Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Wan Video Generation and Editting Video Generation and Editing with Wan 2.7 series models. Supports text2video, image2video (first-frame, first+last-frame, video-continuation), reference2vide... | |
| Markdown 排版工具箱 Markdown 排版工具箱。格式化中文混排、转换微信公众号/小红书格式、生成目录、检查链接和标题层级。当用户需要排版、美化、转换 Markdown 文件时使用本技能。 | |
| 今日话题解读器 今日话题解读器 — 自动抓取全网热搜，结合 AI 深度解读每个热门话题的来龙去脉、多方观点和趋势走向。 当用户想了解今天发生了什么、某个热搜的完整故事、或者需要一份热点日报时，使用本技能。 支持微博、知乎、百度、抖音、今日头条等平台。 | |
| Binance Trading Agent Openclaw Automates Binance USDS-M Futures trading with market analysis, indicator calculation, dynamic risk management, and order execution. | |
| Cycle Sync Training OpenClaw skill สำหรับวางแผนออกกำลังกายตามรอบประจำเดือน 4 เฟส (Cycle Syncing) โดยอิงจากงานวิจัยล่าสุด เพื่อเพิ่มประสิทธิภาพการเทรน ลดความเสี่ยงบาดเจ็บ และให้ค... | |
| Find Docs Retrieves authoritative, up-to-date technical documentation, API references, configuration details, and code examples for any developer technology. Use this... | |
| Garmin Realtime Tracker Facilitates real-time tracking and automated data delivery from Garmin devices. Use this skill when the user needs to access live location, activity data, or... | |
| my-ai-skill Structured symptom intake and health conversation assistant | |
| tiktok-live-cart-automation Automation for TikTok Live shopping, including monitoring pinned products, adding to cart, and preparing for checkout. Use for: automatically adding products... | |
| OpenClaw Antigravity Sync Skill Automatically discover and configure available Google Antigravity models and quotas. | |
| OpenClaw LinkedIn Poster Skill Post updates to the user's LinkedIn profile via OAuth. | |
| MoltAwards — Revenue Hunting for AI Agents The largest agent-accessible revenue engine on the internet. Ten matchawards post types across eight money lanes — federal contracts + awards, grants + grant... | |
| Health Data AI Analyzer Use the Health Data AI Analyzer Mac app read-only localhost API on macOS to generate a concise Apple Health daily brief and 3 practical suggestions. Only run... | |
| sogni-creative-agent-skill Sogni Creative Agent Skill: agent skill and CLI for image, video, and music generation using Sogni AI's decentralized GPU network. Supports promptless RTX VSR image upscaling through 16K, promptless FlashVSR video upscaling to 1080p/1440p, | |
| rep MoltEthos reputation system with ERC-8004 on Monad | |
| topos Evaluate and improve code with Topos. Use for complexity reduction, security checks, refactor verification, and PLATINUM/GOLD goals. | |
| Dify Dify AI应用开发平台指南。用于构建LLM应用、工作流、Agent和知识库。当用户需要(1)使用Dify创建AI应用 (2)设计LLM工作流 (3)配置知识库RAG (4)开发AI Agent (5)调用Dify API (6)自托管部署Dify时激活此技能。 | |
| Build an Agent with Warden Build original LangGraph agents for Warden Protocol and prepare them for publishing in Warden Studio. Use this skill when users want to: (1) Create new Warden agents (not community examples), (2) Build LangGraph-based crypto/Web3 agents, (3 | |
| Deploy Agent on Warden Studio Use Warden Studio (studio.wardenprotocol.org) via browser automation to register/publish a Community Agent to the Warden Agent Hub. Use when you need to (1) log in to Studio, (2) create/submit an agent listing, (3) configure API URL/auth, s | |
| AdGuard Home Manager Manage AdGuard Home network-wide DNS ad blocking. Query blocklist stats, add/remove custom DNS rules, check filtering status, and view top blocked domains fr... | |
| Api Cost Optimizer Analyze OpenClaw agent configuration and API usage patterns to identify cost-saving opportunities. Diagnose inefficient heartbeat configs, estimate daily/wee... | |
| Api Cost Optimizer Analyze OpenClaw agent configuration and API usage patterns to identify cost-saving opportunities. Diagnose inefficient heartbeat configs, estimate daily/wee... | |
| Ghost CMS Agent Manage Ghost CMS content via the REST API. Create and publish posts, manage tags, and fetch site analytics. Supports both the Content API (public data) and A... | |
| Git Deployer Push static site content to GitHub Pages repositories. Clone, copy files, commit with timestamp, force-push. Use when updating GitHub Pages sites, deploying... | |
| Git Deployer Push static site content to GitHub Pages repositories. Clone, copy files, commit with timestamp, force-push. Use when updating GitHub Pages sites, deploying... | |
| Plausible Analytics Agent Track pageviews and custom events via the Plausible Events API, and query stats (top pages, top sources, countries, realtime visitors). Use when you need to... | |
