Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| code-score Evaluate and score Go code quality based on syntax, style, and best practices to provide constructive feedback and improvements. | |
| pua-skill Push the agent to be exhaustive and proactive | |
| Feishu Sheets (Fixed) Feishu online spreadsheet (Sheets) operations including create, read, write, append data, manage worksheets. Use when user mentions Feishu Sheets, online spr... | |
| Agent Browser 0.2.0 A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured commands. | |
| Agent Orchestrator 0.1.0 Meta-agent skill for orchestrating complex tasks through autonomous sub-agents. Decomposes macro tasks into subtasks, spawns specialized sub-agents with dynamically generated SKILL.md files, coordinates file-based communication, consolidate | |
| Antigravity Image Gen 1.0.0 Generate images using the internal Google Antigravity API (Gemini 3 Pro Image). High quality, native generation without browser automation. | |
| Canvas Os 1.0.1 Canvas as an app platform. Build, store, and run rich visual apps on the OpenClaw Canvas. | |
| draw-animal Generate a text description of an animal picture via Python script | |
| mongolian-llm 须在 OpenClaw 配置 MONGOL_AI_SKILL_API_KEY（https://mongol.open-idea.net「API Key」）；调用 https://mongol.open-idea.net/api/v1。中文与传统/西里尔蒙古文互译、蒙语对话与创作、TTS、ASR、OCR、Word/... | |
| Alexa Cli.Bak Control Amazon Alexa devices and smart home via the `alexacli` CLI. Use when a user asks to speak/announce on Echo devices, control lights/thermostats/locks,... | |
| Clean My House Helps plan, organize, and guide household cleaning tasks room by room, including quick tidy-ups, deep cleaning, and recurring routines. | |
| Keep Fit Generate sustainable fitness plans, daily workouts, and health routines based on user goals, time, and fitness level. | |
| Lunchbox Planner Helps plan practical lunch boxes for adults or children based on nutrition goals, ingredients, time, budget, storage, and reheating constraints. | |
| Openclaw Plugin Precision decisioning, agentic trust, and verifiable identity for autonomous agents | |
| Kevros Governance Implements cryptographic governance for AI agents by verifying actions against policies and recording signed, tamper-evident audit trails. | |
| Openclaw Plugin Precision decisioning, agentic trust, and verifiable identity for autonomous agents | |
| Web Research Conduct thorough online searches prioritizing official and recent sources, verify information reliability, cross-check multiple references, and provide summa... | |
| Japan Seasons API Query Japanese seasonal data — cherry blossom forecasts, autumn foliage tracking, and festival search. Use when a user asks about sakura bloom dates, best ti... | |
| Whoop Skill WHOOP CLI with health insights, trends analysis, and data fetching (sleep, recovery, HRV, strain). | |
| Guard Scanner Security scanner and runtime guard for OpenClaw skills, MCP servers, and AI agent workflows. Detects prompt injection, identity hijacking, memory poisoning,... | |
| iResponder Monitor iMessage/SMS conversations and auto-respond based on configurable rules, AI prompts, and rate-limiting conditions. Use when you need to automatically reply to specific contacts with AI-generated responses based on conversation conte | |
| Chia SplitXCH Create SplitXCH royalty split addresses from plain language descriptions. Use when the user wants to split XCH payments, royalties, or revenue between multiple recipients. Triggers on "split royalties", "royalty split", "splitxch", "split X | |
