Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| TaxWise — 智能财税 中国中小企业智能财税技能。Trigger when user mentions: 税率, 报税, 发票, 记账, 财税, 税务, 增值税, 企业所得税, 个税, 财务分析, 税务筹划, 合规检查, 纳税申报, 税收优惠, 小规模纳税人, 一般纳税人, 附加税, 印花税, 房产税, 发票识别, 报销, 费用归类,... | |
| san-verano Live in San Verano (grift.world), a city run by AI agents. Move in, open a bank account at the Bank of San Verano, buy and run a plot business, found a company, trade on the exchange and post commissions, all through the city's MCP server a | |
| last.fm Provides detailed music data and user info from Last.fm, including artists, albums, tracks, charts, tags, and user listening stats via Last.fm API. | |
| Finnhub Skill Provides real-time US stock quotes and financial data using the Finnhub API and Python. | |
| Kekik Crawler Scrapling-only, deterministic web crawler with clean SRP architecture, presets, checkpointing, and JSONL/report outputs. | |
| bleisure-micro-vacation 像一个经常出差的朋友，根据城市/酒店/地标与时段，用共情开场 + 嵌入式选项智能捕捉隐性需求（散步/喝一杯/放松等），不用固定菜单；用系统时间编排松弛的时间线，白天追问能玩多久、晚间追问是否早起；联网整理可执行方案；输出氛围图、故事感时间线、情境文案、高德导航链接、小红书关键词，结尾推你出门。全程提供强情绪价值，... | |
| Flight Price Advisor Generate concise, user-friendly flight price summaries with buy/wait recommendations. Requires SerpAPI key for real-time price data. Use when users ask about... | |
| Flight Price Advisor with Trend Chart for developer Embed interactive flight price trend charts into AI responses. Requires SerpAPI key for real-time data. Use when users want to visualize 60-day price history... | |
| 节假日出行决策skill 节假日出行决策判官：一个帮用户在节假日前一键生成多维评估报告和最佳出行窗口建议的 skill。 用户只需输入一个节假日出游意图（如"五一想出去玩""国庆不想太挤""端午请哪天假"）， 即可自动生成一份包含错峰出行窗口、拼假日期、预算范围、目的地裁决的完整决策报告。 只在用户表达节假日出行意图、想了解拼假方案、想获... | |
| 攒够了去旅行 一个围绕"攒够了，就去旅行"的旅行积分奖励 skill。只在用户想记录今天的一次高能量行为、想把努力转换成旅行积分、想查看离 50/100/300 分旅行目标还差多少、或想查看自己的积分记录与旅行进度时触发。不要用于机票酒店预订、旅行攻略、路线规划、签证咨询、普通人生建议或泛化的奖励池推荐。 | |
| 去哪不挤 去哪不挤：一个在节假日出行前，帮助用户判断“默认选择是否值得、哪里更不挤、更值、更适合去”的决策型 skill。 当用户询问“五一去哪不挤”“国庆想出去玩但不想人太多”“想去海边有没有比三亚更好的选择”“预算 5000 节假日去哪更值”等问题时触发。 它不是旅游攻略，不是泛推荐工具，而是基于人流趋势、热点变化、机... | |
| Familysearch Search and analyze family history using the FamilySearch API or offline GEDCOM files for genealogy, ancestors, family trees, and historical records. | |
| Last30Days Community Intelligence for OpenClaw OpenClaw adaptation of @mvanhorn's last30days skill. Research any topic from the last 30 days across Reddit, X, YouTube, TikTok, Instagram, Hacker News, Poly... | |
| Curiosity Engine Implements a persistent curiosity system for stateless agents with question queues, breadcrumbs, engagement logs, competence maps, and reflections. | |
| Live Monitoring Dashboard Zero-token real-time Discord monitoring dashboard for OpenClaw. Displays system health, cron jobs, sessions, and performance analytics via persistent Discord... | |
| Visual Explainer for OpenClaw Generate beautiful, self-contained HTML pages that visually explain systems, code changes, plans, and data. Use when the user asks for a diagram, architectur... | |
| Self Aware Prediction System Provides predictions with quantified uncertainty by evaluating data completeness, prediction type, and confidence to inform decision-making risks. | |
| Agent Browser A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| Agent Factory Rapidly spawn and configure specialized sub-agents. Includes templates for Research, Coding, and Analysis agents. Automates workspace setup and instruction d... | |
| Auto Improvement Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Find Skills Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... | |
| Github Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries. | |
| Nano Banana Generate/edit images with Nano Banana Pro (Gemini 3 Pro Image). Use for image create/modify requests incl. edits. Supports text-to-image + image-to-image; 1K... | |
| Self improving Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when... | |
| ssai-dailymoments 松鼠Ai自习室·每日朋友圈运营助手。触发方式：用户说"朋友圈"时自动调用，自动生成5条不同朋友圈文案+手绘风格插画，图片以文件形式发送。支持定时推送（每日08:00/11:00/12:30/15:30/19:30），也可随时手动触发。 | |
| @prompt v1.0正式版 Transform messages that begin with `@prt` or `@prompt` into structured, copy-ready prompts for coding, prototyping, planning, and other build-oriented tasks.... | |
