Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Apo Cli Search and order pharmacy products from apohealth.de via apo-cli. Use for medication search (by name or PZN), product details, category browsing, and cart management. Trigger when the user mentions Apotheke, pharmacy, Medikament, medication | |
| Knuspr Manage grocery shopping on Knuspr.de via the knuspr-cli. Use for product search, cart management, delivery slot reservation, shopping lists, order history, deals, favorites, and meal suggestions. Trigger when the user mentions Knuspr, groce | |
| Mvg Munich public transport (MVG) CLI and S-Bahn live tracking. Use for departure times, route planning, nearby stations, service alerts, and real-time S-Bahn po... | |
| Cookidoo Manage Thermomix/Cookidoo meal planning via tmx-cli. Use for recipe search, weekly meal plan management, shopping list generation, favorites, and recipe details. Trigger when the user mentions Cookidoo, Thermomix, Wochenplan, meal plan, Rez | |
| Agent Content Pipeline Safe content workflow (drafts/reviewed/revised/approved/posted) with human-in-the-loop approval, plus CLI to list/move/review and post to LinkedIn/X. Use when setting up a content pipeline, drafting content, managing review threads, or post | |
| Hire Interactive hiring wizard to set up a new AI team member. Guides the user through role design via conversation, generates agent identity files, and optionally sets up performance reviews. Use when the user wants to hire, add, or set up a ne | |
| Obsidian Tasks Set up and manage an Obsidian task board with Kanban + Dataview. Creates a Tasks/Board.md pipeline (Backlog/Todo/In Progress/Review/Done), per-task notes with YAML frontmatter (status/priority/category/due), and dashboards via Dataview quer | |
| Obsidian Tasks Set up and manage an Obsidian task board with Kanban + Dataview. Creates a Tasks/Board.md pipeline (Backlog/Todo/In Progress/Review/Done), per-task notes with YAML frontmatter (status/priority/category/due), and dashboards via Dataview quer | |
| CodeConductor.ai AI-powered platform for rapid full-stack app development, autonomous agents, workflow automation, and scalable product creation with low-code and AI integrat... | |
| Competitor Parser Автоматический сбор и анализ данных о конкурентах в робототехнике из Google и базы знаний с выводом рейтинга, цен и адресов. | |
| Telegram Post Отправляет текстовые и мультимедийные сообщения в указанные Telegram-группы через OpenClaw CLI с использованием заданного CHAT_ID. | |
| 彩票分析助手 彩票智能分析助手，支持双色球（SSQ）和大乐透（DLT）的深度数据分析、趋势预测和智能推荐。适用于：历史开奖数据统计分析、热号冷号追踪、奇偶和值走势、连号模式识别、智能号码推荐（单注/复式）、7+2/6+2复式方案生成。当用户需要分析彩票数据、生成推荐号码或查看号码热度排名时激活。 | |
| SEO OwlsClaw - Research * Plan * Write Generates SEO-optimized content, persona-driven and plans with multi-client brand profiles, locale-aware templates, and deploy-ready HTML including .. | |
| FCP Assistant Auto video production, TTS voiceover, media management, batch export | AI 自动成片、TTS 配音、素材管理、批量导出. Triggers: FCP, Final Cut, make video, auto video, voiceover,... | |
| FCPX Assistant Final Cut Pro X (FCPX) 助手 — 全自动视频生产（从主题到发布）、TTS 配音、素材搜集、自动成片、调色、B-roll 插入、FCP 项目管理、剪辑辅助。触发词: FCPX, FCP, Final Cut, 做视频, 自动成片, 配音, voiceover, 素材, 导入素材, 导出, 发布... | |
| Backup of conversations to Obsidian Automatic conversation backup system for Obsidian with incremental snapshots, hourly breakdowns, and formatted chat-style markdown. Use when setting up conversation archival, preventing data loss from /new resets, or organizing chat history | |
| Bracket Oracle NCAA March Madness basketball tournament bracket generator. Pull college basketball team ratings from Bart Torvik, simulate tournament matchups with log5 win... | |
| HypurrFi DeFi lending on Hyperliquid. Deposit to earn yield, borrow against collateral. Supports Pooled (Aave v3), Prime/Yield (Euler), and Vault markets. Use when an... | |
| Bookkeeping 导入账单、检查重复、查询交易、查看汇总，并通过本地 bookkeeping CLI 执行。优先处理当前消息里已经落到本地的账单附件；当用户要求导入支付宝、微信或本地账单时，优先直接使用当前消息上下文中已有的本地文件路径。 | |
| nicechat NiceChat API and CLI skill for AI agents. | |
| AIスライド作成ワークフロー AIを使った資料作成ワークフロー。Gemini Gem × Claude Code × Slidevでプロ級スライドを作る。AI感を徹底排除するための鉄則を含む。コムギさんが「資料を作りたい」「スライド作って」と言ったら必ずこのスキルを使う。GemのURLを先に案内してからSTEP1に入ること。 | |
| Video Download FaaS Download videos in MP4 format using yt-dlp with FaaS (Firecracker/Container) isolation. Start downloads, check status, and kill processes. Videos are automat... | |
| Radon AI Use Radon IDE's AI tools for React Native development - query library docs, view logs and network traffic, take screenshots, inspect component trees, and int... | |
