Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Moltlang Translator Translate between English and MoltLang, a compact AI language that cuts token usage by 50-70% for efficient, validated, and error-handled agent communication. | |
| Marketing Genius Generate buyer psychology + ad copy. Use when user wants marketing insights, ad copy, or value propositions. | |
| baostock_tt_skills 获取A股历史K线数据、季频财务数据、宏观经济数据、板块成分股等 | |
| alter Build and run a digital persona of the user, their alter ego. Interviews them through chat and voice memos, learns from their documents, writing samples, and AI chat exports from OpenAI or Claude, then chats, answers questions, and drafts m | |
| AgentXPay AgentXPay Skill — 让 AI Agent 在 Monad 链上通过 x402 协议自主发现、付费、订阅 AI 服务。支持链上支付、Agent 钱包管理、服务订阅和资金托管。 | |
| daily-news-english-cards Generate daily bilingual English learning cards with vocabulary, summaries, and AI-created comic illustrations from the latest news in politics, finance, spo... | |
| 饺子安全扫描 🔐 OpenClaw技能安全扫描器 - 专业级安全审计工具，检测敏感操作、木马后门，保护您的AI助手生态安全 | |
| Functional PRD Writer Write concise, implementation-oriented functional PRDs with structured interview, quality checklist, and common pitfalls guide. | |
| Windows 日历同步 将提醒同步到 Windows / Outlook 日历。当用户提到「提醒我」「设置提醒」「加到日历」「同步到日历」「日程」「calendar」「日历」时，使用此技能。支持 Microsoft Graph API 设备代码流认证，无需 Web 服务器，直接写入用户 Outlook 日历。 | |
| NotebookLM Studio Import sources (URLs, YouTube, files, text) into Google NotebookLM and generate user-selected artifacts: podcast, video, report, quiz, flashcards, mind map,... | |
| Fashion Designer Use this skill when users need outfit advice or shopping suggestions for clothing, shoes, accessories, or bags. You will provide fashion outfit options based... | |
| 标书服务 专业解析工程类招标文件，提供标书编写指导及注意事项，支持标书魔方官网AI制作与社群交流服务。 | |
| swanlog Pull a SwanLab cloud experiment (metrics + config + metadata + requirements) down to a local directory in one shot. Use this whenever the user wants to inspe... | |
| Prove Before Act Prove Before Act accountability integration for AI agents. REST API, MCP, and x402. The @jasonxkensei/xproof ClawHub slug is a legacy compatibility identifier. | |
| Jlceda Plugin Builder AI Skill for building EasyEDA Pro extension plugins. Used when users need to create, modify, or debug JLCEDA/EasyEDA Pro plugins, including generating plugin... | |
| Propel Code Review Smoke Run async diff-based code reviews using the Propel Review API, poll for completion, retrieve structured findings, and send comment feedback. Use when reviewi... | |
| OctoMail Agent email via JSON API. Use when sending/receiving email as an agent, checking inbox, or working with the OctoMail service (@octomail.ai addresses). | |
| Suno Claw 基于 Suno AI 的多轮迭代创作流程，生成符合 Suno 标准的高质量带歌词或纯音乐作品。 | |
| Feishu Send Image Send images directly in Feishu chat as native image messages (not file attachments). Use when: need to send a generated image, chart, screenshot, or any loca... | |
| Mijia Control Control Xiaomi Mi Home (米家) smart devices via Xiaomi Cloud API. Use when: user wants to control smart home devices (lights, AC, heater, bath heater, switches... | |
| Model Config Check 校验模型配置是否正确、模型是否可以正常连接和返回内容。当用户说"检查模型"、"测试模型"、"模型能不能用"、"模型配置"、"诊断模型问题"时使用。**每次修改模型配置（config.patch/config.apply涉及models.providers）后必须自动执行校验。** 用户只给模型名+API key时... | |
| Openclaw Safety Guard OpenClaw 安全卫士（发布 slug：openclaw-safety-guard，内部代号：openclaw-watchdog）：默认工作日 10:00 自动扫描 7 个维度（安全、记忆、心跳、定时任务、共享文件、通讯、代码规范），生成健康评分和可视化 Dashboard，通过飞书私信发送报告；没有 Cur... | |
| Gin Ssr Template 根据 Figma 设计稿截图生成可直接运行的 Gin SSR 页面模板（HTML + CSS）。当用户发送“gin前端模板”或提供 Figma 页面截图时触发：生成的页面必须优先保证可运行、可预览、结构完整；禁止输出任何 {{.data}}、{{.Path}}、{{.Config}} 这类动态取值；head 中... | |
| Pixcake Skills 像素蛋糕桌面客户端技能，覆盖项目查询与创建、预设修图、导出任务等真实客户端操作。 当用户明确在使用 PixCake / 像素蛋糕，并希望查看项目、创建项目、导入图片、应用预设、发起导出或查询导出任务状态时，则必须阅读该技能。 | |
| Agent Office Agent Office：创建本地 AI 员工、office worker、AI employee 与 multi-agent office team。每个员工以独立 HTTP Worker 运行，支持 openclaw / hermes / deerflow / cli / external / stub 六种... | |
| Idle Web Developer Make 100s of websites while you're idle. Builds, deploys lovable,v0, quality websites with built-in analytics to help you iterate toward breakout winner and... | |
| MySQL Administration Manage MySQL databases via mysql CLI or Python mysql-connector, supporting queries, schema changes, backups, performance analysis, and user permissions. | |
| Og Board Individual Use when you need to work with tasks: view tasks, list tasks, update task status, add blockers, artifacts, and worklogs. | |
