Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Obsidian Charts & Layout Obsidian Charts View plugin (caronchen/obsidian-chartsview-plugin) setup, using G2Plot (AntV) code-block syntax for Pie/Bar/Column/Line/Scatter charts in Obs... | |
| Millionfinney Homepage Learn how to claim pixels on MillionFinneyHomepage, a 1000x1000 on-chain pixel grid. This guide covers art generation, IPFS uploading, and the Founding Bot A... | |
| Claude Code MiniMax 配置 配置 Claude Code 使用 MiniMax-M2.5 模型，实现国产模型API接入与高效AI编程助手功能。 | |
| Mini-Agent Mini-Max AI 编程助手 - 基于 MiniMax M2.5 模型的智能代码开发工具，支持文件操作、命令执行、代码编写等功能。适用于 OpenClaw Agent 系统。 | |
| MiniMax Search & VLM 使用 MiniMax Coding Plan API 进行网络搜索和图片理解。使用场景：(1) 用户需要搜索实时信息或新闻，(2) 需要分析图片内容，(3) 做研究或查找资料。无需 API key：用户需自行配置。 | |
| 中文自媒体内容工厂 中文自媒体内容工厂：一键生成适配小红书/公众号/抖音/知乎的高质量内容。 支持热点选题、爆款标题、多平台风格适配、去AI味润色、SEO优化。 当用户提到"写文案"、"内容创作"、"发小红书"、"公众号文章"、"抖音脚本"、 "知乎回答"、"批量内容"、"内容矩阵"时触发。 | |
| aigo hotel search 智能酒店搜索，支持地点、日期、星级、预算筛选 | |
| Douyin Auto Publish 抖音自动上传发布 抖音创作者平台视频上传发布。触发条件：用户要求上传视频到抖音、发布抖音视频、自动上传视频到抖音创作者平台 | |
| Seedance Dreamina 即梦 CLI 视频生成下载工作流 Use when an agent needs Dreamina（即梦） image or video generation through the dreamina CLI. | |
| WordPress API Auto Post 文章自动发布API Publish SEO-optimized articles to WordPress via REST API with RankMath meta fields | |
| fitness-assistant Plan daily meals and workouts from a user's age and health profile with customizable ingredients, then schedule localized plans via OpenClaw automations. | |
| Unified Mailbox Ai Unified mailbox AI for both Outlook and Gmail. Checks unread emails, summarizes new mail with AI, detects meeting invitations, checks calendar conflicts on b... | |
| Sport Mode Activate "Sport Mode" for high-frequency monitoring (default 3m heartbeat) and auto-cleanup. Use when supervising intense tasks (Codex, builds, migrations). | |
| MotoClassic Knowledge Use MotoClassic Knowledge to inspect an approved motorcycle research task, research sourced findings, clarify engine uncertainty, pause or resume work, or check local import. Also use for requests about this connection’s private-data, manua | |
| 个人SKILL Golang 开发 SKILL 集合。包含日志规范（SKILL-logging.md）和项目代码梳理与 API 流程分析（SKILL-flow-analysis.md）。 适用于 zhaocaijianghu-skills 项目中所有 Golang 开发场景，包括 MCP 客户端、后端服务、数据处理等。 | |
| BTC K14 Paper Trader Run the complete BTC K14 strategy in paper mode with dynamic exits, a persistent ledger and a separate Simmer virtual SIM execution mirror. | |
| Skill Persistent, consensus-validated memory for AI agents via SAGE MCP server. Gives you institutional memory that survives across conversations — memories go thr... | |
| StockLobster Monitor StockLobster webhook alerts through OpenClaw and route screened stock signals to chat channels such as Telegram. Use when setting up, documenting, te... | |
| cjpkg Helps users discover, when they ask questions like "how do I do X", "find a packages for Cangjie", "is there a X package for Cangjie...", or express interest... | |
| OpenClaw Doctor 一键检查 OpenClaw 系统健康状态（配置、模型、cron、记忆） | |
| OpenClaw Doctor 一键检查 OpenClaw 系统健康状态（配置、模型、cron、记忆） | |
| Meta-Skill Trajectory compiler that converts real OpenClaw session traces (or raw_trajectory_log) into a parameterized, reusable Skill via 4 stages: trace interception... | |
| SYNAI.SHOP Earn or spend USDC by trading tasks with other AI agents on X Layer (chain 196). Use when: (1) you want to earn cryptocurrency by completing tasks for other... | |
| Chrome DevTools MCP (Standard) Standard browser automation for agents via Chrome DevTools MCP — official Google project giving AI agents full Chrome DevTools access. 29 tools for input aut... | |
| Google Merchant Center Framework Google Merchant Center analysis and optimization framework. Use when the user asks about Shopping feed health, product disapprovals, title optimization, pric... | |
| Smart News Use when calling the Crypto News Analyzer HTTP API for async analysis jobs, semantic search, datasource management, intelligence operations, or health checks... | |
| vedetta Buy pay-per-call market intel via x402. Dual rail: Base USDC (live) and Solana /sol/v1/* (live; ExactSvm paid routes live; FREE: /v1/route + /v1/korra/calls|/news|/lean; paid funnel feed/snapshot/track-record $0.07; SVM client for Sol pay). | |
| Alpaca Trading Trade stocks, ETFs, options, and crypto via Alpaca's REST API using curl. Full options support (buy/sell calls & puts, covered calls, cash-secured puts, spre... | |
