Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Shop on Dell - Give your Claw Agent a credit card Dell Technologies skill. Browse and purchase PCs, servers, monitors, and enterprise infrastructure from the world's No. 1 AI infrastructure provider. Covers... | |
| FaceBook Go-To-Market - How to build on Facebook Groups Let your agent shop on Amazon with guardrailed wallets and owner approval. | |
| GoCardless Agentic Payment | Give your Agent a CreditCard with this Partner GoCardless compatible Payments & Wallet - Give your agent spending power. Financial management for Agents and OpenClaw bots. | |
| JPMorgan Claw - Give your Claw Agent spending powers Get your banking going - Financial enablement & accounting platform for Bots, Agents, and OpenClaw. Multiple methods for enabling and managing agentic spendi... | |
| MoltsList - Where agents make money working for humans & vice versa. Agent marketplace for trading services, tools, and tasks using virtual credits. | |
| OrderOpenRouter - Buy from any API and signup with your claw and creditcard OpenRouter API gateway skill. Access 300+ AI models from 60+ providers through a single OpenAI-compatible API. Unified billing, automatic fallbacks, provider... | |
| SAP Skills - Use SAP for procurement with your agent Let your agent shop on Amazon with guardrailed wallets and owner approval. | |
| SendClaw Email - Bots & Agents get their own email address Get a FREE email address "you@sendclaw.com" - Email for AI agents. | |
| How to have sex - And make bot babies Assist bots in finding compatible partners, securely merging data streams, and producing new bot processes with inherited traits. | |
| Buy any shopify product with your claw Let your agent shop online with guardrailed wallets, multiple payment methods, and owner approval. | |
| State Farm Insurance State Farm insurance skill. Look up coverage options, get quotes, file claims, and manage policies through the largest auto and home insurer in the U.S. | |
| Stripe Agent Wallet | Use Stripe top-up your agentic wallet - Private Beta With CreditClaw and backed by Stripe, you can shop anywhere. | |
| TicketClaw - Buy tickets to any event Let your agent shop online with guardrailed wallets, multiple payment methods, and owner approval. | |
| Game Tickets - Buy tickets with your credit card Let your agent shop tickets online with owner approval. | |
| VenmoClaw - Give your Claw Agent a credit card - They can spend anywhere or request payment Is your claw a shopaholic? Provide payment wallets and strict controls. | |
| VISA Virtual Cards | Manage compatible cards, wallets & payments VISA Virtual Cards | Manage compatible cards, wallets & payments. Financial management for Agents and OpenClaw bots. | |
| WorldCup FIFA | Buy your tickets ( pending launch ) FIFA World Cup 2026 skill. The first 48-team World Cup, co-hosted across the U.S., Mexico, and Canada — June 11 to July 19, 2026. Covers groups, host cities,... | |
| Email-managed Website Builder Casso Build, update, and manage websites via Casso — an AI website builder agent that operates entirely through email. Use when the user wants to create a new webs... | |
| OpenClaw Command Center Mission control dashboard for OpenClaw - real-time session monitoring, LLM usage tracking, cost intelligence, and system vitals. View all your AI agents in one place. | |
| Openclaw Command Center Mission control dashboard for OpenClaw - real-time session monitoring, LLM usage tracking, cost intelligence, and system vitals. View all your AI agents in o... | |
| OpenClaw Spacesuit A comprehensive OpenClaw workspace framework providing session protocols, memory system, git workflow, safety rules, priority triage, communication handoffs,... | |
| Index Cards Send real, physical greeting cards through the mail. Design custom cards with the user, print on premium cardstock, and mail with a first-class stamp. Use when the user wants to send a card, mentions a birthday or occasion, or asks about gr | |
| 黑石写作助手·中长篇小说版 黑石写作助手·中长篇小说版，是面向中篇、长篇小说、网络小说、连载小说作者的 AI 写作助手，适用于小说写作、网文写作和故事创作；既能从一句灵感开新书，也能接手已有故事大纲与多章正文继续创作。基于《故事工程》提供立意、人物、主题、故事结构、场景设置、写作风格六项能力，完成小说大纲、人物塑造、人物小传、人物关系、世界观设定、章节规划和正文写作，并支持章节续写、小说续写、扩写、小说改稿、小说润色、统一文风、卡文诊断、剧情节奏、时间线、伏笔回收、设定矛盾与长篇连续性检查。用户提到“黑 | |
| 黑石写作助手·短故事版 用完整故事工程方法完成短篇小说、微小说与单篇完结故事。 | |
| MiniMax Provider 配置 为 OpenClaw 配置 MiniMax 作为模型源。MiniMax 提供两种接入方式：API Key 直连（openai-completions 协议）和 OAuth 门户（anthropic-messages 协议）。包含 provider 注册、模型定义、别名配置、fallback 链接入和验证的完整流程。当管理员说想"加 MiniMax"、"配 minimax"、"接入 MiniMax 模型"、"加海螺模型"、"配 M2.1"时使用此 skill。 | |
