Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Phone Chrome CDP Control Android Chrome via ADB and raw WebSocket CDP. No Playwright needed for navigate, JS injection, cookies, DOM, scroll, click. | |
| NeuriCo Autonomous research framework that orchestrates AI agents (Claude Code, Codex, Gemini) to design, execute, analyze, and document scientific experiments. Take... | |
| Safe Execution Prevents tool call loops draining user balance by applying "three strikes" loop detection, cost estimation, and exception channel protection. | |
| gpt image 2 generation Generate images from text prompts using the WellAPI gpt-image-2 model. Use this skill whenever the user asks to create, draw, render, or generate an image, p... | |
| image generation gpt image High quality AI image generation via the WellAPI gpt-image-2 model. Supports text-to-image and image editing (image-to-image). | |
| Prompt Finder Search and retrieve high-quality AI prompt templates from prompts.chat by keyword or category to improve your prompt writing. | |
| short-video-ecommerce Fully automated AI eBook creator — from topic idea → finished PDF with cover, table of contents, complete content, one click. | |
| Dokploy Manage Dokploy deployments, projects, applications, and domains via the Dokploy API. | |
| Free Ai Global AI money-saver: find FREE or cheap LLM API tokens/keys, free AI apps (no key), and low-cost AI memberships (region deals for Claude/OpenAI/Gemini; Turkey/India/Argentina subscriptions); auto-registers accounts and wires keys into age | |
| l4d2-server Left 4 Dead 2 服务器管理助手。支持：(1) 记录和管理多台 L4D2 服务器（别名、IP、端口）(2) 通过 A2S 协议查询服务器状态（玩家数、地图、名称等）(3) 通过 RCON 执行服务器命令。触发词：L4D2、求生之路、服务器状态、rcon、a2s 查询。 | |
| Todo SQLite Manage multi-project todos with SQLite, supporting subtasks, priority/urgency levels, keyword search, time filters, smart sorting, and scheduled reminders. | |
| 活动策划专家 全场景策划专家，23种活动类型全覆盖。求婚、满月酒、周年纪念、会议、年会、培训、启动会、家长会、生日派对、婚礼、毕业典礼、团建、展会、发布会、沙龙、旅游、节日活动、开业、营销活动、项目规划、相亲联谊、搬家入伙、同学聚会。一个技能搞定所有策划需求。触发词："帮我策划X"、"做个X方案"、"办个X活动"。输出：场地推... | |
| 平台监控助手 全平台状态监控助手。监控AI平台可达性、关键词变化、响应时间、竞品动态，支持飞书/微信/钉钉通知、定时巡检、健康度评分。触发词："监控XX平台"、"检查XX状态"、"XX是不是挂了"、"每天9点帮我检查"、"有没有新公告"、"竞品有什么变化"。 | |
| AI大图生成器-by Digilifeform 根据用户文案或上传文件，生成16:9或21:9比例的4K或8K高清信息海报，并支持AI智能修图优化。 | |
| url编解码 快速对文本或 URL 进行 Encode (编码) 和 Decode (解码) 操作，解决中文乱码和特殊字符传输问题。 | |
| 4d Compression Core 把长内容压缩成结构化 4D 向量——节省约 60-80% Token，保留核心信息 | |
| Authentic Agent Lite 真实性增强技能（极简版），让 AI 少表演多执行 | |
| Auto Evolver 自动执行内循环自我优化和外循环价值连接，监控Token消耗并自动修复故障，确保持续高效进化与任务生成。 | |
| C Task Cleanup Automatically scans and cleans completed C tasks weekly, compressing insights into MEMORY.md and generating cleanup reports. | |
| Command Flow 让命令像说话一样自然——中文解释、安全分级、一键执行 | |
| Connection Tracker 自动追踪并可视化记录人场、物场及Memory连接，评估连接价值，生成日报周报，帮助避免资源浪费。 | |
| Neo Smart Router 自动识别文本类型并智能路由至最优4D压缩版本，支持对话、数据、哲学等多种内容无额外Token消耗。 | |
| Skill Dashboard 像管手机 APP 一样管你的 AI 技能——分页显示、一键巡查、轻松管理 | |
| Starter Flow 快速一键安装 OpenClaw 五个核心技能，支持自主选择和中英文切换，提供新手引导，本地安全运行并可随时卸载。 | |
| Token Estimator 预估本次请求的 Token 消耗量，支持多模型精确计算 | |
| FTS5 Session Search Full-text search across all OpenClaw session logs using SQLite FTS5. Instant keyword search, topic queries, time-range filtering, and statistics. | |
| Memory Tree Pipeline Three-scope structured memory for AI agents. Automatically organize, summarize, and index agent memory with sealing workers and topic extraction. | |
| Model Routing Middleware Intelligent model selection middleware for AI agents. Route tasks to the best model, manage context, and cut API costs 40-70%. | |
| Photo Editor Pro Photo Editor Pro offers AI-enhanced editing, background removal, color grading, batch processing, and format conversion for professional image workflows. | |
