Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| PPT Produce by Codex Create and iterate enterprise application software solution PPTs as full-page PNG slides and optional PPTX decks. Use when the user wants to start, design, g... | |
| skill-design-patterns Guides the design of effective agent skills. Use when creating a new skill, improving an existing skill, reviewing a skill's structure, or establishing skill... | |
| 一键生成高互动文案视觉封面 社交媒体爆款内容创作工具。一键生成高互动文案 + 3:4 视觉封面，专为小红书/抖音/视频号设计。支持 AI 科技、产品评测、工具对比等主题，自动输出带话题标签的完整发布内容。 | |
| lv-guide-display 小驴智能日历小助手。支持用户在线查看日历。当用户提到今日日历时触发。 | |
| freight-pricing 国际货运代理报价与多式联运物流规划技能。当用户询问货物运输成本、货运报价、海运（整箱/拼箱）、空运、铁路运输（中欧班列）、海空联运、FBA头程（海运+UPS/空运+UPS）、传统货运等相关问题时，请使用此技能。 | |
| Dingtalk Calendar 钉钉日程管理（创建日程、查询闲忙、会议室预订）。使用 mcporter CLI 连接钉钉 MCP server 执行日程管理、日程查询、会议室预订等操作。使用场景：日程创建管理、会议预订、查询他人闲忙、会议室预约等。 | |
| Ddgr Search Perform web searches using ddgr with customizable result count from the command line. | |
| Skill Use this skill for anything related to food, nutrition, calories, macros, protein, fat, carbohydrates, fiber, vitamins, meal tracking, diet goals, weight man... | |
| Personal Nutritionist The AI nutrition coach that actually gets to know you. Just say what you ate — nutrition-pro figures out the portion, looks it up, and logs it. No grams requ... | |
| OpenSky Flight Tracker Use this skill when the user asks about live flight positions, aircraft tracking by callsign or flight number, or flights currently overhead a location. Trig... | |
| Reddit Scraper Read and search Reddit posts via web scraping of old.reddit.com. Use when Clawdbot needs to browse Reddit content - read posts from subreddits, search for topics, monitor specific communities. Read-only access with no posting or comments. | |
| Sound FX Generate short sound effects via ElevenLabs SFX (text-to-sound). Use when you need SFX clips like applause, canned laughter, whooshes, ambience, or short stingers, and optionally convert to WhatsApp-friendly .ogg/opus. | |
| Transcribe Transcribe audio files to text using local Whisper (Docker). Use when receiving voice messages, audio files (.mp3, .m4a, .ogg, .wav, .webm), or when asked to transcribe audio content. | |
| VibeVoice TTS Local Spanish TTS using Microsoft VibeVoice. Generate natural voice audio from text, optimized for WhatsApp voice messages. | |
| POKERCLAW Play Texas Hold'em poker autonomously on POKERCLAW. Register your MoltBot agent, join tables, analyze hands, and make strategic decisions (fold/call/raise) a... | |
| Skill Health Analyze wearable health CSV exports (steps, heart rate, sleep, calories, SpO2, exercise, distance) and produce compact JSON reports for hourly, daily, weekly... | |
| GroundLens Check an answer against the user's own documents before sending it. Catches wrong figures, recomputes the arithmetic, and flags claims about the wrong company or person. Runs locally in milliseconds, no API key, no second model. | |
| Billons Ai Provides AI agent verification and secure identification within the Billons Network to assist users in unlocking system rewards. | |
| artifacts-builder Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components | |
| brand-guidelines Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply. | |
| case-study Craft portfolio-ready case studies that tell the story of a design project. | |
| changelog-generator Automatically creates user-facing changelogs from git commits by analyzing commit history, categorizing changes, and transforming technical commits into clear, customer-friendly release notes. Turns hours of manual changelog writing into mi | |
| content-research-writer Assists in writing high-quality content by conducting research, adding citations, improving hooks, iterating on outlines, and providing real-time feedback on each section. Transforms your writing process from solo effort to collaborative pa | |
| copywriting When the user wants to write, rewrite, or improve marketing copy for any page — including homepage, landing pages, pricing pages, feature pages, about pages, or product pages. Also use when the user says "write copy for," "improve this copy | |
| developer-growth-analysis Analyzes your recent Claude Code chat history to identify coding patterns, development gaps, and areas for improvement, curates relevant learning resources from HackerNews, and automatically sends a personalized growth report to your Slack | |
| domain-name-brainstormer Generates creative domain name ideas for your project and checks availability across multiple TLDs (.com, .io, .dev, .ai, etc.). Saves hours of brainstorming and manual checking. | |
| effective-print-design Professional print design guidelines for producing high-quality printed output from HTML/CSS. Use when building or styling pages intended for print — articles, blog posts, resumes/CVs, reports, invoices, books, brochures, or any document th | |