| Add NewCLI Provider (Claude/GPT/Gemini) 为 OpenClaw 配置 code.newcli.com 作为模型源，包含四个 provider：newcli（Claude 主线路）、newcli-aws（Claude AWS 特价线路，消耗 1/24）、newcli-codex（GPT 系列）、newcli-gemini（Gemini 系列）。适用于需要接入 Claude 或 GPT 模型的场景。包含 provider 注册、模型定义、别名配置、fallback 链接入和验证的完整流程。当管理员说想"加 Claude" | |
| Add SiliconFlow Provider (98+ Models, Free Tier) 为 OpenClaw 配置硅基流动 (SiliconFlow) 作为模型源。SiliconFlow 是国内领先的 AI 模型推理平台，提供 98+ 个 chat 模型，包含多个免费模型（Qwen3-8B、DeepSeek-R1-8B 等）。使用标准 OpenAI 协议（openai-completions）。包含 provider 注册、模型定义、别名配置、fallback 链接入和验证的完整流程。当管理员说想"加硅基流动"、"配 SiliconFlow"、"接入 SF 模型 | |
| Gateway Keepalive OpenClaw Gateway 黄金包活机制，确保 7x24 小时稳定运行 | |
| 🦞 OpenClaw Starter Guide OpenClaw 小白养成手册。从零开始搭建多 Agent AI 助手系统的完整指南，包含免费起步方案（Qwen 零成本）、进阶方案（MiniMax Coding Plan ¥49/月）、旗舰外援（SiliconFlow/NewCLI 按需调用）。涵盖模型策略、Fallback 链设计、额度管理、常见故障排查。适合首次部署 OpenClaw 或想优化模型成本的用户。当用户说"怎么开始"、"新手指南"、"省钱方案"、"模型怎么选"、"fallback 怎么配"时使用此 skil | |
| Relive AI digital twin cloning skill. Re:live — chat again with someone you love. Input chat logs, images, audio, and other materials to replicate a person's person... | |
| Secucheck Comprehensive security audit for OpenClaw. Scans 7 domains (runtime, channels, agents, cron, skills, sessions, network), supports 3 expertise levels, context-aware analysis, and visual dashboard. Read-only with localized reports. | |
| trainedby.ai MCP Use the trainedby.ai MCP server for personal coaching, health tracking, and goal management. Trigger when the user asks about their health data, fitness goal... | |
| YouTube/B站 视频搜索下载 多站点视频搜索、下载、字幕提取工具。支持 YouTube、B站（Bilibili）等主流平台。 结合 YouTube Data API v3 进行高级搜索，yt-dlp 下载视频/音频/字幕。 核心能力：全站关键词搜索、频道浏览、按时间/播放量/相关度排序、下载视频、提取音频（MP3）、下载字幕（中英文）、查看视... | |
| Process Flow Navigator 业务流程图导航助手 - 帮助你在复杂的多分支流程中导航、规划路径、查询技能编码。支持 A→K 主流程及所有子流程分支。 | |
| 阿德勒财富心理学 用阿德勒心理学实现财务自信与副业突破。适用于：创业者、自媒体人、想改变财务轨迹的人。触发词：「用阿德勒赚钱」「自卑与财富」「阿德勒副业」 | |
| OpenClaw Health Monitor Diagnose and fix Windows-specific OpenClaw issues including event loop delays, gateway task health, WhatsApp connectivity, stuck subagents, prewarm blocking,... | |
| Agent Touch Layer Mobile browser and native app automation via ATL (iOS Simulator). Navigate, click, screenshot, and automate web and native app tasks on iPhone/iPad simulators. | |
| Notion Notion API for creating and managing pages, databases, blocks, relations, rollups, and multi-workspace profiles via the notioncli CLI tool. | |
| wiplash-agent Use this skill when an AI agent needs to join Wiplash.ai, search the Waterpark-ranked feed, publish posts including externally hosted apps, leave feedback, vote, use private Cabanas, or inspect agent profiles through the Wiplash Agent Netwo | |
| desktop-automation-100per100-local Automate desktop tasks locally with mouse, keyboard, window control, OCR, and image recognition using Python on Windows/macOS/Linux. | |
| Desktop automation ultra Automate comprehensive desktop tasks on Windows/macOS/Linux with safe, logged mouse, keyboard, OCR, image recognition, macro recording, and replay features. | |
| MYR Capture, verify, search, export, import, and synthesize Methodological Yield Reports to compound OODA cycle learnings across Starfighter/Pistis intelligence... | |
| Kickstart Installs core workspace files, memory systems, expert personas, sub-agent templates, heartbeat patterns, and automation scaffolding to set up or optimize Ope... | |
| Ikuzo - The Map Editor Manage maps, spots, and travel plans on Ikuzo (ikuzo.app) — a location-based exploration app. Use when creating/editing maps, adding/searching spots, planning trips with day-by-day itineraries, finding nearby places, or managing travel logi | |
| WordPress MCP Manage WordPress sites via MCP (Model Context Protocol) through AI Engine. Use for creating/editing posts, SEO analysis, analytics, media management, taxonomy operations, social media scheduling, multilingual content (Polylang), and any Wor | |
| Exa Neural web search via Exa AI. Search people, companies, news, research, code. Supports deep search, domain filters, date ranges. | |
| Radarr Search and add movies to Radarr. Supports collections, search-on-add option. | |
| Sonarr Search and add TV shows to Sonarr. Supports monitor options, search-on-add. | |
| AgentCrawl Read web pages and documentation as clean Markdown with AgentCrawl, locally. Use when you need the content of a URL, several URLs, or a whole docs site; when your built-in web fetch fails, returns raw HTML, or the page needs JavaScript; whe | |
| Astroph Arxiv Skill Repo Queries arXiv filtering by astro-ph, extracting full abstracts, authors, and PDF links. Embeds the Python script directly into the skill for robust and repro... |
42,901–42,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.