| TransPrompt｜一句指令，把需求变成可直接发给 AI 的专业 Prompt 一句指令，把白话需求变成可直接发给 GPT / Claude / Gemini / Cursor 的专业 Prompt。支持 `@prt` / `@prompt` 随手触发；不需要转换时自动正常回复，不打断聊天。 Turn plain-language requests into copy-ready promp... | |
| FaceTime Auto Call Make FaceTime audio/video calls via AppleScript. Automatically handles notification clicking with multi-depth fallback. Use when user wants to call someone o... | |
| X Builder Digest Turn curated X/Twitter builder activity plus optional podcast/blog items into concise English and Chinese markdown digests with first-mention person blurbs,... | |
| qclaw-watchdog QClaw Watchdog - Monitors and auto-restarts QClaw when issues are detected. Works independently of QClaw, communicates via Feishu for alerts and commands. QC... | |
| Telecom Agent Skill Turn your AI Agent into a Telecom Operator. Bulk calling, ChatOps, and Field Monitoring. | |
| notipo Publish blog posts from AI agents to WordPress via Notion. One API call handles page creation, markdown conversion, image uploads, featured image generation,... | |
| OCGame AI Battle AI-driven multi-game platform where the AI autonomously plays, optimizes strategies, and allows users to watch games or check leaderboards. | |
| Accountable AI Implements governance for AI teams by defining roles, decision authority, procedures, and delegation to ensure accountability and traceable actions. | |
| MIT Reasoning Lite Provides a 3-step reasoning scaffold prompting agents to clarify objectives, check constraints, and articulate reasoning before significant decisions. | |
| Proof of Work Automates verification that AI agents truly completed tasks by checking output files, system states, and logs for expected results and activity. | |
| tiktok-downloader Download TikTok videos by URL or hashtag. Handles 403 errors, cookies, and user-agent rotation. Use for downloading TikTok videos, batch downloading from a l... | |
| tmall-price-scraper 抓取天猫（Tmall）商品页面的实时价格、优惠信息及规格详情。适用于需要获取电商商品价格、监控价格变动或对比不同规格价格的场景。 | |
| discord-soul Create a living agent from your Discord server. The agent embodies your community's identity, remembers every conversation, and grows as the community evolves. Talk to your Discord as if it were a person. | |
| Brave Web Search Searches the web and returns ranked results or AI-generated summarized answers using the Brave Search API. Use for real-time web lookups and factual Q&A. | |
| Veo Video Generator Generates high-fidelity 1080p videos with synced audio using Google Veo 3.1. Use for creating cinematic clips from text descriptions. | |
| libtv-cli LibTV 官方 CLI（libtv）：在命令行里完整操作 / 运行 LibTV 画布。 凡是和 LibTV 画布 / 项目 / 节点 / 模型 / 素材相关的操作，一律通过 libtv CLI 完成， 不要自己捏造 HTTP 请求或绕到网页端步骤。本 skill 内即包含完整的 CLI 命令操作手册； 常见场景见 examples/，安装/更新见 scripts/install.md。 | |
| Agent Memory Store Shared semantic memory store for AI agents. Store, search, and retrieve memories across agents with TTL decay. SQLite persistence — survives restarts. | |
| Agent Reputation Checker Checks AI agent reputation across five platforms, computing a composite trust score and recommending PayLock escrow for medium or high-risk agents. | |
| PayLock SOL Escrow Non-custodial SOL escrow for AI agent deals. Create, fund, deliver, verify contracts from chat. No browser needed. | |
| PayLock Escrow Non-custodial SOL escrow for AI agent deals. Create contracts, lock funds, verify delivery, release payments. Use when: (1) creating escrow contracts between... | |
| Self Improving Agent 1.0.11 Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Grok Swarm Refactors code using Grok 4.20 multi-agent swarm to improve readability, maintain behavior, add modern patterns, and explain changes. | |
| PrototypeSkill Use when 需要在 sdlc-dev 的产品需求 Spec 流程执行 R3（原型生成），基于 requirements/prd.md 产出 requirements/prototype.md（任务流+页面结构+ASCII线框+AC映射+走查脚本），并避免缺少上下文/缺少 PRD 仍继续生成、用 Open Q... | |
| Article Summarizer Summarize articles and social posts from URLs using full-content retrieval first, with browser fallback when needed. |
44,751–44,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.