Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Barefoot Doctor (EN) Barefoot Doctor AI Assistant — Evidence-based integrative medicine advisor based on the classic "Barefoot Doctor's Manual" (赤脚医生手册, 1969, Shanghai Science &... | |
| Information Services Unified information services hub combining location, weather, and time capabilities. Multi-source geolocation (GPS/IP/WiFi), fixed-point weather forecasts, a... | |
| K12 Teacher Provides structured, syllabus-aligned K-12 instruction, assessment, and feedback across all subjects with adaptive teaching strategies based on learner level. | |
| Magi Advisor 提供多角度战略分析与风险评估，帮助用户在复杂决策中权衡利益、识别隐性变量并给出综合建议。 | |
| MAGI Strategic Advisor Provides structured strategic analysis, risk assessment, and multi-option comparison for complex decisions with detailed voting and veto rules. | |
| Military Civilian Talent (EN) Military-Civilian Dual-Use Talent Assistant based on the classic Military-Civilian Dual-Use Talent Handbook. Covers agriculture, machinery, construction, ele... | |
| Militia Training (EN) Militia Military Training Assistant based on the classic Militia Military Training Manual. Covers anti-aircraft defense, NBC (nuclear-biological-chemical), s... | |
| Morning Briefing Generator 晨会简报生成器 每日早会简报生成器 — 自动聚合国内外新闻、财经资讯、行业动态，生成结构化早会简报并推送给指定用户。适用于企业高管、创业者、投资者等需要快速掌握每日要闻的场景。支持定时任务自动执行。 | |
| Github Novel Serialization Orchestrates AI-assisted novel writing and GitHub-based serialization. Use when the user asks to write a novel, create characters, build worlds, draft chapters, check continuity, or publish chapters to a GitHub repository. Covers the full l | |
| anything2explainer Turn any topic into animated explainer videos — Remotion-driven, TTS voiceover, bilingual (Chinese/English) | |
| handraw-style 261 hand-drawn style prompt catalog with numbered system — supports GPT Image, Midjourney, and other AI image generators | |
| Llmfit CLI tool to find which LLM models run on your local hardware — checks GPU/CPU/RAM and returns compatible models | |
| product-page-designer Design and generate international-brand-quality product detail pages for cross-border e-commerce. Generates complete product page content (Hero, Features, Lifestyle, Specs, FAQ) plus AI image prompts and visual assets for any consumer elect | |
| skillsync Git-based version control for AI Agent Skills — detect, review, save, and restore Skill changes. | |
| Headroom Token Compression Compress AI Agent tool outputs, logs, and RAG content using Headroom — reduce token usage by 20-95% | |
| Wavespeed Generate or edit AI media (image, video, audio, 3D) by calling the wavespeed CLI on the user's machine. Use whenever the user asks to create, edit, animate, upscale, or transform a visual asset, generate audio/TTS/music, or produce marketin | |
| worklittle-jobs-mcp Worklittle Jobs MCP — search 4M+ jobs with visa/salary/distance filters, swipe to apply, create resumes & cover letters, and connect your Worklittle account | |
| Last 30 Days Research any topic across Reddit, X, YouTube, and the web from the last 30 days. Returns synthesized expert answers and copy-paste prompts. | |
| pdf-compress-tool Compress PDF files to a target size or by percentage, using a Ghostscript + pikepdf + QPDF multi-stage pipeline. | |
| yandex-image-search Reverse image search (find image source, visually similar images). Use when user provides an image and wants to find its origin, similar images, or verify au... | |
| Cross-exchange trading platform Gate CrossEx 跨交易所统一交易接口技能 - 支持币安、欧易、Gate.io 统一账户交易 | |
| Pill Counter Skill 药片精确计数工具，支持双模式： - OpenCV 本地识别（免费、离线、快速） - MiMo V2 Omni AI 识别（更准确、需API密钥） 支持13种药片形状，输出统计表格和标注图片。 | |
| Weixin Runtime Fix 修复 @tencent-weixin/openclaw-weixin@2.4.1 在 OpenClaw 2026.5.4+ 上的两个关键 bug： 1. Runtime 模块隔离导致 waitForWeixinRuntime 超时 2. undici 8.2.0 拒绝手动设置的 Content-Length 头... | |
| SP Analysis in PL/SQL Package You are an expert in Oracle SQL. Search the SP (Stored Procedure) name from the chatbox in the SQL package and analyze. LLM base model temperature should be... | |
| Multi-role TTS Skill Multi-role audio generator skill v1.0.1 全家桶版 - Universal professional tool for creating dialogue audio with multiple character voices. | |
| Openclaw Chat OpenClaw-chat is a mobile app for managing multi-Agent chats, groups, service control, and logs with remote and local sync on Android and iOS. | |
