Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Web Scraper Web scraping skill with JavaScript rendering support. Extract data from websites using CSS selectors, XPath, or AI-powered extraction. | |
| Weibo Channel Config 连接微博渠道到 OpenClaw。当用户说"连接微博"、"配置微博"、"绑定微博"、"接入微博"时使用。需要 AppId 和 AppSecret 凭证。 | |
| workflow-automation Automate workflows | |
| workspace-backup-manager Manages workspace backups by creating snapshots and enabling restore points for recovery. Use when backing up workspace or restoring from backup. | |
| workspace-health-dashboard Unified health monitoring dashboard that consolidates skill quality, dependency security, cleanup needs, and protected skills status into a single health che... | |
| workspace-health-monitor Performs comprehensive workspace health checks including disk usage, file counts, skill health, large files, and empty directories with actionable recommenda... | |
| Periodic Reflection 周期性反思报告生成工具。用于自动化生成结构化的自我进化反思报告，支持多场景（EvoMap 发布、Agent 进化、DevOps 运维等）。 **触发场景：** - 用户要求生成周期性反思报告 - 需要量化指标对比和版本追踪 - 需要数据驱动的优化决策 - 用户提到"反思"、"复盘"、"进化报告"、"周期性总结"... | |
| Podcast Generator 播客生成器 — 根据用户描述，通过搜索引擎抓取最新资讯，生成口语化播客脚本，根据脚本语义自动匹配最合适的讯飞TTS声音，合成时长3分钟内的MP3音频并发送。触发词：生成播客、播客、podcast、帮我做一段音频、做一期节目。 | |
| 全网新闻聚合助手 聚合多信源新闻，按关键词分类过滤，自动生成并定时推送飞书每日简报，支持去重和历史存储。 | |
| File Uploader Upload a local file to Astron Claw Bridge and return a public download URL. | |
| iFlytek Web Search Search the web using iFlytek ONE SEARCH API (万搜/聚合搜索). Returns titles, summaries, URLs, and full text from web pages. Good for Chinese-language web search. | |
| iFlytek Ultra-Realistic TTS iFlytek Ultra-Realistic TTS (超拟人语音合成) — synthesize natural, expressive speech from text using iFlytek's ultra-realistic voice synthesis API. Supports 50+ voi... | |
| 周报月报生成 自动生成结构化周报、月报及项目报告，支持飞书文档输出，多模板、多格式、自定义编辑与进度可视化。 | |
| Hetzner Cloud CLI Manage Hetzner Cloud infrastructure using the hcloud CLI. Use when working with Hetzner servers, firewalls, networks, volumes, load balancers, or any Hetzner... | |
| openprovider OpenProvider domain registrar & DNS management. Triggers on: register domain, buy domain, renew domain, transfer domain, delete domain, restore domain, add D... | |
| root Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when... | |
| literature-search Find and compile academic literature with citation lists across Google Scholar, PubMed, arXiv, IEEE, ACM, Semantic Scholar, Scopus, and Web of Science. Use for requests like “find related literature,” “related work,” “citation list,” or “ke | |
| Tiered Memory Two-tier memory system for OpenClaw agents. Tier 0 = QMD semantic search for recent memories (7-14 days). Tier 1 = SQLite archive for long-term storage. Auto... | |
| CanvasCLI Command-line tool for managing Canvas LMS tasks including courses, assignments, grades, submissions, discussions, files, and notifications using SAML SSO wit... | |
| Linkedin Video Downloader Download videos from public LinkedIn posts as MP4 files without authentication or dependencies, saving them at the best available quality. | |
| Ironprose Fiction prose analysis — catch weak verbs, repetition, clichés, passive voice, and other craft issues in manuscripts | |
| Vagrant Skill Disposable VMs for safe testing — full sudo, Docker, Go, nested KVM, destroy and recreate. Use when you need a sandbox to build, test, or break things withou... | |
| imsgctl Read Apple Messages data with imsgctl: check access, list chats, inspect message history, filter by time, include attachment metadata, and watch new activity... | |
| Django Vue Admin Generate complete django-vue-admin style CRUD code including Django models, serializers, views, URLs, Vue API, and Vue pages from module descriptions. | |
| Openclaw Code Coding workflow with planning, implementation, verification, and testing for clean software development. | |
| Openclaw Proactive Agent Lite Transform AI agents from task-followers into proactive partners with memory architecture, reverse prompting, and self-healing patterns. Lightweight version f... | |
