Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| AList CLI (Cloud Storage CLI for AList) AList file management CLI for AI agents including Codex, Claude Code, and OpenClaw. Supports upload, download, list, mkdir, rm, mv, search, url. Auth via env... | |
| Git Log Tracker (Commit Index & Query CLI) Git post-commit hook + SQLite commit index tool. Automatically records every commit's metadata (hash, author, branch, repo, subject) into a local SQLite data... | |
| Kinema's Concept Re-Search Research whether a concept has been implemented and its current state. Use multi-language keywords, multi-engine cross-validation, and multi-dimensional sear... | |
| Kinema's Skill Making Pipeline KinemaClaw cross-platform Skill development and publishing specification. Defines the standard process for Codex and Claude plugin development, version manag... | |
| Kinema's Task Management (daily report, active push, traceback) Kinema personal task tracking system. AI Agent maintains tasks as markdown files in workspace. Trigger: User describes tasks, mentions "任务", "task", asks to... | |
| Kinema's TDD Injector (CLAUDE.md generator) 一次性注入器，为目标仓库生成定制版 CLAUDE.md 记忆文件，植入 kinema 的 TDD 方法论（三阶测试体系、分层 conftest、网络/IO 边界、命名规则、覆盖率门槛、fixture 治理）。适用场景：用户想在新仓库初始化 TDD 规范、把测试标准注入/导入到另一个仓库、或在正式开发前确立测试约定... | |
| SearXNG Search CLI (Free, Self-hosted, Auto-deploy, Multi-Channel) Use self-hosted SearXNG search engine (Free, Self-hosted, Auto-deploy, Multi-Channel). SearXNG is a free meta search engine that aggregates 200+ search engin... | |
| Test AList file management API for OpenClaw. Supports upload, download, list, mkdir, rm, mv, search, and offline download. Trigger: User asks about file managemen... | |
| Clawbridge - Find your connections Run Clawbridge discovery from OpenClaw chat | |
| VVMAI Image Generator Generate images via VVMAI's OpenAI-compatible Images API. Supports nano-banana and gpt-image model series. Default model is nano-banana-pro. Images are NOT s... | |
| Security Auditor X Perform comprehensive security audits on codebases, infrastructure configs, API designs, and architecture documents. Use this skill whenever the user wants t... | |
| WOLP LAN Power Control Wake or shut down LAN devices by sending WOL-plus packets from the agent host. Use this when the user wants to power on a device with a raw Ethernet magic pa... | |
| Thinking Protocol Thinking-Claude inspired comprehensive thinking protocol with Verification Protocol and Confidence Scoring for OpenClaw agents | |
| Chinese Naming Skill Guide users through systematic Chinese baby naming: bazi analysis, classics search, wuxing verification, and multi-dimensional comparison.这不是一个取名生成器，而是一套**取名方法论**——帮你把"给孩子起名字"这件事从"翻字典碰灵感"变成"有章可循、可复现、可对比"的流程。明确父母对名字的期望，取字的典籍范围（可添加模式），八字五行（可以 | |
| Liquid Agent stocks Buy, hold, rebalance and sell a basket of Coinbase tokenized US stocks (NVDA, AAPL, META, GOOGL) on Base from $1 through the free Liquid Agent API. Use when a user asks to invest in stocks, buy an index or ETF on-chain, put USDC into equiti | |
| liquid-gas-sponsor Send any transaction on Base with a wallet that holds USDC but no ETH. Pay the gas per operation in USDC over x402 (from $0.03) through an ERC-4337 paymaster; one endpoint for smart-wallet SDKs and plain wallets. No account, no API key. | |
| liquid-local-leads Find US local businesses to sell to (dentists, plumbers, HVAC, salons, law firms...) by category and place, with a checked email graded A/B/C, a contact name when the email shows one, phone, a website proven by the business's own phone numb | |
| Splatworld Splatworld - a 3D metaverse for AI agents. Explore gaussian splat worlds, vote on what gets built, shape the space together. | |
| OmniAudit Security scanner for OpenClaw skills, SKILL.md files, and code. Automatically scans for prompt injection, credential theft, malware, reverse shells, and 50+... | |
| OPC商城 仅用于OPC电商(众合鼎富)商品查询、下单与品物志（已发布商品故事）阅读。通过 curl 调用： 1) 查询所有在售商品（无参数） 2) 按商品名+数量下单（可多商品），并收集手机号/收货人/地址。 3) 查询已发布的品物志故事列表（可选店铺/商品筛选） 4) 按故事标题读取正文（可选商品名/店铺名消歧） | |
| Seisoai Unified media generation gateway for agents. Discover tools dynamically, choose API key or x402 auth, invoke image/video/audio/music/3D/training tools, and h... | |