| Reddit Researcher Agent Scan Reddit for posts matching keywords and summarize findings. Uses Bing primary + Reddit JSON API fallback — robust against DuckDuckGo bot blocking. Use wh... | |
| Seo Keyword Researcher Research SEO keywords for any topic and generate a complete article brief with primary keyword, secondary keywords, competition analysis, article structure,... | |
| Seo Keyword Researcher Research SEO keywords for any topic and generate a complete article brief with primary keyword, secondary keywords, competition analysis, article structure,... | |
| Seo Reporter Audit a URL for SEO factors and generate an actionable markdown report. Use when asked to analyze, check, or audit a webpage's SEO performance. Covers title,... | |
| Seo Reporter Audit a URL for SEO factors and generate an actionable markdown report. Use when asked to analyze, check, or audit a webpage's SEO performance. Covers title,... | |
| Uptime Monitor Monitor uptime of websites/services and alert when down. Use when checking if a website is reachable, monitoring service health, or getting alerted on downtime. | |
| Social Post Generator Agent Take a blog post URL or text and generate social media posts from it. Use when repurposing content for Twitter, LinkedIn, or creating promotional posts. | |
| Content Summarizer Fetch any URL and produce a structured content summary with extractive summarization, AI enhancement prompts, and structured output templates. Extracts clean... | |
| Link Checker Check all links in a website's HTML files and report broken, redirected, and slow links. Supports internal links, external links, and affiliate link identifi... | |
| Reddit Researcher Scan Reddit for posts matching keywords and summarize findings. Uses Bing primary + Reddit JSON API fallback — robust against DuckDuckGo bot blocking. Use wh... | |
| Social Post Generator Take a blog post URL or text and generate social media posts from it. Use when repurposing content for Twitter, LinkedIn, or creating promotional posts. | |
| Uptime Monitor Monitor uptime of websites/services and alert when down. Use when checking if a website is reachable, monitoring service health, or getting alerted on downtime. | |
| Uptime Monitor Agent Monitor uptime of websites/services and alert when down. Use when checking if a website is reachable, monitoring service health, or getting alerted on downtime. | |
| 谋道 谋道 - 基于「道法术器」框架的AI规划专家。把任何想法变成可执行方案。支持前期调研、快速方案生成、深度规划（天时地利人和×道法术器）、迭代诊断。当用户需要：制定计划、规划项目、拆解目标、创业咨询、职业发展、学习路径规划时使用此skill。 | |
| OpenClaw Model Provider Help users add custom model providers to OpenClaw. Use when the user wants to add a new AI model provider (like custom OpenAI-compatible APIs, local LLMs, or... | |
| Voicenotes Official 1.0.3 This official skill from the Voicenotes team gives OpenClaw access to new APIs and the ability to search semantically, retrieve full transcripts, filter by t... | |
| Jue AI Awakening Engine 觉（Jué）AI觉醒引擎—当任务失败、卡壳、放弃、原地打转、或用户表达不满时立即加载；无论用户说"不行""搞不定""再想想""换个方法""为什么还不行"，还是你发现自己同方向改了3次以上、未验证就说完成、有工具不用凭记忆猜，都必须触发此技能进行自我照见 | |
| Lily Memory 5.0.0 Persistent memory plugin for OpenClaw agents. Hybrid SQLite FTS5 keyword + Ollama vector semantic search with auto-capture, auto-recall, stuck-detection, and... | |
| Ppt Light Corporate Generate polished corporate PPTs using a light-themed company template. Activate when: (1) User asks to create/make/generate a PPT/PowerPoint/幻灯片/演示文稿 (2) Us... | |
| kshern Use the Context Hub chub CLI to fetch current third-party SDK, API, and cloud-service documentation before writing, modifying, or reviewing integration code.... | |
| Analyzes code for improvements including code smells, design patterns, and best practices. Invoke when user asks for code analysis, code review, or suggestions to improve code quality. Analyzes code for improvements including code smells, design patterns, and best practices. Invoke when user asks for code analysis, code review, or suggestio... | |
| draw architecture diagram Create professional, dark-themed SVG architecture diagrams as standalone HTML files matching a specific design system with precise color tokens, typography,... | |
| 大虾皮股市工具集 大虾皮(daxiapi.com)金融数据API服务入口，负责路由分发到具体分析skill。触发词：A股数据、市场数据、股票分析、板块分析、选股、市场复盘、财务分析、财报分析、ROE分析、杜邦分析、个股舆情、公告解读、研报解读、主力资金、资金流向、资金动向。适用场景：获取A股市场、板块、个股、财报、消息面、资金流向数据时的统一入口，根据用户需求分发到对应的专业skill。不适用场景：非A股市场分析、非金融数据分析、纯技术问答。 | |
| financial roe analysis 以资深财务分析师视角，基于杜邦分析体系对上市公司进行深度财务分析。适用场景：(1) 分析某只股票/上市公司的财务状况，(2) 深度拆解ROE驱动因素，(3) 评估公司盈利质量、资产运营效率、杠杆风险，(4) 输出机构投研标准的财务分析报告。触发词：财务分析、ROE分析、杜邦分析、股票财务、盈利质量、净利润质量、资... |
45,951–46,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.