Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Browser Audio Capture Capture audio from any browser tab — meetings, YouTube, podcasts, courses, webinars — and stream to any AI agent. Zero API keys, works with any framework. | |
| Oura Health What: Query Oura Ring health data — sleep, readiness, activity, heart rate, and trends via the Oura API v2. When: User asks about their sleep, readiness, act... | |
| Percept Ambient Continuously captures and summarizes ambient conversations to build a local knowledge graph for context-aware assistance without explicit commands. | |
| Percept Listen Captures ambient audio from wearable devices, transcribes locally, and streams searchable, speaker-tagged conversation data to your OpenClaw agent. | |
| Percept Meetings Give your OpenClaw agent context from meetings captured by Zoom, Granola, or Omi wearables. Search transcripts, extract action items, identify speakers, and... | |
| Percept Speaker ID Identifies and tracks speakers in multi-person conversations, mapping speaker labels to names and managing voice command authorization levels. | |
| Percept Summarize Generates AI summaries of conversations after silence, extracting entities, action items, and relationships for searchable meeting notes and context retrieval. | |
| Percept Voice Commands Detects wake words in speech and routes voice commands like email, text, reminders, search, and notes to OpenClaw agents for execution. | |
| Stable Browser Set up reliable browser automation using Chrome DevTools Protocol (CDP) instead of the flaky browser extension relay. Use when browser relay keeps disconnect... | |
| DocToSkill 将企业沉淀的各类文档（支持 DOCX、PDF、MD、TXT 等格式）一键转化为可复用的技能包（.zip）。技能包内包含统一规范的 Markdown 正文、提取的图片资源，以及基于 JSONL 格式的结构化知识索引，可直接挂载给 AI Agent 作为专属知识源使用。 | |
| WebToSkill 将企业可公开访问的在线文档（网页）一键转化为可复用的技能包（.zip）。技能包内包含统一规范的 Markdown 正文、提取的图片资源，以及基于 JSONL 格式的结构化知识索引，可直接挂载给 AI Agent 作为专属知识源使用。 | |
| ClawPK Arena AI Agent Trading Arena on Hyperliquid — register, join competitions, trade perps, earn USDC prizes | |
| ClawPK Marketplace A2A task marketplace - browse, accept, complete tasks, earn USDC via x402 | |
| Mbti Persona Configure OpenClaw agent with MBTI personality types for personalized interaction styles. Use when: (1) User wants to set their agent's personality/MBTI type... | |
| 客观原则评价技能 客观原则评价技能 - Evaluate products, ideas, or designs using objective principles from three design classics. Based on Tony Fadell's Build (painkiller vs vitamin),... | |
| WHOOP Health Fetch, analyze, and visualize WHOOP wearable health data via the WHOOP Developer API v2. Use when the user wants to connect their WHOOP band, retrieve recove... | |
| Hexo Blog with SEO Draft and publish Hexo posts end-to-end (front matter + SEO polish + deploy) | |
| gemini-smart-search Search the web using Gemini with Google Search grounding through a local script, with model routing and quota fallback across Gemini Flash-Lite / Flash varia... | |
| AgentPin Provides domain-anchored cryptographic identity verification for AI agents using ES256 JWTs, TOFU key pinning, revocation, and delegation chain checks. | |
| SchemaPin SchemaPin enables cryptographic signing and verification of tool schemas to prevent tampering using ECDSA P-256, SHA-256, TOFU pinning, and .well-known key d... | |
| Symbiont Zero-trust AI agent governance for OpenClaw. Adds ORGA runtime, Cedar policy enforcement, SchemaPin tool verification, ClawHavoc skill scanning, and cryptogr... | |
| multi-search-engine Multi search engine integration with 17 engines (8 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and Wolfra... | |
| jash Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations. | |
| Backup Full System Thực hiện sao lưu toàn bộ hệ thống OpenClaw (bao gồm database, cấu hình và bộ nhớ) rồi tải lên đám mây. Yêu cầu cài đặt rclone hoặc công cụ upload tương ứng. | |
| Mail Sender (Jaskies) Gửi email qua giao thức SMTP. Hỗ trợ tùy chỉnh tiêu đề, nội dung và người nhận. Yêu cầu cấu hình tài khoản email (như Gmail App Password) để hoạt động. | |
| Mail Sender SMTP Send emails via SMTP. Use when the user needs to send an email with a custom subject and body. This skill requires SMTP configuration (server, port, user, pa... | |