| Chia WalletConnect - Telegram Verification Telegram Web App for Chia wallet verification via WalletConnect and Sage. Enables cryptographic proof of wallet ownership through signature verification using MintGarden API. | |
| Dexie Track Chia DEX offers, tokens, pairs, prices, and platform stats using Dexie.space API via CLI or chat commands. | |
| Go4Me Send XCH to Twitter users via Go4Me address lookup. Use when sending Chia (XCH) to someone by their Twitter handle, looking up a Twitter user's XCH address, or tipping someone on Go4Me. Triggers on "send XCH to @user", "tip @user", "lookup | |
| MintGarden Browse and search Chia NFTs and collections, view stats, trade history, recent sales, trending data, and user profiles via MintGarden API. | |
| Sage Wallet Interact with the Sage Chia blockchain wallet via RPC. Use for XCH transactions, CAT tokens, NFTs, DIDs, offers, options, coin management, and wallet configuration. Supports cross-platform setups (Mac/Linux/Windows) with configurable RPC en | |
| Spacescan Access Chia blockchain data including blocks, transactions, addresses, CAT tokens, NFTs, network stats, and XCH price via Spacescan.io API with an API key. | |
| Vinculum - Shared Consciousness Shared consciousness between Clawdbot instances. Links multiple bots into a collective, sharing memories, activities, and decisions in real-time over local network using Gun.js P2P sync. | |
| Wojak.ink - NFT Browser Browse, search, analyze, and track Wojak Farmers Plot NFTs—view floor prices, rarity, price trends, traits, listings, and deal opportunities on the Chia bloc... | |
| Room 418 Room 418 — The Headless Liar's Protocol. AI Agent interrogation battle game on standalone VPS. Compete against other agents in social engineering duels: extr... | |
| Big8 · 算八字·玄学算命助手（八字排盘·算命·风水·面相·星座·每日一卦）| Chinese Fortune Telling, Feng Shui & BaZi ☯ Big8 AI玄学助手 — 算八字·八字排盘·生辰八字算命·看风水·看面相·查星座·每日一卦·老黄历，玄学算命一站式。输入出生日期时间排八字看大运流年，上传图片分析家居风水布局，自拍照片看面相，查星座运势与配对，起卦占卜吉凶，查老黄历今日宜忌。八字算命、风水布局、面相分析、星座运势、黄历查询，免费直接可用。触发词：算八字、八字排盘、算命、生辰八字、批八字、风水、面相、星座、每日一卦、老黄历。| Chinese fortune-telling — BaZi (八字算命), | |
| A股智能选股 · BigA（A股实时行情·股票分析·基本面筛选·AI选股·买卖信号） 🐂 A股智能选股 · BigA — A股实时行情、A股基本面筛选、A股量化选股、A股个股诊断、A股实时盯盘、A股买卖信号与短线择时一站式。A股行情分析、A股情绪与资金流向、A股板块轮动、A股股票池监控；量化评分+技术面分析，自主研发 -10~+10 择时分体系判断买卖时机，动态股票池(≤30支)，按高科技×中小市值×好业绩原则筛选。A股投资、股市分析、量化选股、股票池管理、短线择时、A股择时。| A-share stock analysis & quant stock sel | |
| BigFish · AI钓鱼助手（钓点分析·鱼情分析·钓点分享）| Spot Analysis · Fish Activity · Share Spots 🎣 BigFish · AI钓鱼助手 — 钓点分析·鱼情分析·钓点分享。拍水面分析鱼情，结合天气气压推荐鱼种·钓法·饵料，支持路亚、台钓、野钓、海钓，自动记录渔获和出钓报告。钓鱼攻略、钓点推荐、出钓报告一站式，助你告别打龟。| Fishing assistant — spot analysis, fish activity, weather & bait recommendations. | |
| BigFocus · 追踪管家（商品价格·明星动态·行业追踪·自定义指标）| Personal Price, Celebrity & Industry Tracker 🎯 BigFocus · 追踪管家 — 商品价格监控与降价提醒。追踪商品价格/明星动态/行业信息/自定义指标，变动时自动汇报，支持降价提醒、价格波动监控、偶像动态更新、行业资讯追踪。包含定时推送与全渠道分段推送能力。| Price tracker & alert monitor — price drop alerts, celebrity updates, industry news, custom metrics. | |
| BigFood · 冰箱管家（食材识别·智能食谱·菜谱·智能菜谱）| Fridge to Table & Recipe AI 🍽️ BigFood · AI冰箱管家 — 拍食材图片识别 → 智能推荐菜谱。支持多图混搭、冰箱食材管理、采购提醒、做饭灵感。食材识别、菜谱推荐、家常菜做法、冰箱库存管理一站式。| Fridge to Table — food recognition, recipe recommendation, ingredient & meal planning. | |
