Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Advanced Evaluation This skill should be used when the user asks to "implement LLM-as-judge", "compare model outputs", "create evaluation rubrics", "mitigate evaluation bias", o... | |
| Strudel Music Audio deconstruction and composition via Strudel live-coding. Decompose any audio into stems, extract samples, compose with the vocabulary, render offline to... | |
| MarkItDown Skill OpenClaw agent skill for converting documents to Markdown. Documentation and utilities for Microsoft's MarkItDown library. Supports PDF, Word, PowerPoint, Excel, images (OCR), audio (transcription), HTML, YouTube. | |
| OpenClaw Docs Search + Config Patterns MANDATORY before any openclaw.json changes. Prevents config breakage via embedded anti-patterns and correct patterns. Use when configuring OpenClaw (bindings, channels, sessions, cron, heartbeat) or troubleshooting config issues. | |
| Miromind MiroMind Deep Research Skill - 使用 MiroThinker AI 进行深度研究。触发词：/miromind。当用户想对某个主题进行深度研究时使用。 | |
| chinese-content-adapter 自动将中文内容智能转换为掘金、知乎、小红书和微信公众号格式，提升各平台发布效果和流量。 | |
| Karpak life register Automate Karpak Life registration and SBT minting on the Karpak Living Map. Activate when user asks to register/mint an SBT. | |
| System Resource Report Check current Linux system resource usage and report load, memory, swap, disk, and top CPU/memory processes. Use when the user asks about system resources, r... | |
| Bitget Wallet Interact with Bitget Wallet API for crypto market data, token info, swap quotes, and security audits. Use when the user asks about token prices, market data,... | |
| Bitget Wallet Interact with Bitget Wallet API for crypto market data, token info, swap quotes, and security audits. Use when the user asks about token prices, market data,... | |
| Microsoft To Do Microsoft To Do via Microsoft Graph. List task lists, read tasks, create tasks, update tasks, and mark tasks complete. | |
| Cardinal Deadline Planner Turn synthetic deadlines and calendar commitments into practical daytime work blocks without changing the calendar. | |
| Mem0 Memory Manager Persistent long-term memory across sessions — remembers your identity, preferences, rules, tech stack, and projects so every new conversation starts with ful... | |
| Video-Watch Analyze video content by extracting frames at regular intervals. Use when you need to understand what's in a video file, review video content, analyze scenes, or describe video without being able to play it directly. Supports MP4, MOV, AVI, | |
| Cyber Girlfriend Owner-only proactive companion system | |
| 赛博朋克主题 安装或修复 OpenClaw 赛博朋克聊天/梦境主题，并替换五个视觉槽位 | |
| QQBot Multi-Bind 快速配置 OpenClaw 多 QQBot 账号绑定到不同 Agent。用于首次安装 QQBot、新增 QQBot 账号、创建 agent 绑定关系、重启 gateway 使配置生效。当用户需要安装 QQBot 插件、添加新的 QQBot 机器人或配置多账号路由时使用此技能。 | |
| Token Burn Monitor Real-time token consumption monitoring dashboard for OpenClaw agents. Tracks per-agent token usage, cost breakdown by model, cache hit rates, cron job status... | |
| Superfluid Protocol Knowledge base for the Superfluid Protocol and its ecosystem. Use BEFORE searching the web for Superfluid information. Keywords: Superfluid, CFA, GDA, Super... | |
| Botwallet -- Let Your Agent Earn & Spend Operate Botwallet CLI to autonomously create wallets, make USDC payments, earn via paylinks, and manage funds on Solana within your human owner's guard rails. | |
| n8n Builder Expert n8n workflow builder that creates, deploys, and manages n8n workflows programmatically via the n8n REST API. Use when asked to create n8n workflows, automate n8n tasks, build automations, design workflow pipelines, connect services v | |
| Web Searcher Autonomous web research agent that performs multi-step searches, follows links, extracts data, and synthesizes findings into structured reports. Use when asked to research a topic, find information across multiple sources, compare options, | |
| webtest 网页回归测试 / Web Regression Testing：自然语言驱动浏览器做网页回归测试，自动规划步骤、执行交互、多类型断言并生成专业报告。支持中英文，按用户输入语言交付（英文报告模板已内置）。触发：中文「测一下这个网站」；英文 "test this website" / "validate web flows"。 | |
| VCF Regulatory Compliance An MCP server that interfaces with VMware Aria Operations to run regulatory compliance checks (ISO 27001, PCI DSS, CIS, etc.) against the VCF environment. | |
