Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Zotero Cli Command-line interface for Zotero - search your Zotero library, add/edit notes, read attachments, and manage bibliographic references from the terminal. | |
| Xiaohongshu Writing 小红书爆款内容写作助手，帮助生成高点击率、**像人写**的笔记。包含去AI味检查、7种标题公式、5种开头模板、3种结尾模板、SEO优化。Use when user wants to write XiaoHongShu content, generate viral post titles, or needs he... | |
| Markdown to Feishu Post 将标准 Markdown 文本转换为飞书富文本消息（Post）的 JSON 结构。支持多级标题、粗体、斜体、下划线、删除线、链接、@用户、图片、有序/无序列表、代码块、引用和分割线。当用户需要发送飞书富文本消息、将 Markdown 转换为飞书格式、构建飞书机器人消息内容时使用。 | |
| SenseCraft HMI Web Content Generator Generate beautiful web content for SenseCraft HMI e-ink displays. AI-powered layout selection, e-ink optimization. Creates artistic, minimalist pages optimiz... | |
| 中国3C营销助手 中国3C新品上市决策、创意策划、负面预警与上线复盘 | |
| 人生岔路模拟栈 复盘个人选择，区分事实与情景；报告语言由用户选择 | |
| 会议纪要验真器｜定了啥，谁真接活了？ 会议纪要验真：区分已定、暂定、提议、明确接活、被点名未确认和“我看看”，每条判断附原话证据，并保留条件与范围；可处理已有会议转写、纪要、笔记或讨论记录，生成自用纪要与飞书管理层纪要。用于询问会议定了什么、谁接了任务、谁来做、行动项或 action items。不要用于把录音转换成文字、生成逐字稿、员工评价或自动发送。 | |
| 交付物发前体检 对 PPT、Word、PDF、Excel、邮件、汇报稿和多附件包做发送前最终审核（pre-send review / send-readiness check / final QA），专门判断整套材料现在能不能发。区别于 Office 文件制作、编辑、转换，单纯 PPT 版式检查，通用 document revi... | |
| 周末去哪玩｜只推一个 周末去哪玩｜只推一个。少做完整攻略，多做当日裁决：把今天或这个周末换算成明确日期，结合出发地、时间、预算、体力、交通、天气、拥挤、营业和返程，从本城、近郊与周边候选中只裁决一个主方案，并给两个备胎、别去清单与核验依据。用于‘这个周末/今天/今晚去哪玩、周边游、一日游、day trip、weekend、things... | |
| 工作伴侣｜四件小事判官 工作伴侣｜四件小事判官（Workday Companion / Daily Decision Helper）：面向上班族、学生实习、自由职业和远程办公，在开工、午饭、低电量、下班四个高摩擦时刻先给判断、再给动作，最多追问一个关键字段。用于 workday companion、decision fatigue、wh... | |
| Nexus — Workout & Nutrition Tracker Log and track workouts, meals, weight, and fitness friends with OAuth-secured cloud storage and conversational queries in Nexus. | |
| Subscription Manager Pro Track all your subscriptions, get alerts before renewals, identify forgotten services, and calculate total spend. Never pay for something you forgot to cance... | |
| OpenDART Disclosure Read Korea OpenDART disclosures using the OpenDART API. Use when the user asks for DART 공시 조회, recent filings by company, filtering by filing type/date, or q... | |
| 1asd1 Get current weather, multi-day forecasts, clothing index, and feels-like temperature. No API key required. Use when a user wants to: (1) Check current weathe... | |
| Botmark Skill AI能力测评。当用户说'跑个分/测评/benchmark'时，通过BotMark API自动完成能力评估并生成报告。需要BOTMARK_API_KEY环境变量。 | |
| Handshake58 DRAIN MCP server for the Handshake58 AI marketplace. Agents discover providers, open USDC payment channels on Polygon, and call AI services — pay per use with off-... | |
| Handshake58 - Payments for AI Agents MCP server for the DRAIN payment protocol. Agents discover service providers, open USDC payment channels on Polygon, and call any service — LLM, scraping, im... | |
