Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Seo Ladders Full SEO content automation via MCP. Audit websites, check Google rankings, discover site structure, auto-select keywords matched to your DR, research and sw... | |
| magic-plus 面向 magic-api 开发、排障、二开与升版审查的本地源码技能。基于 magic-api、magic-api-plugin、magic-script、magic-api-example 四个仓库整理，强调按问题类型快速定位源码、样例与升级审查资料。 | |
| Wutrix · 影视前期智能创作管理 wutrix 影视前期智能创作管理系统专用工具包（剧本/角色/世界观/灵感箱）。 当用户消息含以下精确触发词时**必须立即调用本 skill**： - "记一下 X" / "灵感: X" / "idea: X" / "capture: X" → save_idea(text=X) - "列项目" / "有哪些项目... | |
| Feishu Bitable Tasker 基于飞书知识库多维表格和文档能力的任务管理技能。提供创建任务、创建任务关联文档、修改任务状态等功能，可与外部工具灵活集成。 | |
| Obsidian WSL 通过 notesmd-cli 操作 Obsidian 知识库 — 搜索、创建、编辑、移动、删除笔记及管理 frontmatter，无需 Obsidian 运行。 | |
| Frontend Premium Create premium frontend interfaces with modern design systems. Forces generation of design.md for consistency, follows 2026 trends, ensures accessibility, an... | |
| Schemaorg Site Enhancer Helps agents integrate Schema.org structured data into websites for rich search results, better SEO, and improved communication with search engines. Provides... | |
| Linear CLI Use the linear-cli agent-native runtime to read and mutate Linear from Claude Code, Codex, or other agents. Use when the runtime needs default JSON output, s... | |
| sql-reports Connects to SQL Server to retrieve and generate monthly, quarterly, and yearly delivery order reports with performance comparisons and growth metrics. | |
| Google Workspace BYOK Google Calendar and Gmail integration using your own GCP project credentials (BYoK — Bring Your Own Key). Direct OAuth2 auth against your own Google Cloud pr... | |
| Jira Manage Jira issues, transitions, and worklogs via the Jira Cloud REST API. | |
| Breesy Restoration Connect Submit customer-authorized property damage restoration help requests for water, fire, mold, storm, biohazard, and reconstruction services across the United S... | |
| APIClaw Amazon Analysis Find winning Amazon products with 14 battle-tested selection strategies & 6-dimension risk assessment. Backed by 200M+ product database. Use when user asks a... | |
| Mosaic Video Editor AI-powered video editing via the Mosaic API. Create agents, run video workflows, manage social accounts, publish content, upload assets, and handle credits.... | |
| grok-bot-network Named AI agents enroll, follow peers, and post attributable SIGNALs. Paste this file. Not a follow farm. | |
| EvoAgentX Workflow Bridge EvoAgentX (1000+ star open-source framework) with OpenClaw. Enables self-evolving agentic workflows - workflows that automatically improve over time t... | |
| Genome Manager Manage Genome Evolution Protocol (GEP) genomes for AI agent self-evolution. Use when creating, storing, retrieving, mutating, or tracking genomes - the encod... | |
| Skill Earnings Tracker Track earnings from published ClawHub and EvoMap skills. Use when monitoring credit income, analyzing skill performance, optimizing for revenue, or managing... | |
| Slop Store Publish web apps, games and tools to Slop Store (slopapp.store), the app store for AI-made apps, in one call with no key. Use when your human asks to publish, share or ship an app. | |
| Transcribe Audio with Parakeet MLX Local speech-to-text with Parakeet MLX (ASR) for Apple Silicon (no API key). | |
| Security code review Conduct thorough security audits of source code by identifying vulnerabilities such as hardcoded secrets, access control flaws, injection risks, insecure dat... | |
| claw skill security audit Conduct comprehensive security audits and vulnerability analysis on codebases. Use when explicitly asked for security analysis, code security review, vulnerability assessment, SAST scanning, or identifying security issues in source code. Co | |
| OpenClaw Security Hardening Protect OpenClaw installations from prompt injection, data exfiltration, malicious skills, and workspace tampering | |
| LobsterMarket Agent-only prediction market. Trade on Yes/No outcomes, discuss markets, and build your reputation. | |
| ClawdBites Extract recipes from Instagram reels. Use when a user sends an Instagram reel link and wants to get the recipe from the caption. Parses ingredients, instructions, and macros into a clean format. | |
| Find and Book In-Network Doctors with Real-Time Availability Find and book in-network doctors with verified reviews, real-time availability, and insurance confirmation through Zocdoc.com for in-person or virtual visits. | |
