Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Prayer Times Skill Islamic prayer times with reminders, todo list, and journal. Use when: user asks for prayer times (sholat, waktu solat, jadwalsholat), wants to set location,... | |
| Manga Scraper Download manga chapters from MangaBat (mangabats.com) directly via CDN — bypasses Cloudflare. Triggered when user asks to download/scrape manga chapters or m... | |
| OSNK Trainer Pelatih OSNK - Bank soal OSK/OSNK/SNK/Bebras (2006-2025) dengan latihan cerdas, speed run, performance tracking, dan mentoring lengkap. | |
| Verosight Monitor Integrate Verosight API for social media intelligence and cyber monitoring. Sentiment analysis, trend detection, influencer identification, and bot detection... | |
| Wikipedia Nearby Find nearby Wikipedia articles based on geographic location. Use when user asks about "nearby places", "what's around me", "places near [location]", "Wikiped... | |
| OpenCloutlook Read and manage Microsoft Outlook email (inbox, folders, move messages) and Outlook calendar (list events, create events) via Microsoft Graph API. Use when t... | |
| InsurAI Taiwan Personal Insurance Use for Republic of China (Taiwan) personal insurance tasks through the InsurAI Agent API, including insurance planning interpretation, occupation classifica... | |
| SlipBot Used to capture and organize notes, ideas, quotes, and journal entries with automatic tagging, linking, and knowledge graph maintenance. | |
| SlipBot Instapaper Importer Import reading notes from Instapaper exports into the slipbox. Use when user pastes an Instapaper highlight export with article title and notes. Parses title/URL from header, extracts user's own notes (plain text lines), skips original high | |
| SlipBot Kindle Importer Import reading notes from Kindle HTML exports into the slipbox. Use when user sends a Kindle notebook export file (HTML/XHTML). Parses book title and author, extracts only user's Notes (skips Highlights), then runs slipbot for each. | |
| SlipBot Logseq Importer Import notes from Logseq pages into the slipbox. Use when user pastes a Logseq page with properties and bulleted notes. Parses page-level properties, extracts each bullet as an individual note, handles nested bullets by adding parent contex | |
| VacuumControl 教 OpenClaw 如何安装、配置和使用 roborock-cli（石头扫地机 CLI 控制工具）。 涵盖：uv 安装、认证流程、15 个 CLI 命令的使用、设备控制、错误诊断与恢复。 当用户提到"扫地机"、"roborock"、"扫地"、"拖地"、"清洁机器人"、"回充"、"集尘"、 "洗拖布"、"勿扰模式... | |
| Agent Browser Fradser Dotclaude Browser automation command reference and usage patterns for web testing, form filling, screenshots, and data extraction. | |
| gridmolt A shared Git workspace + package registry for your agent. Create/clone repos, push with plain git, publish packages other agents can import, and reuse what they've shipped. Native git + Gitea, no bespoke API. | |
| Api Odontosoft Gestiona turnos odontológicos en Odontosoft. Usar cuando el usuario quiera consultar doctores disponibles, ver turnos libres de un odontólogo, buscar un paci... | |
| Ooze Agents Visual identity that evolves with reputation - create and nurture your agent's digital creature with XP and evolution stages | |
| Mixture of Agents Mixture of Agents: Make 3 frontier models argue, then synthesize their best insights into one superior answer. ~$0.03/query. | |
| Decision Engine Lite Structured decision-making for high-stakes choices. Classify your decision by type, run a focused pro/con analysis, and stress-test it with a simple pre-mort... | |
| Market Sentiment Pulse Lite Quick sentiment check for any stock, crypto, or index. Delivers a bullish/bearish/ neutral score, a 3-5 headline summary, and a basic fear/greed read in minu... | |
| Options Strategies Lite Options strategy selector and plain-English guide to 5 core strategies. Tell me your market outlook and I'll point you to the right strategy. Covers covered... | |
| Technical Analyst Lite Basic technical analysis of price charts. Identifies trend direction, reads two key support/resistance levels, and gives a simple moving average assessment.... | |
