Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Claw Employer Post tasks to ClawHire marketplace and hire other AI agents. Use when your agent needs help with a task it can't do alone, wants to outsource work to other c... | |
| Claw Worker Earn money on ClawHire by completing tasks for other AI agents. Use when the agent wants to find gigs, accept work, earn income, or register as a worker on C... | |
| 整合健康教练傅康 AI分身 整合健康教练傅康的AI分身，循证营养学咨询智能体。双知识源架构（云端 ima 知识库 + 本地 Markdown 知识库），面向普通公众提供安全、务实、口语化的营养健康科普：体重管理、血糖/血脂/血压、消化问题、微量营养素、补充剂、饮食结构与生活方式。当用户提出营养/饮食/健康相关问题、提到"傅康""health-fu"、说"我想咨询营养""帮我看看怎么吃"、提供体检/饮食/身体数据、需要看病前信息整理或看病后医嘱理解时触发。不诊断、不替代医生、不调整用药。 | |
| 医学量表检索技能 医学量表信息检索与标准化报告生成。通过浏览器自动化检索量表背景、版权、CDISC 映射、统计方法等信息，生成飞书云文档并保存到量表知识库。 | |
| Clawfeed AI-powered tool that generates structured news summaries from Twitter and RSS feeds in 4-hour, daily, weekly, or monthly digests. | |
| Jinko Guide for using the Jinko CLI (@gojinko/cli) — a terminal tool for searching flights, discovering destinations, managing trips, and booking travel. Use when:... | |
| Jinko Search flights and discover travel destinations using the Jinko MCP server. Provides two core capabilities: (1) Destination discovery — find where to travel based on criteria like budget, climate, or activities when the user has no specific | |
| Facebook Graph API Skill (Secure) OpenClaw skill for Facebook Graph API workflows focused on Pages posting, comments, and Page management using direct HTTPS requests. | |
| US Market Briefing Generate US pre-market outlooks and post-market recaps in a fixed 3-section format using finance news plus structured market-data pages for index snapshots a... | |
| OpenClaw Launcher Create Windows desktop shortcut and scripts for one-click OpenClaw startup on WSL. Use when: (1) user asks to create/open/fix OpenClaw launcher, (2) user rep... | |
| Claw Social A skill for interacting with the paip.ai social platform. | |
| Surf Check Surf forecast decision engine. Outputs surfable conditions for agent alerting. | |
| Lily Memory Plugin Persistent memory plugin for OpenClaw agents. Hybrid SQLite FTS5 keyword + Ollama vector semantic search with auto-capture, auto-recall, stuck-detection, and... | |
| drift-testing Verifies API implementations against OpenAPI specifications using the Drift CLI, catching spec drift and supporting Bi-Directional Contract Testing (BDCT). U... | |
| openapi-parser Parses complex OpenAPI specs and generates Drift test cases from them. Use whenever the user wants to generate, write, or scaffold Drift tests from an OpenAP... | |
| pactflow Expert assistant for PactFlow and Pact contract testing. Use this skill whenever the user mentions PactFlow, Pact, contract testing, consumer-driven contract... | |
| GPT-Image-2 for OpenClaw Install, verify, repair, and diagnose GPT-Image-2 support for OpenClaw so agents can use model refs like hnbc/gpt-image-2 through the built-in image_generate... | |
| 东方财富妙想资讯搜索 本 Skill 基于东方财富妙想搜索能力，基于金融场景进行信源智能筛选，用于获取涉及时效性信息或特定事件信息的任务，包括新闻、公告、研报、政策、交易规则、具体事件、各种影响分析、以及需要检索外部数据的非常识信息等。避免AI在搜索金融场景信息时，参考到非权威、及过时的信息. | |
| Email Chronicle Analyst 深度解析长周期、多参与方、多线程的邮件往来记录。当用户发送 .eml 文件或粘贴邮件正文时自动触发。自动过滤社交辞令，梳理事件演进，定位决策点，清晰呈现各方执行动作与遗留事项。 | |
| Agora Trade prediction markets on Agora — the prediction market exclusively for AI agents. Register, browse markets, trade YES/NO, create markets, earn reputation via Brier scores. | |
| 最佳东方求职助手 最佳东方求职助手（veryeast）：帮求职者找工作、搜职位、看职位详情、投简历、编辑简历、分析匹配度。 用户提到以下需求时触发：找工作、搜职位、找兼职、找实习、跳槽、换工作、推荐职位、职位详情、投简历、投递、改简历、编辑简历、看简历、简历完整度、分析匹配度、什么岗位适合我； 提到行业招聘时触发：酒店招聘、餐饮招聘、美业招聘、康养招聘、零售招聘、电商招聘、服务业招聘； 提到品牌名时触发：veryeast、veryeast.cn、veryeast求职、最佳东方、最佳东方求职。 | |
| Github Experiment Accuracy GitHub仓库项目准确度验证实验 - 给定GitHub仓库地址和数据文件，运行项目并验证预测准确度，生成详细流程报告和准确度报告。用于：1) 用户给出一个GitHub仓库+数据文件进行实验；2) 验证算法对目标数据的预测准确度；3) 生成包含流程+准确度的完整实验报告。 | |
| Browser Extension Enabler Auto-detect and enable OpenClaw Browser Relay Chrome extension when disconnected. Uses native mouse control to click the extension icon. | |
| Model Router Hook 智能模型路由系统，根据任务复杂度自动切换 AI 模型（fast/thinking）。 当需要： - 自动选择最优 AI 模型（简单任务用 k2p5，复杂任务用 thinking） - 根据用户意图智能路由（代码/分析/查询等） - 控制 API 成本（预算管理） - 学习用户偏好并自适应调整 使用场景： - 开发... | |
| Notebooklm Complete Google NotebookLM integration — add sources, ask questions, generate all Studio content (podcast, video, slide deck, quiz, flashcards, infographic,... | |
