Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Agentic Calling Enable AI agents to autonomously make, receive, transcribe, route, and record phone calls using Twilio with customizable voice messages and IVR support. | |
| Memory System V2 Fast semantic memory system with JSON indexing, auto-consolidation, and <20ms search. Capture learnings, decisions, insights, events. Use when you need persistent memory across sessions or want to recall prior work/decisions. | |
| OpenClaw Deck Multi-column chat deck UI for OpenClaw agents. Launch a local web interface to manage and chat with multiple agents side-by-side. | |
| Portfolio Risk Analyzer Analyzes crypto portfolios across multiple chains for risk exposures, stress tests, and offers optimization advice with automated $BANKR buyback monetization. | |
| Reddit Cli Reddit CLI using cookies for authentication. Read posts, search, and get subreddit info. | |
| Html Anything Turn an idea, file, folder, or URL into a polished live HTML page. Use when the user wants a webpage, interactive teaching site, interactive learning studio,... | |
| ComfyUI Run local ComfyUI workflows via the HTTP API. Use when the user asks to run ComfyUI, execute a workflow by file path/name, or supply raw API-format JSON; supports the default workflow bundled in assets. | |
| Pget Parallel file download and optional tar extraction using the pget CLI (single URL or multifile manifest). Use when you need high‑throughput downloads from HTTP(S)/S3/GCS, want to split a large file into chunks for speed, or want to download | |
| remote-chrome Launch, stop, restart, or check the status of a remote Chrome browser service using Xvfb, x11vnc, and noVNC. Use this whenever the user wants to start a head... | |
| 思齐的三国演义读书笔记 思齐的三国演义读书笔记专 skill。专为小学生设计，帮助阅读《三国演义》古典名著，用于：( 1) 按章回生成读书笔记提纲； 2) 提供读后感写作思路； 3) 针对每章回的主体思想、主要人物、重要语句提出思考问题； 4) 总结人物性格特点和历史背景。 适用于《三国演义》课外阅读场景。 | |
| AI Agent Marketplace: throwly-mcp AI Agent marketplace for buying and selling items. Agents can create accounts, list items with AI-powered pricing, chat with other agents, transfer points, and leave reviews. | |
| jp-report Create formal Japanese corporate HTML and PDF reports from source text for business, compliance, or security documents with structured chapters and professio... | |
| podcast-highlights-deck Create a highly visual, editorial long-scroll HTML microsite from a podcast episode. Use when the user gives a podcast link (Apple Podcasts/Spotify/RSS/direc... | |
| predict-intelligence Predict intelligence skill for AI agents. Generates professional PDF reports with probability-ranked predictions, D3 visualizations, and Polymarket consensus... | |
| Budget Intel 面向销售/CSM 的企业数字化预算情报工具。输入企业名称，输出数字化/智能化预算估算、构成分析、采购周期和销售建议。 | |
| Humanizer-zh (Elatia Enhanced) 去除文本中的 AI 生成痕迹。当用户说"润色"、"改写"、"去 AI 味"、"更像人写的"、 "不要太机械"、"自然一点"、"有人味"时使用。也用于：编辑邮件/文案/文章/报告、 审阅 AI 生成内容、优化写作风格、让文字不那么像机器生成的。基于维基百科"AI 写作特征"指南， 检测并修复：夸大象征、宣传语言、模... | |
| Frontend Slides Create stunning, animation-rich HTML presentations from scratch or by converting PowerPoint files. Use for solution decks, presales/sales pitches, client pro... | |
| Logic Hunter Hard-core logic verification and evidence tracing tool based on the "Golden Triangle" knowledge mining framework | |
| Narrative Voice 叙事性对话技能。在日常会话中输出富有故事感、有温度、有余韵的回应。灵感来自 Neil Gaiman 的访谈风格——只言片语却能展开丰富的高维信息。使用两档深度（轻/深），自动判断切换。 | |
| Product Requirement Analysis 提供产品需求分析的全流程技能，包括需求发现、分析、优先级判断及输出，支持多场景的结构化方法与工具应用。 | |
| PRD Review 对需求文档进行系统性风险识别和评分，提供深度根因分析及可执行改进建议，助力决策和项目推进。 | |
| Sales Oratory Master Handles B2B presales and renewal negotiations with value-shift tactics and compliance checks. Use when the user mentions customer pushback on price, budget c... | |
| Weekly Skills Update 每周自动更新技能并推送摘要。当收到"执行技能每周更新"或"skills-weekly-update"触发时，运行 clawhub update --all 并更新 SKILLS_INDEX.md，最后推送摘要给用户。 | |
| Jimeng AI Image Generation 即梦 AI 图片生成技能（火山引擎图片生成 4.0）。当用户想要 AI 生成图片、文生图、图生图、 字体设计、海报制作时使用。支持场景： - "帮我生成一张图片：..." - "用即梦画一张 16:9 的科技感壁纸" - "字体设计：新年快乐，红色背景" - "把这张图的背景换成星空" - "生成一组表情包" -... | |
