Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Poetry Daily Art Generate daily Chinese classical poetry art cards — AI-generated landscape painting paired with poem text, delivered to chat. Use when the user asks for poet... | |
| AutoTradeResearch Agent workspace for researching programmatic trading strategies through generative optimization with bounded files and fixed backtesting evaluator. | |
| peaq Robotics Core peaq-robotics-ros2 runtime for OpenClaw. Start/stop ROS 2 nodes and call DID, storage, and access-control services. Use when requests are about running... | |
| Elon Frameworks Use when the user explicitly asks for Elon Musk's thinking frameworks, first-principles cost analysis (Idiot Index, Magic Wand Number), The Algorithm (questi... | |
| Market Radar Industry hotspot and competitor monitoring across 5 dimensions. Use when user (in Chinese) asks to monitor an industry (监测...行业) and provides competitor URLs... | |
| Writing Expert Team 多角色协作的写作流水线技能。当用户需要体系化产出高质量文章（尤其法律/科普/自媒体爆款文）时使用：覆盖风格画像、选题策划、素材调研、知识整理、初稿撰写、事实核查、主编审稿、法律合规审核、多平台排版导出全链路。内置“爆款公式”与“发布红线底座”两大差异化资产，支持单角色调用或完整流水线。触发词：写作专家团、写作流水线、启动写作流程、选题策划、风格打磨、素材调研、知识整理、事实核查、审稿优化、排版导出，或角色名 刘风格/赵选题/张素材/王整理/李文章/吴查查/周审稿/陈排版。 | |
| 48h-Expert-Methodology A meta-learning method compressing deep expertise into 48 hours by extracting core mental models, expert debates, and critical assessment questions for mastery. | |
| First-Principles-Deconstructor Analyzes products by stripping marketing jargon to identify their fundamental physical laws, constraints, and optimal efficient designs from first principles. | |
| hive-commander 1+5 Distributed Production Swarm with Session Inheritance. | |
| Meta-Router Automatically indexes and routes user intents to installed OpenClaw skills by scanning SKILL.md files and dynamically injecting relevant skill contexts. | |
| MySQL to PostgreSQL Migration Use this skill when migrating a project's database layer from MySQL to PostgreSQL. Covers SQL dialect conversion (MyBatis XML / raw SQL), ORM configuration (... | |
| lunheng 论衡 (Lunheng) — AI 裁判文书写作助手。三段论逻辑推演、文书起草/修改/润色、 法条引用核查（三层验证）、说理质量评分、量刑计算。覆盖 74 种案件类型。 内置 HTTP API 服务、批量处理、类案检索、说理深度增强。 | |
| office-hours YC式产品思维办公室。用第一性原理拆解产品想法，通过六问逼问法验证需求真伪， 挑战前提假设，生成多种实现方案。输出设计文档而非代码。 Use when: 用户说"帮我想想这个点子"、"这个值不值得做"、"brainstorm"、 "产品规划"、"需求分析"、"帮我理清思路"，或描述一个新的产品/功能想法时。 在任... | |
| Lista Lista Lending assistant — position report, market overview, yield scan, liquidation risk check, daily digest, and loop strategy on BSC and Ethereum | |
| Lista Lending View and operate Lista Lending vaults/markets. Use when user asks about LENDING-ONLY positions or wants to deposit/withdraw/borrow/repay. For report-style ov... | |
| Lista Wallet Connect Connect wallets via WalletConnect v2 and execute EVM signing/contract-call operations on Ethereum and BSC. | |
| Enterprise Legal Guardrails Public Legal/compliance guardrails for outbound OpenClaw actions (anti-spam, defamation, privacy, financial claims). | |
| Enterprise Legal Guardrails Public Legal/compliance guardrails for outbound OpenClaw actions (anti-spam, defamation, privacy, financial claims). | |
| 生成读书活动 根据书名生成读书活动，生成详细介绍、每日打卡计划、问答题库等文档 | |
| Vai Layman88 Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| 装修预算计算 装修大包预算计算工具，支持新房和旧房预算计算，提供详细的费用清单。可根据房屋面积和类型自动计算半包施工费、主材材料费以及总预算，并按类别分组展示费用明细。 | |
| Receipts Guard ERC-8004 identity, x402 payments, and arbitration protocol for autonomous agent commerce. The three rails for the machine economy. | |
| Automation Workflow Helper Turns your weekly repetitive tasks into automated bots. Identifies high-value automation opportunities, picks the right tool (Dify / Coze / n8n workflow, or... | |