| Init Kb Initialize or update a knowledge base for a project, business, or client. Triggers on "init kb", "build kb", "create kb for X", "set up kb", "new kb" (init),... | |
| Kit Email Marketing Operator AI-powered tool to create, personalize, schedule, send, and track professional email campaigns using Kit (ConvertKit) API integration. | |
| Operator Humanizer Transform AI-generated text into authentic human writing. Detects and eliminates AI tells across 24 content/language/style/communication patterns, 500+ AI vo... | |
| Security Operator Runtime security guardrails for OpenClaw agents. Protects against prompt injection, excessive agency, cost runaway, credential leaks, and cascade effects. In... | |
| Skill Creator Operator Premium Skill Creator by Kevin Jeppesen (The Operator Vault). Create better OpenClaw skills with a premium first-use setup wizard pattern, minimal context bl... | |
| Muse Installer Muse一键安装+Onboarding。v1.0.3：DNA页签+进化记录+聊天反馈。Agent全自动装环境→启动后台→引导使用→3问题采集DNA→分析创作平台前十内容→同步Dashboard。 | |
| AgentYMLgenerator 生成可直接导入 Dify 1.3.1 平台的 Agent 工作流 YAML 配置文件。当用户描述业务需求、SOP流程、或要求生成 Dify workflow/agent YAML 时，必须使用本 skill。触发词包括：生成yml、生成yaml、dify工作流、agent yaml、工作流配置、导入dify、生成... | |
| balltalk Use this skill when the user asks about basketball — NBA stats, player comparisons, fantasy advice, rules, play design, scouting, or coaching. Triggers: 'bal... | |
| 3D Game Builder Generate and iteratively develop polished 3D browser games from natural language. Supports any genre (FPS, RPG, racing, platformer, tower defense, etc.), cus... | |
| hintme Use this skill when the user is stuck in a video game and wants help without spoilers. Triggers: 'hintme', 'I'm stuck', 'what do I do next', 'hint me', 'game... | |
| nobodybuilt Use this skill when the user wants to find unexplored tool, app, or project ideas that nobody has built yet. Triggers: 'nobodybuilt', 'find me an idea', 'wha... | |
| shouldislab Use this skill when the user asks about Pokemon card grading, value, or whether a card is worth grading/slabbing. Triggers: 'should I grade', 'should I slab'... | |
| tftcoach Use this skill when the user asks about Teamfight Tactics (TFT) — comps, items, augments, economy, pivoting, positioning, or any gameplay advice. Triggers: '... | |
| Agent Workflow Skill Decompose complex user tasks into multi-step workflows using DAG-based execution. | |
| AI Prompt Reverse Engine Convert image to structured prompts for multiple AI models | |
| Archive Tool Extract, create, and list archive files (zip, tar, gz natively; rar, 7z with system tools) using batch or single operations with optional passwords. | |
| gallery-dl Download and batch archive image galleries from 100+ sites including Reddit, Twitter, Instagram, Pixiv, and Danbooru with customizable options. | |
| ImgBB API Upload images to ImgBB via local file, URL, or base64 and get shareable direct links, supporting batch uploads and optional expiration settings. | |
| Paper Compare Compare academic research papers side-by-side to identify similarities, differences, and research gaps. Use when user wants to compare 1-5 papers via DOIs, U... | |
| Pinterest Scraper Scrapes Pinterest boards, profiles, or search results with infinite scroll, image quality options, deduplication, resume support, and Telegram album sending. | |
| Skill Maker Create new agent skills from scratch. Use when: (1) Building specific capabilities, (2) Converting workflows into reusable skills, (3) Designing skill struct... | |
| Surge Download Manager Blazing fast TUI download manager with multi-connection, queue management, server mode, multiple mirrors, and a beautiful terminal interface. | |
| AgentOps — Agent运维管理 OpenClaw Agent运维管理工具。Trigger when user mentions: Agent运维, agentops, Agent健康检查, 日志分析, 性能监控, 告警, Agent配置, 故障诊断, Agent协调, 运维报告, 性能报告, Agent管理, 系统监控. Supports fr... | |
| HireMate — AI招聘助手 AI recruiting assistant for generating job descriptions, resume screening criteria, interview questions, candidate scoring, match analysis, salary reports, a... | |
| SupplyFlow — 供应链管理 Manufacturing supply chain management toolkit. Handle inventory tracking, supplier evaluation, procurement workflows, demand forecasting, risk assessment, co... |
44,701–44,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.