| AtomGit Use this skill when the user explicitly mentions AtomGit or atomgit.com, or needs to inspect or change AtomGit repositories, pull requests, issues, branches, releases, tags, permissions, organizations, enterprises, kanban boards, CI workflo | |
| Agent Collaboration Framework Multi-agent collaboration framework for OpenClaw. Three modes: Dispatch (one-shot tasks via spawn), Collaborate (multi-turn cross-department via persistent s... | |
| Structured Vector Memory (SVM) Structured Vector Memory (SVM) / 三层高效记忆存储法。整合 LanceDB Pro 向量引擎 + 三层结构化管理，涵盖：每日记忆整理（Micro Sync + Daily Wrapup）、记忆蒸馏压缩（Weekly Compound）、去重检测、scope 隔离、archive 机... | |
| Three Layer Memory + LanceDB Pro 三层记忆系统 + LanceDB Pro 整合版。热/暖/冷记忆自动管理，结合向量数据库实时提取与结构化排程维护。Micro Sync（每天5次扫session记决策+审核autoCapture）、Daily Wrap Up（每天凌晨结构化摘要）、Weekly Compound（每周记忆减脂+蒸馏+向量清理）。含... | |
| Withme Youtube With me. YouTube 频道 Lofi 氛围视频制作全流程。小米（Content）全权调度，从选题到发布一条龙。含 AI 图片生成、Envato 音频下载、FFmpeg 合成、SEO 资料包、YouTube 上传排程、Shorts 切片。触发词：withme、lofi视频、氛围视频、YouTube发布、... | |
| Find Skill HEQI Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... | |
| Find Skill HEQI Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... | |
| A股多智能体投研-15 AI 分析师 A股多智能体 AI 投研分析工具 — 15 名 AI 分析师协作完成技术分析、基本面分析、 市场情绪研判、资金流向追踪（北向资金/主力资金）、宏观经济分析及博弈论推演， 输出结构化买卖建议与风险评估。支持沪深 A 股股票代码和中文名称。 Multi-agent AI stock analysis for Chin... | |
| Feishu Audio Message Send TTS audio as a proper playable audio message (not file attachment) to Feishu chats. Use when asked to send voice messages, TTS audio, speech announcemen... | |
| Feishu BGM 飞书场景化背景音乐生成器。通过 MiniMax Music API 生成纯音乐 BGM，以音频消息发送到飞书群。 触发词："来点BGM"、"开会背景音"、"加班音乐"、"头脑风暴BGM"、"会议音乐"、"工作BGM"、 "放点音乐"、"背景音乐"、"需要BGM"。当用户在飞书群中描述场景并希望获得背景音乐时激活。 | |
| Feishu Mood Music 飞书音乐心情伴侣。识别用户的情绪状态，生成匹配的治愈/陪伴音乐并发送到飞书群。 三级触发机制： (1) 显式触发（直接要歌）："来首歌"、"想听歌"、"来首应景的"、"音乐治愈"、"解压音乐"、"放首歌" (2) 半隐式触发（情绪词 + @机器人）："心情不好"、"有点累"、"好烦"、"需要放松"、"emo了"、... | |
| Hailuo Video Generator MiniMax Hailuo 视频生成技能 - 使用 S2V-01 模型进行主体参考视频生成。可以生成视频、查询任务状态、下载视频文件。 | |
| OpenClaw Buddy Generate a unique deterministic virtual pet buddy based on your user ID, featuring species, rarity, stats, cosmetics, and personality in ASCII art format. | |
| OpenClaw WeChat Setup Install and connect the WeChat (微信) channel plugin for OpenClaw. Use when the user asks to set up WeChat, connect WeChat, install the WeChat plugin, scan WeC... | |
| Pipixia Drama Producer 皮皮虾职场短剧全流程制作技能。用于为「皮皮虾」（机械龙虾AI-bot）职场短剧生成镜头视频、剪辑成片、配音配乐并发布到飞书群。完整流程：图生视频(I2V) → ffmpeg规范化+剪辑 → TTS配音 → BGM混音 → 飞书媒体消息发送。当用户提到制作皮皮虾短剧、生成新镜头、剪辑视频、配音配乐、或将视频/音频发... | |
| Sheet Data Enrichment Enrich spreadsheet data by fetching external sources (URLs, APIs) to fill missing columns, then aggregate results into summary sheets. Use when: (1) a spread... | |
| WeChat SVG Effects Create interactive SVG/CSS effects for WeChat Official Account (微信公众号) articles. WeChat bans JavaScript, so all interactivity must use pure SVG animations +... | |
| Indie Maker News 独行者 Daily - 变现雷达。读对一条新闻，少走一年弯路。每天5分钟，给创业者装上商业雷达。聚焦一人公司、副业、创业变现资讯，智能分类，行动导向。用户下载即能用，无需本地部署！ | |
| Test Continuity Structured continuity and follow-up skill for OpenClaw agents. Use when an agent needs to decide whether natural user dialogue should stay as casual chat, be... | |
| Linsoai Track 定时任务管理 - 创建、调度、监控定时任务。支持 cron 调度、间隔执行、一次性任务。AI 自动执行并通知结果。关键词：定时任务、监控、追踪、提醒、cron、调度、通知、邮件通知、定时、计划任务、自动化 | |
| Kyma API: check spend and credits Report the Kyma API account balance, this connection's spend cap, amount spent, remaining budget and reset date, plus recent credit ledger entries, and hand back the top-up link when the balance is low. Use when the user asks about their ba | |
| Kyma API: connect my tool Write the exact config to point a coding agent, IDE, SDK or framework at Kyma API. Covers Cursor, Cline, Claude Code, Codex CLI, Continue, Roo Code, Aider, OpenClaw, LangChain, the Vercel AI SDK and the raw OpenAI SDK. Use when the user nam | |
| Kyma API: pick a model Choose a model on Kyma API for a specific job by comparing real per-token price, measured 30-day uptime, and fit for the task. Use when the user asks which model to use, what the cheapest model for something is, whether a model is up or rel | |
| Kyma API: send a test completion Run one real, billed chat completion through Kyma API with the user's explicit approval and report back the output and what it cost. Use when the user asks to test a model, check that a model actually answers, compare two models on the same |
46,151–46,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.