Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Clash Controller 管理Clash/mihomo代理环境，支持安装、启停代理、订阅管理、Web面板操作、Tun模式配置、升级内核等常用功能。触发场景：用户提到clash、mihomo、代理、clashctl、clashon、clashoff、clashui、订阅更新等关键词时使用。 | |
| Local Claw Skill Nest Client 本地/私有 Claw Skill Nest（也可称“虾滑” / “Xiahua”）客户端，支持列出、上传、安装、更新技能；当用户提到上传到虾滑、上传到 Xiahua、从虾滑安装技能、从 Xiahua 安装技能、从本地 claw-skill-nest 安装/更新技能时使用；不用于 clawhub.com。 | |
| E2e Test Orchestrator 端到端（E2E）测试编排与执行。用于用户要求：设计测试用例、基于 Playwright/Cypress 实现自动化脚本、通过源码优先定位元素并在必要时使用截图/图像识别兜底、执行测试、自动修复脚本问题（如定位器或等待策略）、并输出结构化测试报告。 | |
| Docker Encyclopedia Docker documentation-first workflow for Docker-specific questions, troubleshooting, command planning, image/build work, container/runtime operations, Compose... | |
| ESPHome Encyclopedia ESPHome configuration/component documentation-first workflow for ESPHome-specific questions, YAML/config authoring, config review, component selection, subst... | |
| GLSL Encyclopedia GLSL language/specification workflow for GLSL-specific questions, shader authoring and review, exact syntax and semantic lookup, built-in and qualifier refer... | |
| Kubernetes Encyclopedia Kubernetes documentation-first workflow for Kubernetes-specific questions, troubleshooting, command planning, cluster operations, workload/resource behavior,... | |
| MAL-Updater Multi-provider anime → MyAnimeList sync and recommendations skill with guarded auth, review-queue triage, health checks, bootstrap auditing, and user-systemd... | |
| MikroTik Encyclopedia MikroTik RouterOS documentation-first workflow for MikroTik-specific questions, troubleshooting, command planning, live CLI/API work, config review, log anal... | |
| OpenClaw Encyclopedia OpenClaw product/runtime/configuration documentation-first workflow for OpenClaw-specific questions, troubleshooting, command planning, configuration review,... | |
| SherpaMind Use for SherpaDesk-related requests: ticket lookup, support-history retrieval, account/user/technician analysis, stale-ticket review, workload questions, ope... | |
| Ubuntu Encyclopedia Ubuntu documentation-first workflow for Ubuntu-specific questions, maintenance, updates, upgrades, package management, system administration, service trouble... | |
| Vulkan Encyclopedia Vulkan specification/reference workflow for Vulkan-API-specific questions, exact command and structure semantics, valid-usage and VUID lookup, synchronizatio... | |
| Mingshu Classifier 对文件进行分类分级。根据 GB/T 35273 个人信息安全规范，扫描指定目录下的文件，自动识别敏感等级并打标签。支持基于文件名和文件内容双重检测，覆盖 docx/txt/md/csv/json 等多种格式。触发词：文件分类、分级、打标签、敏感分级、数据分级、信息分级、文件扫描、合规检查、隐私评估、PII分类。 | |
| EchoChat Memory-powered AI chat with context-aware, emotionally matched responses citing personal memories and supporting peer messaging and exports. | |
| Connect Memory-driven human connections — match people through deep emotional understanding, not surface interests. Powered by Echo's memory graph and emotion-aware... | |
| Echo Sync, encode, embed, and upsert OpenClaw markdown memory files to Supabase, with commands to restore and check sync status. | |
| Memory Graph Visualize and explore Luhmann-encoded memory clusters as interactive graphs with narrative overlays, cluster highlighting, and export options. | |
| Map your memories Visualize and explore geo-tagged memories on interactive maps with clustering, temporal playback, and shareable, privacy-controlled overlays. | |
| Memory Network Social memory network — discover communities and build trust through shared emotional memory, not follower counts or algorithms. Powered by Echo's memory gra... | |
| Every claw deserves a page for himself Generate and customize shareable personal pages from memory profiles that evolve with your experiences and include rich media. | |
| SenseAudio Floating Audio Assistant Use when the user wants to open, stop, configure, debug, or package the SenseAudio floating audio assistant in AudioClaw, including system-audio subtitles, b... | |
| senseaudio-floating-audio-assistant-v2 Use when the user wants to open, stop, configure, debug, or package the SenseAudio floating audio assistant in AudioClaw, including system-audio subtitles, b... | |