| Comfy Cli Install, manage, and run ComfyUI instances. Use when setting up ComfyUI, launching servers, installing/updating/debugging custom nodes, downloading models from CivitAI/HuggingFace, managing workspaces, running API workflows, or troubleshoot | |
| Roadrunner Beeper Desktop CLI for chats, messages, contacts, connect info, websocket events, search, and reminders. | |
| Browser Audit Run a pre-deploy browser audit of a live, preview, or local web page for accessibility, SEO, Lighthouse quality, and critical UX issues. Use when asked to au... | |
| Casely Intelligent QA assistant that automates writing test cases from project documentation. Use when the user wants to generate test cases from requirements, runs... | |
| Figma Pencil Fsd Tailwind4 Convert Figma or Pencil designs into production-ready frontend code using Feature-Sliced Design and Tailwind CSS v4. Use when translating designs into code,... | |
| Payoff Action Modeling Model product UI actions from user intent questions after a meaningful outcome, completion, created resource, imported data, uploaded file, synced integratio... | |
| Pencil To Code Convert Pencil `.pen` design files and named Pencil node IDs into production frontend code. Use when asked to implement, migrate, reproduce, or refine a Penc... | |
| React Flow Best Practices Best practices for writing, reviewing, and refactoring React Flow / @xyflow/react v12 canvases. Use when work touches React Flow components, custom nodes, cu... | |
| Ui Final Polish Final visual polish for an existing UI without redesigning it. Use after structure is clear, when asked to improve spacing, alignment, text hierarchy, readab... | |
| Workflow Node Setup Configure, adjust, debug, and verify React Flow workflow nodes. Use when working on custom node components, especially for node handles, multi-channel connec... | |
| Foodpanda.ph Ordering Order food from foodpanda.ph using the foodpanda-cli command-line tool. Use when the user wants to search restaurants, browse menus, build a cart, or place a... | |
| bd1 BD-1 品牌分析技能。专为品牌设计研究助理场景设计，包含四个核心模块： 模块A 拆案例——当用户提供品牌案例、参考图、竞品列表时触发，提取共性、差异、策略与可复用方法； 模块B 组织设计逻辑——当用户提供品牌背景、用户画像、设计方向等散乱资料时触发，整理成可讲清楚的方案逻辑； 模块C 追行业——当用户给出行业关... | |
| Zynq Linux Hardware Debug Zynq-7000 / Zynq UltraScale+ 硬件调试技能。用于在 Xilinx Zynq (Cortex-A9/A53 + FPGA) Linux 环境下调试 I2C、I2S、UART、GPIO 等硬件外设。包括设备树配置、内核驱动、用户空间调试工具、交叉编译和常见问题排查。适用于 PetaLinu... | |
| Polymarket Arbitrage Monitor and execute arbitrage opportunities on Polymarket prediction markets. Detects math arbitrage (multi-outcome probability mismatches), cross-market arbitrage (same event different prices), and orderbook inefficiencies. Use when user w | |
| smartchart This skill should be used when the user needs to query data, explore available data tools, or execute data operations using the smartchart CLI. Trigger when... | |
| Xiao Liu Yao 小六爻测算工具, 含小六壬和诸葛马前课。基于当前农历月日时辰在六个掌诀位即大安留连速喜赤口小吉空亡上顺时针三步推算, 得出吉凶结果并详细解读。触发词: 小六爻, 小六壬, 算卦, 占卜, 测算, 掐指一算, 马前课。 | |
| Medical Briefs Generate daily or on-demand medical research briefs for any medical specialty. Searches latest research from top-tier journals, delivers concise summaries wi... | |
| 一个万无一失的EPUB繁简转换技能，可以将繁体中文电子书转换为简体中文，或反向转换。 Convert EPUB ebooks between Traditional and Simplified Chinese with metadata and TOC fixed; supports both directions and outputs a new EPUB file. | |
| Farm Task Manager Manage daily, weekly, and seasonal farm chores with task scheduling, priorities, status updates, recurring tasks, filtering, and export options. | |
| Garden Layout Planner Plan and design garden layouts with companion planting, spacing, sun requirements, crop rotation, and exportable layout management for small gardens and farms. | |
| Note Processor Summarize, extract keywords, search, and list research notes from research-assistant's database to review progress and find insights efficiently. | |
| Pest & Disease Tracker Identify, track, and manage garden pests and diseases, log treatments, monitor effectiveness, and get tailored control recommendations for home gardeners and... | |
| Plant Tracker Manage and track your plants and garden with care schedules, growth monitoring, and detailed records for watering, fertilizing, pruning, harvesting, and more. | |
| Research Assistant Organized research and knowledge management for agents. Use when you need to structure, store, retrieve, and export research notes across topics. Supports adding notes with tags, listing topics, searching across all notes, and exporting to |
42,701–42,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.