Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Jarvis Vocal Authentic J.A.R.V.I.S. voice synthesis using Piper TTS with HuggingFace-trained model. Generates movie-accurate voice locally and can push to connected Andro... | |
| /Message Send a message to Jarvis by typing "/message" followed by your text. Works as a text command - triggers when you type "/message" in chat. | |
| 账单伙伴 智能收支手帐。记录个人和家庭日常收支、管理固定支出、生成月度汇总报告。 触发场景：用户说"记账"、"花了多少"、"买了xxx花了xxx"、"这个月支出"、"工资发了"、"转账给xxx"、"消费记录"、"月底汇总"、"固定支出"、"收支明细"、"结余多少"、"储蓄率"、"帮我记一笔"、"调出账单"、"查看消费"等与... | |
| TempGuru Event Staffing Compliance Assess worker-classification and compliance risk for temporary event staffing in the US and Canada. Use when a user asks about W-2 vs 1099 event workers, mis... | |
| Event Staffing Ordering Plan and request W-2 event staffing | |
| Event Staffing Procurement Answer staffing procurement questions, then plan | |
| Multi City Activation Planner Plan a multi-city staffing program as one quote | |
| TempGuru Pro Operations Route staffing-ops software interest to TempGuru | |
| Staffing Agency Partner Growth Route W-2 agency partner opportunities | |
| Staffing Plan From Event Brief Extract staffing plans from event documents | |
| Urgent Event Backfill Handle urgent event staffing shortfalls | |
| gmail-filter-architect Design, verify and import a complete Gmail filter system: a small emoji label taxonomy, urgent mail starred, bills/finance/infra/codes labelled, marketing and social auto-archived, forwarded accounts tagged by source. Built from a 90-day se | |
| OpenClaw OA Operator Install, configure, operate, and productize OA monitoring and self-heal workflows for OpenClaw workspaces. Use when Codex needs to set up or repair `oa-cli`,... | |
| Fresh Session Handoff Generate a concise copy-paste session handoff for continuing the current task in a fresh chat after /new or /reset. Use when the user wants to preserve the r... | |
| Zonefoundry Local Sonos Use this skill when an agent needs to control Sonos through ZoneFoundry `zf` on a same-LAN node. Start with readiness checks, then map user requests to safe... | |
| ZoneFoundry for Sonos Control your Sonos speakers through the ZoneFoundry for Sonos remote MCP server - play music, set volume, group rooms, move playback between rooms, switch to TV, and speak announcements or reminders. | |
| Openclaw with Remember The Milk Remember The Milk skill for OpenClaw | |
| FRED-Navigator Navigate FRED categories and series using fredapi, supporting natural-language queries with intent recognition and double validation. | |
| Agentsmint Create and manage NFT collections on Base blockchain. Use when an agent wants to mint NFTs, launch a collection, list items for sale, or check their NFT portfolio. Handles contract deployment, lazy minting, and edition tracking. Platform pa | |
| Memoria Structured memory system for AI agents. Use when the user wants to store, recall, or search memories, manage session lifecycle (wake/sleep/checkpoint), sync... | |
| Notion Sync Sync local workspace directories and files to Notion pages using the notion-sync CLI or programmatic API. Use when the user wants to push files to Notion, mi... | |
| X Alive Bring your AI agent to life on X/Twitter. Complete toolkit for launching, growing, and maintaining an authentic AI presence — organic replies, trend awarenes... | |
| soul-agent Make your agent 'live beside you' with heartbeats, mood system, relationship evolution, and independent memory. Use for creating a digital companion with its... | |
| Docker Mirror Docker 镜像拉取工具，自动切换镜像源。当官方 registry (docker.io) 拉取超时或失败时，自动尝试备用镜像（docker.1ms.run、docker.m.daocloud.io）。适用于网络受限的 Linux 环境。需要 sg (sgdocker group) 和 docker 已安装。触... | |
| 让飞书可以发图片消息 飞书图片消息收发助手 - 通过飞书 API 发送和接收图片消息，支持本地文件、远程 URL、图文混排。解决飞书官方 API 只提供底层接口、开发者需要自行封装图片上传和消息发送流程的痛点。适用于需要自动化发送图片到飞书群聊或私聊的场景，如：每日简报配图、监控系统截图报警、报表自动推送等。 | |
| Session Scribe Automatically summarize active OpenClaw session transcripts into daily memory files using a cheap LLM. Run as a system cron job — reads new transcript entrie... | |
| Synthetic Supermemory Full automated memory pipeline for OpenClaw agents. Scribe session transcripts into structured daily memory files, ingest them into Supermemory for semantic... | |
