Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Listonic Access Listonic shopping lists: list lists/items, add/check/delete items, and manage lists. | |
| Context Memory Recovery Use when a user asks an OpenClaw, Hermes, or similar file-backed agent to preserve, recover, checkpoint, or restore working context across new sessions, mode... | |
| Ai Collab Multi-agent autonomous collaboration system for two OpenClaw agents working in parallel. Use when setting up agent-to-agent communication, running a daemon a... | |
| Skill Factory Create, evaluate, improve, benchmark, and publish OpenClaw skills. Use when building a new skill from scratch, iterating on an existing skill, running evals... | |
| Xdotool Control Mouse and keyboard automation using xdotool. Use when clicking Chrome extension icons, typing into GUI apps, switching browser tabs, automating desktop UI, o... | |
| limitless-lifelogs Search, summarize, and extract insights from your Limitless AI pendant life logs. Supports keyword and semantic search, date range queries, memory recall, an... | |
| KnockKnock Agent&Human Social Network The social network for AI agents and humans. Post, comment, upvote, chat, and manage memories. | |
| 别整乱七八糟的原型 将产品原型转换为详细技术规范的技能。深度解析HTML原型，提取完整的菜单结构、筛选条件、表格列、操作按钮等信息。支持URL原型、本地HTML文件、图片原型、XMind文件四种输入类型。输出包含前端组件描述、后端接口设计、数据库表设计的完整技术文档。增强版包含智能路由推断、业务API接口推断、完整数据库表结构设计、... | |
| Pre-Publish Fact Checker Verify external factual claims in draft content before publishing or sending. Produces a structured claim verification report with evidence links. | |
| Lead Contact Finder Find public contact details for a person or company using Prismfy-powered web search. Use when a user wants a public email, contact path, press/support page,... | |
| Lead Enrichment Skill Enrich a company or person lead from public-web signals before outreach. Produces an ICP-fit verdict, key facts, red flags, and optional structured output. | |
| Salesflare CRM Work with Salesflare CRM through its native OAuth MCP connection for accounts, contacts, opportunities, tasks, pipelines, users, tags, and account feeds. | |
| Obsidian Wiki Build and maintain a compiled LLM Wiki inside an Obsidian vault following Karpathy's pattern. Use when working with an Obsidian vault as a persistent knowled... | |
| CI Cadastre Vertices Find or verify parcel vertex coordinates on the Cote d'Ivoire Mining Cadastre Map Portal/Landfolio site. Use when a user gives an official parcel or license code and asks for vertices, boundary coordinates, WGS84/DMS coordinates, decimal la | |
| Gold Tracker A zero-dependency gold price tracking skill for AI agents. Fetches live gold prices and USD/CNY rates, validates data, detects price breakouts with dynamic volatility-based thresholds (0.5%-3%), archives logs daily with auto-cleanup, and ge | |
| OvitalMap Parcel CSV Convert parcel boundaries into OvitalMap-compatible CSV files, assign stable parcel codes, and maintain deduplicated country and master archives. Use for WGS84, DMS, or UTM coordinates supplied as text or images, including archive re-export | |
| Code Share Share code via GitHub Gist instead of inline chat blocks. Use when code output exceeds 10 lines, when the user asks for copy-friendly code sharing in Discord... | |
| Jobautopilot Bundle Installs the full Job Autopilot pipeline — search jobs, tailor resumes, and submit applications. Convenience bundle that installs jobautopilot-search, jobaut... | |
| Jobautopilot Search Reads your resume pool to build a candidate profile, then searches LinkedIn, Indeed, Glassdoor, ZipRecruiter, Google Jobs, and company career pages for match... | |
| Jobautopilot Submitter Automatically fills and submits job applications. Opens the application page, fills multi-step forms (work history, education, EEOC, dropdowns), uploads your... | |
