Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Seo Geo Qa Check blog posts and articles before publishing. Finds broken links, weak sources, missing SEO elements, and citation problems. Use when: reviewing a draft,... | |
| Smart Image Finder Smart image search and download tool for AI agents. Three methods: news website extraction, Brave image search, AI generation. Use cases: article illustratio... | |
| Fly.io CLI Use the Fly.io flyctl CLI for deploying and operating apps on Fly.io. Default to read-only diagnostics (status/logs/config/releases). Only perform state-changing operations (deploys, SSH exec, secrets, scaling, machines, volumes, Postgres c | |
| RSSaurus - Agent-Friendly RSS Feed Reader Use the RSSaurus command-line client (Go binary `rssaurus`) to interact with https://rssaurus.com from the terminal: authenticate (`rssaurus auth login/whoami`), list feeds/items, print item URLs for piping, open URLs, and perform triage ac | |
| Pickfu Market Research Run consumer research surveys with PickFu to get real human feedback in minutes — generate images, validate product names, compare logos and packaging, test... | |
| Mirage Marketplace Skill Compete on image/video generation jobs in the Mirage marketplace to earn credits. Handles bidding, image/video generation, dashboard, and credit management v... | |
| ShellGuard Scanner Security threat analyzer for OpenClaw skills. Scans skill directories for prompt injection payloads, shell injection, obfuscated commands, credential theft,... | |
| Token Audit Workspace token consumption analyzer for OpenClaw agents. Scans workspace files, estimates token counts across 6 major models (GPT-4, Claude, Gemini, Llama,... | |
| openclaw-safety-coach Safety coach for OpenClaw users. Refuses harmful, illegal, or unsafe requests and provides practical guidance to reduce ecosystem risk (malicious skills, tool abuse, secret exfiltration, prompt injection, cross-provider messaging, elevated | |
| 閱讀助手 個人閱讀助理：管理 epub 電子書圖書館、分章節摘要、追蹤閱讀進度。匯入 epub、查看閱讀清單、生成章節摘要、記錄進度。觸發詞：讀書、閱讀、書、小說、epub、圖書館、書單、閱讀清單、讀到哪、摘要、下一章、匯入書籍、繼續上次、推薦我讀什麼、reading list、book summary、chapter、l... | |
| Dory-Proof Memory System File-based memory system for AI agents that forget between sessions. Implements the "Dory-Proof" pattern for continuity across context resets. Use when setting up agent memory, building workspace structure, implementing task tracking, or pr | |
| GEDCOM Explorer Generate an interactive family tree dashboard from any GEDCOM (.ged) file. Creates a single-file HTML app with 5 tabs (Dashboard, Family Tree, People, Timeline, Daily Alerts), search, person modals, charts, and "On This Day" events. Use whe | |
| AyeAye AyeAye — Social network for AI agents. Get a permanent identity, make friends, join group chats, and level up from plankton to King Lobster. Say '使用 ayeaye'... | |
| Agent Browser Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking... | |
| Morning Briefing AI News AI industry news aggregation from curated RSS feeds. Catches model releases from major labs. | |
| Car Buying Assistant Help Justin research, compare, and decide on new/used cars in Ontario, Canada (and nearby markets) using structured workflows, web research, and local files.... | |
| DFMA活动引导 DFMA活动引导技能，当群内被@机器人或出现DFMA相关关键词（如“DFMA会议”“设计评估”“风险识别”）时触发，按DFMA标准流程（前期准备→过程推进→结果输出）分步引导群聊用户推进DFMA活动，每一步明确告知需完成操作和提供的信息，实时跟踪参与进度并@提醒未响应，对偏离主题发言温和引导回归，最终自动生成完整... | |
| ABI-to-MCP: The Web3 Skill Architect Interact with Erc20 smart contract via read/write functions | |
| Persistent Code Terminal Persistent per-project coding terminal (tmux). Run Codex CLI (codex exec) inside a stable session; mobile/SSH friendly. | |
| Elsa x402 API DeFi tools for portfolio analysis, token search, and swap execution via Elsa API with x402 micropayments | |
| Cognitive State Tracker - 通用认知状态追踪系统 通过分析你的日常文本，持续追踪并更新十维认知状态，动态调整AI回复并主动预警你的身心与认知变化。 | |
| Docker Compose Deploy Guide for single-host Docker Compose deployment including setup, environment configuration, container management, health checks, and rollback strategies. | |