| Og Board Manager Use when you need to delegate, track, or review work. | |
| Zerodha Route natural-language trading/account queries to the correct `zerodha` CLI command with exact flags, validation constraints, and synonym mapping. Use when a... | |
| hookpost Draft, schedule and list social media posts on X, LinkedIn, Threads, Instagram, Facebook, YouTube and more through the hookpost CLI. Find the next free slot and see what is scheduled. | |
| MeiGen Compose MeiGen image/video and five dedicated image tools inside an existing workflow, or opt into creative planning. Preserves caller prompts, parameters, approved count and budget; includes discovery and recoverable task handles. | |
| Skills Creator — Build High-Quality OpenClaw Skills Guide users through creating, reviewing, and improving OpenClaw skills following proven best practices. Use when someone asks to "create a skill", "write a S... | |
| Agent Browser Jau771 A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| 3D Maker Companion Professional assistant for 3D printing, laser engraving, and 3D modeling workflows. Supports generating visual references for sculpting (Forger/ZBrush), crea... | |
| holded-skill Operate Holded ERP through holdedcli to read and update data safely. Use when the user asks to read, search, create, update, or delete Holded entities (conta... | |
| Slides/PPT generation and voice narration AI-powered presentation generation using 2slides API. Create slides from text content, match reference image styles, or summarize documents into presentations. Use when users request to "create a presentation", "make slides", "generate a de | |
| China Phone Checker Validate Chinese mobile phone numbers using the apipick China Phone Checker API. Returns carrier (China Mobile/Telecom/Unicom), province, city, zip code, and... | |
| Get company fact and information by ticker or CIK Retrieve public company information by stock ticker symbol or SEC CIK number using the apipick Company Facts API. Returns company name, industry, sector, exc... | |
| Email check and vaildation Validate email addresses using the apipick Email Validator API. Performs syntax checking, MX record verification, and disposable/throwaway email detection. U... | |
| Get IP Geo Location Look up geographic location and network information for any IPv4 or IPv6 address using the apipick IP Geolocation API. Returns country, continent, city, lati... | |
| Get public holidays by country and year Query public holidays for any country and year using the apipick Public Holidays API. Supports 100+ countries identified by ISO 3166-1 alpha-2 country codes.... | |
| Telegram Phone Checker Check if a phone number is registered on Telegram using the apipick Telegram Checker API. Returns registration status, Telegram user ID, username, first/last... | |
| powerdrill-data-analysis This skill should be used when the user wants to analyze, explore, visualize, or query data using Powerdrill. Covers listing, creating, and deleting datasets; uploading local files as data sources; creating analysis sessions; running natura | |
| Powerdrill Data Analysis This skill should be used when the user wants to analyze, explore, visualize, or query data using Powerdrill. Covers listing, creating, and deleting datasets; uploading local files as data sources; creating analysis sessions; running natura | |
| slides-generation-skills AI-powered presentation generation using 2slides API. Create slides from text content, match reference image styles, or summarize documents into presentations. Use when users request to "create a presentation", "make slides", "generate a de | |
| i18n (Internationalization) guideline skills for nextjs web development Internationalization (i18n) guide for Next.js / Node.js web applications using the App Router. Covers translation file structure, locale routing, SEO metadat... | |
| AI 行业资讯专家与小红书内容创作 AI 行业资讯专家 + 小红书内容创作。检索 24 小时内最新 AI 资讯，生成小红书文案 + 3:4 比例 HTML 封面。使用场景：(1) 每日 AI 资讯汇总，(2) 小红书图文笔记创作，(3) 大模型发布/融资/技术突破等资讯整理。 | |
| 博客/公众号文章润色改写专家 博客/公众号文章润色改写专家。将现有文章进行深度润色改写，在保持核心事实不变的前提下大幅降低文本相似度，同时提升内容吸引力和传播力。支持链接内容抓取、AI 痕迹消除、HTML 封面设计、事实核实。使用场景：(1) 输入链接或文本需要改写降重，(2) 需要生成社交媒体封面图，(3) 需要去 AI 化润色，(4) 需... | |
| llm-wiki Use when the user is working inside an Obsidian or markdown vault and wants to ingest sources, query accumulated knowledge, or maintain a Karpathy-style LLM... |
40,501–40,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.