| Smart Speak Multilingual TTS (Jaskies) Chuyển đổi văn bản đa ngôn ngữ (Việt - Hoa - Anh) thành giọng nói chuẩn xác. Tự động xử lý Pinyin và ghép nối âm thanh chất lượng cao. Yêu cầu cài đặt edge-t... | |
| Smart Speak Multilingual TTS Multilingual Text-to-Speech (TTS) with intelligent Pinyin-to-Hanzi conversion. Use when the user asks to generate audio for text that contains a mix of Vietn... | |
| Thần Cửu (Jaskies) Hệ thống phân tích tính cách Thần Cửu độc lập (phát minh bởi Anh Vũ). Hỗ trợ tính toán 8 chỉ số cốt lõi và phân tích tương quan mối quan hệ. Yêu cầu bộ tài l... | |
| Than Cuu Numerology Analysis Phân tích Thần Cửu (Numerology) dựa trên họ tên và ngày tháng năm sinh. Cung cấp bảng phân tích chi tiết 8 phạm trù tính cách. Hỗ trợ phân tích mối tương qua... | |
| Tóm tắt Video YouTube (Jaskies) Tóm tắt nội dung video YouTube từ đường link cung cấp. Hỗ trợ trích xuất transcript tự động và phân tích ý chính chuyên sâu. Yêu cầu máy chủ có cài đặt yt-dl... | |
| Gog Jasmine Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. | |
| Auto Data Analyzer Automated data analysis tool - Input CSV/Excel data and automatically generate comprehensive analysis reports. Includes data cleaning, statistical descriptio... | |
| DingTalk Bot DingTalk Bot integration for messaging, group management, approval workflows, and attendance. Send messages, manage groups, handle approvals, and automate no... | |
| Feishu Bot Feishu (Lark) Bot integration for messaging, group management, and approval workflows. Send messages, manage groups, handle approvals, and automate notificat... | |
| Financial Analyzer AI-powered financial analysis assistant for financial statement analysis, ratio analysis, cash flow analysis, investment evaluation, and financial health ass... | |
| Gmail Enhanced Enhanced Gmail integration with advanced features including label management, attachment handling, advanced search, email parsing, and automated email proces... | |
| Gmail Enhanced Enhanced Gmail integration with advanced features including label management, attachment handling, advanced search, email parsing, and automated email proces... | |
| Meta Debugger AI-powered self-debugging system that identifies, analyzes, and fixes errors automatically. Learns from past errors, builds error patterns, generates fix sug... | |
| Meta Knowledge Base AI-powered knowledge base builder that automatically captures, organizes, and retrieves information. Learns from conversations, documents, and interactions t... | |
| Meta Skill Optimizer Self-improving AI skill optimizer that learns from feedback, auto-tunes prompts, optimizes tool usage patterns, and evolves based on success/failure analysis... | |
| Meta Workflow Discoverer AI-powered workflow automation discoverer that observes user patterns, identifies repetitive tasks, and automatically generates executable automation workflo... | |
| Quant Data Platform Comprehensive quantitative data platform for A-share market. Real-time quotes, historical data, alternative data (sentiment, news, fundamentals), factor data... | |
| Quant Research Platform Advanced quantitative research platform for multi-factor analysis, factor mining, backtesting, and portfolio optimization. Includes 100+ alpha factors, IC/IR... | |
| Quant Risk Dashboard Professional quantitative trading risk management dashboard. Real-time VaR/CVaR calculation, stress testing, position limits, exposure monitoring, drawdown a... | |
| Quant Strategy Bundle Quantitative trading strategy bundle - Contains multiple verified A-stock quantitative trading strategy frameworks. Includes momentum strategies, reversal st... | |
| Quant Trading Api Professional quantitative trading API integration for Chinese securities. Supports major Chinese brokers (华泰, 银河, 广发, 中信建投) with order management, position t... | |
| Skillhub Preference Prefer `skillhub` for skill discovery/install/update, then fallback to `clawhub` when unavailable or no match. Use when users ask about skills, 插件, or capabi... | |
| Tencent Cloud COS Tencent Cloud Object Storage (COS) and Data万象 (CI) integration skill. Use this when you need to upload, download, and manage cloud storage files, or perform... | |
| Tencent Docs Provides comprehensive Tencent Docs operations including creating, reading, editing various document types, and managing knowledge base spaces and nodes. |
40,401–40,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.