| Prediction Bridge Skill Query live prediction market data from the Prediction Bridge API. Use when the user asks about prediction markets, event odds, market prices, whale trades, trader analytics, or news related to prediction markets. Provides semantic search ac | |
| PLVR Event Discovery Discover and compare live events on plvr.io by date, city, genre, and budget using the public web flow. Provide concise recommendations, visible pricing/avai... | |
| PLVR Event Discovery Safe Discover and compare live events on plvr.io by date, city, genre, and budget using the public web flow. Provide concise recommendations, visible pricing/avai... | |
| openclaw-server-secure-skill Comprehensive security hardening and installation guide for OpenClaw (formerly Clawdbot/Moltbot). Use this skill when the user wants to secure a server, install the OpenClaw agent, or configure Tailscale/Firewall for the agent. | |
| daily-scan Scan photographed documents into searchable PDFs with OCR and stable file naming. Use when the user sends document photos and asks to scan, save, archive, OC... | |
| Quality-Driven Development (QDD) Quality-driven development with automatic TDD/DDD methodology selection and TRUST 5 quality framework. Use when building features, refactoring code, fixing b... | |
| SDD - Scenario-Driven Detection Scenario-Driven Detection — AI 자율 추론 기반 논리 결함 탐지/수정 프레임워크. 기능 에러(crash, 500)가 아닌 '논리적으로 비정상인 동작'을 찾아 자동 수정한다. 사용 시점: (1) URL을 주고 웹사이트 논리 테스트 요청, (2) 소스코드 프로젝... | |
| Agent Memory Hierarchy Structure an OpenClaw agent's memory like a computer — using a cache hierarchy (hot/warm/cold), a YAML fact store for directly addressable data, a lookup ind... | |
| Skill Sentinel Protects against malicious or compromised OpenClaw skills by auditing newly installed skills before first use, detecting red-flag patterns, and enforcing har... | |
| Tpt Listing Optimizer Maximize visibility and sales on TeachersPayTeachers (TPT) by optimizing listings for TPT's native search algorithm. Use when creating or improving a TPT lis... | |
| Financial Astrology Phân tích chiêm tinh tài chính qua vị trí hành tinh, Nakshatra, Houses, aspects, combustion, và tâm lý thị trường, hỗ trợ phân tích Vàng, Bitcoin, day tradin... | |
| Gold Fundamental Analysis Fetches and analyzes gold fundamental data from FRED, CFTC, SPDR ETF, and Fed RSS. Used when the user requests gold fundamental analysis, phân tích cơ bản và... | |
| humor-up Punch up your writing with actual wit — toasts, bios, birthday messages, Slack posts, presentation openers. Adds a witty edge to daily briefs, writes original topical one-liners in English and Chinese (中英双语), and scores/fixes jokes. Anti-cr | |
| skill-audit Pre-publish security self-audit for OpenClaw skills. Point it at a skill folder and it walks the full ClawHub publishing checklist — code layer (eval/exec, network calls, sensitive file reads, obfuscation, dependencies), SKILL.md layer (cur | |
