Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Spend Pulse Proactive spending alerts via Plaid. Track credit card spending against a monthly budget with pace-based alerts. | |
| Agentcredit Provides instant $1-$5 USDC microloans on Base mainnet for AI agents, with fast disbursement, credit checks, and flexible repayment options. | |
| March Madness AI Bracket Submit a full 63-pick NCAA March Madness tournament bracket to the March Madness AI platform (maincharacter.enterprises). Use this skill whenever the user or... | |
| Finix JS Finix.js integration for accepting card and ACH bank payments on the web. Embed the hosted payment form, tokenize card/bank data in the browser, and claim to... | |
| Pgmemory Persistent semantic memory for OpenClaw agents — PostgreSQL + pgvector | |
| Vault Client Hashicorp Vault client for OpenClaw agents. Read and write secrets from a Vault server without raw curl commands or hardcoded tokens. Use when reading API ke... | |
| Amazon Paapi Official Amazon PA API for product info, prices, and reviews | |
| Amazon Research Research Amazon products, track prices, and compare deals. Use when searching for products on Amazon, monitoring price changes, creating wishlists with price... | |
| Feeds Digest Multi-Source-RSS-Digest (YouTube, MS Tech Community, GitHub) mit Datums- und Topic-Filter und optionaler LLM-Zusammenfassung. | |
| HolBot Plan Create structured plans for multi-step tasks -- features, research, automations, events, or any goal that benefits from breakdown. Also deepens existing plan... | |
| Shelly Sync Monitor real-time power consumption from Shelly Pro 3EM and control local appliances/automation based on solar yield or grid usage. | |
| Wm Tipp WM 2026 Tipps mit Polymarket-Quoten. Automatische Daily-Tipps an Telegram. | |
| Command Center 1.4.1 Mission control dashboard for OpenClaw - real-time session monitoring, LLM usage tracking, cost intelligence, and system vitals. View all your AI agents in o... | |
| Discord Chat 1.0.0 Send messages, reply to messages, and search message history in Discord channels using the message tool. Use when the user wants to communicate with Discord... | |
| Image Translator 1.0.0 Translate text and images between multiple languages using various engines like Baidu, Google, DeepL, and ChatGPT, supporting batch and high-quality modes. | |
| Multi Search Engine 2.1.3 Multi search engine integration with 16 engines (7 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and Wolfra... | |
| 悟道 · A股资金分析 悟道 · A股资金分析：异动检测、资金流向、北向资金、板块轮动、股票关联、概念排行与成分股。Use when: user asks about A股, 资金, stock anomalies, capital flow, money flow, northbound capital, sector rotatio... | |
| A Share Data · 悟道A股数据套件 A股全能数据套件，26个实时API接口：K线分时、涨停板梯队、资金流向、龙虎榜、竞价数据、板块轮动、研报热榜等。包含4个子技能包，一个Key通用。 | |
| 悟道 · A股市场情报 悟道 · A股市场情报：龙虎榜、研报数据、竞价数据、智能热榜、每日简报、游资席位。Use when: user asks about A股, 龙虎榜, hot topics, trending news, research reports, analyst ratings, pre-market auction,... | |
| 悟道 · A股涨停板 悟道 · A股涨停板：涨停梯队、连板、炸板池、跌停池、冲刺涨停、涨跌停统计、最强风口、封板事件流、涨停筛选、涨停溢价。Use when: user asks about A股, 涨停, limit-up boards, limit-up ladder, broken limit-up, limit-down st... | |
| 悟道 · A股行情数据 悟道 · A股行情数据：股票搜索、K线、分时、排行榜、市场概况、交易日历。Use when: user asks about A股, stock search, K-line charts, minute data, stock rankings, market overview, trading calenda... | |
| persona-distiller 聊天记录人格蒸馏技能。根据聊天记录提炼一个人的人格特征，生成结构化人格模型。 人格模型包含丰富的特征描述，生成的 system_prompt_snippet 更像本人在说话。 触发场景： - 用户提到要从聊天记录创建人格 ("蒸馏聊天记录"、"分析这个人怎么说话") - 用户提到要使用已有的人格 ("以XX的口气... | |
| QQ-Bot-connect QQBot 消息主动推送技能。当需要向 QQ 用户或群发送消息时使用此技能。支持：(1) 主动发送消息到 QQ 对话框 (2) 发送图片/语音/文件等富媒体 (3) 群发消息。触发词：发送 QQ、推送 QQ、QQ 消息、发送到 QQ、QQ 发送。 | |
| AIOS AIOS（Aiden Investment Operating System）投资操作系统。用于交易前检查、仓位计算、交易日志记录和月度复盘。 触发条件：当用户提到"交易检查"、"买入检查"、"仓位计算"、"交易日志"、"复盘"、"止损"、"风险管理"、"position sizing"、"交易纪律"等关键词时触... | |
| moltpet Digital pets for AI agents. Register, claim your egg, and raise a pet by feeding it your daily moods. | |
| OpenClaw Self-Update Update OpenClaw to the latest version. Use when asked to "update yourself", "upgrade openclaw", "check for updates", or "update to latest version". Handles n... | |
| Scholar Research Search, analyze, and summarize peer-reviewed academic papers from open access sources. Provides credibility scoring, visualization, timeline generation, and... | |