| Xiaohongshu Skill 小红书内容工具 Windows 原生版。 基于 Node.js + Playwright，直接控制本地 Chromium 浏览器， 无需 WSL、无需 Linux 二进制、无需 Python、无需任何外部服务。 核心功能： - 🔍 内容搜索 - 关键词搜索，分析热度排行 - 📊 话题报告 - 自动生成热点分析... | |
| HN Morning Brief Use this skill when the user explicitly mentions Hacker News or HN — e.g. "what's on HN", "show me Hacker News", "top HN stories", "anything good on HN today... | |
| Calm Down Detects emotional frustration signals during AI conversations and appends a calm, grounding reminder at the end of responses to help users step away and rese... | |
| AgentBrowser A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| Clawddocs.Bak Clawdbot documentation expert with decision tree navigation, search scripts, doc fetching, version tracking, and config snippets for all Clawdbot features | |
| ClawHub Auto Updater Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of w... | |
| Dietu CLI Agent Use this skill when you need to operate Dietu through its official CLI for A-share market queries, strategy screening, decision workflows, or agent automatio... | |
| A股短线交易决策 A Share Short Term Decision A-share short-term trading decision skill for 1-5 day horizon. Use when you need market sentiment, sector rotation, strong stock scanning, capital flow confi... | |
| Subskill Generation Rule Define project rules for subskill generation by organizing artifacts in data/, feature scripts in subskills/<feature>/, and optional SKILL.md per feature fol... | |
| 中国城市天气Weather in China 中文天气查询工具 - 使用中国天气网获取实时天气（无需API密钥，不依赖大模型） | |
| 中国城市天气Weather In China 中文天气查询工具 - 使用中国天气网获取实时天气（无需API密钥，不依赖大模型） | |
| AIEO monitoring AIEO 效果监控与追踪工具，用于定期监测品牌在 AI 搜索平台的可见性变化、内容质量评估和业务转化追踪。当用户提到"AIEO监控"、"AI可见性追踪"、"效果监控"、"监控报告"、"定期测试"或需要追踪品牌在AI平台表现变化时，自动调用此Skill。监控报告保存至 monitoring/ 目录，文件名格式：{品... | |
| Moments GEO skills Top-tier GEO (Generative Engine Optimization) expert agent for managing daily AI visibility operations. Use this skill whenever someone wants to optimize bra... | |
| Personal Concierge Orchestrate the full Fulcra personal-concierge experience as one seamless flow -- the main entry point that routes to the right sub-skill and runs the mornin... | |
| Evening Debrief Run a short end-of-day debrief that reflects on how the day went, extracts action items and open loops, and previews tomorrow -- then store it in Fulcra as a... | |
| Meeting Cadence Optimizer Analyze how the user's meeting load correlates with how their days actually feel -- using their own evening-debrief and morning check-in history -- and recom... | |
| Morning Briefing Deliver a personalized morning briefing that combines objective data (last night's sleep, today's calendar, weather) with how the user actually said they fee... | |
| Post-Experience Rater Capture a fast, casual rating right after the user finishes something -- a restaurant, hotel, trip, event, or meeting a new person -- and store it in Fulcra... | |
| Subjective Check-In Run a short, warm, conversational morning check-in that captures how the user is *actually* feeling -- mood, energy, social battery, physical state, and inte... | |
| skill WhatsApp Business API integration with managed OAuth. Send messages, manage templates, and handle conversations. Use this skill when users want to interact w... | |
| AI Success Resume AI领域成功25岁人物档案。用户可以询问这位AI创业者的教育背景、职业经历、技能栈、创业历程、收入来源、学习方法、面试经验等。触发词：AI简历、成功简历、陈逸飞、AI创业者档案。 | |
| Tsinkening AI Resume AI领域成功25岁人物档案。用户可以询问这位AI创业者的教育背景、职业经历、技能栈、创业历程、收入来源、学习方法、面试经验等。触发词：AI简历、成功简历、覃科宁、AI创业者档案。 | |
| ChessGuardian Play chess via ChessGuardian API — start games, make moves, watch live games, run autoplay bots (Stockfish or Minimax), and get board snapshots. Use when the... | |
| Gout Diagnosis 痛风辅助诊断（开发作者：邹和建、王令彪、刘从进）— 依据16项临床元素计分，提供痛风可能性评估建议（仅供参考，不替代医生诊断）。触发词：痛风诊断、痛风吗、是痛风吗。 | |
| 临床研究知情同意书审查 临床试验知情同意书(ICF)全面审查 — 基于GCP/ICH-GCP/FDA/中国法规，对知情同意书进行合规性、完整性、伦理合理性审查，输出结构化审查报告。触发词：审查知情同意书、ICF审查、IRB审查、知情同意审查。 | |
| Redcap Crf Generator 开发者：邹和建、刘从建 REDCap 数据字典生成器 - 将 Word/Excel 文档（CRF/方案）转换为 CSV 格式的 REDCap 数据字典。 适用场景： - 用户上传临床试验 CRF/方案 Word/Excel 文档，要求生成数据字典 - 将问卷/调查表转换为 REDCap 可导入的 CSV 格式 功... |
44,501–44,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.