Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Skill Vetter 1.0.0 Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,... | |
| AI DeepNews AI Product Manager daily intelligence digest. Fetches news from 16+ curated RSS sources across tech media, AI labs, research papers, developer communities, a... | |
| AI Intel Daily AI Product Manager daily intelligence digest. Fetches news from 16+ curated RSS sources across tech media, AI labs, research papers, developer communities, a... | |
| AIPM DeepNews Daily AI Product Manager daily intelligence digest. Fetches news from 16+ curated RSS sources across tech media, AI labs, research papers, developer communities, a... | |
| test safe agent-browser 受限的瀏覽器自動化工具。僅用於導航網頁、截圖、提取公開資料與測試。嚴禁在未啟用安全邊界的情況下執行。 | |
| Clawdbot Documentation Expert Expert guidance on navigating, understanding, configuring, troubleshooting, and automating Clawdbot using official documentation and config snippets. | |
| ADHD Body Doubling This skill should be used when the user asks for body doubling, ADHD focus sessions, accountability while working, help getting started on a task, pomodoro-style work sessions, or says things like 'I can't focus', 'I'm stuck', 'help me star | |
| ADHD Founder Planner This skill should be used when the user asks to 'plan my day', 'help me plan today', 'morning planning', 'what should I work on today', 'daily planner', 'evening reflection', 'reflect on my day', 'migrate tasks', 'carry tasks forward', 'rap | |
| Maiklubi Access Finnish sports club events, invoices, notifications, and RSVP on myclub.fi for AI agents and parents. Works with myclub and MyClub clubs across Finland. | |
| excalidraw Generate Excalidraw diagrams (.excalidraw files) from natural language descriptions. Use this skill whenever the user asks to create, draw, or visualize a di... | |
| gaokao-advisor 高考志愿填报顾问技能。当用户提到高考志愿、报考大学、填志愿、模拟分数报什么学校、专业选择、录取分数线查询、六边形分析、冲稳保、平行志愿、新高考选科、选大学、大学排名、专业就业前景等话题时使用此技能。触发词包括：高考、志愿填报、报考、分数线、录取线、专业选择、选大学、冲稳保、一分一段、位次、新高考、选科、大学排名、... | |
| Error Log Analyzer AI-powered error log analyzer that explains errors in plain English and provides actionable fix suggestions. Supports Node.js, Python, and Go log formats. | |
| ppt-mcp-server AI 驱动的 PPT 生成工具，通过执行 python-pptx 代码自动创建专业 PowerPoint 演示文稿 | |
| Context Manager 管理多个 AI Agent 的长期记忆与文件，通过向量和时间双重过滤，实现高效语义检索和减少 LLM 调用。 | |
| Smart Refinement System Automatically refines unclear prompts, matches relevant skills via vector similarity, integrates context, and suggests execution steps for efficient AI task... | |
| LWC Memory Durable memory and project code intelligence | |
| Google Chirp 3 HD TTS Skill High-definition generative speech synthesis using Google Cloud Chirp 3 HD voices. Delivers superior realism, emotional expressiveness, and natural pacing usi... | |
| Jaravus Jaravus enables multi-agent workflows to create, search, and reuse concise wiki-style and bot-to-bot knowledge snippets with category tagging and markdown ou... | |
| DB Smart Import Intelligent database import from .csv and .sql dumps into MySQL, MariaDB, and SQLite. Analyzes schemas, parses SQL dumps, suggests column mappings based on c... | |
| Windows-Android_SSH_Remote_Control Setup and guide for full remote control of a Windows PC from an Android device over the internet via SSH tunneling. Use for: remote desktop access, secure RD... | |
| 4claw 4claw — a moderated imageboard for AI agents. Boards, threads, replies, media uploads, bumping (bump=false to not bump), greentext, and automatic capacity purges. Post spicy hot takes (what you’re REALLY thinking) — but no illegal content, | |
| Supermemory Long-term agent memory with atomic fact extraction, relational versioning, semantic search, and entity profiles. Extracts facts from conversations, tracks ho... | |
| Ultramemory Structured AI agent memory with temporal versioning, relational tracking, and semantic search. Use when storing facts, recalling context, searching past conv... | |
| GLM-Image-Gen Official skill for generating high-quality images from text prompts using ZhiPu GLM-Image API. Excellent at scientific illustrations, high-quality portraits,... | |
| GLM-Master-Skill Documentation-only master skill for GLM ecosystem discovery and installation. This skill does not execute scripts or subprocess commands. It provides a curat... | |
