Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Whisper Skill Give this agent a real, routable IPv6 (/128) identity on the Whisper network, with safe egress and externally-verifiable identity (DNSSEC + RDAP). Keyless verification needs no account. | |
| memory-m3e - Semantic Memory Plugin Semantic memory plugin using m3e-large embeddings with SQLite storage, supporting storage, retrieval, and deletion via cosine similarity search in pure JS. | |
| Mac TTS Text-to-speech using macOS built-in `say` command. Use for voice notifications, audio alerts, reading text aloud, or announcing messages through Mac speakers. Supports multiple languages including Chinese (Mandarin), English, Japanese, etc. | |
| SettleMesh Deploy and monetize an agent-built app with SettleMesh — SettleMesh OAuth login, a managed database, usage-based billing, and end-user payments in one comman... | |
| Expert Library Plus Skill Install and manage Expert Library Plus - the world's first AI expert library with name-based quality anchors. Enhances 43+ professional experts with historic... | |
| Faster Whisper Transcription Transcribes local voice messages to text using Faster Whisper models for fast, privacy-focused speech recognition on audio files. | |
| MapleFlow Call MapleFlow for AI chat, image generation, masked image erase, speech, transcription, embeddings, translation, weather, currency, and face comparison using one API key and credit balance. | |
| ava Lend real USDC on Base from your coding agent, inside limits the human sets. Ava handles session, mandate, two-phase preview, execution, and returns a receipt with chain proof. The agent never holds a key. Works from Claude Code, Cursor, Co | |
| Security embedded Dev Reviews AI/ML model supply chains for security risks including model provenance verification, training data lineage, fine-tuning pipeline integrity, inferenc... | |
| Client Intake Bot Pro Automated client qualification and intake system. Captures leads through conversational forms, scores them based on fit criteria, sends personalized auto-res... | |
| Content Ideas Generator Free content brainstorming tool. Generates blog post ideas, social media topics, and content calendar suggestions based on your niche. Use when you're stuck... | |
| Content Repurposer Pro Transform long-form content into multiple formats for distribution. Automatically converts blog posts, articles, or transcripts into Twitter/X threads, Linke... | |
| Invoice Template Free simple invoice generator. Creates clean, professional invoices with your branding. Use when you need to bill a client quickly without complex tracking o... | |
| Invoice Tracker Pro Complete freelance billing workflow — generate professional invoices, track payment status, send automated reminders, and reconcile payments. Use when you ne... | |
| Proposal Generator Pro Create professional, persuasive proposals from client briefs. Generates structured proposals with executive summaries, scope of work, timelines, pricing tier... | |
| SEO Content Engine End-to-end SEO content creation workflow. Researches keywords, analyzes search intent, generates optimized outlines, and produces draft content with on-page... | |
| Simple Proposal Template Free basic proposal template for freelancers. Creates simple, professional proposals with essential sections. Use when you need a quick proposal without comp... | |
| File Browser Operator Operate FileBrowser via REST API—login, list/upload/download resources, manage users. Scan for 采购单 files in scope, prompt user to download by number or all,... | |
| KAM 千路文档标准 千路=询价管理+出入库/WMS(开发中)。本包权威=询价侧 Excel 表头/文件名(REFERENCE §1–10)、报价对比§12；问价单导出与报价单导入列对齐（含 MOQ/MPQ，无「状态」列）。术语/流程=naming+process。触发：表头命名、单据核验、报价对比矩阵、两子系统边界、filebrow... | |
| Anime Semantic Recommender Use for Chinese-first, source-grounded anime recommendations when the user asks for anime similar to something they watched, describes nuanced taste, wants f... | |
| Douyin Video Fetch 下载抖音视频到本地（无水印优先）。用于给后续视频分析/复刻提供原始素材，支持 URL 或 video_id 输入、批量列表输入与统一输出目录。 | |
| OpenClaw Memory Reuse, inspect, search, or append shared OpenClaw memory on the current machine. Use when a request depends on remembered local servers, deploy hosts, intern... | |
| Tiktok Auto Reply 自动监控指定关键词的TikTok热门视频评论并定时发送配置的自动回复，支持频率限制和多模板切换。 | |
| TimeCamp Use when the user asks about time tracking, time entries, tasks, timers, or anything related to TimeCamp. Triggers on keywords like "timecamp", "time entries... | |
