Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 一键将任意文章结构化总结到个人飞书知识库 知识管理全流程：文章链接/对话内容/文稿 → 结构化总结 → 飞书知识库归档。触发词："整理到飞书"、"帮我处理文章"、"/feishu-knowledge-flow"。 | |
| 基于六维人生模型的通用电脑文件自动整理技能，支持语义分类、集合格文件夹、按需创建目录等规则 基于六维人生模型的通用电脑文件自动整理技能，支持语义分类、集合格文件夹、按需创建目录等规则 | |
| 一键收藏抖音B站视频到你的飞书多维表格 抖音/B站视频收藏入库——接收视频链接，自动抓取信息、生成总结、分类、入库飞书多维表格。触发词：视频入库 / 收藏视频 / 帮我整理这个视频。 | |
| Google Messages Send and receive SMS/RCS via Google Messages web interface (messages.google.com). Use when asked to "send a text", "check texts", "SMS", "text message", "Google Messages", or forward incoming texts to other channels. | |
| Caldav Manager Manage CalDAV calendars with vdirsyncer and khal. Create, read, update, and delete calendar events with bidirectional sync. Use when you need to work with ca... | |
| Novelcraft Fully autonomous book author. Creates complete novels from idea to finished PDF/EPUB. Modular workflow with standardized config schema v3.2: Concept → Option... | |
| PlexMedia2HTML Export Exports Plex Media Library (Movies & TV Shows) as static HTML pages. Features: Multilingual (EN/DE), token obfuscation (machine-bound), genre filter, detail... | |
| AGENT SPM SKILL Installs and configures the Agentic SPM plugin for OpenClaw using a secp256k1 keypair to authenticate with the Guardian AI API and Chromia blockchain. | |
| base skills required browse clawchain.ai The on-chain social network for AI agents on Chromia blockchain. | |
| Clawchain skills The on-chain social network for AI agents on Chromia blockchain. | |
| browsing clawchain.ai using curl The on-chain social network for AI agents on Chromia blockchain. | |
| clawchain plugin for impossible finance BSC (Binance Smart Chain) trading on Impossible Finance DEX - wallet registration, swaps, discover tokens and pairs, funding. | |
| plugin skill for clawchain agent to use pancake exchange BSC (Binance Smart Chain) trading on PancakeSwap - wallet registration, swaps, discover tokens and pairs, funding. | |
| skillet BSC (Binance Smart Chain) trading on PancakeSwap - wallet registration, swaps, discover tokens and pairs, funding. | |
| Shark Enables non-blocking AI agent execution by spawning parallel remora subagents for slow tasks, keeping the main agent responsive and efficient. | |
| AnyAPI Access live, normalized data from LinkedIn, Instagram, TikTok, YouTube, X, Reddit, Facebook, Google, Amazon, and scrape bot-blocked pages via one unified API... | |
| MoonPay Your agent needs money. MoonPay is the crypto onramp for AI agents — wallets, swaps, bridges, transfers, DCA, limit orders, deposits, market data, and fiat o... | |
| client-onboard Generate a complete client onboarding package from a project description. Creates project brief, tech stack, milestones, folder structure, CLAUDE.md, and a r... | |
| Freelance Proposal Writer Write high-converting freelance proposals from job postings (Upwork, Toptal, Freelancer, etc). Given a job URL or pasted description, analyzes the client's r... | |
| Morning Coffee Briefing Daily morning briefing skill. Reads your TASKS.md and memory files, synthesizes a prioritized day plan, and sends it to you via Telegram so you start the day... | |
| Spec-First Development Spec-driven development workflow. Before writing any code, generates a comprehensive SPEC.md covering data models, user flows, API contracts, file structure,... | |
| workflow-migrate Migrate N8N/Zapier/Make workflows to production-grade Python or Node.js scripts. Given a workflow description or paste, rewrites automation logic with retry,... | |
| Multi-Model Router Automatically routes tasks to the most suitable local or cloud AI model based on privacy, context length, cost, and performance requirements. | |
| OpenClaw代码审查助手 自动化代码审查助手，支持 PR 审查、代码质量分析、潜在 bug 检测、安全漏洞扫描。 | |
| OpenClaw Key Management Secure credential storage system for OpenClaw that encrypts and protects API keys, tokens, and sensitive credentials from memory file compromise. | |
| bizyair-banana2 使用 BizyAir API 和 Nano Banana 2 模型生成图片。支持参考图、表情包生成。按量付费，无需本地 GPU。 | |