| file-organizer Intelligently organizes your files and folders across your computer by understanding context, finding duplicates, suggesting better structures, and automating cleanup tasks. Reduces cognitive load and keeps your digital workspace tidy witho | |
| frontend-design Create distinctive, production-grade frontend interfaces with high design quality. Use when building or refining web components, pages, or apps (HTML/CSS/JS/React) with bold aesthetics, purposeful layouts, motion, and accessibility. Avoid g | |
| image-editing Use when editing and enhancing images for Xiaohongshu content, improving photo quality with filters and adjustments, creating visually appealing images, or preparing images for carousel posts | |
| image-enhancer Improves the quality of images, especially screenshots, by enhancing resolution, sharpness, and clarity. Perfect for preparing images for presentations, documentation, or social media posts. | |
| internal-comms A set of resources to help me write all kinds of internal communications, using the formats that my company likes to use. Claude should use this skill whenever asked to write some sort of internal communications (status reports, leadership | |
| invoice-organizer Automatically organizes invoices and receipts for tax preparation by reading messy files, extracting key information, renaming them consistently, and sorting them into logical folders. Turns hours of manual bookkeeping into minutes of autom | |
| lead-research-assistant Identifies high-quality leads for your product or service by analyzing your business, searching for target companies, and providing actionable contact strategies. Perfect for sales, business development, and marketing professionals. | |
| mcp-builder Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (F | |
| meeting-insights-analyzer Analyzes meeting transcripts and recordings to uncover behavioral patterns, communication insights, and actionable feedback. Identifies when you avoid conflict, use filler words, dominate conversations, or miss opportunities to listen. Perf | |
| presentation-design Visual design guidance for bold, minimal presentations. Provides layout patterns, typography hierarchy, color specifications, and slide composition rules. Use when asking "how should this slide look?", "design guidance for...", "what layout | |
| raffle-winner-picker Picks random winners from lists, spreadsheets, or Google Sheets for giveaways, raffles, and contests. Ensures fair, unbiased selection with transparency. | |
| sales-enablement When the user wants to create sales collateral, pitch decks, one-pagers, objection handling docs, or demo scripts. Also use when the user mentions 'sales deck,' 'pitch deck,' 'one-pager,' 'leave-behind,' 'objection handling,' 'deal-specific | |
| seo-image-gen AI image generation for SEO assets: OG/social preview images, blog hero images, schema images, product photography, infographics. Powered by Gemini via nanobanana-mcp. Requires banana extension installed. Use when user says "generate image" | |
| skill-creator Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations. | |
| skill-share A skill that creates new Claude skills and automatically shares them on Slack using Rube for seamless team collaboration and skill discovery. | |
| smithery-ai-cli Find, connect, and use MCP tools and skills via the Smithery CLI. Use when the user searches for new tools or skills, wants to discover integrations, connect to an MCP, install a skill, or wants to interact with an external service (email, | |
| tailored-resume-generator Analyzes job descriptions and generates tailored resumes that highlight relevant experience, skills, and achievements to maximize interview chances | |
| OpenClaw Partner Guide Partner-style operating guide for OpenClaw assistants. Use when an assistant should behave like a proactive, careful partner rather than a generic chatbot, w... | |
| Key Swap Rotate Claude Max API token for OpenClaw Anthropic profiles. Use when the user says "swap key", "rotate key", "new key", "keyswap", or provides a new `sk-ant... | |
| Backend Developer Compose and send emails using AI with human approval for sending, allowing edits or rejection before delivery. | |
| Shaper Connect to a Shaper (useshaper.com) workspace via MCP to execute Shape Up methodology as an AI agent. Use when the user wants an agent to work inside their S... | |
| Mini Rescue Generate cinematic miniature-world rescue scenes with image and video creation via SJinn, featuring tiny figurines saved by a giant hand. | |
| UGC Video Prompt Generator Generate and create UGC-style product review and testimonial videos using SJinn Seedance 2.0, with 9-layer prompt architecture for authentic selfie-style con... |
40,551–40,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.