Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Regime Transition Detects imminent regime transitions before they fully materialise | |
| Regime Transition Probability Probabilistic regime transition forecast with timing estimate | |
| Regime Transition Probability Institutional Institutional regime transition model with confidence intervals | |
| Risk Assessment Bundle Provides real-time portfolio heat, liquidation pressure, and position exposure risk metrics from APEX Runner's live trading system across major crypto exchan... | |
| Signal Intelligence Aggregated signal quality score across all active APEX modules | |
| Slippage Forecast Predicts expected slippage for a given order size and market condition | |
| Token Unlock Upcoming token unlock events that may create sell pressure | |
| Trading Intelligence Bundle Provides real-time momentum, whale sentiment, and regime confluence trading signals from APEX Runner's live autonomous system. | |
| Trend Confirmed Confirms whether the current trend has sufficient momentum to trade | |
| Volume Analysis Volume profile analysis detecting accumulation or distribution patterns | |
| Whale Sentiment Whale leaderboard sentiment derived from Hyperliquid top traders | |
| Creative Agent OS North Star Review or shape product and architecture decisions for a lightweight creative agent OS. Use when comparing runtimes, cloud execution, agent system shape, cod... | |
| Offer Positioning Auditor Audit a product or service offer for clarity, differentiation, and buying friction. Use when improving positioning, promise, audience fit, and conversion bef... | |
| Personal Finish Notifier Add a simple "Claude has finished." alert to Claude Code or other agent workflows through an OpenClaw-configured transport. | |
| Skill Listing Polisher Improve a skill's public listing before publish. Use when tightening title, description, tags, changelog, and scan-friendly packaging so the listing looks cl... | |
| Multichain Protocol Turn any AI agent into a 19-chain crypto wallet via MeneseSDK on ICP. Send tokens, swap on DEXes (Raydium, Uniswap, ICPSwap, KongSwap, Cetus, Minswap), bridg... | |
| A股/港股/美股数据查询 Use this skill when the user wants Chinese stock market data or analysis, including A-share行情、上证/深证/创业板指数、个股K线、涨跌停统计、资金流向、基本面、板块表现、港股美股行情、基金可转债、财经新闻和研报。 The... | |
| 抖音实时上升热点榜 调用抖音上升热点榜接口，获取实时热点上升趋势数据。使用此技能当用户需要：获取抖音热榜/上升热点/热点趋势数据、调用 /douyin/billboard/fetch_hot_rise_list 接口、使用 azt_api_key 调用热榜接口、用 Python 脚本拉取抖音热点上升榜单。Use this skill... | |
| 抖音文案解析 Call the coze-js-api Douyin transcription endpoint and return transcript-ready results from Douyin URLs or share-text. Use this skill whenever the user asks... | |
| google-search-web 调用 Google 网页搜索接口，获取实时网页搜索结果。使用此技能当用户需要：Google 搜索/网页搜索/搜索引擎查询、调用 /google/search/web 接口、用 Python 脚本执行 Google 搜索、获取搜索结果列表（标题/链接/摘要）。Use this skill for Google we... | |
| publish-to-wechat AI-ready skill to format and publish Markdown articles to WeChat Official Accounts using Wenyan CLI. | |
| 推特(X)数据接口 调用 Twitter 推文详情和搜索时间线接口，获取推文内容、作者信息、互动数据和搜索结果。Use this skill for Twitter tweet detail and search timeline API calls. | |
| unkey-cli 使用 Unkey CLI 在终端中管理 API namespaces、keys、identities、permissions、rate limits 和 analytics 查询。当用户提到 unkey 命令、API key 管理、限流、RBAC 权限、身份分组或 key 验证排查时触发。Use this ski... | |
| AI网站一键发布 免费 AI 网站一键上线助手（内部标识：vibecoding-deployment-auditor）：适合国内用户与零基础小白，无需 Git、服务器、域名或复杂部署配置；面向 VibeCoding 生成的纯静态网站，适用于官方 Sites/ChatGPT Sites 上线不成功或不适用时，通过私有 ZIP 链路完成上线并验证公开 HTTPS 地址。支持 H5 小游戏、个人作品集、企业官网、活动落地页、数据可视化及浏览器直连公开 HTTPS API 的前端工具；最终产物必须可本 | |
| Volcengine Web Search 调用火山引擎联网搜索接口，获取 web / web_summary / image 搜索结果。使用此技能当用户需要：联网搜索、火山联网搜索、web_summary 总结、调用 /volcengine/web-search 接口、使用 Python 脚本请求并读取 summary_text / 搜索结果。Use t... | |
| 字幕菌 字幕菌（zimujun）：从主流视频平台链接提取视频文案/字幕文本。适用于 YouTube、TikTok/抖音、小红书、Bilibili 等平台。 | |