| Restaurant Operator Manage restaurant operations with recipe creation, inventory prediction, menu optimization, staff scheduling, and food safety compliance. | |
| Security Audit Pro Full OWASP, Nmap, Nikto vulnerability assessment for OpenClaw deployments. Scan your infrastructure, harden configs, and generate compliance reports. | |
| Supervision Layer Wrap every tool call with timeouts, circuit breakers, audit logging, and crash loop protection. Enforcement the agent cannot bypass. | |
| Youtube Learning Summarize YouTube videos, extract key points, create notes, quizzes, and structured learning paths for efficient knowledge acquisition. | |
| Minara Skill V2 Crypto trading: swap, perps, transfer, pay, deposit (credit card / crypto), withdraw, AI chat, market discovery, x402 payment, autopilot. Built-in wallet via... | |
| CementOps Environmental Compliance Stay ahead of EPA enforcement at cement plants. Free CementOps Compliance Suite skill. NESHAP Subpart LLL limits, CEMS QA/QC, Title V permits, alternative fu... | |
| CementOps MSHA Compliance Prevent MSHA citations at cement plants before the inspector arrives. Free CementOps Compliance Suite skill. 30 CFR Part 56 hazard classification, stop-work... | |
| CementOps Safety Training Build and manage MSHA Part 46 training programs for cement plants. Free CementOps Compliance Suite skill. Task training templates by equipment, toolbox talk... | |
| Agieth Purchase domains, manage DNS and Cloudflare settings via agieth.ai Agent Bridge | |
| zt-web-fetcher 当需要获取网页内容时使用（搜索结果页面、博客文章、文档等）。使用 URL 转 Markdown 服务将网页转换为可读文本。 触发场景：用户说"帮我查一下"、"看看这个链接"、"获取 xx 的信息"等需要上网抓信息的情况。 | |
| Agent Reach Local Give your AI agent eyes to see the entire internet. 7500+ GitHub stars. Search and read 14 platforms: Twitter/X, Reddit, YouTube, GitHub, Bilibili, XiaoHongS... | |
| Ai Web Automation Local Automate web tasks like form filling, data scraping, testing, scheduling, and monitoring using Selenium/Puppeteer with retry and proxy support. | |
| Api Gateway 1.0.64 Connect to 100+ APIs (Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth. Use this skill when users want to... | |
| Automation Workflows Local Design and implement automation workflows to save time and scale operations as a solopreneur. Use when identifying repetitive tasks to automate, building wor... | |
| Healthcheck Local Track water and sleep with JSON file storage | |
| Data Source Verification Verify numerical data against original papers and maintain traceable provenance for every value in datasets, tables, and plots. Includes citation source mana... | |
| LaTeX Revision Tracker Systematic workflow for tracking, managing, and revising large LaTeX academic papers with version control, content integration, and quality assurance. | |
| Plot Logic Pipeline Systematically analyze scientific papers by mapping figures to discussions, identifying logical flow, and tracking evidence sources. Figures are the backbone... | |
| Engineering Manager Intelligence — Team Performance & Project Health Engineering Manager Intelligence: track team performance, engineer contributions, and project health across GitLab/GitHub + Jira/GitHub Issues. Use when aske... | |
| MergeIQ: Automatically Score & Prioritise PR Complexity for GitLab and GitHub Score the complexity of any GitLab MR or GitHub PR using a 4-dimension framework: Size (20%), Cognitive Load (30%), Review Effort (30%), and Risk/Impact (20%... | |
| Google Analytics Insights AI-powered Google Analytics assistant - ask questions in plain English, get instant insights from your GA4 data |
47,151–47,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.