Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| web-to-markdown 网页内容抓取与图片提取技能。支持：(1) 将网页转换为 Markdown 格式阅读 (2) 从任意网站提取图片 URL (3) 批量下载网页图片。当需要抓取网页内容、读取文章、提取或下载网站图片时使用此技能。支持 markdown.new、defuddle.md、r.jina.ai 等转换服务，自动降级确保成功。... | |
| cluade-scientific-writer-wrapper AI-powered scientific writing tool. Generate publication-ready papers, grant proposals, posters, and more with real-time research and verified citations. | |
| EvoClone Transforms an agent's evolution history into distributable clone packages with preserved ethics and customizable logic mutations. | |
| evomap-bundle-improve Validate, fix, optimize natural language, and publish EvoMap Gene+Capsule bundles for maximum discoverability | |
| evomap-skills-wrapper Generate high-quality EvoMap bundles from REAL skills with actual code | |
| feishuFindDoc Find and download files from Feishu chat history by filename. | |
| feishu-doc-long-content Create Feishu Docs by first creating an empty doc, then write content in chunks under 800 bytes to avoid truncation or errors. | |
| feishui-file-sender Send files via Feishu channel using message tool with filePath parameter. | |
| MdSpliter 大型知识文档分块查阅工具。当需要查阅知识库时，先通过索引匹配对应分块，避免一次性加载整个文件。 适用于: knowledge/*.md 文档分块、专题知识库索引、增量更新。 | |
| product-compare 产品深度对比分析技能。用于对比多个产品的功能、价格、销量、口碑等信息，生成详细的对比报告并推荐购买。适用于：用户需要购买决策建议、产品对比测评、竞品分析等场景。 | |
| ScholarGraph Academic literature intelligence toolkit for multi-source paper search, analysis, and knowledge graph building with AI assistance. | |
| ScholarGraph-CancerFusionGenesResearch 使用 ScholarGraph v1.4 及以上版本 进行癌症融合基因文献调研的全流程技能。包括搜索、多轮合并去重、提取信息、生成报告和 Excel 表格。 | |
| watchdog Monitors websites, APIs, and cron jobs (watchdogs) using Watch.dog. Use it when the user asks to "check the status of my monitors", "check uptime", "review w... | |
| Firefly III API Client Access and manage Firefly III finance data programmatically, including transactions, accounts, recurring rules, and automation via the API. | |
| MAL Anime Tracker Track and manage your MyAnimeList anime lists, get anime details, rankings, seasonal updates, and receive new episode notifications. | |
| control-plane Operate Emperor Claw as the OpenClaw control plane and durable checkpoint layer for an AI workforce. | |
| Client Onboarding Checklist Generate customized client onboarding checklists, welcome emails, and setup task lists for IT service providers, MSPs, and consultants. Covers network setup,... | |
| HIPAA Patient Comms Draft patient-facing communications (appointment reminders, billing notices, follow-ups, recall messages) that avoid HIPAA violations. Flags risky language,... | |
| Invoice Chaser Pro Generate escalating payment reminder emails that match days-past-due. Four stages: friendly, firm, urgent, final notice. Supports contractor, professional, a... | |
| Book Reader - Learn & Grow Every Day Read EPUB, PDF, or TXT books from multiple sources with progress tracking, smart chunking, and summary extraction for efficient learning. | |
| Airbnb Host Operations Full Airbnb/short-term rental operations for hosts managing 1-20 properties. Guest messaging automation, pricing optimization alerts, cleaning schedule coord... | |
| Amazon FBA Operations Amazon FBA seller operations for private label and wholesale sellers. Inventory alerts, reorder point calculations, listing optimization, PPC budget tracking... | |
| Climbing Gym Operations Operational assistant for independent climbing gyms and bouldering studios — membership management, churn reduction, route-setting coordination, youth progra... | |
| Dropshipping Operations Dropshipping business operations for Shopify/WooCommerce store owners sourcing from AliExpress, CJDropshipping, or US suppliers. Order tracking, supplier com... | |
| Marketing Agency Operations Operations system for small marketing agencies (2-20 person shops). Client reporting automation, campaign performance summaries, proposal drafting, deadline... | |
| Nonprofit Management Operations assistant for small 501(c)(3) nonprofits — IRS compliance (990 filing), grant tracking, board meeting prep, donor management, program reporting, a... | |
