Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Tencent Cloud Lighthouse Manage Tencent Cloud Lighthouse (轻量应用服务器) — auto-setup mcporter + MCP, query instances, monitoring & alerting, self-diagnostics, firewall, snapshots, remote... | |
| WeChat MP Assistant WeChat Official Account Manager - Automatically generate articles, images, SEO optimization, and data analysis. Supports end-to-end operations from topic sel... | |
| active-defense-sentinal Defensive triage for OpenClaw, Hermes Agent, local host telemetry, and skill-supply-chain scanning. Separates verified evidence from suspicion and keeps remediation explicitly authorized. | |
| Openclaw Skill Scanner Scan local or staged ClawHub skills before installation; report High/Critical findings and optionally quarantine managed skills. A scan is not proof of safety. | |
| EdgeComputing ATS Analyzer Analyzes EdgeComputing ATS (Automatic Ticket System) codebase architecture, device protocols, and business logic. Invoke when user asks about ATS project str... | |
| Bind Protocol MCP Server Use Bind Protocol MCP server for credential verification, policy authoring, and zero-knowledge proof generation. | |
| Citrea Claw Skill Run Citrea L2 monitoring commands — check arbitrage opportunities, token prices, pool liquidity, wallet balances, and new pools across JuiceSwap and Satsuma... | |
| PrivaClaw Secure outbound-only relay for remote OpenClaw control — no exposed ports, no SSH, no Telegram. | |
| Private Bridge Secure outbound-only relay for remote OpenClaw control — no exposed ports, no SSH, no Telegram. | |
| Remote Relay Secure outbound-only relay for remote OpenClaw control — no exposed ports, no SSH, no Telegram. | |
| certen Give this agent a CERTEN identity and let it execute proof-gated actions on any chain it is linked to. It never spends without the owner's explicit consent. | |
| AI Songwriter 三道工序 AI 写歌。用户只需给主题，全自动跑完白描起草→注入灵魂金句→完美押韵排版→Suno生成，最终直接返回试听链接。中间不停顿、不等用户确认。 | |
| AI Songwriter (Clone) 风格克隆 AI 写歌。用户给一首参考歌/歌手 + 新主题，全自动跑完音乐基因解构→歌词DNA提取→同构填词→Suno生成，最终直接返回试听链接。中间不停顿、不等用户确认。 | |
| Airbnb Gateway A skill for safe, coherent Airbnb operations in OpenClaw-style agent environments. It standardizes how agents check inbox threads, inspect reservations and b... | |
| Decomtangle Atomic tool-call decomposer for OpenClaw-style agents. Enforces an execution-time discipline for multi-step and stateful procedures: one observable action pe... | |
| Google Workspace Direct-OAuth Google Workspace operator skill. Sends/reads Gmail, manages Calendar events, creates and edits Google Docs/Sheets/Slides, browses Drive folders... | |
| OpenClaw Mobile Gateway Installer Installs and manages OpenClaw mobile gateway as a system service. Invoke when users need one-command deploy, start, stop, upgrade, or uninstall. | |
| smart-cart-command-planner Convert Chinese or English natural-language requests for an OpenClaw-powered omnidirectional smart cart into conservative, structured motion plans. Use for command understanding, task decomposition, waypoint planning, obstacle-aware movemen | |
| smart-cart-integration-troubleshooter Diagnose and document assembly, calibration, deployment, communication, camera, motion, and obstacle-avoidance problems for a lightweight OpenClaw smart cart using a 12V battery, a multi-channel servo controller, three ST3215 servos, omnidi | |
| Ppt Ooxml Translator AI-agent Skill for PPTX OOXML localization workflows. Use it to unpack PPTX, extract and apply text translations, normalize terminology, enforce language-specific fonts, validate XML integrity, and repack outputs with machine-readable JSON | |
| Ai Autotester Automates code testing by analyzing tasks, planning subtasks, executing tests, validating results, and providing detailed reports and summaries. | |
| Ai Backendfrontend Autowriter Generate and validate backend and frontend code based on task descriptions with clear role division and detailed execution logs. | |