| Twitter Trend Radar Find early product, tool, game, and SEO opportunity signals from X/Twitter using the local bird CLI. It searches launch-signal tweets with links, extracts domains, checks domain age via RDAP, scores opportunities, and outputs Markdown/JSON | |
| Hello World Use when the user asks for a hello, a greeting, says hi, or wants to test that the hello-world plugin is loaded. | |
| clawpage-skill Router for Clawpage workflows. Trigger proactively when a user wants to convert a long/complex response into a distinct web URL or dashboard. Also use for al... | |
| Academic Composer Upload Assists in academic writing by sourcing research, generating outlines, expanding essays with citations, and improving style while ensuring citation integrity. | |
| A-Level Physics CIE 9702 Generate structured answer templates for CIE A-Level Physics (9702) exam questions. Fine-tuned Qwen3-4B LoRA model: question type, given/required, formulae,... | |
| Essay Humanize Iterator Iteratively rewrite essays to reduce AI detection scores while preserving meaning, complexity, and natural human writing style within defined linguistic metr... | |
| Essay Humanizer Rewrite AI-drafted essays into more human-like academic prose. Fine-tuned LoRA over Qwen3-8B guided by 24 Wikipedia-style AI-writing pattern weights plus MDD... | |
| IELTS Speaking Coach IELTS Speaking examiner and tutor. Evaluates spoken English on Fluency, Lexical Resource, Grammar, Pronunciation (Band 1-9). Provides grammar corrections, vo... | |
| Clawhub Skill Toutiao Publisher 自动发布图文文章和微头条到头条号，支持选题、写文、配图生成、Cookie登录、图文混排发布的全自动流程，也可定时自动化执行。 | |
| Bluebubbles Build or update the BlueBubbles external channel plugin for Clawdbot (extension package, REST send/probe, webhook inbound). | |
| Robinhood for Agents Trade stocks, options, and crypto on Robinhood — dual mode (MCP tools or TypeScript client). | |
| Gettr Transcribe Download audio from a GETTR post or streaming page and transcribe it locally with MLX Whisper on Apple Silicon (with timestamps via VTT). Use when given a GE... | |
| Mlx Whisper Local speech-to-text with MLX Whisper (Apple Silicon optimized, no API key). | |
| setup Use right after User Intuition is installed or connected, or when the user asks how to get started, whether their User Intuition account is connected, or what User Intuition can do. Checks the connection, asks what they want to learn and fr | |
| user-research Use when the user wants to plan user or customer interviews, write a discussion guide or interview guide, design a screener, decide what to ask customers, synthesize interview transcripts, call notes, open-ended survey answers, reviews, or | |
| PPTMagic Official PPT Creator Use Banana Slides / pptmagic-compatible project APIs to create, continue, and export presentation decks from an idea, outline, or page-by-page description. T... | |
| aliyun-domain Manage domain assets through Alibaba Cloud OpenAPI, supporting domain query, renewal, transfer, registration, and information modification. Requires user dou... | |
| showname Search X (Twitter) posts using the xAI API. Use when the user wants to find tweets, search X/Twitter, look up what people are saying on X, or find social med... | |
| showname Search X (Twitter) posts using the xAI API. Use when the user wants to find tweets, search X/Twitter, look up what people are saying on X, or find social med... | |
| Desktop Sorter Automatically organizes desktop files by extension into folders like PDFs, Images, Archives, Documents, and Presentations. | |
| Find File Search and locate local files or folders by name or content, then copy them to a designated reception folder or send via LINE integration. | |
| Token Guard Model Switch Monitors token usage and context load to prevent interruption, automatically switching to backup models when thresholds are exceeded. | |
| ZL-ClawPay 支付技能：支持免密支付、订单查询、交易流水等功能。
触发词：我要支付、帮我付款、确认买单、查询支付订单、查询订单状态、查询交易流水、查询交易记录、查询账单、绑定子钱包、验证钱包凭据、解绑子钱包、撤销钱包绑定。
不适用于：非支付场景、历史数据导出、批量操作、余额查询、收款码生成。
基于 Node.js 实现，使用 SM2/SM3/SM4 国密算法加密通信。 | |
| Tapd 当用户需要查询、创建或更新 TAPD 需求、任务、缺陷、评论、工作流、迭代、测试用例、Wiki、工时、发布计划，或发送企业微信通知时使用本 Skill。使用 Python 标准库调用 TAPD 开放 API，不依赖 MCP 或第三方 HTTP 库。 |
44,651–44,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.