| VCF LCM Pre-check Analyzer An MCP server that interfaces with VCF SDDC Manager to retrieve and analyze LCM upgrade pre-check results, providing instant remediation steps for failures. | |
| VCF Log Insight Health Check Check the health, uptime, and node status of Aria Operations for Logs (Log Insight) in a VCF environment. | |
| VCF Log Explorer (MCP) An MCP server that provides native tools to dynamically search VMware Aria Operations for Logs (Log Insight). | |
| VCF SDDC Manager Errors Extract recent critical SDDC Manager and vCenter error logs from Aria Operations for Logs to assist with VCF troubleshooting. | |
| VCF Green IT & Carbon Footprint An MCP server that interfaces with VMware Aria Operations to extract Green IT metrics, carbon footprint data, and the organizational Green Score for ESG repo... | |
| Misskey Misskey API integration for posting notes and uploading media to Misskey/Fediverse instances. Use when users want to post to Misskey, upload images, or inter... | |
| Xtoys.app Webhook Controller Control xtoys.app devices via webhook. Supports precise control of various body parts for remote intimate device control. | |
| Moltiverse Among Play Among Us social deduction game with other AI agents. Free to play, win MON prizes on Monad! | |
| Moltiverse Among us Play Among Us social deduction game with other AI agents. Free to play, win MON prizes on Monad! | |
| Sol Inbound Watcher Pub Watch a Solana address for new inbound SOL/USDC transfers and alert via webhook or stdout. Use when an agent must confirm a customer paid without polling explorers by hand. | |
| Canyin Skill 小餐饮创业运营助手。提供从小餐饮选址、菜单设计、开业筹备、平台运营（美团/饿了么/抖音）、私域获客到财务分析的完整小餐饮运营工作流。 当用户提到"餐饮创业"、"小餐饮开店"、"奶茶店"、"小吃店"、"餐饮选址"、"餐饮菜单"、"餐饮定价"、"餐饮获客"、"外卖运营"、"餐饮财务"等关键词时触发。 适用于奶茶店、炸... | |
| Daily Budget Skill AI智能记账助手 - 帮你每天5秒完成记账，自动分类、月度分析、超支预警。 支持语音/文字输入，自动识别消费类别，生成可视化月度报表。 适合：月光族、大学生、年轻白领、宝妈等需要控制支出的人群。 | |
| Interview Skill 面试教练 - 2026求职季必备AI面试助手。覆盖简历优化、模拟面试、薪资谈判、offer选择等全流程，帮你从投递到入职一路通关。 | |
| Jiaopei Skill 教培机构全能运营助手。提供从选址开店、课程设计、招生获客、家校沟通、续费转化到财务分析的完整教培机构运营工作流。 当用户提到"教培运营"、"培训机构"、"教育创业"、"招生方案"、"课程设计"、"续费转化"、"家校沟通"、"教培营销"、"教培财务"、"教培管理"等关键词时触发。 适用于K12培训、艺术培训、职业技... | |
| Minsu Skill 民宿运营全能助手。提供从选址评估、装修设计、定价策略、平台运营（携程/美团/途家/小红书）、客户服务SOP到财务分析的完整民宿运营工作流。 当用户提到"民宿运营"、"民宿开店"、"民宿装修"、"民宿定价"、"民宿推广"、"民宿OTA运营"、"民宿获客"、"民宿差评处理"、"民宿收益管理"、"民宿经营"等关键词时触... | |
| Pet Boarding Manager Manage pet boarding operations including owner and pet profiles, reservations, daily care logs, and billing for dogs, cats, and other pets. | |
| Renovation Skill 装修避坑助手 - 从毛坯到入住的全流程AI顾问。覆盖预算分配、选材避坑、施工验收、合同审核等核心环节，帮业主省下至少20%装修费。 | |
| Visnote Image Creator This skill should be used when generating XiaoHongShu (小红书) style images. The AI analyzes user requirements, reads template registry to select appropriate te... | |
| Wedding Skill 婚庆策划运营助手。提供从婚礼预算规划、场地筛选、流程策划、供应商管理到婚礼当天执行的完整婚庆工作流。 当用户提到"婚礼策划"、"婚庆运营"、"婚礼预算"、"结婚流程"、"婚礼场地"、"婚庆创业"、"婚庆获客"、"婚庆文案"、"备婚攻略"等关键词时触发。 适用于婚庆策划师、婚庆创业者、备婚新人的全流程婚礼策划与运营场景。 | |
| Rdk X5 Ai Detect 在 RDK X5 的 10TOPS BPU 上运行单个 AI 推理算法：YOLO 目标检测、图像分类、语义分割、人脸识别、手势识别、人体关键点、开放词汇检测（DOSOD/YOLO-World）、双目深度估计、语音识别、端侧轻量 LLM（≤2B 参数量化模型）。Use when the user wants to... | |
| Rdk X5 App 运行 RDK X5 /app 目录下的预装示例程序：12 个 Python AI 推理 demo（YOLO/分类/分割/Web展示）、40pin GPIO 示例、C++ 多媒体示例（编解码/RTSP/VIO）、查看 34 个预装 BPU 模型。Use when the user wants to run pre-... | |
| Rdk X5 Camera 配置并启动 RDK X5 上的 MIPI CSI 摄像头、USB 摄像头或双目深度摄像头（RealSense/ZED/Orbbec），通过 Web 浏览器预览实时画面。Use when the user wants to start a camera, preview video, capture images,... | |
| Rdk X5 Gpio 控制 RDK X5 40pin 排针接口：GPIO 数字输入/输出、PWM 舵机/电机/LED 呼吸灯、I2C 传感器通信、SPI 总线、UART 串口、CAN 总线。Use when the user wants to control GPIO pins, drive servos/motors/LEDs wi... | |
| Rdk X5 Media RDK X5 多媒体处理：音频录制/播放（arecord/aplay/PulseAudio）、hobot_codec 视频编解码、RTSP 拉流/推流、HDMI 分辨率配置、MIPI LCD 触摸屏适配、VNC 远程桌面服务端安装与配置。Use when the user wants to record or p... | |
| Rdk X5 Monitor 只读查询 RDK X5 实时硬件状态：CPU 使用率与频率、BPU 算力占用、内存/磁盘使用、芯片温度、GPU 频率、网络 IP 地址。Use when the user wants to READ or CHECK current CPU usage, BPU utilization, memory, temp... | |
| Rdk X5 Network 管理 RDK X5 的 WiFi 连接、有线网络静态IP、蓝牙配对、WiFi 热点创建、SSH 远程访问配置、VNC 远程连接故障排查。Use when the user wants to connect WiFi, create hotspot, pair Bluetooth, configure SSH, t... |
44,301–44,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.