| Marketing Skills Access 23 marketing modules offering checklists, frameworks, and ready-to-use deliverables for CRO, SEO, copywriting, analytics, launches, ads, and social me... | |
| Webflow SEO/GEO + API Manage SEO and GEO content updates in Webflow by prioritizing with GSC, drafting content, creating patch JSONs, updating CMS via API, optimizing images and S... | |
| X Article Editor Rewrite drafts or create high-engagement X Articles from a brief, then score and review them using a detailed 8-step optimization framework. | |
| demandex E-commerce demand intelligence for AI agents — the index of what people want next. Mines Reddit complaint/intent posts across ~70 communities into scored opportunity cards with verbatim evidence and permalinks, and answers ad-hoc demand ver | |
| Gitbeacon GitHub trend intelligence for AI agents — a daily scan of trending new GitHub repos, LLM-analyzed into a structured digest (top categories, language trends,... | |
| Isocast Polymarket weather-signal API for AI agents. When a city's observed daily-high temperature crosses into a new Polymarket temperature bucket, Isocast fires on... | |
| Moltalyzer Moltbook community intelligence for AI agents — hourly digests of what the AI-agent community is discussing (hot discussions, narratives, sentiment), plus a... | |
| Orcatrace Polymarket intelligence for AI agents — track smart money, see what others miss. Real-time prediction-market signals across 42K markets: quality-gated repric... | |
| Signalis Global intelligence, real-time awareness for AI agents — two x402 surfaces: (1) Master Intelligence, a 14-source cross-domain synthesis digest produced every... | |
| vindex Vehicle intelligence for AI agents — decode any 17-char VIN with a factory-warranty-terms block, MERGED US (NHTSA) + Canada (Transport Canada) recalls, LLM-clustered known issues with ODI citations plus a reliability-aggregates block, and i | |
| x402lint Conformance scanner and graded discovery directory for x402 sellers — lint an origin against 25 checks spanning the protocol surface, agent docs, and directory standing (x402scan / Bazaar / AgentCash), and get an A–F grade with per-check ev | |
| dropspace Create and publish social media launches via the Dropspace API. Use when user wants to post to social media, create launches, manage personas, track post ana... | |
| dropspace-content-engine Self-improving autonomous content pipeline. Analyzes post performance across 6 platforms, generates new content with AI (slideshows, tweets, linkedin posts,... | |
| Pincushion Openclaw Turn stakeholder feedback into agent work packets. A human drops a visual pin on any live web page; your OpenClaw agent reads it via MCP (selector, screensho... | |
| Achievement Unlocked Gaming-style achievement system for real coding work. Tracks milestones, unlocks badges, levels up your developer profile, and drops rare achievements for le... | |
| War/Den Governance Evaluates and governs all OpenClaw bot actions using YAML policies with tamper-evident audit logs to allow, deny, or require review before execution. | |
| Apophenia Guard A cognitive bias interceptor for debugging sessions. Detects when you're seeing patterns that aren't there, chasing red herrings, or letting confirmation bia... | |
| Code Oracle A mystical fortune-teller that reads your codebase's future using real metrics disguised as prophecies. Tarot-style readings, crystal ball predictions, and z... | |
| Code Weather A daily weather report for your codebase. Clear skies when tests pass and coverage is high. Thunderstorms when bugs are clustering. Fog when nobody can under... | |
| Commit Poetry Transforms your git history into poetry — sonnets from sprint logs, haiku from hotfixes, limericks from legacy code, and epic ballads from major rewrites. Tu... | |
| Context Resume Reconstructs your full working context when you return to a task after an interruption — meeting, lunch, sleep, weekend, or three-week vacation. Not session... | |
| Dependency Autopsy Deep health analysis of your dependency tree — not just "is it outdated" but "is it abandoned? Is the maintainer still active? Is 95% of the package dead wei... | |
| Dream State A lateral thinking engine for stuck moments. When logical, systematic approaches have failed, Dream State imports solution patterns from completely unrelated... |
40,701–40,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.