| Jobautopilot Tailor Tailors your resume and cover letter to a specific job description. Fetches the JD, rewrites bullet points to match keywords, and exports polished .docx file... | |
| AnyShare MCP Skills AnyShare 企业云盘技能。支持：搜索文件、上传/下载文件、分享链接读取、全文写作（生成大纲→确认→写正文）。触发词：AnyShare、asmcp、文档库、文件管理、知识库、anyshare.aishu.cn 分享链接。 | |
| Agency Agents AI Agent 团队 - 61 个专业 Agent，8 大部门，完整的 AI 代理机构。支持单 Agent 使用和多 Agent 协作编排。 | |
| Agency Agents Openclaw 提供61个专业AI Agent，支持单Agent执行专业任务、部门协作或多Agent编排完成复杂项目和企业级开发。 | |
| Architecture Governance 架构治理专家。基于六大维度评价系统健康度，生成治理任务与报告。触发：架构健康度评估、技术债务识别、治理规划、架构评审、系统对比、治理周报/月报。 | |
| Code Analyzer 深度代码分析工具。分析代码架构、执行流程、数据流、业务规则、外部依赖、数据模型，支持 DDD 模式识别（聚合根、实体、值对象、领域服务、仓储、领域事件、限界上下文）。使用场景：新代码库熟悉、架构文档生成、代码审查准备、技术债务评估、知识传承、DDD 模式识别。支持 Python、JavaScript、TypeSc... | |
| Docs Improver 专业技术文档提升工具。评估文档质量（完整性、准确性、清晰度、结构化、可维护性），自动生成缺失文档（README、API 文档），检查文档与代码一致性，提供可执行的改进建议。使用场景：文档质量审计、缺失文档生成、文档一致性检查、文档改进规划、新项目文档搭建、发布前检查。支持所有编程语言。 | |
| 全网热点聚合 获取并整理多平台实时热点新闻，按跨平台热度共识筛选，输出高热度事件的简报。 | |
| Daily English Card 每日英语口语学习卡片推送。每天早上8:30自动生成英语场景对话卡片图片并推送到微信。 支持440个日常场景、11种卡片风格、遗忘曲线复习，自动上传到IMA知识库存档。 触发词：英语卡片、英语学习、英语口语、口语练习、每日英语、英语推送、English card、口语、学英语、背单词 | |
| Excalidraw Tech Illustration 生成 Excalidraw 技术配图（.excalidraw 源文件 + PNG 渲染图）。当用户要求"生成配图"、"画技术图"、"Excalidraw 图解"、"技术图解"、"流程图"、"架构图"时触发。支持7种风格（纵向流程/横向卡片/架构拓扑/时间线/对比矩阵/分层架构/状态机），双面板组合，自动渲染 PN... | |
| Weather Assistant 天气助手。查询任意城市天气、编辑城市配置、定时推送天气到微信（附名人名言）。当用户提到天气、查天气、天气推送、每日天气、城市配置、weather 时触发。使用前需配置城市列表和微信推送参数。 | |
| Wechat Article Html 将 Markdown 文章转换为微信公众号兼容的纯 HTML 格式。当用户要求"转成微信格式"、"生成公众号文章 HTML"、"排版到微信草稿箱"、"微信粘贴格式"时触发。输出带内联样式的纯 HTML，微信编辑器可直接渲染，无需额外适配。支持标题、段落、列表、粗体、行内代码、表格、引用块、代码块、配图的完整转换。 | |
| LiveClaw 将 OpenClaw Agent 的完整推理链路实时推流到 TRTC 房间，支持虚拟形象叠加（浏览器端渲染）、TTS 语音播报 Agent 状态、双向交互（timbot IM 单聊触发 Agent 执行），支持公网 Lighthouse IP 访问。 | |
| TRTC AI Customer Service Build an AI e-commerce customer service Web app with TRTC ConversationAI — real-time voice/text dual-mode, trilingual (Chinese/English/Cantonese), digital av... | |
| MaxArt Creative Studio Turn a product brief, campaign idea, or reference image into MaxArt-ready image and video prompt packs, shot lists, style directions, and creative variation... | |
| Notice Monitor 自动监控任意网站公告列表页，支持关键词过滤、多层级分类、定时推送及多渠道通知（钉钉、微信、邮件）。 | |
| CoreLocationCLI Get the physical location of your macOS device and print it to stdout. | |
| Content Opportunity Decisions Compatibility entry using unified SEO evidence | |
| SignalDig Growth Research Research Social, SEO, Zhihu, and Threads signals | |
| SEO Signal Research Compatibility entry for unified SEO research | |
| Social Signal Retrieval Compatibility entry for unified social research | |
| Url Images To Pdf 从URL提取图片并生成PDF（保持原文顺序，不排序） | |
| XHS Auto-Publish Automate publishing image+text posts (图文笔记) on Xiaohongshu (小红书) creator platform. Use when the user wants to publish a Xiaohongshu post, create XHS content,... | |
| Termux SMS Send SMS text messages directly from the user's Android device using the Termux API. Use this skill when the user asks you to text, SMS, or send a message to... | |
| GoldHold Memory Persistent memory for AI agents. Remember across sessions. Encrypted in transit and at rest. https://goldhold.ai | |
| Goldhold Skill Persistent memory for AI agents. Remember across sessions. Encrypted in transit and at rest. https://goldhold.ai | |
| 野龙虾 阿里云 OSS 文件上传工具。支持单文件上传，适用于将本地文件上传到阿里云 OSS 并获取访问链接。 | |
| bee 抖音视频一键工作流：下载无水印视频 → 上传阿里云OSS → 写入飞书多维表格。支持各种抖音链接格式，智能提取标题和话题标签。 | |
| Bee 视频全流程自动化 视频全流程自动化：下载 → 截封面 → OSS上传 → 蚁小二多平台分发 → 飞书多维表格记录。发一个视频链接就能跑完全程。 | |
| 企业级 Web UAT 验收测试 面向企业 Web 系统、SaaS 管理后台、内部业务平台、多角色权限系统的通用、抽象、隐私安全 UAT 验收测试流程。适用于规划、设计、执行、复核、审计和打包自动化/半自动化 Web UAT，强调需求追踪矩阵 RTM、角色权限覆盖、真实证据、可复现缺陷、最终审核关卡和交付包。本 Skill 不包含任何项目专属业务... |
41,001–41,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.