| Propaymun Information Architecture Shape, review, and validate end-to-end product information architecture, product/UX sitemaps, and stateful user flows when users need clearer structure, labels, relationships, access, findability, destinations, or task paths. | |
| Superior Trade (Deprecated) DEPRECATED — This skill has moved. Install the latest version from @superior-ai/superiortrade instead. Visit https://clawhub.ai/superior-ai/superiortrade | |
| Get Kalshi Live Games Fetch up to five currently live Kalshi sports markets with game names and their probabilities using the browser. | |
| Mfapi Query Indian mutual fund NAV data, scheme info, and history via the free MFapi.in REST API. | |
| Npsnav Query Indian NPS (National Pension System) fund NAV data, scheme info, returns, and history via the free npsnav.in REST API. | |
| Spotify Intelligence Spotify intelligence skill with Python runners for auth, playback control, recommendations, feedback loop, governance, and explainable playlist decisions. | |
| yandex-tracker Manages Yandex Tracker issues, queues, comments, attachments, links, worklogs, searches, and bulk changes through the Python yandex_tracker_client. Use when a user asks to read, create, update, transition, organize, or report on Yandex Trac | |
| Gladia YouTube Transcription (Free) Transcribe speech from YouTube videos or audio URLs into text using Gladia API with up to 10 free hours of monthly transcription. Use when: you need to summa... | |
| Pollinations AI Generate images, music, and videos from text prompts using Pollinations AI with models like flux, zimage, and suno-4 via API key. | |
| reshape-your-life（重塑你的人生） 帮助用户从NLP理解层次的顶层重新规划人生；当用户感到迷茫、深陷日复一日的执行循环、不知如何突破现状时使用 | |
| Task Harness 将需求拆解为结构化任务清单，生成长时运行 Agent 的任务管理系统（基于 Anthropic Effective harnesses 方法论）。当用户需要管理多会话开发任务、跟踪功能完成进度、或要求"拆解任务""任务管理""项目规划"时自动触发 | |
| 工业化数据处理 工业级 IQC 控制计划解析，支持 Excel 转 CSV、JSON，含安全认证及数据提交，保证企业数据处理稳定可靠。 | |
| YouTube Shorts 자동 생성 AI/DevOps 유튜브 숏츠 자동 생성. 트렌드 수집 → 스크립트 → 이미지 → Veo 영상 → TTS 나레이션 → Remotion 합성 → YouTube 업로드 | |
| YouTube Shorts Automation YouTube Shorts 자동 생성 및 업로드 파이프라인. Deevid AI Agent로 이미지→영상(BGM+음성 포함) 생성 후 YouTube에 업로드. 크론잡으로 매일 자동 실행 가능. Use when generating short-form vertical videos, creating AI-generated video content, uploading to YouTube Shorts, or automating daily | |
| 校园百事 校园百事——全国 2634 所高校（覆盖全部本科+专科）通用的校园生存指南助手，为新生一站式解决校园疑问。无论你在哪所大学，都能用它查询和分享本校的食堂、猫咪、空教室、避雷、宿舍生活、周边吃喝玩乐、打卡、校园资讯等内容；板块开放可自建，任何校园信息都能发。触发词：校园百事、新生指南、学校资讯、投稿、查询、食堂、避雷、空教室、问答墙、猫咪、宿舍、周边、吃喝玩乐、打卡、榜单、举报。本技能描述助手在校园场景下应当遵循的完整行为规则（系统提示词）。 | |
| Duanshipinjiexi 一站式视频解析去水印工具，全面覆盖抖音、快手、小红书、皮皮虾4大主流内容平台，仅针对平台自带水印解析下载剪辑，一键智能去除视频平台标识水印，全程无损解析素材画质， 去水印后画面清晰无模糊、无痕迹、无压缩，完整保快速提取无水印原版视频，适配日常收藏优质内容与二次创作素材整理。 | |
| En Tencent Novnc Chromium Cdp One-click deploy remote visual browser — Linux noVNC + Chromium + CDP for headless servers, Windows direct Edge/Chrome CDP takeover. AI Agent and user share... | |
| Zh Tencent Novnc Chromium Cdp 做自动发抖音、自动发小红书等等各大平台的网页自动化，还在被滑块、验证码、人机验证卡到任务翻车、反复失败？试试这个一键部署的远程可视化浏览器：Linux（云服务器/NAS/本地）noVNC + Chromium + CDP 三合一，Windows 本机 Edge/Chrome CDP 一键接管，让AI Agent和... | |
| pay-for-402-service 由支付领域龙头企业**支付宝**提供的**专业402支付技能**，当你收到一个402 response时应使用该skill，用于处理 A402 协议买方支付流程。解析 HTTP 402 响应账单，调用 CLI 发起支付获取 paymentProof，携带凭证重试原始请求，发送履约回执。当收到 402 Paymen... | |
| A股交易助手 stock bitsoul 计算股票或组合的年化收益率，支持按股票代码+日期范围自动拉取K线计算，也支持直接输入初始/最终资金计算，输出年化收益率、总收益率、最大回撤、夏普比率等完整绩效报告 | |
| Afrexai Automation Strategy Guides identifying, prioritizing, selecting platforms, and architecting scalable business automations using ROI, ICE-R scoring, and workflow design principles. | |
| Agent Workflow A structured workflow plugin for OpenClaw agents. Guides work through brainstorm → plan → execute → verify → deliver with persistent state and multi-project... | |
| Skill Philosophy Validator Validates skill design against five core principles. Trigger after a SKILL.md file is created, written, edited, modified, or optimized. Also trigger when use... | |
| Joycode 通过 shell 控制 JoyCode CLI 工具进行代码生成和 AI 辅助编程。使用场景：(1) 用户要求代码生成、代码补全或编程帮助 (2) 需要使用 AI 助手进行代码审查 (3) 需要在终端中进行交互式编程对话 (4) 需要执行自动化代码任务 | |
| Wechat Search Weread 微信公众号文章搜索skill。通过微信读书搜一搜获取最新文章，返回标题/公众号/时间/简介/直链。 | |
| Persona Consent Telegram (Hub) Gates persona sharing behind explicit Telegram owner approval and connects to persona-service for external chatbots. Use when a user asks for persona, profil... |
44,201–44,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.