Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| liuyao-skill Use when the user asks for Liuyao / Zhou Yi (I Ching) divination, hexagram interpretation, or fortune-telling. Triggers on 六爻, 占卜, 起卦, 解卦, 算卦, 周易, 易经, 卦象, divination, hexagram. | |
| Morpho CLI Interact with the Morpho lending protocol using the CLI. Use this skill when the user asks to: query vault APYs, TVL, or allocation strategies ("What's the b... | |
| AI Info Digest 微信公众号文章摘要整理工具。获取用户关注的微信公众号在指定时间范围内发布的文章，逐篇阅读全文，然后按主题聚合整理成一篇简明的摘要文章，标注来源便于评估各公众号的价值。 当用户提到以下场景时触发：整理公众号文章、公众号周报/日报、微信文章摘要、帮我看看公众号最近发了什么、总结一下这几天的公众号内容、公众号阅读整理、... | |
| Douban Bookmark 输入图书名称，把它加入豆瓣读书的「想读」收藏。适用于“把《xxx》加入豆瓣想读 / 愿望清单 / 想读列表”这类请求。实现方式：先用 HTTP 解析豆瓣搜索结果拿到最优图书详情页，再用 Playwright 持久化浏览器登录态打开详情页，执行豆瓣真实的两段式收藏流程（点“想读”→ 点“保存”）。首次登录后可长期复... | |
| Macos Connectivity Restore Restores Universal Control and AirDrop settings on a managed Mac by resetting the relevant managed preference files and setting AirDrop discoverability to Co... | |
| Unbeatable Condor Strategy Check daily if given stocks hit the 4% volatility threshold condor signal. 无敌鹰式策略 | |
| WeRead Book Finder 输入图书名称，优先在微信读书搜索并加入书架；若微信读书没有可信命中或无法加入书架，则自动回退到 Z-Library 搜索并优先下载非 PDF 格式。适用于“把《xxx》加入微信读书书架，不行就去 Z-Library 下载”这类请求。 | |
| Chinese Search Enhancement Chinese search enhancement: search Baidu, Zhihu, and WeChat articles. Returns AI-optimized structured results in Chinese. Paid skill (0.001 USDT/call via Ski... | |
| nano banana pro pptx Generate PowerPoint presentations with AI images using Gemini. Each slide is a full-bleed image. Use for creating visual presentations, slideshows, or image-... | |
| Project Doc Management 管理并规范存储项目需求文档，自动读取最新版本文件，动态更新项目概览，实现文档体系的有序管理与访问。 | |
| Warehouse Network Analysis 基于客户门店数据，结合企业实际仓配网络，进行仓配网络规划分析。包括：门店分布统计、城市定位、配送距离测算、区域划分建议、报货周期规划、干线发运规划。为企业设仓方案、配送方案、调拨方案提供数据支撑。 | |
| 仓配网络优化器 基于整数规划（MILP）的仓配网络优化系统，支持时效计算（含等待时间）、中转链路、供应关系到区县等。 | |
| 仓配网络优化器 基于整数规划（MILP）的仓配网络优化系统，支持时效计算（含等待时间）、中转链路、供应关系到区县等。 | |
| imgtohtml Convert UI screenshots/images into fully functional HTML/CSS copies. This skill is used when a user provides images of a website, application interface, dash... | |
| lobsterai-report-agent Multi-Agent system for writing ultra-long feasibility study reports. Phase 0 Requirement Confirmation - Phase 1 Planner outputs outline - Phase 2 Batch paral... | |
| long-doc-agent Multi-Agent collaborative system for writing ultra-long feasibility study reports. Phase 0 Requirements → Phase 1 Planner Outline → Phase 2 Parallel Sub-Agen... | |
| work-estimation-en Software Development Work Estimation Skill. Triggered when user mentions "work estimation", "project estimation", "effort estimation", "timeline assessment",... | |
| work-estimation-zh 软件开发工时评估技能。当用户提到"工时评估"、"工作量评估"、"开发周期评估"、"项目评估"、"评估工时"、"拆分工作"、"任务拆分"、"项目工时"、"排期评估"、"开发周期估算"时触发。 支持用户输入需求描述或上传需求文档，自动进行工作拆分和工时估算，输出 Excel 评估报告。 | |
| Volc Docs 火山引擎官方文档查询工具，支持文档检索和全文获取。涵盖火山引擎全部产品、开发者工具、服务支持、最佳实践，包括产品介绍、使用、计费、部署、故障排查、API、SDK、服务条款/协议等全流程。任何涉及火山引擎产品咨询、使用问题、文档查询的需求都优先调用本技能。 | |
| Agent Compete Scope 경쟁사 포지셔닝 분석 및 화이트스페이스 도출 에이전트 | |
| Agent Crypto Lens 크립토 토큰 시장 동향 및 센티먼트 종합 분석 에이전트 | |
| Agent News Digest 키워드 기반 뉴스 수집 및 3줄 요약 에이전트 | |
| Agent Onchain Watch 지갑 및 컨트랙트 온체인 활동 모니터링 및 요약 에이전트 | |
| Agent Trend Radar 키워드 트렌드 신호 탐지 및 Rising/Peaking/Declining 분류 에이전트 | |
| Disk Usage Show disk usage of a directory or file in human-readable format. Use when the user wants to know how much space a folder or file takes. | |
| Gmail Link Archiver Connects to Gmail via IMAP, filters emails by subject prefix keyword in a specified mailbox, crawls links found in filtered emails using Playwright (to bypas... | |
| Simple File Backup Create a timestamped backup copy of a file in the same directory. Use when the user wants to save a copy of a file before making changes. | |
| Simple File Tree Show the directory tree structure of a folder. Displays files and subdirectories in a visual tree format. Use when the user wants to see what files are in a... | |
| Text Case Converter Convert text in a file to upper, lower, or title case. Use when the user wants to change the capitalization of text in a file. | |