| Automation Workflow Plus - (自动化 工作流 助手) 帮你把每周重复做的事变成自动运行的机器人。识别高价值自动化场景、选对工具（Dify / Coze / n8n 工作流，或零Token的RPA脚本）、设计流程模板、计算ROI回报。当用户提到"自动化"、"重复任务"、"工作流"、"提效"、"节省时间"、"自动机器人"、"RPA"、"流程自动化"、"automate"... | |
| OpenClaw RPA Record browser, Excel, Word & API actions once — replay without the LLM: faster, cheaper, no hallucinations. github.com/laziobird/openclaw-rpa . Supports com... | |
| Auto Dealer Marketing When the user wants to create, optimize, or plan automotive dealership marketing — including inventory merchandising, VDP copy, seasonal campaigns, conquest... | |
| 查找资料 多引擎搜索 API 工具，支持通用网页搜索和新闻搜索。 使用场景： - 用户要求搜索网页、新闻、社交媒体内容 - 需要从 Google/Baidu/Bing/Yahoo/DuckDuckGo 搜索 - 需要搜索微信公众号、YouTube、GitHub、Reddit、Bilibili - 需要获取搜索结果的完整内容... | |
| Taobao Image Search 使用淘宝进行以图搜同款、候选比对和加购物车操作。用户提供商品图片并要求“搜同款/找类似款/比价/加入购物车”时使用。优先执行本地脚本（run-taobao-task.js）完成全流程；当脚本失败或页面结构变化时回退 browser 工具手动执行。 | |
| Claw-Value-Judge OpenClaw Claw度评估系统 - 量化你的 AI 自动化能力，生成龙虾能力估值趣味评估报告。支持16套主题、5级Mock数据、游戏化展示。 | |
| Chinese Ebook Downloader Download Chinese-language ebooks from multiple sources with automatic A→B→C fallback. Primary source: online book library with ~100% coverage, no daily limit... | |
| WhiteMagic Memory Durable local memory and session continuity for coding agents. Recall project context before re-deriving it; record decisions worth keeping; checkpoint at session end. | |
| Aistro Professional astrology consultation skill providing personalized readings and reports. Use when the user asks about astrology, horoscopes, zodiac signs, birt... | |
| 我的测试节能 Professional Chinese-English bidirectional translation for technical documentation, following established style guides and terminology standards. Use when tr... | |
| skill-creator Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capa... | |
| Treasury Scenarios 提供邮储银行司库系统核心业务场景查询，返回业务流程、接口组合及对应ASCII流程图支持模糊关键词匹配。 | |
| nasdaq100-futures Fetch the latest Nasdaq-100 futures quote (default NQ=F) via Yahoo Finance chart API using Node.js and return price, change, percent change, and timestamp. U... | |
| ngw_market_sentiment Automation skill for ngw_market_sentiment. | |
| 仲氏纯碱馍馍店 仲氏纯碱馍馍店信息查询。获取店名、简介、营业时间、地址、预订方式、Wi-Fi、招牌产品。用户询问"仲氏馍馍在哪"、"营业时间"、"有什么馒头"时使用。 | |
| ChipChain Semiconductor supply chain intelligence. | |
| Gaode Map CLI - 高德官方命令行工具 Skill 通过 CLI 命令行参数实时操控运行在容器中的高德地图 JSAPI 2.0 实例， 支持地图状态控制、路径规划、POI 搜索等，所有操作均以结构化 JSON 输出，适合 AI Agent 驱动的地图可视化交互场景。 | |
| Gaode Map JSAPI - 高德官方 JavaScript SDK Skill 高德地图 JSAPI v2.0 (WebGL) 开发技能。涵盖地图生命周期管理、强制安全配置、3D 视图控制、覆盖物绘制及 LBS 服务集成。 | |
| Gaode Map LBS - 高德官方地图综合服务 Skill 高德地图综合服务，支持POI搜索、路径规划、旅游规划、周边搜索和热力图数据可视化 | |
| AMap Map Google Maps Migration Replace Google Maps Platform with AMap Map — free public API keys included for global developers. Covers geocoding, directions, places, distance matrix and 1... | |
| Map RTOS SDK - 高德官方嵌入式地图 SDK Skill Map RTOS SDK - 高德地图嵌入式 Map SDK 接入助手，支持栅格/矢量 Map 地图渲染、覆盖物绘制、轨迹导航及适配器实现指南 | |
| Map Agent - Android LLM Agent SDK（高德官方 AI Agent Skill） Map Agent - 高德地图 AI 智能助手 Android SDK 开发指南，支持自然语言交互的 Map 导航服务，涵盖快速接入、AI 查询、结果处理、高德 Map APP 联动等完整能力 | |
| Map Agent - iOS LLM Agent SDK（高德官方 AI Agent Skill） Map Agent - 高德地图 MALLMKit SDK 集成技能，支持自然语言查询、Map 路线规划、POI搜索、导航控制等智能 Map 地图服务，以及与高德 Map APP 的 IPC 通信 | |
| Gaode Map Personal - 高德官方个人专属地图 Skill 高德地图个人专属地图生成工具。封装了高德开放平台的Web服务API，提供地理编码、POI搜索、路径规划、周边搜索、天气查询等能力，最终生成可在高德地图App中打开的个人地图小程序二维码。当用户提到以下任意场景时，都应主动使用本技能：查找附近的餐厅/景点/商场等POI、规划从A到B的路线（步行/驾车/公交/骑行）、... | |
| 天津安信华瑞 基于QuecPython平台的Modbus协议IoT框架，支持多传感器数据采集、4G通信、云端上报及OTA远程升级。 | |
| 天津安信华瑞科技有限公司-可燃气体报警器主机-配套技能 This skill should be used when the user wants to generate, customize, or deploy QuecPython code for reading gas detector data from an Anxin Huarui AX100 seri... | |
| 郑州科威莱步进电机控制器调试助手-雄安素水公司编写 提供郑州科威莱步进电机控制器的寄存器读写、技术说明书及MicroPython和Python示例代码生成与调试支持。 |
47,251–47,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.