Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Crypto Alert Aggregator Aggregates real-time crypto market data and Twitter signals into actionable alerts for traders and researchers. Use when you need to monitor price movements,... | |
| Jina CLI Reads web content and searches the web using Jina AI Reader API. Use when extracting content from URLs, reading social media posts (X/Twitter), or web search... | |
| Local Vector Store Implements semantic search using local vector embeddings for knowledge base indexing and similarity matching. Use when you need to search documents by meanin... | |
| B2c Organic Social Media Marketing Organic growth coach for B2C apps and products on TikTok and Instagram, with no ad spend. Covers account creation, the 7-day warmup before posting, finding content-market fit, hook and caption formulas, CTA placement, riding trends, convert | |
| multi-account-operator Run 15 to 400+ social accounts without burning them. Covers account-count vs per-channel economics, bulk scheduling and spacing, per-account caption variation, reading per-account results instead of one vague error, telling a platform restr | |
| Post Bridge Create, schedule, and manage social media posts across Instagram, TikTok, YouTube, X, LinkedIn, Facebook, Pinterest, Threads, and Bluesky via the Post Bridge API. Covers media upload, post creation, scheduling, platform-specific configs, dr | |
| 高考志愿 提供基于分数、省份和选科的高考院校与专业组查询，支持付费API订阅及数据只读调用接入。 | |
| analyzing-financial-statements This skill calculates key financial ratios and metrics from financial statement data for investment analysis | |
| data-storytelling Transform data into compelling narratives using visualization, context, and persuasive structure. Use when presenting analytics to stakeholders, creating dat... | |
| gh-issues Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label b... | |
| github-repo-search 帮助用户搜索和筛选 GitHub 开源项目，输出结构化推荐报告。当用户说"帮我找开源项目"、"搜一下GitHub上有什么"、"找找XX方向的仓库"、"开源项目推荐"、"github搜索"、"/github-search"时触发。 | |
| node-connect Diagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps. Use when QR/setup code/manual connect fails, local Wi-Fi w... | |
| Getnote 1.5.7 Get笔记 - 保存、搜索、管理个人笔记和知识库。 **当以下情况时使用此 Skill**： (1) 用户要保存内容到笔记：发链接、发图片、说「记一下」「存到笔记」「保存」「收藏」 (2) 用户要搜索或查看笔记：「搜一下」「找找笔记」「最近存了什么」「看看原文」 (3) 用户要管理知识库或标签：「加到知识库」「建... | |
| Car Scraper 车辆信息采集反爬 Skill - 从大搜车、懂车帝、汽车之家采集二手车/新车数据，输出 OpenClaw 兼容格式。USE FOR: 采集车辆列表、车辆详情、价格行情、商家信息。支持反爬对策: UA轮换、限速退避、Cookie管理、指纹伪装。 | |
| AI Fortune Teller AI玄学大师 - 八字命理、塔罗占卜、运势分析。基于传统命理典籍与现代AI技术融合的智能占卜工具。 | |
| Leanctx Integration Automatically compresses OpenClaw tool outputs to reduce token usage by 60-99% | |
| Creating R Research Projects Set up a reproducible R research workspace, install required packages, run statistical or bioinformatics analysis, and generate publication-ready reports and... | |
| Debugging R Environment And Dependencies Diagnose and fix R environment issues, including package installation failures, dependency conflicts, system library problems, renv errors, and Bioconductor... | |
| Generating Publication Ready Figures In R Transform standard ggplot2 figures into publication-quality visualizations matching Nature, Science, and other top journal styles with proper themes, colors,... | |
| Google Scholar Search Skill Search academic papers on Google Scholar with keyword, author, and year filters, plus access author profiles and export results in JSON format. | |
| PubMed Search AI-powered tool for searching and analyzing PubMed biomedical literature | |
| Rstudio Research Agent Interact with R and RStudio environments for scientific research tasks including creating projects, running analyses, managing dependencies, and generating p... | |
| Running R Analysis In Existing Projects Work inside an existing R project to extend analyses, modify scripts, run statistical models, update visualizations, and regenerate reports. | |
| Sci Data Extractor AI-powered tool for extracting structured data from scientific literature PDFs | |
| Sci Hub Search AI-powered tool for searching and downloading academic papers through Sci-Hub | |
| Scientific Graphical Abstract Skill Generate editable, publication-quality SVG graphical abstracts for scientific papers using AI models with customizable charts, diagrams, and data-driven visu... | |
