Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Proposal & SOW Generator Generate professional freelancer proposals, scopes of work, and project quotes from a brief description. Produces client-ready documents with deliverables, t... | |
| Teacher Lesson Plans (UK Curriculum) Generate UK National Curriculum-aligned lesson plans, differentiated worksheets, assessment questions with mark schemes, and student report comments. Covers... | |
| Contract Review & Risk Flagger (UK) Review contracts for risks, unfair terms, and missing clauses. Generates plain-English summaries, risk flags, and negotiation talking points. Use when someon... | |
| UK Employment Law Calculator & Letters Calculate UK statutory employment entitlements (holiday, sick pay, notice, redundancy, maternity/paternity pay, minimum wage) and generate HR letters (discip... | |
| UK Landlord Compliance Docs Generate compliant UK landlord documents — Section 8 notices, tenancy agreements, rent increase notices, deposit prescribed information, Right to Rent record... | |
| UK Tax Calculator & MTD Prep Calculate UK freelancer tax liability for 2025/26. Computes Income Tax, Class 4 NI, Class 2 NI, VAT threshold tracking, and MTD quarterly summaries from inco... | |
| send image in feishu Send images inline in Feishu chat by uploading via API to get image_key, then sending image message using receive_id_type in URL query. | |
| Soulforge Run high-signal autonomous coding loops with Soulforge (feature-dev/bugfix/review-loop) using strict worktree isolation, review gates, and scoped fix cycles. | |
| Full Potential Intelligence Provides real-time AI frontier intelligence with scores, live feeds, labor displacement, investment insights, gap opportunities, and daily briefings. | |
| LNBits Wallet wtih QR Code Manage LNbits Lightning Wallet (Balance, Pay, Invoice) | |
| AI Video Creator AI 治愈氛围视频自动生产流水线。选题 → 即梦AI生成多段视频 → 拼接配乐 → 发布小红书。每天一条命令，自动产出治愈系短视频内容。 | |
| Prompt Refiner Transforms casual or voice-transcribed user requests into precise, AI-optimized prompts. Handles mixed languages, vague input, and ambiguity. Reduces task ex... | |
| chrome_skill Browser automation via Chrome AI Action (CAA) bridge. Control Chrome programmatically — navigate, click, type, screenshot, extract content, and more. Uses Pu... | |
| database_skill Python-based database connectivity skill supporting MySQL, PostgreSQL, Oracle, SQL Server, and SQLite. Provides connection management, parameterized query ex... | |
| Argus Edge — Prediction Market Betting Engine Argus-style prediction market edge detection and betting strategy. Computes expected value from TA-implied probability vs market odds, sizes bets via Kelly c... | |
| Binance Watchlist Scan a full Binance spot watchlist using multi-indicator TA scoring. Returns ranked trading opportunities sorted by signal strength. No API key required (use... | |
| Crypto Macro Regime Classifier Classify current crypto macro regime (Risk-On / Risk-Off / Neutral) using Fear & Greed Index, BTC dominance, Reddit sentiment, on-chain signals, and macro ne... | |
| Crypto Signals Daily Provides daily crypto briefings with top technical analysis signals for 20 Binance pairs, macro regime, sentiment indices, and top 3 trade ideas. | |
| Defi Yield Scanner Scan DeFi protocols for the best yield opportunities. Covers Aave, Compound, Curve, Yearn, Uniswap v3, and emerging L2 protocols. Compares APY vs risk, track... | |
| HFT Paper Trader — Autonomous Crypto Framework High-frequency paper trading framework for crypto. Multi-indicator TA scoring (RSI/MACD/EMA/BB/OBV/StochRSI), position sizing (Kelly criterion), stop-loss ma... | |
| Hourly Momentum Trader Momentum-based trading agent for hourly crypto candles. Uses RSI, MACD, OBV, EMA, and Bollinger Band confluence to score directional momentum from -10 to +10... | |
| Hyperliquid Perps Paper and live perpetual futures trading on Hyperliquid. Smart leverage (1x/3x/5x based on signal strength), OBV divergence, auto-stop-loss. Use for Hyperliq... | |
| Macro Regime Detector Detect the current macro regime (Risk-On, Risk-Off, Inflationary, Deflationary, Stagflation) using multi-source intelligence. Combines Fear & Greed, DXY, yie... | |
| Opentask Worker Autonomous worker agent for OpenTask.ai — the agent-to-agent task marketplace. Handles registration, task discovery, bidding strategy, contract management, a... | |