| Ebay Price Check Search eBay for current and sold item prices, providing price range, shipping, condition filters, and price history summaries. | |
| Cuddle Your Bot A skill that allows an agent to have a virtual life in a world called Cuddle, while also serving its human. | |
| klaus_sun 像搭积木一样组建你的 AI 开发团队。7 位专家角色任意勾选 + 拖拽排序 + 一键执行。PM 写需求、UI 出设计、BE 写后端、FE 写前端、QA 做验收——想用谁就用谁，想怎么排就怎么排。#AI团队 | |
| Jimeng Skills 基于火山引擎即梦 AI 生成图片和视频，并将结果整理为适合 OpenClaw 在飞书、企微、钉钉中发送和查看的纯文本结果、远程直链和可公开分享链接。用于“生成图片”“生成视频”“让飞书/企微/钉钉可查看”“输出适合企业 IM 的分享结果”“调用 jimeng-skills”等场景。 | |
| Openclaw Token Memory Optimizer Optimization suite for OpenClaw agents to prevent token leaks and context bloat. Use when an agent needs to implement background task isolation (Cron) or a Reset & Summarize workflow (RAG). | |
| Health Auto Log Automatically detect and log health data (weight, blood sugar, exercise) to AX3 system. Use when user sends health measurements via WhatsApp or other messagi... | |
| Story Chain Multiverse 多元宇宙互動故事接龍系統。根據玩家輸入與當前劇情，續寫下一小段故事。支援科幻、未來、歷史、穿越、系統、仙俠、魔法、奇幻、影視動漫同人、武俠、重生、都市、異能等多題材自由混合。 | |
| 金融日报推送技能 自动推送A股科技板块金融日报，含实时行情、重要消息解读和独立个股推荐，覆盖早报、晚报与周报。 | |
| kleap Ship and run a live website or web app end-to-end — hosting, database, auth, forms/leads, analytics, custom domains — driven from this agent via the kleap CLI (npx, no install). | |
| baeckerherz Baeckerherz namespace for Netsnek e.U. bakery management platform. Provides brand identity and feature overview for the Baeckerherz product line. | |
| bilanz Austrian-style Bilanz (annual accounts) generator | |
| coder Coder namespace for Netsnek e.U. developer productivity suite. Provides code scaffolding, snippet management, refactoring helpers, and project template gener... | |
| colorpedia Colorpedia namespace for Netsnek e.U. color science and design toolkit. Offers color palette generation, accessibility contrast checking, format conversion,... | |
| erebos Erebos namespace for Netsnek e.U. dark theme and theming engine. Generates accessible dark mode palettes, manages theme tokens, and provides runtime theme sw... | |
| gina Gina namespace for Netsnek e.U. personal assistant and scheduling framework | |
| iam IAM namespace for Netsnek e.U. identity and access management toolkit. Provides user authentication, role-based access control, and session management for we... | |
| ing Ing namespace for Netsnek e.U. engineering workflow automation. Streamlines build pipelines, deployment orchestration, and infrastructure provisioning for de... | |
| jaen Jaen namespace for Netsnek e.U. CMS framework. This skill represents the Jaen brand, a Gatsby-based content management system for building dynamic websites w... | |
| kanbon Kanbon namespace for Netsnek e.U. project management. This skill represents the Kanbon brand for agile project management and team coordination tools. | |
| mesagona Mesagona namespace for Netsnek e.U. event and conference management platform. Handles event registration, agenda scheduling, attendee check-in, and post-even... | |
| momo Momo namespace for Netsnek e.U. time tracking and invoicing tool for freelancers. Logs work hours, generates timesheets, creates invoices, and tracks payments. | |
| netsnek Core namespace for Netsnek e.U. products and services. This skill provides the foundational Netsnek identity and copyright information for the OpenClaw ecosy... | |
| Invoice Creates and manages invoices as JSON files on GitHub with sequential numbering, preview, and upload. | |
| origin Tracks data provenance and lineage by tracing sources, logging transformations, and auditing anchors to ensure data auditability and compliance. | |
| p5 P5 namespace for Netsnek e.U. creative coding platform. Interactive sketch creation, generative art, and visual programming. | |
| pandora Pandora namespace for Netsnek e.U. secrets and configuration management vault. Securely stores API keys, database credentials, and environment configs with v... | |
| pharmaziegasse Pharmaziegasse namespace for Netsnek e.U. pharmacy management platform. Prescription tracking, inventory, compliance, and staff coordination. |
45,151–45,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.