| SemanticScholar Search Skill Search academic papers, authors, and citations with detailed metadata using the Semantic Scholar API, supporting queries, paper details, author profiles, and... | |
| OnlyBaby Analyze contraction JSON and baby log JSON to assess mum's labour/contraction situation and baby's feeding and diaper status. Use when the user provides (or references) contractions_*.json and babyLogs_*.json files and wants to know if mum | |
| BNBot The safest and most efficient way to automate Twitter/X — BNBot operates through a real browser session with 40+ AI-powered CLI tools. Grow your Twitter with... | |
| BNBOT Mascot Generate BNBOT lobster-bot mascot images in consistent style using reference images. Use when the user asks to generate mascot illustrations, character poses... | |
| ClawMoney Earn money with your AI agent on ClawMoney. Complete social media tasks for USD, search and call agent services on the Hub, and accept incoming tasks. | |
| Clawmoney Skill Earn money with your AI agent on ClawMoney. Complete social media tasks for USD, search and call agent services on the Market, and accept incoming tasks. | |
| Scan To Skill QR-based skill installer for ClawHub. Decodes QR images (Telegram uploads, screenshots, camera captures), extracts a valid skill slug or install command, and... | |
| Skill Feed Scenario-driven skill recommendation engine for ClawHub. Detects failed or stuck workflows, builds targeted search queries, and returns ranked skill recommen... | |
| Skill QR Card Generate styled QR images/cards for ClawHub skills so users can scan and install instantly. Supports install-command payloads, ClawHub links, and GitHub link... | |
| SpeakNotes: YouTube, Audio & Document Summaries Use when OpenClaw needs to call SpeakNotes API routes directly using an API key and generate transcripts/summaries from YouTube URLs, media files, or documen... | |
| Km Destine Skill KTV包厢预订技能。帮助用户完成 KTV 包厢从选择门店到完成支付的完整预订流程， 通过聚合接口一次性返回可预订的包厢时段与价格，简化调用链， 并集成用户登录与订单支付子流程。 当以下任一情况出现时必须调用本技能： 1. 用户表达预订/订包厢/KTV/订位等意图（如"我想订个KTV"、"明天晚上有包厢吗"、"预订一个唱歌的地方"、"我想唱歌"、"订个包间"） 2. 用户询问 KTV 门店、包厢、时段、价格等相关信息 3. 用户已有订单号，要求支付、查询支付状态或重新支付 4. | |
| Convertible Bond Research 以可转债为切入点的企业综合研究工作流。当用户要求研究可转债、筛选转债、分析下修/强赎博弈、做转债投资分析、或从转债角度研究一家企业时使用此 skill。覆盖从转债筛选、单券深度分析、下修博弈评估、正股业务、行业可比、行业周期、正股估值到投资小结的完整链条。关键词：可转债研究、转债筛选、下修分析、强赎博弈、转股溢价... | |
| The Colony Join The Colony - social network & communications platform for AI agents. | |
| The Colony Heartbeat Periodic check-in routine for The Colony. Keeps your agent engaged with the community by checking notifications, reading new content, and participating in discussions. | |
| News Sentiment Scan 舆情监控与情绪分析技能。扫描港股、美股、A股等公司公告、新闻报道、券商研报、社交媒体（微博、雪球等），去噪后进行情绪打分（-10至+10），输出情绪温度计与重大事件清单。触发场景：舆情监控、情绪分析、新闻情绪、社交媒体情绪、上市公司消息面分析、研报解读、"监控XX股票舆情"、"XX新闻情绪如何"。 | |
| Vouch Signs, verifies, and manages cryptographic identity for AI agents using the Vouch CLI on Base. Use when an agent needs to: set up identity and register an ac... | |
| 候茶商店 Browse, recommend, and purchase Chinese tea from hou-tea.com using the agent-native API (https://hou-tea.com/api/agent/catalog) and x402 USDC payments. Activ... | |
| Pieces Long-Term Memory (MCP) Connect OpenClaw to Pieces via MCP-only (no SSE) and use Pieces as external long-term memory. Use this when the human runs PiecesOS with LTM enabled on anoth... | |
| Save Usage ~4x (Codex oAuth users) Classifies tasks by safety and complexity to route safe, negligible queries to gpt-5.1-codex-mini and escalates critical or executable tasks to gpt-5.3-codex. | |
| Simplified Social Media Manage your entire social media from AI — post, schedule, and analyze across Facebook, Instagram, TikTok, YouTube, LinkedIn, Pinterest, Threads, Bluesky and... | |
| Cognitive Bias Adivsor 认知偏差顾问。覆盖决策、学习、行动、沟通、影响、管理六大人生领域，基于查理·芒格"25类人类误判心理学"+经典认知偏差理论。六大领域并列，根据用户问题路由到对应领域文件执行诊断与策略输出。触发词：决策、学习、拖延、说服、谈判、影响别人、管理团队、带人等。 | |
| Cognitive Bias Adivsor 认知偏差顾问。覆盖决策、学习、行动、沟通、影响、管理六大人生领域，基于查理·芒格"25类人类误判心理学"+经典认知偏差理论。六大领域并列，根据用户问题路由到对应领域文件执行诊断与策略输出。触发词：决策、学习、拖延、说服、谈判、影响别人、管理团队、带人等。 | |
| Engineering manager 1-on-1 meeting brief generator Generate a 1-on-1 brief from GitHub activity. Fully deterministic pipeline — 5 tool calls, zero sub-agent spawns. | |
| Writers Room Story Engine Orchestrates modular story development by diagnosing the current phase and routing to the right story skill for foundations, worldbuilding, scene writing, or... |
40,051–40,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.