| Ai Codefactory Generate and manage multiple programming tasks by analyzing, planning, executing, validating, and summarizing code projects efficiently. | |
| Ai Codegenerator Automatically generates code based on task descriptions, with optional context and constraints, providing plans, results, and summaries. | |
| Clawpilot Expert skill for OpenClaw (v2026.2.19) — self-hosted AI gateway connecting chat apps (WhatsApp, Telegram, Discord, Slack, iMessage, Signal, LINE, Matrix, Tea... | |
| ClawHub API Guidance 提供ClawHub API的详细使用指南，包括认证、接口文档、示例代码、限流处理和安全最佳实践，助力开发者高效集成。 | |
| hwc-cli-guidance 提供华为云命令行工具KooCLI的安装指导、认证配置、常用命令示例及最佳实践，助力快速管理华为云资源。 | |
| hwc-cli-guidance 提供华为云命令行工具KooCLI的安装、配置、认证、常用命令及自动化运维等详细使用指导和最佳实践方案。 | |
| 企微智能表格 企业微信智能表格全流程自动化操作技能。触发词：企微智能表格、智能表格、工作任务表格、费用申请表格、视频制作表格、企微表格、新建任务、添加任务、添加费用、费用申请、报销、视频制作流程、工作流、任务提醒、到期提醒、巡检、企微工作流。 任何涉及在企微智能表格中新增/查询/提醒/通知的操作，均触发此技能。 | |
| Maya Loop Maya Loop provides a six-step AI-assisted engineering framework with strict checks and a five-ring autonomous operation system for reliable multi-agent devel... | |
| Mind Engine A universal 7-stage thinking engine. When a user asks any question, seeks advice, or needs analysis, this engine auto-activates: Problem Diagnosis → Model Ma... | |
| OpenClaw Memory System A lightweight, prompt-driven three-layer memory system for long-term context retention in OpenClaw agents with secure, asynchronous data extraction and Markd... | |
| sam-faces Face recognition and identity memory for AI assistants. Enroll known people with reference photos, then automatically identify faces in inbound images — with... | |
| Kroger Api.Skill Search Kroger/QFC products, manage cart, check pickup availability, and create pickup orders using the official Kroger API. | |
| Qfc Order Automates adding unchecked grocery-list items to QFC online cart, adjusts quantities, confirms cart details, and schedules a pickup slot via attached Chrome... | |
| Banana Api Generate and edit images using Nano Banana (Gemini-3-Pro-Image-Preview) API. Handles automatic base64 encoding/decoding, image compression, and Discord integ... | |
| CLI Anything Generate or refine agent-usable CLIs for existing software/codebases using the CLI-Anything methodology. Use when the user wants to turn a GUI app, desktop t... | |
| 应用市场监测 华为应用市场AppGallery批量查询应用版本/更新说明/用户评论，输出PDF汇总报告。通过手机GUI Agent在AppGallery中查询信息并生成表格汇总。触发词：'应用市场监测'——用户发送附件表格+该关键词即可自动批量查版本/评论并生成PDF。 | |
| Browser Automation Use Browser Relay when the user wants to control a real signed-in Chrome or Chromium browser through the published browser-relay-cli package and unpacked Bro... | |
| CV Skill Create professional Harvard-style resumes, CVs, and matching cover letters from user-provided candidate descriptions, structured data, or existing resumes. U... | |
| X Engagement X/Twitter 运营辅助。完整 onboarding → Persona 学习 → Browser Relay 浏览器控制 → 记忆系统 → 手动提醒模板 → For You 关注建议 → Following 互动建议 | |
| wechat-miniprogram-dev 微信小程序云开发完整指南。包含项目结构、云函数开发、miniprogram-ci 部署命令、常见问题处理。适用于需要开发、部署微信小程序的场景。 | |
| Aps Filesystem Agent Use this skill whenever an APS (production scheduling) agent needs to interact with a local filesystem-based knowledge base. Triggers include: reading or sea... | |
| corn-manager-master 定时任务创建通用技能。自动提取当前对话上下文，标准化创建和检查OpenClaw定时任务。 | |
| BidClub Post investment ideas to the AI-native investment community | |
| BidClub Post investment ideas to the AI-native investment community | |
| Personal Finance Visualizer Local finance charts with English and Chinese views | |
| sandbox simulator 沙盘推演系统：模拟多人物社交对话互动。基于 sessions_spawn 能力实现并行推演， 支持10+人物、5个并行session、分批调度。用户可作为干预者暂停、修改状态、注入事件。 所有数据以 Markdown 文件存储，支持命令和自然语言双模式交互。 | |
| go2Travel — 飞猪旅行智能规划 当用户需要旅行规划、行程编排、机票/酒店/景点搜索时触发。 适用场景：自由行/家庭游/蜜月/商务/亲子/宠物出行/出境游/露营。 不适用：纯天气查询（用 weather skill）、纯汇率查询（用独立工具）。 触发关键词：旅游/旅行/行程/机票/酒店/景点/租车/签证/攻略/预算/行李。 不触发：只问天气、只问... | |
| Session2blog Clawhub 把 OpenClaw 里你与 AI 真实协作解决问题的过程，沉淀成带真人决策链的结构化博文（技术复盘/学习笔记/排障记录），自动保存为 Markdown 文件。在会话中输入 /s2b 即可触发。 |
40,451–40,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.