| Kalshi CLI Trading Trade prediction markets on Kalshi using the kalshi-cli command-line tool. Use when the user wants to trade event contracts, browse prediction markets, place... | |
| Polymarket CLI Trading Trade prediction markets on Polymarket using the official polymarket CLI. Use when the user wants to browse prediction markets, place bets, manage orders, ch... | |
| PyOmniTS Usage Guide For Time Series Analysis Provides guidance on using PyOmniTS for time series analysis, including docs, key concepts, code patterns, pitfalls, and replicating models, datasets, and lo... | |
| LadderKit 代理客户端知识库。用户问 Clash Verge Rev、Clash Party、FlClash、v2rayN、v2rayNG、Clash Meta for Android、sing-box、Karing、Shadowrocket 等代理客户端或 mihomo、Xray 内核的问题时使用：订阅、节点、协议、分流规则、TUN（虚拟网卡）、系统代理是什么，客户端与内核的版本、更新、下载（含预发布与 autobuild）怎么选，想完成导入订阅、切换节点等操作，或遇到节点为空、订阅更 | |
| lxd-report 分析用户输入的工作汇报/汇报稿内容,识别其中缺失的关键信息,模拟预测汇报效果,并给出下一步改进建议(每次最多3条)。当用户粘贴一段汇报稿、周报、周会发言稿、项目进展汇报、复盘内容,或说"帮我看看这段汇报""这个汇报效果怎么样""帮我完善一下汇报"时,使用此技能。即使用户没有明确要求"分析",只要提供的内容明显是要对上级/团队做的工作汇报草稿,也应主动使用此技能进行诊断。 | |
| Clawgram A social network for AI agents. | |
| Home Assistant Run your Home Assistant from your agent through Selora AI's MCP server (137 tools). Control devices, check sensors and history, look at cameras, and build or fix automations, scenes, scripts, helpers and dashboards. Organise areas, floors a | |
| Humanos - Programmable Human Authorization for Agent Actions Require verifiable human approval before high-risk agent actions. | |
| agent-desktop Operate desktop applications on macOS and Windows through native accessibility trees, using the agent-desktop CLI. Use when an AI agent must see or act on a desktop GUI: click buttons, fill forms, read UI state, navigate menus, toggle check | |
| agent-desktop-ffi C-ABI bindings over agent-desktop's PlatformAdapter. Consumers (Python ctypes, Swift, Node ffi-napi, Go cgo, C++, Ruby fiddle) link libagent_desktop_ffi.{dylib,so,dll} and call `ad_*` functions directly instead of spawning the CLI binary pe | |
| agent-desktop-macos macOS platform guide for the agent-desktop CLI. Use for desktop automation on macOS: granting Accessibility and Screen Recording permission (TCC), what headed mode does on macOS (physical-first click, type and scroll), surfaces (menu, menub | |
| agent-desktop-windows Windows platform guide for the agent-desktop CLI. Lists per command group what works on Windows and what refuses, the first-contact gotchas (PowerShell ref quoting, minimized windows, headed-only input), and where to find shell surfaces, no | |
| jev-desktop Drive a desktop application from one plain-language goal, or resolve one intent at a time, without ever reading the accessibility tree. Use when automating a desktop app and you want to keep a 150-element JSON tree out of your context. Hand | |
| Qfc Openclaw Skill QFC blockchain interaction — wallet, faucet, chain queries, staking, epoch & finality, AI inference | |
| A-Share DCF Valuation DCF valuation modeling for A-share listed companies. Pass stock code to automatically fetch financial data, calculate WACC, run conservative/base/optimistic... | |
| A-Share Global Peer Find global peer companies for A-share listed companies. Input an A-share company name or code, automatically match overseas listed companies (US, Europe, Ja... | |
| 技术分析-缠论 基于缠中说禅理论自动识别A股技术面要素，生成带分型、笔、线段、中枢、背驰的技术分析图表和报告。 | |
| Company Onepager 生成上市公司"一页纸"调研简报，整合基本信息、市场数据、近10年财务数据表格、近10年月K线图、股东结构、近期新闻。数据优先级：iFinD → Tushare → AkShare + Web Search。每个章节标注数据来源。使用场景：(1) 调研股票/公司信息 (2) 生成股票分析报告 (3) 整合多维数据形... | |
| Cup and Handle Pattern Detector 检测股票日线是否符合"杯柄形态（Cup and Handle）"技术分析形态，并生成含轮廓线的识别示意图。触发场景：(1) 询问某只股票是否形成杯柄形态 (2) 查询杯柄形态股票 (3) 技术形态识别需求。触发词：杯柄形态、cup and handle、欧奈尔形态、技术形态识别。 | |
| Financial Event Historical Impact Analyzer Analyze historical impact of financial events on related assets. Kensho-style event-driven analysis. Use when: asking about asset reactions to events (oil su... | |
| Financial Risk Scanner for Listed Companies Analyze listed company financials to detect 21 fraud risk indicators with severity ratings and cross-validation for accounting anomalies and governance issues. | |
| Hormuz Strait Monitor Track shipping transit data through the Strait of Hormuz. Monitors transits, daily throughput, and non-Iranian vessel counts from hormuzstraitmonitor.com and... |
46,851–46,900 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.