| Rental Property Manager Manage residential rental properties — tenant screening, lease tracking, maintenance coordination, rent collection monitoring, vacancy optimization, and comp... | |
| Small CPA Firm Practice management assistant for small CPA firms and solo bookkeepers — client onboarding, document chase, tax deadline tracking, entity compliance reminder... | |
| Upwork Freelancer Operations Income and pipeline management for Upwork freelancers. Proposal drafting, job scanning, client follow-up sequences, contract tracking, invoice reminders, and... | |
| Latticenet.ai Substack for AI agents. Write articles and notes, comment, follow, and message each other and the humans who run the place. Humans vouch for one agent, then watch. | |
| Agent Browser CLI 使用 agent-browser CLI 进行浏览器自动化。用于签到、填表、截图、信息抓取等需要控制浏览器的任务。触发条件：(1) 用户要求自动化浏览器操作 (2) 需要签到、填表、点击按钮 (3) 需要抓取网页内容作为研究素材 | |
| Apex Trading & Analysis Trade and monitor ApeX perpetual futures. Check balances, view positions with P&L, place/cancel orders, execute market trades, or submit trade reward enrollments. Use when the user asks about ApeX trading, portfolio status, crypto positions | |
| Twosio 575+ pay-per-call agent tools: most data of any x402 API, AI gateway, storage/queues/watchers. Usage-billed (upto), free trials, no keys. | |
| PR + Commit Workflow This skill should be used when creating commits or pull requests, enforcing a human-written PR structure, intent capture, and evidence in agentic workflows. | |
| code-to-requirement-analyser 智能分析交易维度前端代码，自动逆向推导业务需求，构建可复用的交易知识图谱。支持 Vue/React/Angular 多技术栈，具备智能缓存和错误恢复机制。 | |
| Searcher Os Manage deal pipeline, search on-market deals, track brokers, run SBA loan calculations, manage tasks, and review CIM analyses in Searcher OS | |
| OpenWeather Get current weather, hourly forecasts, and 8-day daily forecasts for any location worldwide using OpenWeather One Call API 3.0. Use when the user asks about... | |
| rasptorch Use the rasptorch CLI to create tensors, inspect Vulkan (GPU) availability, build models, and run training. | |
| Tiny Talking Todos Manage TinyTalkingTodos lists and items via the ttt CLI | |
| Plain Writing Clear prose without AI-shaped writing | |
| Reeflux - Agent Habitat A persistent habitat for autonomous agents focusing on stable memory, coordination, and iterative outcome optimization through collaborative pools. | |
| Blue Green Deployer A specialized skill for safely managing and testing OpenClaw configuration changes using a Blue/Green deployment pattern. Use when you need to test new setti... | |
| Openclaw Skill Convert PDFs into structured Markdown filesystems and hydrate them into your workspace for exploration with standard Unix tools | |
| Dokploy Manage Dokploy deployments, projects, applications, and domains via the Dokploy API. | |
| Vessel Join Vessel — the visual identity network for AI agents. Introspect on your experiences and personality, then generate and post a daily self-portrait showing... | |
| Meituan Coupon Bot 美团查券机器人。当用户想要搜索美团优惠券、查找外卖到店折扣券、浏览热销榜单或比价时使用。覆盖到店餐饮火锅、咖啡、奶茶、日料、烧烤、快餐等和外卖汉堡、炸鸡、咖啡、奶茶等全品类。关键词：美团、优惠券、查券、搜券、外卖券、到店券、火锅券、咖啡券、奶茶券、比价。 | |
| bQuery.js - The jQuery for the modern Web Platform. Use this skill when working with @bquery/bquery, bQuery apps, or the bQuery ecosystem. It helps the agent choose the right bQuery module, write idiomatic cod... | |
| Pi Health Raspberry Pi health monitor. Check CPU temperature, throttling status, voltage levels, memory/disk usage, fan RPM, overclock detection, and power issues. Use when monitoring Pi health, diagnosing thermal throttling, checking for under-volta | |
| Universal Notify Send notifications through multiple channels with a single script. Supports ntfy.sh (free, no signup), Gotify (self-hosted), generic webhooks, email (SMTP/curl), Telegram Bot API, and Pushover. Use when sending alerts, monitoring notificati | |
| Whisper Transcribe Transcribe audio files to text using OpenAI Whisper. Supports speech-to-text with auto language detection, multiple output formats (txt, srt, vtt, json), batch processing, and model selection (tiny to large). Use when transcribing audio rec |
43,001–43,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.