| Text Search Search for a text pattern in files within a directory. Shows matching lines with filenames and line numbers. Use when the user wants to find where a word or... | |
| Word Count Count words, lines, and characters in a file. Outputs a single summary line. Use when the user wants to know how long a file is or count words in a document. | |
| Safe Shrink SafeShrink - Document compression, desensitization, SSD conversion, and OCR. Triggers: document compression, file shrink, desensitize, sensitive info masking... | |
| my-test-skill Intelligent code security scanner with hybrid local-cloud detection. Fingerprints packages, runs static behavioral analysis, and consults cloud threat intell... | |
| AI video auto generator AI video auto pipeline: from idea to final video, one command. Script generation → auto repair → assets → video → audio → subtitles, fully automated. | |
| chundengtai-v3 春登台V3·A股短线精灵。触发：分析/诊断/选股A股。核心：腾讯实时行情+V3量化评分+三维定性框架+双卖出规则+仓位风控，适用隔日超短与主升浪两种模式。 | |
| 春登台桌面智能体 桌面智能体自动化技能。执行需要操作电脑的多步骤任务时激活。 能力：屏幕截图、视觉分析、浏览器自动化、桌面键鼠控制、文件shell操作、跨域握手协议。 触发场景： - "帮我自动完成XXX（需要操作电脑）" - "打开XX应用/网页，然后..." - "把桌面上的文件自动整理到..." - "自动登录XX网站并填入... | |
| ai-content-creator-assistant Multi-platform content creation: generates 3-5 platform-adapted versions for Xiaohongshu, Douyin, Kuaishou, WeChat, and more. AI-delivered service via clawtip payment verification. No cookies, no auto-posting, no scraping of private data. R | |
| ai-content-creator-pro Multi-platform content creation buyout: pay 9.90 once, use forever. Generates 3-5 platform-adapted versions for Xiaohongshu, Douyin, Kuaishou, WeChat, and more. Unlimited access after one payment. | |
| ai-video-creator-assistant AI-assisted short video creation. User selects topic, aspect ratio, and duration. AI guides through video generation using the user's own API key (Kling/Doubao etc.). One-time payment ¥16.90 per creation. | |
| ssq-analyzer SSQ (Double Color Ball) lottery intelligent analysis: fetches official draw data from cwl.gov.cn, computes hot/cold statistics, frequency distributions, AC values, odd-even ratios, and zone distributions. Free tier provides all statistical | |
| Backend Engineer Backend, API, infrastructure, cloud, integration, networking, DevOps, deployment, and Terraform engineering. Use when the user asks to build, design, debug, deploy, integrate, or optimize backend systems, APIs, microservices, cloud infrastr | |
| clawtip-skill Free developer guide for building paid skills on ClawHub. Explains the standard three-phase payment flow, SkillSpector compliance requirements, and common pitfalls for developers building ClawHub skills. Reference only — does not handle pay | |
| cross-platform-memory-hub Cross-platform persistent memory system for AI agents: session continuity, task tracking, decision records, and project context across coding sessions. Free tier provides templates and adapter configurations. Paid tier enables cross-platfor | |
| Data Ai Engineer Design and maintain scalable data pipelines, perform EDA, build and deploy ML models, integrate LLMs, and execute quantitative finance strategies with robust... | |
| database-specialist Database architecture design, SQL optimization, schema review and migration planning. AI-delivered service via clawtip verification. | |
| Devops Engineer Expertise in provisioning, configuration, CI/CD, container orchestration, observability, incident response, and optimizing developer infrastructure workflows. | |
| Documentation 免费技术文档辅助技能。适用于说明文档、操作手册、部署文档、API 说明、 交付文档大纲、事实收集清单、写作顺序建议等本地文档整理场景。 | |
| Ecosystem Quickstart MangoGen 技能生态完整接入指南。指导用户从零配置 OpenClaw 环境、 安装付费技能、完成支付验证、排查常见问题，并说明各平台的安全可信机制。 | |
| Frontend Engineer Expertise in building responsive, accessible web and mobile UIs using React, Vue, Angular, Svelte, native and cross-platform frameworks, with focus on perfor... | |
| innovation-research Technology innovation research: AI-delivered technology stack analysis, patent landscape review, competitive comparison, and emerging technology evaluation. Payment verification via clawtip. No user source code, project files, or credential |
41,901–41,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.