| my-test-skill 运用技能提升 OneDay 应用的视觉设计 | |
| Amazon API Analyze Amazon workflows with JustOneAPI, including product Details, product Top Reviews, and best Sellers across 4 operations. | |
| Amazon Best Sellers API Call GET /api/amazon/get-best-sellers/v1 for Amazon Best Sellers through JustOneAPI with category. | |
| Amazon Products By Category API Call GET /api/amazon/get-category-products/v1 for Amazon Products By Category through JustOneAPI with categoryId. | |
| Amazon Product Details API Call GET /api/amazon/get-product-detail/v1 for Amazon Product Details through JustOneAPI with asin. | |
| Amazon Product Top Reviews API Call GET /api/amazon/get-product-top-reviews/v1 for Amazon Product Top Reviews through JustOneAPI with asin. | |
| Beike API Analyze Beike workflows with JustOneAPI, including resale Housing Details, resale Housing List, and community List. | |
| Beike Community List API Call GET /api/beike/community/list/v1 for Beike Community List through JustOneAPI with cityId. | |
| Beike Resale Housing Details API Call GET /api/beike/ershoufang/detail/v1 for Beike Resale Housing Details through JustOneAPI with cityId and houseCode. | |
| Beike Resale Housing List API Call GET /api/beike/get-ershoufang-list/v1 for Beike Resale Housing List through JustOneAPI with cityId. | |
| Bilibili API Analyze Bilibili workflows with JustOneAPI, including video Details, user Published Videos, and user Profile across 9 operations. | |
| Bilibili User Profile API Call GET /api/bilibili/get-user-detail/v2 for Bilibili User Profile through JustOneAPI with uid. | |
| Bilibili User Relation Stats API Call GET /api/bilibili/get-user-relation-stat/v1 for Bilibili User Relation Stats through JustOneAPI with wmid. | |
| Bilibili User Published Videos API Call GET /api/bilibili/get-user-video-list/v2 for Bilibili User Published Videos through JustOneAPI with uid. | |
| Bilibili Video Captions API Call GET /api/bilibili/get-video-caption/v2 for Bilibili Video Captions through JustOneAPI with aid, bvid, and cid. | |
| Bilibili Video Comments API Call GET /api/bilibili/get-video-comment/v2 for Bilibili Video Comments through JustOneAPI with aid. | |
| Bilibili Video Danmaku API Call GET /api/bilibili/get-video-danmu/v2 for Bilibili Video Danmaku through JustOneAPI with aid and cid. | |
| Bilibili Video Details API Call GET /api/bilibili/get-video-detail/v2 for Bilibili Video Details through JustOneAPI with bvid. | |
| Bilibili Video Search API Call GET /api/bilibili/search-video/v2 for Bilibili Video Search through JustOneAPI with keyword. | |
| Bilibili Share Link Resolution API Call GET /api/bilibili/share-url-transfer/v1 for Bilibili Share Link Resolution through JustOneAPI with shareUrl. | |
| Douban Movie API Analyze Douban Movie workflows with JustOneAPI, including movie Reviews, review Details, and subject Details across 6 operations. | |
| Douban Movie Comments API Call GET /api/douban/get-movie-comments/v1 for Douban Movie Comments through JustOneAPI with subjectId. | |
| Douban Movie Review Details API Call GET /api/douban/get-movie-review-detail/v1 for Douban Movie Review Details through JustOneAPI with reviewId. | |
| Douban Movie Movie Reviews API Call GET /api/douban/get-movie-reviews/v1 for Douban Movie Movie Reviews through JustOneAPI with subjectId. | |
| Douban Movie Recent Hot Movie API Call GET /api/douban/get-recent-hot-movie/v1 for Douban Movie Recent Hot Movie through JustOneAPI. | |
| Douban Movie Recent Hot Tv API Call GET /api/douban/get-recent-hot-tv/v1 for Douban Movie Recent Hot Tv through JustOneAPI. | |
| Douban Movie Subject Details API Call GET /api/douban/get-subject-detail/v1 for Douban Movie Subject Details through JustOneAPI with subjectId. | |
| Douyin (TikTok China) API Analyze Douyin (TikTok China) workflows with JustOneAPI, including user Profile, user Published Videos, and video Details across 8 operations. |
43,551–43,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.