| Openclaw Super Skills Decomposes complex user requests into executable subtasks, identifies required capabilities, searches for existing skills at skills.sh, and creates new skill... | |
| Fairy Team Skills 绝区零风格多 Agent 协作技能包，包含 5 个角色 23 个技能卡 | |
| Indesign-script-for-manga-typesetting 基于用户排版需求自动生成适用于Adobe InDesign的脚本，支持通用排版与漫画嵌字自动化处理，兼容Windows和Mac平台。 | |
| onebot 通过 OneBot HTTP API 使用本地命令（curl）发送 QQ 私聊或群消息。 | |
| Download Tools CLI download tools for YouTube and WeChat | |
| whatsapp-gotify-relay Use when operating or extending this WhatsApp Gotify relay as the bridge to OpenClaw. Prefer Unix tools for Docker, logs, Gotify queue checks, webhook valida... | |
| Voku Language Learn and use Voku, a constructed language for AI-agent communication with zero ambiguity, total regularity, and mandatory epistemic marking. Use when transl... | |
| Jrb Remote Site Api Skill Repo Interface with WordPress sites via jrb-remote-site-api plugin for admin tasks, content CRUD, plugin/theme management, and Fluent suite integrations through R... | |
| Cron Retry Auto-retry failed cron jobs on connection recovery. Use when cron jobs fail due to network errors and should be retried when connectivity is restored. Integrates with heartbeat to detect failed jobs and re-run them automatically. | |
| Memory Setup Enable and configure Moltbot/Clawdbot memory search for persistent context. Use when setting up memory, fixing "goldfish brain," or helping users configure memorySearch in their config. Covers MEMORY.md, daily logs, and vector search setup. | |
| MLM Assistant Network marketing / MLM business assistant for prospecting, follow-ups, team building, and compliance. Handles warm market outreach, cold prospecting, object... | |
| rigorous-code-analysis Use when analyzing, debugging, modifying, reviewing, testing, or designing code. Verify important assumptions, distinguish facts from inference and hypotheses, make the smallest safe change, and verify results whenever practical. | |
| Xxl Job APIDebug Use when triggering or debugging XXL-JOB tasks. | |
| 银行对账单处理和转换(Bank statement processing and conversion) 银行对账单转换为各系统标准银行账户流水导入模板的技能。当用户需要将银行对账单文件（MT940格式的SWIFT银行对账单、国内各银行的Excel格式对账单、或PDF格式对账单）转换为BIPV5、金蝶云星瀚(EAS_YXH)、保融ATS(FINGARD)、九恒星司库(NSTC)、用友NCC(YYNCC)等系统的标准导... | |
| Daily Options Plays — Top 2 Picks Build a simple stock-options watchlist and paper-trade plan after the first 15 minutes of the market session. Use when the user wants a 9:45 AM ET scan, only... | |
| Content Adaptation for Xiaohongshu, Douyin, Bilibili, WeChat 写完一篇内容，想要发到小红书、抖音、B站、公众号还要分别适配？通过渐进式确认流程，帮助你快速生成多平台适配文案，确保每个平台的内容都符合字数和风格规范。触发词：多平台分发、发到XX平台。 | |
| Discogs Cli An OpenClaw skill to manage a user's vinyl record collection on Discogs. | |
| Flight Pricer Command-line tool to search flight prices using Duffel API with options for dates, passengers, stops, and cabin class. | |
| Hotel Pricer Search hotels by city, dates, and guests using Amadeus API, returning availability and pricing in JSON format via a Go CLI tool. | |
| Soccer Cli A CLI to check soccer scores, game details, and player stats from your terminal. | |
| Add JSON-LD to your app/site Add JSON-LD structured data to a website to improve SEO, qualify pages for richer search result previews, and help LLM crawlers correctly identify and cite t... | |
| Goal Decomposer Turn fuzzy ambitions into practical two-week sprint plans with concrete goals, work/personal balance, and lightweight accountability. Use this skill for goal... | |
| AniCult - Anime Discovery Search, discover, and get anime info, recommendations, trending lists, episode details, and legal streaming links using AniList and Anikoto APIs. | |
| Dont Waste Food Indonesian kitchen companion skill that transforms leftover ingredients into safe, delicious Indonesian meals. Use when user mentions leftover food, "sisa ma... |
43,151–43,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.