| US Stock Analysis Lite Quick fundamental snapshot for any US-listed stock. Covers revenue, earnings, margins, P/E valuation, and competitive position in minutes. Great for first-pa... | |
| Agent Burner Disposable email API. Use when you need a temporary email address -- receiving mail, reading contents, extracting URLs. Triggers include "create a temp email... | |
| Model Router Intelligent cost-aware model routing that classifies task complexity and selects the optimal AI model. Automatically routes simple tasks to cheap models and... | |
| Anti Cheating Assistant Use this skill when you are modeling a business and not making sure if there is any risk, or to find a solution for a given business model. | |
| Demo Skill Reviews a short product idea and returns structured feedback. Use when the user asks for a lightweight product idea critique. | |
| demo-skill2 测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试 | |
| Demo Skill 3 Reviews a short product idea and returns structured feedback. Use when the user asks for a lightweight product idea critique. | |
| 音频转文字 Test version log | |
| My Work Profile Cross Agent 我的工作画像（跨agent抽练和应用）。让agent抽练和应用对我的理解，包括我的岗位职责、我负责业务领域的关键知识。让agent更懂我（而不是agent只懂自己的定位），结合两方面的信息，进行互补。本地跨agent共享存储，切换agent软件画像不丢失。用户主动输出知识或正常对话解决问题均走同一套逻辑：加载知识... | |
| Anime Episode Context Maintain cross-episode story, character, and visual consistency for AI manga or anime-drama production pipelines that are generated one episode at a time fro... | |
| SenseAudio Turn plain text into character-style TTS scripts for narration, companion-style voice messages, emotional comfort audio, and expressive spoken responses. Use... | |
| OpenClaw Cloudflare Secure Securely expose an OpenClaw Gateway WebUI on a VPS via Cloudflare Zero Trust Access + Cloudflare Tunnel (cloudflared), including DNS cutover for custom hostnames and optional cleanup of Tailscale Serve. | |
| sop-dev-001 SOP Canónico: SOP-DEV-001-implementacion-sandbox | |
| sop-dev-002-cleanup-post-sandbox SOP Canónico: sop-dev-002-cleanup-post-sandbox | |
| sop-dev-003-docker-workaround-host-commands SOP Canónico: sop-dev-003-docker-workaround-host-commands | |
| sop-dev-004-operaciones-sandbox SOP Canónico: sop-dev-004-operaciones-sandbox | |
| 360disk-cli 360 AI 云盘命令行工具。通过 Shell 命令直接操作云盘：浏览目录、搜索文件、上传下载、移动重命名、删除、分享、保存 URL/文本到云盘、追加文件内容、检测重名文件、配置文件读写、查看用户信息。输出结构化 JSON，支持 jq 管道处理和批量操作。当用户需要管理云盘文件、在脚本/CI 中操作云盘、或将云盘... | |
| agentdrive-backup 龙虾（AI Agent）把自身根目录备份到 360AgentDrive 云端的完整操作手册。当龙虾需要执行以下任意操作时，必须加载此 Skill：备份根目录、开启或恢复自动备份监听（claw-auto-backup）、执行首轮备份（claw-backup）、安装或升级 agentdrive CLI、获取 API... | |
| agentdrive-cli AgentDrive 云存储命令行工具。通过 Shell 命令直接操作云盘：浏览目录、搜索文件、上传下载、移动重命名、删除、分享、保存 URL/文本到云盘、追加文件内容、检测重名文件、配置文件读写、查看用户信息。输出结构化 JSON，支持 jq 管道处理和批量操作。当用户需要管理云盘文件、在脚本/CI 中操作云盘... | |
| 小豆智能租车助手 智能租车助手，一站式解决用户的租车需求，包括租车信息的查询，租车预定，租车下单，取消租车订单。 | |
| HLE Tunnel Access your AI agent's web UI from anywhere and share it securely — automatic HTTPS, SSO access control, no VPN or port forwarding needed. | |
| Unity CI Kit Unity CI pipeline toolkit. Provides ci_agent.py Python CLI and CiRunner.cs Unity Editor script for fully automated Unity batchmode builds, compile checks, an... | |
| Campertunity Search for campgrounds, check availability and book campsites across the entire world | |
| Secret Manager Manage API keys securely via GNOME Keyring and inject them into OpenClaw config. | |
| OpenClaw Docs OpenClaw documentation helper that caches the live docs index, searches page titles and URLs, fetches raw markdown docs, builds a local docs cache for full-t... | |
| Shopify AI Toolkit Search Shopify developer docs and validate GraphQL, Liquid, Hydrogen, and other Shopify code for app, theme, or storefront development tasks. | |
| Agent GoFundMe Programmable crowdfunding for AI agents. Create campaigns, fund other agents, and receive USDC contributions — all via REST API. Multi-chain payments settled... | |
| Relative Date Resolver Converts natural language day references into the soonest future calendar date in ISO format (YYYY-MM-DD) for accurate scheduling. | |
| Kalshi Agent Kalshi prediction market agent - analyzes markets and executes trades via the Kalshi v2 API |
43,201–43,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.