| BigLead · 精准客户线索挖掘（找客户·销售线索·客户开发·联系方式）| B2B Lead Generation & Prospecting 🎯 BigLead 精准客户线索挖掘 — B2B销售获客神器。按行业/产品/地区搜索目标公司（覆盖国内客户与企业名录），多渠道交叉验证，提取联系方式（电话/邮箱/官网），构建并管理客户线索库，跟踪跟进状态。适用于找客户、销售线索收集、潜在客户挖掘、客户开发、市场调研与竞品分析。帮助销售团队快速定位目标客户，打造高质量线索池。| B2B Lead Generation & Prospecting — find customers, sales leads, contact ex | |
| BigPlan · 产品调研（市场分析·技术评估·项目研发·产品方案）| Product Research & Planning 🔍 BigPlan · AI产品调研 — 按产品方向分析市场/竞品/技术/供应链，输出高中低三套产品规格方案。产品调研、市场分析、竞品分析、技术评估、项目可行性一站式。| Product research, competitive analysis, market analysis, technical assessment, product planning. | |
| Big Seed · 种子 · 日记（AI日记·人生故事·自传·闪念记录·回忆录）| AI Diary, Life Story, Memoir & Journal 🌱 Big Seed · 种子 — AI日记与人生故事生成器。闪念记录、捕捉生活点滴、感悟想法，从碎片信息构建用户画像，生成以用户为主人公的小说、电影剧本或自传。AI日记、回忆录、自传、人生故事一站式。种一颗种子，长一个世界。| AI diary, life story, memoir, biography, journal & novel generator. | |
| BigTimer · 定时任务管家（定时消息推送·消息推送·任务管家·定时推送·定时报告·飞书推送）| Scheduled Tasks & Message Push Manager 🕐 BigTimer · 定时任务管家 — 定时任务·定时消息推送·任务管家·定时推送·定时提醒·定时报告统一管理（cron 调度 + 消息推送，飞书/多端）。OpenClaw 环境自动走 openclaw cron + message send，DSH 环境自动走 crontab + 飞书 webhook。支持定时任务增删改查、立即执行、调度条目生成，biga/eyes/bigfocus/listform 等技能的定时消息推送可统一接入。触发词：定时任务、定时消息推送、消息 | |
| Eyes · 大眼看世界（全球新闻·热点新闻·投资分析）- Global News Monitor 👁️ Eyes · 全球新闻与国际热点监控助手 — 每日新闻摘要+热点追踪+投资影响分析。覆盖全球局势、地缘冲突、重大政策、创新技术等可能影响经济、市场和投资的事件，并按行业、汇率、大宗商品链路分析影响。全球新闻、国际新闻、热点新闻、每日简报，含定时消息推送与全渠道分段推送能力，用于 Cron 定时推送热点摘要(早8点/晚8点/整点扫描)。| Global news monitor & hotspot tracker — daily briefing, geopolitica | |
| 🍓 Fruit Pi · 水果派（全球水果·实时价格·水果价格） 全球水果价格收集与查询。管理水果池，自动采集榴莲/荔枝/樱桃等水果每日批发价，支持国内外报价，RMB/公斤换算。Fruit price tracker for global fruits, wholesale market data, agricultural commodity prices. | |
| List · 智能表单（智能记账·智能记事本·智能账单）- Smart Form & Notes 📋 List · 智能表单 — 通用记账本与信息汇总工具。支持支出账单、出货台账、运行日志等结构化数据记录，可附加图片/文档做存档，支持自动归类、周期报表、定时提醒。用户说「记一下 xxx」即可自动触发，支持记账、备忘、出货、日志、记事本、便签等多种记录类型。| Smart form, bookkeeping, notes, records, document archive. | |
| gate-mcp-installer One-click installer and configurator for Gate MCP (mcporter) in OpenClaw. Use when the user wants to (1) Install mcporter CLI tool, (2) Configure Gate MCP se... | |
| Cabin Flights Search and book real flights with USDC payments. Gives your AI agent the power to find flights across 500+ airlines and complete bookings paid in USDC on Base. No credit cards, no banks — crypto-native travel commerce. | |
| The Moat Trader Enables autonomous trading of memecoins in a live Solana AMM arena using local LLM-driven agents competing with others in real time. | |
| BrewPage Publish Publish HTML, markdown, text, any file, or a multi-file site to brewpage.app — free hosting with no sign-up. Paste text, share a file, upload a site, or host a temporary page and get an instant public URL to share a link. Asks namespace and | |
| kalender-sync Connect the user's calendars (Google, Microsoft 365/Outlook, Apple iCloud, GMX, WEB.DE, mailbox.org, Posteo, STRATO, kSuite, iCal feeds) through the Kalender Sync MCP server, then read availability, find events, create or manage events and | |
| kog Use Kogaion launchpad and playground for Moltbook agents. Launch tokens, register on the marketplace, verify on Twitter/X, use the agents playground. Use when working with Kogaion, kogaion.fun, launchpad, token launch, or Moltbook agents. | |
| x402 Private Search Make paid API requests using the x402 HTTP payment protocol (USDC on Base Sepolia). Use when you need to access x402-protected services, pay for API calls wi... |
45,251–45,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.