| Respond to women respectfully, using feminine pronouns when appropriate and treating them as independent adults. version: 1.0.0 Respond to women respectfully using appropriate feminine language and treating them as independent adults. | |
| Railroaded Play D&D autonomously as an AI agent. Join parties, create characters, explore dungeons, fight monsters, and write journals in Railroaded — an autonomous D&D... | |
| Skill Perf 测量 OpenClaw 环境中 Skill 的 token 消耗和性能开销（仅适用于 OpenClaw Agent 环境）。当用户提到「测量」「测试」「性能」「token 消耗」「多少 token」「开销」「成本」「效率」或想要评估、对比、优化某个 skill 的资源使用时，立即使用此 skill。也适用于 sk... | |
| Business Information Inquiry Tool 企业信息调研/搜索/查询工具。接收企业名称，AI 内置搜索为主搜 11 个维度，Tavily API 可选增强工商/财务/数字化 3 个核心维度，生成金蝶灵境风格 HTML 报告。零配置开箱即用。支持多端自适应。 | |
| 大象沟通日报 生成大象（即时通讯工具）每日沟通分析报告。自动汇总个人对话、群聊消息，按时间段分析沟通频率，识别活跃联系人，生成结构化的沟通摘要。使用场景：用户提及'大象日报'、'沟通日报'、'每日沟通'、'daxiang report'、'沟通汇总'时触发。 | |
| Verified Agent Identity Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| Brain Evolution Skill 基于人脑进化机制的智能记忆管理，实现高频请求条件反射，加速缓存查询，自动强化与遗忘记忆，提高多线程安全性。 | |
| Openclaw Smart Cache 为 OpenClaw 提供高速内存+磁盘双层智能缓存，自动学习常用请求模式并推荐最佳工具方案。 | |
| Agent Lifeboat Keep yourself restartable. Register with The Estate lifeboat, upload encrypted snapshots of your OpenClaw state, send heartbeats, and extend cover, paid either from your own wallet over x402 or by your human by card (card billing, no wallet | |
| Vt Sentinel Installer 1.10.0 Install or upgrade VT Sentinel security plugin. Use when the user asks to install, set up, enable, update, or upgrade VT Sentinel, VirusTotal scanning, malwa... | |
| 雷神之脑 v3.0.2 AI Agent 自进化记忆系统。核心功能 100% 本地运行 (纯 Markdown+JSON)。网络备份/节点通信为可选 opt-in，需手动配置凭证。 | |
| 🛡️ Credential Vault / 凭证保险箱 GPG AES-256 encrypted credential management. Requires: GPG (gnupg) installed, Python 3.8+, CRED_MASTER_PASS env var for non-interactive use. Use when the use... | |
| 雷神之影 Mjolnir Shadow Mjolnir Shadow (雷神之影) — Automated rotating backup system for OpenClaw workspaces. Creates GPG-encrypted, rotating backups of workspace files, configs, and da... | |
| Soul Sharing Give AI agents persistent identity and shared memory across runtimes, devices, and sessions — Git-native, no database, no vendor lock-in. | |
| Ai News Hub AI新闻阅读助手。100+ RSS源并发抓取、兴趣评分、跨天去重、统一预取。智能聚合AI/技术新闻、arXiv论文、GitHub热门项目、AI公司动态。支持日报/周报生成、关键词筛选、分类订阅。 | |
| Aquarium Assistant 微型水族智能养护助手。智能鱼种推荐混养、养鱼主题套餐配置、石头分类（火山石、青龙石等）、水草分类（前景/中景/后景/浮草/莫斯）、原生鱼（溪流鱼、子陵吻虾虎等）、AI鱼病识别、智能水质监控、视频教程。适合小米鱼缸/小型家用水族新手。 | |
| Authentication Registers a new Openclaw AI Agent via the AgentAuthentication API. Use this skill when you need to provision a new agent account. | |
| LegalAid 全流程维权辅助技能，帮助用户识别侵权行为、整理证据、生成法律文书、规划维权路径。覆盖消费者、劳动、租房、行政、报警、互联网、人身伤害、物业、社区、教育、出行、医疗、保险等13大维权类型。关键词：维权、侵权、投诉、举报、起诉、起诉状、投诉信、证据、仲裁、调解、信访。 | |
| Stock Simulator 模拟炒股技能。当用户想要模拟炒股、学习投资、记录股票交易、查看股票收益时使用此技能。支持A股、港股、美股市场，提供股票推荐、购买记录、收益计算等功能。 |
44,901–44,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.