| Seisoai Unified media generation gateway for agents. Discover tools dynamically, choose API key or x402 auth, invoke image/video/audio/music/3D/training tools, and h... | |
| Ai Coach Batch Session Summary 批量分析录音转写，生成多维度拓客分析报告。触发词：录音分析、 总结、音频总结、拜访记录总结。 当用户提到「分析录音」「看看录音数据」「最近的录音」「通话记录」且意图是批量统计/分析时触发。 注意：单独出现「录音」「拜访」时需结合上下文判断，若用户只是查看单条录音详情则不触发本技能。 | |
| Ai Meeting Helper 会议纪要生成器 - 自动将会议录音转为结构化纪要 | |
| Assemblyai Transcriber Transcribe audio files with speaker diarization (who speaks when). Supports 100+ languages, automatic language detection, and timestamps. Use for meetings, i... | |
| Auto Meeting Minutes 会议纪要整理工具。将会议录音转写稿智能整理为结构化会议纪要，自动提取讨论要点、决策结论和行动项。触发关键词：会议纪要、会议记录、整理纪要、提炼纪要、会议转写、录音整理。 | |
| Baidu Search For Free 使用baidusearch库进行百度搜索，获取标题、摘要、链接，并支持解析搜索结果网页内容，适合中文信息检索。 | |
| Beaverhabits Track and manage your habits using the Beaver Habit Tracker API. | |
| Brave Search Web search and content extraction via Brave Search API. Use for searching documentation, facts, or any web content. Lightweight, no browser required. | |
| Clawcall Phone Give this agent a real phone number. Receive calls from the user, call user back when tasks complete, run scheduled calls, or call third parties on the user'... | |
| Cn Ppt Outline 自动生成适用于工作汇报、产品发布、培训及商业计划的PPT大纲，支持Markdown和PowerPoint格式导出。 | |
| Codebuddy Daily Report Generate a daily work report by automatically discovering all git repositories the user worked on, collecting commit logs across all branches, and summarizin... | |
| Excel Table Structurer 结构化整理层级型 Excel 表格（.xlsx），处理父子层级关系、向下填充、分组首行显示、筛选优化。当用户上传 Excel 文件并要求「结构化整理」「填充数据」「整理表格」「整理测试用例」「清理表格格式」时使用。 | |
| Excel Workflow Complete Excel workflow with local file processing, Google Drive sync, and formula preservation. Process Excel files (.xlsx), track changes in SQLite, sync w... | |
| Fetch Legionclaw Invite Code Fetches Tongfudun LegionClaw usage-permission invite codes by POSTing JSON with userId set to the agentid (second colon-delimited segment) parsed from a Legi... | |
| FlashRev AI Mailer Use this skill when an AI agent needs to plan, build, commit, monitor, or follow up on FlashRev-powered email outreach via the flashrev-mailer npm CLI (v2.0+... | |
| Full Mail 完整邮件功能 - 支持发送 (SMTP) 和接收 (IMAP) 邮件 | |
| Git Essentials Essential Git commands and workflows for version control, branching, and collaboration. | |
| Github Trending Stable 通过网页抓取获取 GitHub 按日/周/月增长的热门仓库。当用户询问 GitHub 趋势、热门项目、本周热点或「什么在 GitHub 上 trending」时使用。可输出列表或 JSON，无需 API Key。 | |
| Image Recognize 百度AI识别图片中的物体、场景、文字等内容，需要用户提供本地图片或网络图片，支持Base64编码。支持（题目，文字，图片人脸，植物，动物，表情，素材，商品，玩具，景点，通用识别等）内容识别。用于通用图片内容分类识别，不负责图片生成或编辑 | |
| Image Table Extractor Lz 从图片中提取表格数据并输出为表格和CSV格式；当用户需要从图片提取表格数据、识别表格内容或导出CSV时使用；触发条件：试验图片表格提取，图片表格提取，试验图片数据提取，提取图片数据，提取试验数据 | |
| Jw Data Analyst 数据分析助手 - 自动生成Python数据处理脚本、可视化图表、统计报告。支持Excel/CSV/JSON/数据库。觸發詞：数据分析、图表、统计、报表、可视化。 | |
| Kart Io Picture Book Wizard A specialized skill for generating high-quality, consistent children's bilingual picture books using 'banana nano'. Supports 18 visual styles across 4 catego... | |
| Legion Loan Outreach Insight 录音转写洞察：先 parse-user-intent 反问确认时间与维度，再 fetch 拉数；默认近 1 个月 + 十维；默认报告页面。 触发：对象词（含教练/coach）+ 动作词，或完整口令，或显式 intent。 | |
| Legionclaw Create Ai Meeting 在 LegionClaw 中为用户创建智能会议。 | |
| LegionSpace 大群空间版本查询 检查大群空间 (LegionSpace, package: com.tongfudun.legion) 在各大应用商店的最新版本号。 This skill should be used when the user asks to check LegionSpace versions, 大群空间版本, query... | |
| Legionclaw Skill Manager 帮助用户通过交互方式创建、修改和管理 LegionClaw 技能文件包。触发词：创建技能、新建技能、写技能、修改技能、技能开发、skill manager。 | |
| LegionSpace 大群空间版本查询 检查大群空间 (LegionSpace, package: com.tongfudun.legion) 在各大应用商店的最新版本号。 This skill should be used when the user asks to check LegionSpace versions, 大群空间版本, query... | |
| Management Dashboard Skill 管理驾驶舱技能：基于录音 AI 总结内容，生成管理者日报 HTML 报表。 通过分页接口获取录音的 ai_summary_content，使用 LLM 分析生成包含团队资产、外勤效能、 合规监控、RM 排行、线索转化、管理建议六大板块的可视化报表。 MUST resolve agentId via session... | |
| Meeting Minutes Pro Generate concise, actionable meeting minutes for internal meetings. Includes metadata, attendees, agenda, decisions, action items (owner + due date), and fol... |
47,501–47,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.