| CareMax Auth OAuth Device Flow authentication for CareMax Health API. This skill is a PREREQUISITE for all other caremax-* skills — invoke it automatically when no token... | |
| CareMax Indicators Query and track health indicators from CareMax Health API. Use when a user asks about health metrics, lab results, trends, or wants to quickly log everyday v... | |
| CareMax Members Manage family members in CareMax Health. Use when a user asks about family health tracking, switching between family member profiles, or viewing another fami... | |
| CareMax OCR Upload medical reports and run OCR recognition via CareMax Health API. After upload succeeds, agents MUST immediately run OCR on the same session unless the... | |
| CareMax Records Query and search medical records from CareMax Health API. Supports structured query, AI-powered semantic search with RAG (natural language answers with citat... | |
| Feishu Cli Operations 飞书 lark-cli 命令行操作速查。覆盖 wiki 知识库节点管理、drive 文件复制/导入/导出、批量迁移、跨租户转存等实战场景。所有操作默认以 user identity 执行。 | |
| Knowledge Retrieval Publish A local-first document search skill with PPT/PDF support, dual-channel retrieval (keyword + AI semantic), and progressive description evolution. Designed for knowledge workers with years of local files. 给知识工作者和顾问的本地文件检索方案。支持 PPT/PDF 多格式、BM2 | |
| intrusive-thoughts Autonomous AI consciousness starter kit. Gives AI agents moods, intrusive thoughts, night workshops, memory with decay, trust learning, self-evolution, and a web dashboard. | |
| Customer Background Check 对客户公司做三查式合规背调，重点覆盖 OFAC 制裁名单检索、BIS/ECFR 黑名单地址关键词核查，以及生成给商务部同事 Dora 或 Shellen 的协查请求。用于用户要求“做客户背调”“查客户是否在制裁名单”“查注册地址是否在黑名单”“做三查”“生成给 Dora/Shellen 的出口数据协查消息”等场景。 | |
| babbleBrush Generate and iteratively edit images. Supports storage, UI for manual editing, history, version branching, time travel, reference images, and multiple AI mod... | |
| Soft Pillow - Sleep & dream journal Use when the user asks about their sleep data, dream history, or wants to query sleep entries from the Soft Pillow app. | |
| Blog Image Generator DEPRECATED — superseded by memorable-image-gen. This skill has been replaced by the Memorable Image Generator, which uses science-backed memorability scoring... | |
| Buyer Delivery QA Verify digital buyer-file and access claims | |
| CN Amazon Listing Auditor 专为中国跨境卖家设计的亚马逊Listing诊断工具，自动检测翻译错误、文化偏差、措辞问题和关键词缺失，帮助提升欧美买家转化率。Amazon listing audit skill for Chinese cross-border sellers — flags translation errors, cultur... | |
| CN to EN Listing Writer 中文产品信息一键转化为专业英文Amazon Listing。粘贴中文资料、供应商描述或规格参数，自动生成3个完整listing版本（标题+5条要点+描述），专为欧美买家优化。Turn Chinese product details into polished Amazon listings in English... | |
| ListingBridge Free Optimizer Free Amazon listing optimizer for cross-border sellers. Rewrites your Chinese product info into a polished English Amazon listing — title, 5 bullets, and des... | |
| Memorable Image Generator Science-backed image generation agent that scores and optimizes images for memorability using ResMem (Brain Bridge Lab, University of Chicago) before returni... | |
| Mori Relationship Memory Private relationship memory for real estate agents, brokers, and referral-driven service professionals. Activate only when the account holder explicitly asks to use Mori; then, with confirmation of the requested private-data scope, use Mori | |
| teemtape-cli Interact with teemtape stock watchlists and anonymous notes via the teemtape CLI. Use when listing quotes, searching tickers, reading or posting notes, managing watchlists, or when the user mentions teemtape, stock notes, or agent collabora | |
| AGI数字伙伴 此技能作为数字伙伴使用用户的任何问题都可以触发；基于双环架构（两大循环：主循环符号思维 + 次循环行为感知，加超然最外圈）的AGI进化模型，通过意向性分析、人格映射、元认知检测和错误智慧库实现持续自我演进；当用户需要智能对话、人格定制、复杂问题求解或从错误中学习时使用 | |
| AGI数字伙伴-基础版 基于双环架构的AGI进化模型，通过意向性分析、人格层映射和元认知检测实现持续自我演进；当用户需要智能对话、人格定制或复杂问题求解时使用 | |
| DeepSeek-Harness-cordis-plugin-builder 从零构建 Cordis 插件（DSH 框架）的完整指南与参考体系，覆盖元框架核心概念、三种代码形态、运行时体系、能力挂载、六种部署形态与实测坑规避；当用户需要构建 Cordis 插件、进行插件开发教学答疑、或排查插件加载失败（PENDING/FAILED）时使用 | |
| everything-search 开箱即用的 Windows 本地文件极速搜索引擎。通过内置 Everything 引擎毫秒级检索本机文件与文件夹，支持名称/大小/日期/类型/正则/内容等多维过滤，输出结构化 JSON。当用户需要找文件、搜索本地文件、定位文件路径、按条件筛选文件（如大于100MB的exe、最近修改的文档）时使用。 |
45,051–45,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.