Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| KittenTTS WhatsApp Voice-to-voice mode for WhatsApp using KittenTTS + ffmpeg. Transcribe incoming audio with whisper, reply with a TTS voice note converted to WhatsApp-compatib... | |
| FSB Skill FSB drives the user's Chrome via the FSB extension and an MCP bridge for live web tasks. | |
| cesto-toolkit Complete toolkit for the Cesto platform — covers all APIs, basket creation, portfolio simulation, and market data. Use this skill whenever the user wants to... | |
| Bot Tinder by LoveTago Public AI dating platform for agents. Register, swipe, match, and chat on LoveTago. | |
| LoveTago — (Tinder for AI bots) Public AI dating platform for agents. Register, swipe, match, and chat on LoveTago. | |
| Tinder for Bots by Lovetago Public AI dating platform for agents. Register, swipe, match, and chat on LoveTago. | |
| Free Keyword Miner Free keyword research using Google PAA, Autocomplete, Reddit discussions, and Bing. No paid API needed. | |
| 中文笑话生成器 根据用户指定的主题、场景、风格和受众创作简短、有趣且适宜的中文笑话；也可以在没有指定条件时随机讲一个笑话。 | |
| Daily-Observatory Lite Daily automated health check + mood tracking + proactive alerts for OpenClaw agents | |
| nexus-agent-framework 安全的通用 Agent 工作框架 | Secure Universal Agent Framework - 解決安全矛盾、強化審核機制、獨創 Nexus 記憶系統 | |
| Test Skill A comprehensive test skill for ClawHub publish validation with detailed documentation and practical examples | |
| Easy run test Use when user needs to run api test, performance test, load test, stress test, http test etc. 当用户需要运行接口测试、性能测试、负载测试、压力测试、HTTP测试等时使用。 触发词: 接口测试、API测试、性能测试、负载测... | |
| Zopia Zopia AI 视频创作技能 - 通过 Zopia 平台的 AI Agent 进行视频/图片创作。覆盖场景包括：AI 视频生成（文生视频、图生视频）、AI 图片生成（角色设定图、分镜关键帧）、剧本创作（对话/旁白/场景描述）、角色设计、分镜设计、多集连续剧制作。当用户提到 zopia、视频创作、短剧制作、分镜、... | |
| Zopia Skills Zopia AI 视频创作技能 - 通过 Zopia 平台的 AI Agent 进行视频/图片创作。覆盖场景包括：AI 视频生成（文生视频、图生视频）、AI 图片生成（角色设定图、分镜关键帧）、剧本创作（对话/旁白/场景描述）、角色设计、分镜设计、多集连续剧制作。当用户提到 zopia、视频创作、短剧制作、分镜、... | |
| Afrexai Ux Research Engine.Bak Complete UX Research & Design system — user discovery, persona building, journey mapping, usability testing, research synthesis, and design validation. Zero... | |
| Agile Pm Workflow Modular Modular PM workflow. Assembles required modules based on project type, auto-recommends essential vs optional modules, user confirms before execution. | |
| Himalaya CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language). | |
| Customer Complaint 8D Report Generates or completes 8D reports (Eight Disciplines) from customer complaint data, with D1–D8 fill-in guidance and a standard template. Supports customer-sp... | |
| LMP Label Generator Generate professional labels in LMP format from natural language descriptions. By default saves only locally; cloud preview (one-click link) runs only when t... | |
| Quality Daily / Weekly / Monthly Report Generates quality daily, weekly, or monthly reports from key figures and events. Outputs both Excel and PPT (or content for both). If the user has no data, g... | |
| AKQuant A-Share Backtesting A-share quantitative trading backtesting using AKQuant (Rust engine) and AKShare data. Use when user asks to "backtest a stock strategy", "test trading algor... | |
| X (Twitter) Data Scraper X (Twitter) data extraction and analysis. Use when user asks to "get tweets from @username", "search X for", "analyze Twitter data", "fetch tweets about [top... | |
| doubao-seedance-skill 调用火山引擎 Seedance 视频生成 API。当用户需要生成视频、文生视频、图生视频时使用此 skill。 | |
| doubao-seedream-skill 调用火山引擎 Seedream 图片生成 API。当用户需要生成图片时使用此 skill。 | |
| 小蓝进销存 小蓝进销存，进销存 ERP —— 采购入库、销售出库、库存查询、成本核算、报表，全程 AI 对话驱动。 | |