| Blockly Block Builder Help users with [Blockly] - [Feature Request] - Add Blockly block to Enable/Disable Things. Use when a user asks for general-help, enhancement, blockly, feat... | |
| Bookkeeping Reconciliation Helper Help users with Validated demand: Finance and operations teams need repeatable workflows for reconciling bank feeds, invoices, receipts, payment processor ex... | |
| Budget Cash Flow Cleanup Helper Help users with Validated demand: Households, freelancers, and small businesses need practical help importing bank or card exports, categorizing transactions... | |
| Bun Migration Advisor Help users with Considerations about migrating away from bun?. Use when a user asks for work-productivity, considerations, migrating, away, bun, or needs a p... | |
| Business Operations Tavily Search Business Planner Helps with Agent users show strong demand for Tavily Search-s... | |
| Document Formatting Automation Helper Help users with Validated demand: Knowledge workers need practical help automating document formatting, find-and-replace, styles, and Word-like editing tasks... | |
| Error Message Improver Helps with Users and support teams need clearer error message... | |
| Error Message Improver Help users with Validated demand: Users and support teams need clearer error messages that explain what failed, why it failed, and what action to take next.... | |
| Error Message Improver Help users with Validated demand: Users and support teams need clearer error messages that explain what failed, why it failed, and what action to take next.... | |
| Error Message Improver Helps with Users and support teams need clearer error message... | |
| Error Message Improver Help users with Validated demand: Users and support teams need clearer error messages that explain what failed, why it failed, and what action to take next.... | |
| Error Message Improver Help users with Validated demand: Users and support teams need clearer error messages that explain what failed, why it failed, and what action to take next.... | |
| Error Message Improver Rewrite vague application, API, CLI, and support errors into diagnostic messages that explain what failed, why it likely failed, and the next safe action. Us... | |
| Error Message Improver Helps with Users and support teams need clearer error message... | |
| Error Message Improver Help users with Validated demand: Users and support teams need clearer error messages that explain what failed, why it failed, and what action to take next.... | |
| Error Message Improver Help users with Validated demand: Users and support teams need clearer error messages that explain what failed, why it failed, and what action to take next.... | |
| Error Message Improver Help users with Validated demand: Users and support teams need clearer error messages that explain what failed, why it failed, and what action to take next.... | |
| Error Message Improver Helps with Users and support teams need clearer error message... | |
| Error Message Improver Help users with Validated demand: Users and support teams need clearer error messages that explain what failed, why it failed, and what action to take next.... | |
| Error Message Improver Helps with Users and support teams need clearer error message... | |
| Error Message Improver Helps with Users and support teams need clearer error message... | |
| Error Message Improver Help users with Validated demand: Users and support teams need clearer error messages that explain what failed, why it failed, and what action to take next.... | |
| Error Message Improver Help users with Validated demand: Users and support teams need clearer error messages that explain what failed, why it failed, and what action to take next.... | |
| Error Message Improver Helps with Users and support teams need clearer error message... |
46,251–46,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.