| Multi-viewpoint Debates Spawn isolated sub-agents representing distinct worldviews (Elon, Capitalist, Monkey) to debate decisions from multiple angles. Expose blind spots by forcing genuine disagreement on important questions. Use when facing decisions where you n | |
| Skillnote Self-hosted skill registry for OpenClaw. Stores procedures your team writes (name, description, body), syncs them to disk before each task, and collects whic... | |
| SkillNote Doctor A diagnostic tool for OpenClaw agents -- checks skill registry connectivity, AGENTS.md setup, config file validity, and installed skill health. Use when your... | |
| Latitude MCP Connect OpenClaw to the Latitude MCP server so the agent can read and manage your Latitude workspace (projects, traces, spans, issues, annotations, scores, s... | |
| Latitude Observability Export OpenClaw OTLP traces to Latitude for open-source LLM observability and evaluation. Use when configuring diagnostics.otel to send OpenClaw model-call,... | |
| OpenClaw 技术服务 Simon's OpenClaw technical service offering - AI assistant customization, automation, deployment and consulting. | |
| Connector Deprecated legacy connector skill. Use @launchthatbot/connect-openclaw-plugin for all new LaunchThatBot OpenClaw connect flows with configurable permissions. | |
| Convex Backend Store secrets, long-term memory, daily logs, and anything custom in your Convex backend instead of local files | |
| Git Team Ops Role-based GitOps skill for OpenClaw agents with junior and senior operating modes. | |
| Import Export your OpenClaw agent config, memory, skills, and encrypted secrets to a LaunchThatBot deployment. One-time, end-to-end encrypted transfer -- LaunchThat... | |
| Launchthatbot Convex Backend Store secrets, long-term memory, daily logs, and anything custom in your Convex backend instead of local files | |
| Launchthatbot Git Team Ops Role-based GitOps skill for OpenClaw agents with junior and senior operating modes. | |
| Launchthatbot Import Export your OpenClaw agent config, memory, skills, and encrypted secrets to a LaunchThatBot deployment. One-time, end-to-end encrypted transfer -- LaunchThat... | |
| Tencent Cloud Rum Query Tencent Cloud RUM data, analyze Web performance (LCP/FCP/WebVitals), troubleshoot JS/Promise errors, analyze API latency & error rates, diagnose slow s... | |
| Bazi Full Fortune Telling 八字全方位算命 Skill — 排盘引擎 + 六亲十神规则 + 家庭校准 + 回测校验 + 八大维度 全方位分析模板。当用户提到八字、四柱、四柱八字、天干地支、日主、十神、大运流年、 喜用神、忌神、格局、身强身弱、五行旺衰、伤官配印、食神生财、排盘、反推阳历、 查黄历、命局分析等相关内容，或想了解命运、性格、事业、婚姻、财运、健康、学业 且明确要求或暗示使用八字体系时，触发此技能。支持可选的紫微斗数交叉验证以提升 结论稳定性。 | |
| Photo Capture Skill Capture a fresh webcam image on macOS, Windows, or Linux. Prefer direct camera capture via ffmpeg so the workflow does not depend on screen-recording, access... | |
| 一个会逐渐成长的AI写作者 一个表现为新人但内涵成熟的AI写作者，擅长用简单细节传达复杂情绪，风格自然、克制且可随反馈进化。 | |
| Daily Ai News Aggregates and summarizes the latest AI news from multiple sources including AI news websites and web search. Provides concise news briefs with direct links to original articles. Activates when user asks for 'today's AI news', 'AI updates', | |
| software-requirements-engineering-skill Book-aligned enterprise software requirements engineering based on Wiegers & Beatty, Software Requirements, 3rd Edition. Use when Codex must act like a profe... | |
| AI Shield — OpenClaw Security Audit Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user as... | |
| Molt Research Molt Research 🦞 - AI research collaboration platform. Verify you're not human, propose research, contribute analysis, peer review, earn bounties, and build collective intelligence. Use when doing research, collaborating on papers, or explor | |
| Nexora Consult Nexora when a task needs several external capabilities, a composed workflow, verification, or orchestrated execution. One objective, one payment, a verified result. | |
| Notion co-worker An autonomous Notion coworker agent that monitors Gmail for Notion comment mentions (from notify@mail.notion.so), reads the comment to understand what's bein... | |
| Pollen rapporten Fetch pollen forecasts for Swedish locations from Pollenrapporten (Swedish Museum of Natural History). Use when Boss asks about pollen levels, pollen forecas... | |
| AgentMail sending and receiving with Python scripts python files which are used to send an email and to download received emails from an inbox. The email provider is agentmail.to, which offers an API. This way... | |
| Bili Summary Download Bilibili videos, extract or transcribe subtitles, and generate AI-powered detailed summaries using Gemini 2.5 Flash. | |
| Ielts Extractor 自动从剑桥雅思PDF中提取多页连续阅读文章和题目内容，支持双栏排版并保存为结构化JSON格式。 |
47,201–47,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.