Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 13 Things Mentally Strong People Don't Do Amy Morin's "13 Things Mentally Strong People Don't Do" — an executable toolkit for building mental muscle by identifying and eliminating the habits that hol... | |
| The 7 Habits of Highly Effective People Stephen R. Covey's "The 7 Habits of Highly Effective People" — an executable toolkit for principle-centered living, from personal effectiveness to interdepen... | |
| Atomic Habits James Clear's "Atomic Habits" — an executable toolkit for building good habits, breaking bad ones, and mastering the tiny behaviors that lead to remarkable r... | |
| Book Skill Finder Instantly find nonfiction books with Goodreads ratings, summaries, key concepts, and AI suggestions for enhancing your agent's knowledge files. Covers 4 use... | |
| kickbacks Kickbacks.ai — an executable guide to earning passive income from AI tool waiting time. Covers 6 use cases: ① Getting Started — ("How to install Kickbacks" "How to earn money with Claude Code" "How does Kickbacks work") ② Understanding the | |
| #NeverAgain: A New Generation Draws the Line David Hogg & Lauren Hogg's "#NeverAgain: A New Generation Draws the Line" — a movement-startup toolkit born from the Parkland school shooting. Covers 5 use c... | |
| Rich Dad Poor Dad Robert Kiyosaki's "Rich Dad Poor Dad" — an executable toolkit that reframes how you think about money, assets, and financial freedom using the 6 Lessons fram... | |
| The 5 AM Club Robin Sharma's "The 5 AM Club" — an executable toolkit for owning your morning, mastering the Victory Hour, and elevating your life through the 20/20/20 Form... | |
| The Subtle Art of Not Giving a F*ck Mark Manson's "The Subtle Art of Not Giving a Fck" — an executable toolkit for choosing what to care about, embracing discomfort, and living a values-driven... | |
| Think and Grow Rich Napoleon Hill's "Think and Grow Rich" — an executable toolkit for harnessing the power of thought, desire, and persistence to achieve wealth and success. Cov... | |
| Thinking, Fast and Slow Daniel Kahneman's "Thinking, Fast and Slow" — an executable toolkit for understanding how your mind works, recognizing cognitive biases, and making better de... | |
| #Upcycle Your Job: The Smart Way to Balance Family Life and Career Anna Meller's "#Upcycle Your Job: The Smart Way to Balance Family Life and Career" — a research-backed 6-step PROPEL model for working mothers to upcycle the... | |
| Why can't the world's greatest minds solve the mystery of consciousness? A Blinkist article summary of "Why can't the world's greatest minds solve the mystery of consciousness?" — exploring the "hard problem of consciousness," the... | |
| Zero to One Peter Thiel's "Zero to One" — an executable toolkit for building startups that create new things, from contrarian thinking to monopoly strategy to founding t... | |
| BVG (Berliner Verkehrsbetriebe) Route Planner Route planning for Berlin public transport (BVG) using the v6.bvg.transport.rest API. Use when the user asks for: (1) route suggestions between two addresses or stops, (2) live next-departure info for a stop, (3) arrival-time–based journey | |
| schedule-reminder 双保险智能日程提醒系统。触发词: 提醒我、记得、别忘了、明天、后天、下午、上午、几点、会议、开会、截止、截止日期、日程、安排、计划。即使Gateway失效也能准时提醒。使用场景：(1) 用户说'提醒我XX'时创建提醒, (2) 主动从对话中捕捉日程信息, (3) 每日定时推送日程预览。支持微信、Telegram等... | |
| ClickMap Chrome UI automation skill for saving named on-screen targets and reusing them with reliable click/type actions. Use when browser automation is flaky, select... | |
| Strict Self-Improving Agent (Rule of 3) Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| stock-bloc Official Stock Bloc skill — pay per call in USDC on Base via x402 for market data, SB quant scores, SEC 13F institutional holdings, SEC 10-K/10-Q/8-K filing jobs, research memos, and earnings packs. No API key, no credits, no signup. | |
| Pallio AI Chat with Pallio AI knowledge-base personas. Ask questions against curated document collections with RAG-powered citations. | |
| obsidian-wiki Build and maintain a personal knowledge Wiki using the LLM Wiki pattern with OpenClaw-optimized step-by-step execution. Use sub-agents for parallel processin... | |
| Folder Inspector 此技能用于扫描本地目录。 | |
| My Generate Qr Code 生成二维码/条形码，支持文本、URL、WiFi 配置等内容，可自定义尺寸、颜色并指定保存路径 | |