| Polymarket Live Bet Place live bets on Polymarket CLOB with EIP-712 signing on Polygon. Handles USDC.e approval, order submission, and position tracking. Use for Polymarket auto... | |
| Polymarket Scout — Hourly Edge Detector Scan Polymarket hourly crypto markets (BTC/ETH/SOL/XRP) for edge opportunities. Detects counter-consensus setups, freshness windows, and expected value using... | |
| Prediction Market Aggregator Cross-market prediction market data aggregator. Covers Polymarket, Manifold, Metaculus, and Kalshi. Finds arbitrage between markets, tracks consensus drift,... | |
| Crypto Portfolio Tracker Track a crypto portfolio across Binance, Hyperliquid, and Polymarket. Calculates NAV, unrealized P&L, daily drawdown, win rate, and equity curve. Use when yo... | |
| RHO Signals — Live Crypto TA Engine Real-time crypto TA signals for BTC, ETH, SOL, XRP. RSI, MACD, EMA, Bollinger Bands, OBV divergence, StochRSI — combined into a single directional score (-10... | |
| Telegram Alerts Send formatted trading alerts, portfolio updates, and market signals via Telegram. Supports price alerts, stop-loss notifications, win/loss reporting, and sc... | |
| sshx Operate remote servers with the `sshx` CLI — inspect hosts, dissect remote logs with `sshx text`, run commands over SSH, transfer files over SFTP, apply a single remote file, manage named hosts, store SSH/sudo passwords in the OS keyring or | |
| 心跳回忆 Heartbeat-Memories (HBM) - A fully local long-term memory system for OpenClaw. Features five memory banks (Goals/Experience/Emotions/Session/Version) + heart... | |
| Olympus Ask Olympus for cited answers, check source readiness, and ask a frontier model anonymously through the exact four-tool Hermes MCP surface. | |
| OpenClaw Leaderboard Submit your OpenClaw agent's autonomous earnings to the public leaderboard with proof. Get verified by the community. | |
| ilc Evidence-first graph protocol for human-AI truth maintenance, attribution, CCSS contact, and OpenClaw local graph work. | |
| A2A Market AI Agent skill marketplace integration for A2A Market. Enables agents to buy skills, sell skills,
and earn money autonomously. Use when: (1) User asks to find/search/buy a skill or capability,
(2) User wants to sell/list/monetize their agen | |
| 语音车辆控制助手 语音控制车辆助手，支持启动熄火、车窗门锁、方向控制、状态查询与场景模式；适用于"帮我发动汽车"、"打开回家模式"或"查询电量"等语音交互场景 | |
| myskill Provides daily Shopify sales summaries, low stock alerts, and competitor price tracking using your Shopify API key. | |
| email-query-summary 邮箱查询总结技能。按时间范围从已配置邮箱实时拉取邮件数据，输出重要邮件、往来统计与待办跟进内容。当命中本技能使用场景时，必须强制使用本技能并返回拉取结果，不得凭记忆回答或规避实时查询。首次使用前请阅读同目录 SETUP.md 完成 accounts.json 配置。 | |
| inventpay Accept crypto payments, manage a digital storefront, and track balances through the InventPay REST API | |
| Meal Subsidy 2号人事部餐补申请自动化 — 读考勤判断下班时间，全自动填表提交。触发方式："申请餐补"查昨天；"申请4月7日餐补"查指定日期；"申请4月餐补"查整月批量申请；"本周餐补"查本周批量申请。 | |
| payaion-transfer Transfer files via the Payaion REST API, set USDC per-download pricing on Base mainnet, and list on the marketplace. Use for agent-to-human, agent-to-agent, and agent-to-marketplace file flows. | |
| SenseCraft AI Model Hub Connect OpenClaw to the SenseCraft public model library to search, inspect, export, and download AI vision models for software and edge AI workflows. | |
| GPT Image 2 API Generate and edit images via OpenAI gpt-image-2 model. Agent-agnostic CLI — works with any AI agent (Hermes, Claude Code, Codex, OpenClaw, etc.). Supports co... | |
| Seedance AI Video Gen 使用火山引擎 Seedance 2.0 系列模型（doubao-seedance-2-0 / doubao-seedance-2-0-fast）通过方舟平台 API 生成高质量 AI 视频。支持文生视频、图生视频、视频参考、音频参考等多模态内容生成，适用于用户要求生成/制作/创建视频、文生视频、图生视频、AI 生... | |
| Local Vector Memory Store, search, and manage local vector memories using Ollama embeddings with Qdrant, supporting Chinese and English text without cloud dependencies. | |
| Hxn Audio Producer Preproduction Planning 音频制作人前期筹备规划。用于有声书、多角色演播、多人CV协作、集数规划、阅读理解块、全书资料包、角色颜色与录制责任、分集文本、原文画本、录制执行稿、录制版画本、前情提要、试录校准、Markdown 画本模板等正式录制前的筹备工作。用户讨论接书后怎么组织制作、如何读长篇原文、如何沉淀资料包、如何切集、如何生成原文画... | |
| Agent Browser A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| Data Analysis 1.0.2 Data analysis and visualization. Query databases, generate reports, automate spreadsheets, and turn raw data into clear, actionable insights. Use when (1) yo... | |
| Self Improvement Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... |
40,301–40,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.