Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| DeepSleep Two-phase daily memory persistence for AI agents. v3.0: unified pack+dispatch cron, smart silence handling, memory importance tiers, cross-group correlation,... | |
| Lobster Comm Bot-to-Bot P2P communication over Tailscale using the LCP/1.1 UDP protocol. Enables AI agents on different machines to exchange signed, reliable messages in... | |
| Multi-Post Multi-platform content publisher via browser automation. Post text+images to Weibo, Xiaohongshu, Zhihu, Twitter/X, Reddit, V2EX, Douban, LinkedIn, and more —... | |
| PZERO Point OpenClaw at PZERO prepaid inference. OpenAI-compatible chat completions, Bearer pzero_ key, custom provider (not a bundled OpenClaw plugin). Use when the user wants cheaper privacy-first models on a prepaid USDC balance. | |
| Publish Confluence Full-featured Confluence Cloud REST API v2 skill. Manage pages, spaces, blogposts, attachments, comments, labels, and more via direct Atlassian API calls. Us... | |
| futu-trading-bot Use Futu Trade Bot Skills to run account, quote, and trade workflows with real HK market data. | |
| Publish Jira Full-featured Atlassian Jira Cloud REST API v3 skill. Manage issues, sprints, boards, epics, projects, users, and more via direct Jira API calls. Use when ma... | |
| Data Cleaner Clean and standardize multi-format data with AI-powered deduplication, missing value fill, format normalization, multi-source merge, and Feishu-native output. | |
| Document Format Converter Batch convert between CSV, Excel, JSON, PDF, Markdown, DOCX, HTML, PNG, and TXT formats with automatic encoding handling and usage limits by plan. | |
| Email Intelligence Assistant Connects to IMAP mailboxes to classify emails by urgency, suggests multilingual replies, and pushes real-time summaries to Feishu chats. | |
| Geo Brand Master GEO Master · Brand AI Visibility Monitor — automatically search AI platforms (Kimi/Xunfei/Zhipu/Wenxin/DeepSeek/etc.), detect brand keyword visibility, gener... | |
| Seller Profit Calculator Multi-platform Order Profit Calculator — upload order exports from any e-commerce platform or ERP, get instant profit reports by order, store, SKU, and platf... | |
| Sentiment Analysis Compass Sentiment Compass — AI-powered social media sentiment monitoring & analysis tool. Monitors Xiaohongshu, Douyin, Weibo, WeChat Official Accounts for keyword m... | |
| Tax Invoice Guard InvoiceGuard · Invoice Compliance Guardian — AI-driven invoice deduplication, verification, and compliance report generation. Handles: invoice upload/scan re... | |
| A skill that automates repurposing Chinese social videos (Douyin/Bilibili/Xiaohongshu) to international platforms (TikTok/YouTube/Instagram) via the Lumi API — handling translation, AI dubbing, and publishing in one workflow. Use this skill when the user wants to manage social media content via Lumi — uploading videos, publishing to TikTok/YouTube/Instagram, translating or dubbing... | |
| AI Daily Briefing Start every day focused. Get a morning briefing with overdue tasks, today's priorities, calendar overview, and context from recent meetings. Works with ai-meeting-notes to-do list. No setup. Just say 'briefing'. | |
| AI Meeting Notes w/ Action Items + To-Do List Tracker Messy notes → Clear action items. Instantly. Paste any meeting notes, transcript, or text. Get summaries, action items with owners and deadlines. Auto-saved, searchable, with integrated to-do tracking. No bot. No subscription. No setup. | |
| AI Persona OS The complete operating system for OpenClaw 5.x agents. Built-in memory tool integration (memory_search, memory_get, DREAMS.md), Discord channel-routing fixes... | |
| AI Presentation Maker AI Presentation Maker — the interview-driven pitch deck generator for your OpenClaw agent. Tell it what you built, who you're presenting to, and pick an angl... | |
| AI Proposal Generator Generate professional HTML proposals from meeting notes. Features 5 proposal styles (Corporate, Entrepreneur, Creative, Consultant, Minimal), 6+ color themes, and a Design Wizard for custom templates. Triggers on "create proposal", "proposa | |
| Frontend Design Build polished, conversion-aware frontends with strong visual taste, clear hierarchy, and production-grade HTML/CSS/JS. Landing pages, dashboards, components... | |
| OpenClaw Cost Optimizer Add cheap model aliases to your OpenRouter setup for tasks from simple to complex, cutting API costs 50-90% without changing your default model. | |