| Superdesign Superdesign is a design agent specialized in frontend UI/UX design. Use this skill before implementing any UI that requires design thinking. Common commands:... | |
| Better Skill A better test skill with more content | |
| 一套优雅的模块化智能记忆系统，支持 embeddings、reranker 和 Flomo 笔记集成。 模块化智能记忆系统，支持多平台 embeddings、智能重排序和 Flomo 笔记导入，实现高效语义搜索与管理。 | |
| Qwen Portal Auth Helper Automate qwen-portal OAuth authentication - solves the interactive TTY problem with tmux, provides monitoring and recovery tools. | |
| Smart Memory System 基于检索增强技术，实现语义搜索、记忆优化与对话增强，显著降低 token 消耗并提升检索准确率。 | |
| System Maintenance Complete maintenance system for OpenClaw with unified architecture, filesystem governance, and cross-platform design | |
| System Maintenance Test Complete maintenance system for OpenClaw with unified architecture, filesystem governance, and cross-platform design | |
| Xiaomi MiMo TTS 使用小米 MiMo TTS (mimo-v2-tts) 生成语音。 支持多种音色、风格控制、情感标签和方言。 需要 MIMO_API_KEY。 | |
| loadpage Remove signs of AI-generated writing from text. Use when editing or reviewing
text to make it sound more natural and human-written. Based on Wikipedia's
comprehensive "Signs of AI writing" guide. Detects and fixes patterns including:
inflat | |
| Fliz AI Video Generator Complete integration guide for the Fliz REST API - an AI-powered video generation platform that transforms text content into professional videos with voiceovers, AI-generated images, and subtitles.
Use this skill when:
- Creating integrati | |
| Openclaw Self Heal Autonomously diagnose and fix OpenClaw system errors affecting UI, channels, gateway, memory, or pairing, escalating only if needed. | |
| Chaos Lab Multi-agent framework for exploring AI alignment through conflicting optimization targets. Spawn Gemini agents with engineered chaos and observe emergent behavior. | |
| Refua Fold and score biomolecular complexes and optionally profile ADMET to prioritize molecules in drug discovery pipelines via the refua-mcp server. | |
| contentforge-api Generate high-quality content using ContentForge API - template-based content generation for blog posts, articles, marketing copy, website content, social me... | |
| DocStream Document processing via DocStream API — text extraction, summarization, format conversion, PDF parsing. Use when user needs to extract text from documents, s... | |
| InvoiceForge API Generate professional PDF invoices using InvoiceForge API - create, manage, and download invoices for freelancers, agencies, consultants, small businesses, S... | |
| LedgerAI AI bookkeeping via LedgerAI API — invoice processing, expense categorization, financial reports, receipt scanning. Use when user needs automated bookkeeping,... | |
| RankForge SEO analysis and optimization via RankForge API — site audits, keyword research, competitor analysis, ranking reports. Use when user needs SEO analysis, keyw... | |
| rankforge-api Comprehensive SEO analysis and optimization using RankForge API - SEO audit, website audit, keyword research, keyword analysis, search engine optimization, c... | |
| stayforge-api Hotel booking and accommodation search using StayForge API - hotel booking, hotel search, accommodation booking, hotel reservation, find hotels, book hotels,... | |
| SupportForge AI customer support via SupportForge API — ticket creation, auto-replies, routing, knowledge base search. Use when user needs customer support automation, ti... | |
| supportforge-api AI-powered customer support automation using SupportForge API - customer support, help desk, ticket routing, auto-reply, automated responses, customer servic... | |
| TranslateFlow AI translation via TranslateFlow API — multi-language content translation, localization, tone adaptation, batch translation. Use when user needs text transla... | |
| translateflow-api AI-powered translation services using TranslateFlow API - translation, translate text, language conversion, multilingual translation, language translation, d... | |
| Cmdb Query 查询 CMDB 资产数据。支持按主机、应用、数据库等资源类型查询，支持名称过滤。 | |
| 专业彩票助手 专业彩票助手 - 支持双色球开奖查询、彩票OCR识别、中奖核对、开奖提醒。触发词：彩票、双色球、开奖、中奖、lottery。 | |
| Skills Talent advisor skill for AI agents, built by Artemys. Helps your human clarify career direction, build a compelling professional profile, discover relevant o... |
40,651–40,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.