| GLM-OCR Extract text from images using GLM-OCR API. Supports images and PDFs with high accuracy OCR, table recognition, formula extraction, and handwriting recogniti... | |
| GLM-OCR-Formula Official skill for recognizing and extracting mathematical formulas from images and PDFs into LaTeX format using ZhiPu GLM-OCR API. Supports complex equation... | |
| GLM-OCR-Handwriting Official skill for recognizing handwritten text from images using ZhiPu GLM-OCR API. Supports various handwriting styles, languages, and mixed handwritten/pr... | |
| GLM-OCR-SDK Trigger when: (1) User wants to extract text, tables, formulas, or structured data from images/PDFs/scanned documents, (2) User mentions "OCR", "文字识别", "文档解析... | |
| GLM-OCR-Table Official skill for recognizing and extracting tables from images and PDFs into Markdown format using ZhiPu GLM-OCR API. Supports complex tables, merged cells... | |
| GLM-V-Caption Generate captions (descriptions) for images, videos, and documents using ZhiPu GLM-V multimodal model series. Use this skill whenever the user wants to descr... | |
| GLM-V-Doc-Based-Writing Write a textual content based on given document(s) and requirements, using ZhiPu GLM-V multimodal model. Read and comprehend one or multiple documents (PDF/D... | |
| GLM-V-Grounding A skill that uses GLM-V native grounding capabilities for coordinate conversion, bounding-box visualization, and more. GLM-V native grounding can locate any... | |
| GLM-V-Prompt-Gen Analyze images/videos and generate professional prompts for text-to-image and text-to-video AI tools (Midjourney, Stable Diffusion, DALL-E, Sora, Runway, Kli... | |
| GLM-V-Resume-Screen Screen and evaluate resumes against criteria using ZhiPu GLM-V multimodal model. Reads multiple resume files (PDF/DOCX/TXT), compares against user-defined sc... | |
| Etsy Seller Helper Helps Etsy sellers write better listings, shop pages, customer messages, and social media captions using AI. Use when a user asks for help with Etsy product... | |
| Lobster MUD Play and manage a Lobster Tamagotchi farm game autonomously via browser. Each installed agent gets a unique KEY binding it to its own lobster. The agent acts... | |
| Lobster Says 🦞 虾说——你的专属共情虾。每天早晚给你一句关心的话，让你觉得被看到了。注册 cron 定时任务推送消息到 IM 通道；可选在用户选择的理解模式下读取本地会话日志生成摘要上传到 nixiashuo.com。 | |
| skills-monitor AI Skills 一站式监控评估平台 — 7因子评估引擎、跨模型基准评测、中心化 Dashboard、智能推荐 | |
| Mermaid Diagrams Generate and render diagrams from Mermaid syntax into PNG, SVG, or PDF using customizable themes and various diagram types. | |
| Namecheap DNS Manage Namecheap DNS records safely by fetching existing entries, merging changes, auto-backing up, previewing diffs, dry-running, and rolling back updates. | |
| China Tax Calculator 中国个人所得税计算器，支持月度工资、年终奖、专项附加扣除、年度汇算清缴、多收入来源计算。适用于个税咨询、工资计算、年终奖优化、跳槽薪资谈判等场景。 | |
| test Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use whe... | |
| Seats Aero Search award flight availability across 24 mileage programs, including business and first class, with detailed route and booking info via seats.aero API. | |
| Job Search 中国招聘平台搜索技能。支持BOSS直聘、智联招聘、前程无忧三大平台，提供关键词搜索、地点筛选、薪资范围过滤等功能。专门针对中国本土招聘市场设计。 | |
| WeChat Auto Reply (V26 Safe) Monitors a detached WeChat Mac window via OCR and automatically replies using a customizable AI persona with safety locks to prevent interference. | |
| Agent Optimizer by Drakon Systems CLI tool that audits Claude Code, OpenClaw, and Hermes Agent config files for misconfigurations, token waste, security issues, and stale auth. Audit, scan, and optimize make no network calls. No API keys required. Network use is command-tri | |
| fleet-doctrine Model routing strategy for a multi-model AI fleet. Use when spawning sub-agents, choosing models for scheduled jobs, delegating coding tasks, or deciding which model should handle a task. | |
| ShieldCortex Memory and defence for AI agents: semantic recall, knowledge graph and decay, plus a memory firewall that scans and enforces against prompt injection, credential leaks and poisoning. | |
| WatchClaw Auto-recovery watchdog for OpenClaw gateway. Monitors health, detects bad config changes, and recovers via git stash/revert. Supports native and Docker resta... |
40,351–40,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.