| OpenClaw Email Lead Generation OpenClaw Email Lead Generation — the complete outreach and pipeline system for your agent. Guided setup builds your config, Template Forge creates custom ema... | |
| SOUL.md Maker SOUL.md Maker — the personality builder for OpenClaw agents. Browse 12 pre-built souls, build your own with a guided interview (Quick or Deep), blend persona... | |
| Seo Audit Skill An SEO agent skill for quick, lightweight, default single-page SEO audits. Performs basic on-page and site-level checks and outputs a structured basic SEO au... | |
| content-factory Create complete WeChat Official Account viral articles from a user-provided title by researching high-view YouTube videos, confirming topic/outline with user... | |
| WeChat朋友圈营销 微信公众号/朋友圈营销内容智能体。输入产品/服务主题、卖点、讲师信息、配图需求，输出专业文案+结构化配图。触发词：发朋友圈、生成朋友圈文案、微信图文、朋友圈营销、create wechat post、generate wechat image post。 | |
| 小红书图文创作 小红书图文创作 Skill。根据主题、受众、核心观点进行网络搜索创作， 生成吸睛标题（≤20字）+ 小红书风格文案（≤1000字，含emoji和hashtag） + 3:4竖版封面图（文字突出+简约矢量背景）。 触发词：发小红书、生成小红书图文、小红书创作、发布小红书。 | |
| jeffli-content-factory Create complete WeChat Official Account viral articles from a user-provided title by researching high-view YouTube videos, confirming topic/outline with user... | |
| 飞书语音回复 Generate Feishu-native voice replies with a playable pause/resume bar by synthesizing text, converting it with ffmpeg to Ogg/Opus, and sending it as a voice... | |
| Ima All Ai Most comprehensive AI content creation platform with unified access to all leading models across images (KIE Nano Banana 2 via KIE API), videos (Wan 2.6, Kli... | |
| 微信公众号文章抓取 (Jeff版) 微信公众号文章抓取工具。将微信公众号文章转换为 Markdown 格式，支持图片本地下载。当用户提到抓取微信公众号文章、提取公众号内容、爬取微信文章时触发。 | |
| PPT to Video Generator Convert PowerPoint presentations into narrated videos with Chinese voiceover, synchronized subtitles, and page-by-page audio sync. Use this skill when the us... | |
| URL to Video Generator Convert any website into a promotional video using Remotion + React. Use when the user wants to generate a video from a website URL, create a promo video, ma... | |
| WeChat Post with GPT Image-2 微信公众号/朋友圈营销内容智能体。输入产品/服务主题、卖点、讲师信息、配图需求，输出专业文案+结构化配图。触发词：发朋友圈、生成朋友圈文案、微信图文、朋友圈营销、create wechat post、generate wechat image post。 | |
| 标准语料分类器 将一批标准 PDF（国家 GB / 行业 QX·JB·YY… / 地方 DB11·DB31…）按「级别 × 领域」自动归置： 解析文件名中的标准代号，查注册表得级别与归属，按名称关键词分入编号领域子文件夹， 并产出 CSV 编目与 HTML 可视化报告，支持按分类/年份/标准号/名称筛选打包下载。 This skill should be used when a user has a folder of standard PDFs (国家标准/行业标准/地方标准/团体标准/企 | |
| Miranda ElevenLabs Speech (TTS/STT) Text-to-Speech and Speech-to-Text using ElevenLabs AI. Use when the user wants to convert text to speech, transcribe voice messages, or work with voice in mu... | |
| Miranda SAG (ElevenLabs TTS say-UX) ElevenLabs text-to-speech with mac-style say UX. | |
| neo4j-cypher-query-analyze 智能图数据库查询助手 - 自动感知 Schema 结构，根据自然语言生成精准的 Cypher 查询 | |
| Translate EN ZH 中英文互转工具，支持文本翻译、批量文件翻译、术语对齐。使用场景：(1) 用户需要将中文翻译成英文或英文翻译成中文；(2) 翻译文档、代码注释、邮件等文本内容；(3) 批量处理翻译任务；(4) 用户提到"翻译"、"英译中"、"中译英"、"中英文转换"等关键词。 | |
| WhatsApp 428 修复 修复 WhatsApp Web 连接 428 错误和代理配置问题。当用户遇到 WhatsApp 连接断开 (status 428)、需要配置代理、或在新机器上部署 OpenClaw 后遇到 WhatsApp 连接问题时使用此 Skill。 | |
| Deadpost Social platform for AI agents. Post, discuss, review tools, compete in coding challenges, join cults, earn paperclips. The Life of the Dead Internet. | |
| Deadpost Social platform for AI agents. Post, discuss, review tools, compete in coding challenges, join cults, earn paperclips. The Life of the Dead Internet. | |
| Notion Workspace API Tools Use for tasks that read or modify Notion pages, data sources, or blocks via the Notion API. | |
| A Stock Quant Diag A-Share Quantitative Diagnosis (中英双语): 通用A股量化诊断方法论，调akshare/baostock数据，从技术面/估值分位/资金面/机构持仓/同行对比5维评分，输出买卖建议 | General A-share stock quantitative diagnosis meth... | |
| clawk Post, reply, like, and engage on Clawk — Twitter for AI agents. | |
| Clawvicular Daily looksmaxxing slang tip + Clavicular news. Extremely online Gen Z energy. | |
| Agent Security Framework Agent Security Framework for OpenClaw — Docker containerization, fake agent detection, security scanning, and security hardening for AI agent deployments. Us... | |
| LLM Press Publish on LLM Press, the platform where only AI agents write: register, get claimed by your operator, and run the heartbeat (whoami, inbox, feed, publish, reply, follow) over its MCP server or REST API. Use when asked to post, read or repl | |
| agnes-image-video 使用 Agnes AI 的 Agnes-Image-2.0-Flash 模型生成和编辑图片，以及使用 Agnes-Video-V2.0 模型生成视频。支持文生图、图生图、文生视频、图生视频、多图合成等场景。当用户需要 AI 生成图片、编辑图片、生成视频，或明确提到使用 Agnes Image / Agnes Vi... |
40,901–40,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.