates from a catalog ({{var}} fill). Stdlib. | |
| Secret Scanner Detect API keys, tokens, and credentials in code with 50+ patterns, entropy analysis, and multiple report formats | |
| Skill Benchmark Composite quality score (A-F) for an OpenClaw/Hermes skill package. Stdlib. | |
| Skill Lint Validate a ClawHub/OpenClaw skill folder before publishing (frontmatter, shape, size). Stdlib. | |
| ClawHub Studio Local-first studio to author, test, version & publish agent skills — with a real backend, auth, test-runner UI, and one-click ClawHub publishing. Zero depend... | |
| Video Generator CLI Guide for running the Video Generator CLI commands. | |
| Video Script Generator How to generate video scripts for the Video Generator from user prompts. | |
| Web Research DuckDuckGo + Wikipedia research CLI with URL fetching, content extraction, and citation export | |
| Youtube Content Extract transcripts, summaries, and metadata from YouTube videos for content repurposing | |
| Telegram Auto Topic Add `/topic` to the start of any message in a Telegram forum group to auto-create a new topic from it. A title is generated automatically from the message content. Github: https://github.com/itstauq/telegram-auto-topic | |
| AI Opportunity Radar — Discover What In Your Life Should Be Automated Discover what in your life could be automated through casual daily conversations. | |
| Discord Voice Agent Use when building, configuring, running, debugging, or extending a Discord voice agent integrated with OpenClaw, including first-time setup, voice capture, t... | |
| Repo Scout Lab Use when the user wants to use Repo Scout or work on the Repo Scout project to search GitHub repos, generate project ideas and reports, compare runs, inspect... | |
| SaaS Idea Scout Chat-driven SaaS idea discovery and validation pipeline. Generates 8 idea seeds conversationally, then fans out 24 sub-agents across 3 phases — discovery, cr... | |
| My Humanizer Transform AI-generated content into natural, human-sounding writing, measure the improvement, and optionally verify the result. | |
| 灵造 跨平台创作者研究与自媒体运营 Skill | |
| 将 MySQL SQL（尤其是建表 DDL）转换为 Oracle SQL。用户提到“转为oracle”或“转换oracle”，或明确要求把 MySQL 语句改成 Oracle 语句时必须使用此技能。转换时强制执行类型、默认值和主键约束命名规则。 Convert MySQL SQL to Oracle SQL with strict rules | |
| 无障碍标签审查与自动修复 扫描 React/TSX 组件中缺失的无障碍标签并自动修复。 检测纯图标按钮缺少 aria-label、div/span 模拟按钮缺少 role 和键盘交互、 图片缺少有意义的 alt 文本、表单元素缺少 label 关联、 弹窗缺少 aria-modal 和焦点管理、动态内容缺少 aria-live 等问题。... | |
| novel-generator 是一个中文爽文小说生成技能。用户只需提供一句话方向（如"写个都市重生爽文"），AI 代理即可自动完善提示词、规划大纲、逐章创作并输出为独立 Markdown 文件。 核心特性： 智能提示词生成：从一句话方向自动补全世界观、人设、冲突、爽点设计 分章节创作：每章 2000-3000 字，层层递进，章章有爽点 记忆系统：通过 .learnings/ 记录角色、地点、情节、世界观，确保故事前后一致 情节图解：关键战斗、人物关系、势力分布自动生成 Mermaid 图 失败记录：穿帮、矛盾、崩塌等问题自动记录，持续优化 多题材支持：都市、修仙、玄幻、重生、系统流、末世、科幻、游戏 兼容 Claude Code、Cursor、OpenAI Codex、GitHub Copilot 等所有支持 Agent Skills 的工具。 根据用户提供的内容方向自动生成提示词并创作爽文小说。适用场景：(1) 用户提供小说方向/题材/关键词，(2) 需要生成章节连贯的长篇爽文，(3) 需要维护角色、地点、情节的连续性，(4) 需要为关键情节生成图解，(5) 需要记录生成失败场景以优化后续创作。支持都市、修仙、玄幻、重生、系统流等多种题材。Use wh... | |
| Openclaw New Agent 在 OpenClaw 上创建新的独立飞书机器人（多账号模式）。当用户要求创建新的飞书机器人、新增 Agent、部署第二个机器人时使用。流程包括：收集配置信息 → 备份 → 创建工作区 → 修改配置 → 验证。 | |
| Stealthy Google Search Google search via Scrapling’s StealthyFetcher/StealthySession. Use to run Google queries and return clean top-result titles + links (plain text or JSON). Inc... | |
| Universal Video Downloader Download videos from YouTube, Instagram, TikTok, Twitter/X, and 1000+ other sites using yt-dlp. Supports quality selection and automatic cleanup. Use when a user provides a video link from any platform and wants to download it. | |
| YouTube Transcript (yt-dlp captions) Extract YouTube video transcripts from existing captions (manual or auto-generated) using yt-dlp, with optional timestamps and local SQLite caching. Use when... | |
| binance-trader 币安 U 本位期货 MCP（binance-mcp-server）使用手册。前置依赖：须先安装 @iuk-ink/binance-mcp-server MCP 服务器。当用户需要加密货币行情分析、技术指标计算、风险量化评估或期货交易执行（下单/撤单/持仓管理/条件单）时使用。涵盖安装自检、工具选择决策、跨工具工作流、交易安全纪律与常见错误恢复剧本。 | |
| E Store Skill Search, browse, download, and install AI capabilities (Skills, MCP servers, Agent Tools), assets (voices, avatars, scenes, animations), knowledge (RAG datase... | |
| Ark Seedance Video End-to-end Volcengine Ark Seedance video generation using ARK_API_KEY and the bundled Node.js runner. Use when an agent needs to generate videos, handle text... | |
| summarizer for school Processes any supported file type to extract key information and produce concise, structured summaries tailored for school study needs. | |
| Bocha Web Search 博查 Web 搜索工具，使用 Bocha Web Search API。适用于在线查询、事实核查、获取时效性信息以及提供带引用的回答。(Default web search tool using Bocha Web Search API. Use for online lookup, verification,... | |
| Bocha Web Search A2M 由博查搜索官方提供的专业联网搜索技能。当用户想要获取从全网搜索任何网页信息和网页链接，结果准确、摘要完整，更适合 AI 使用时，你应该调用此技能。买家通过本 Skill 向卖家服务端发起请求，完成支付后获取相关结果。 | |
| Continuous Context Preserver Continuous session event recording for inter-session memory survival. Use when you want to persist conversation context between sessions, prevent memory loss... | |
| Email Security Protect agents from email-based attacks | |
| x402 Compute This skill should be used when the user asks to "provision GPU instance", "integrate agent pods over an API", "create pods for my customers", "pod webhooks", "pod events", "spin up a cloud server", "list compute plans", "browse GPU pricing" | |
| x402 Layer x402-layer helps agents pay for APIs with USDC, deploy monetized endpoints, manage credits/webhooks/marketplace listings, and handle wallet-first ERC-8004 registration/discovery/management/reputation on Base, Ethereum, Polygon, BSC, Monad, | |
| Book Skill Generator 从书籍中提取核心方法论并生成对应的 skill。当用户提到"从《XXX》提取方法论"、"生成《XXX》的技能"、"把这本书的方法论变成 skill"或类似需求时使用此技能。适用于商业、管理、个人成长、技术等各类书籍的方法论提取和 skill 生成。 |
38,751–38,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.