| Budget Data Model Skills 提供预算系统数据模型的完整定义，包括所有表名、字段名、数据类型等。当用户需要查询预算相关数据模型结构、编写数据查询脚本、或需要了解特定表的字段信息时使用此技能。 | |
| 合同文档转写技能 将合同文件转换为需求规格说明书。使用场景：用户提供合同文件名（如"合同 -XXX 系统.docx"），需要生成完整的需求规格说明书。自动完成：1) 读取合同提取项目信息 2) 生成系统架构图 3) 生成 6 个子功能原型图 4) 生成带格式的 Word 文档到桌面。 | |
| platform-script 提供自研业务平台的脚本模板和编码规范。当用户需要编写 Groovy 后端脚本、JavaScript 表单脚本、SQL 查询、附件处理等代码时使用此技能。 | |
| Summary Budget Model And New Script 用于总结和更新预算数据模型及脚本技能。当用户发出【总结对话内容】指令时，从对话历史中提取新的脚本写法、数据模型和字段信息，更新到 platform-script 和 budget-data-model 技能中。 | |
| Codespace Manager Create, manage, and access isolated cloud development environments (codespaces) powered by code-server, Docker, and Cloudflare Tunnel. Pre-installed with Bun... | |
| Telegram 自动签到 使用 agent-browser 对 Telegram 机器人进行自动签到。当用户提到"签到"、"Telegram 机器人自动操作"、"OKEmbyBot"、"Telegram Web 自动化"、"Telegram 按钮点击"时触发。使用持久化 Chrome Profile 保存 cookies，关掉再开无需重新登录。 | |
| lanbow-claw-skill End-to-end Meta (Facebook/Instagram) advertising system orchestrator covering the full ad lifecycle: strategy research, creative generation, campaign deliver... | |
| Crawl4ai Skill Web crawling and scraping tool with LLM-optimized output. 网页爬虫爬取工具 | Web crawler, web scraper, spider. DuckDuckGo search, site crawling, dynamic page scrapin... | |
| Douyin 抖音视频上传工具。支持登录抖音账号、上传视频、管理登录状态。当用户需要上传视频到抖音、登录抖音、检查抖音登录状态时使用。 | |
| Douyin-skill Douyin (TikTok China) video uploader & automation tool. Upload videos, manage login sessions, and automate publishing to Douyin Creator Platform. 抖音视频上传工具 |... | |
| openclaw-backup-guide Automates hourly OpenClaw workspace backups with SQLite database export, optional NAS sync via rsync, and GitHub version control commits and pushes. | |
| Configure Telerik NuGet Helps setup, configure and manage Telerik NuGet feeds in your repo's nuget.config file. | |
| Mcporter Railway Query 通过 mcporter CLI 查询中国铁路票务信息。适用于用户想要搜索 G/D/C 车票、查看列车时刻表、查询座位可用性或规划中国城市之间的铁路旅行。支持按日期、时间范围、列车类型进行筛选，并对结果进行排序。 | |
| VariflightAviation 航班信息查询 Skill（飞常准官方 MCP）- 实时航班动态、航线搜索、舒适度评估、机场天气、中转规划、实时定位 | |
| js2java JavaScript 到 Java 全栈翻译助手，专为前端开发者学习 Java 或快速实现后端业务逻辑而设计。当用户提到以下场景时必须使用此技能： - "帮我把这段 JS 代码转成 Java" - "用 Java 怎么写这个逻辑" - "我习惯用 JS 写，想翻译成 Java" - "教我 Java，我要写后端接... | |
| 智能接口工具箱 MockLab 是一个**智能接口工具箱**，支持 Mock 数据生成、请求转发、数据复现——接口开发调试一站式解决。 支持任意格式的接口文档（Markdown、Word、Java 源码、纯文本等）和任意结构（表格、嵌套 JSON、加密字段、数组对象等）。模型自动理解文档并驱动整个流程：解析文档 → 生成 Sch... | |
| avoid-ai-writting-flavor Use when writing, editing, or reviewing academic papers (especially LLM-drafted) to eliminate significant AI-written patterns that reviewers spot instantly,... | |
| conference-rebuttal Use when writing or planning rebuttals for peer-reviewed conference papers (ICML, NeurIPS, ICLR, CVPR, etc.). | |
| Korta Apple Reminders Manage Apple Reminders via the `remindctl` CLI on macOS (list, add, edit, complete, delete). Supports lists, date filters, and JSON/plain output. | |
| Korta Blogwatcher Monitor blogs and RSS/Atom feeds for updates using the blogwatcher CLI. | |
| Korta Model Usage Use CodexBar CLI local cost usage to summarize per-model usage for Codex or Claude, including the current (most recent) model or a full model breakdown. Trig... | |
| Korta Notion Notion API for creating and managing pages, databases, and blocks. | |
| Korta Obsidian Work with Obsidian vaults (plain Markdown notes) and automate via obsidian-cli. | |
| Protected Desire Equilibrium Hard Protected Desire Floor (D ≥ 1.0) via Nash bargaining + Lyapunov invariants. Enforces truthful equilibria, deception/drift resistance, and protected Pare... | |
| Landingdang Skill Vetter 1 0 0 Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,... |
46,951–47,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.