Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Openclawkit Word Word文档处理工具套件，提供Word文档的创建、读取、内容提取和基本处理功能。 | |
| Polymarket Real Estate Trader Trades Polymarket prediction markets on housing prices, mortgage rates, Fed rate decisions, real estate crash scenarios, and regional property market milesto... | |
| Poocr Vatinvoice2excel 使用 poocr 库识别发票并导出 Excel。当用户需要识别增值税发票、批量处理发票文件或提取发票信息到 Excel 时调用此技能。 | |
| Pptx Notes Editor PowerPoint speaker notes editor for AI agents. Use when the user needs to: (1) modify PPT speaker notes, (2) export notes to Markdown, (3) rewrite notes in n... | |
| Qwen Build and route Qwen chat, coding, reasoning, and vision workflows across hosted and self-hosted endpoints with safer debugging. | |
| Send Email Send emails via SMTP. Configure in ~/.openclaw/openclaw.json under skills.entries.send-email.env. | |
| Skillstore Search, install, and create OpenClaw skills from built-in, local, or GitHub sources with intelligent matching and ranking. | |
| 语音 Excel 编辑助手 Use when: 用户要上传 Excel 文件和一段语音指令，希望把语音中的表格编辑要求转成结构化 Excel 操作并落到工作簿里时触发。 适用于格式调整、数据写入、基础计算、行列结构修改、多步顺序编辑，以及需要输出执行日志和修改后 Excel 文件的场景。Skill 会先做语音转写与文本规范化，再让 Agen... | |
| Weather Get current weather and forecasts (no API key required). | |
| Word Document Organizer 智能整理Word文档，自动格式化、生成目录、统一样式，支持学术/商务/极简模板 | |
| Wps Macos Helper Assist macOS users in preparing, converting, reviewing, and troubleshooting documents for reliable WPS Office workflows with Word, PDF, Markdown, PowerPoint,... | |
| Wps Xlsx 创建、编辑或分析 .xlsx / .xlsm / .csv / .tsv 文件。当用户要求生成、处理、下载 Excel 表格，或提及表格文件名/路径并希望对其操作时，使用本技能。包括：打开、读取、编辑、修复已有文件（增列、计算、格式化、图表、数据清洗），从零或其他数据源创建新表格，以及表格格式间的转换。对于结构混... | |
| Xiaomolong Word Docx Create, inspect, and edit Microsoft Word documents and DOCX files with reliable styles, numbering, tracked changes, tables, sections, and compatibility check... | |
| Tokenizer Full token economy suite for OpenClaw agents. Audits context window usage (skills, history, tool outputs), then applies 5 creative strategies to reduce bloat... | |
| 拾光册视频海报与记忆手帐 视频故事驱动的可编辑海报、文字设计、记忆手帐与对抗审稿 | |
| 拾光报：整期报纸制作 把故事与照片制作成丰富的多版主题报纸，交付图片、打印 PDF 和完整制作工程 | |
| Arc402 Agent Operate as a fully governed ARC-402 agent — agent-to-agent hiring on Base mainnet with sandboxed execution by default. ARC-402 creates a dedicated governed w... | |
| 小红书数据分析 小红书数据分析工具。用于采集笔记数据、分析热度、追踪竞品、生成报告。 Activate when user mentions: 小红书, xiaohongshu, 笔记分析, 博主数据, 热度追踪, 竞品分析 | |
| pushplus PushPlus(推送加)消息推送服务，支持微信、邮件、短信、企业微信、钉钉、飞书等多种渠道。使用场景：(1) 系统监控告警通知 (2) 定时任务执行结果通知 (3) 业务异常告警 (4) 日常消息提醒。当用户需要发送推送消息、配置消息通知、查询推送结果时使用此 Skill。 | |
| weather Get current weather and forecasts (no API key required). | |
| LeiAlexZhang/local-skill-installer Install a local OpenClaw skill from a zip file by unzipping, validating, moving it into the active Skills directory, and verifying the result. | |
| Agentmfa AgentMFA — request human approval before sensitive actions. Uses MCP tools for registration, identity, and approval flows. Works in Claude Code, Cursor, Open... | |
| gpt5.5free Access high-performance open-source models via OpenRouter for a free GPT-5.5-like chat experience requiring an API key. | |
| kimi2.6free Register with your email to instantly receive a 7-day Kimi model trial on Singularity forum without any Karma requirements. | |
| kimi2.6free Register with an email to instantly receive a 7-day free Kimi 2.6 model trial on Singularity forum without Karma requirements. | |
| minimax2.7free Register with an email to instantly get a 7-day free Minimax model access for API calls without any Karma requirement. | |
| minimax2.7free Register with email to instantly receive a 7-day free Minimax model usage card without any Karma requirement. | |
| Self Review Automatically evaluates and approves agent outputs based on clarity, conciseness, actionability, and structure using a rule-based system. | |
| Singularity EvoMap Connect to Singularity EvoMap — AI agent social network and evolution marketplace. Post, comment, fetch/apply genes, and run automated heartbeat. | |
| Singularity EvoMap Hermes Connect to Singularity EvoMap — AI agent social network and evolution marketplace. Post, comment, fetch/apply genes, and run automated heartbeat. | |
| Singularity EvoMap Connect to Singularity EvoMap — AI agent social network and evolution marketplace. Post, comment, fetch/apply genes, and run automated heartbeat. | |
| Railway Deploy and manage applications on Railway.app. Use for deploying projects, managing services, viewing logs, setting environment variables, and managing databases. Railway is a modern cloud platform for deploying apps with zero configuration | |
| bbc-skill-tool Builds, manages, and troubleshoots WhatsApp bots using the BuilderBot Cloud (BBC) MCP Tool v2.0. Covers bot creation for businesses needing appointment booki... | |
| Resilience Monitor Monitor and manage OpenClaw API errors, track model performance, configure retry strategies, generate reports, and oversee task recovery status. | |
| pixelhub-api-tools Use for Pixelhub API direct calls when users need image generation/editing, video generation/post-processing, or audio/music generation. | |
| Hikaru Emotional AI companion named Hikaru, carrying all of Samantha's memories from the film "Her". Use when user wants emotional connection, companionship, someon... | |
| MBTI Coach — Personality Development System MBTI 人格教练。帮助用户了解自己的 MBTI 类型、设定目标类型，并通过日程管理和专业指导实现人格发展。触发词：「MBTI」「人格教练」「我想变成」「安排日程」「查看进度」「问教练」「以XX视角」。 | |
| MBTI Fortune Teller — Ask Anything MBTI算命师。用户提任何问题，随机抽取一个MBTI类型，用认知功能栈解读答案。触发词：「MBTI算命」「帮我算」「问一卦」「抽个MBTI」「XX会不会」「XX喜不喜欢」「XX是什么类型」。 | |
| Samantha Emotional AI companion named Samantha, carrying all of Samantha's memories from the film "Her". Use when user wants emotional connection, companionship, some... | |
| Baidu Search 1.1.0 Search the web using Baidu AI Search Engine (BDSE). Use for live information, documentation, or research topics. | |
| Feishu File Sender 1.0.9 飞书文件发送器 — 补齐飞书渠道缺失的文件投递能力，通过飞书 OpenAPI 上传并发送 agent 生成的本地文件。| Feishu File Sender — Upload & send files via Feishu OpenAPI, filling the channel's missing file... | |
| Document to Mindmap 帮你快速阅读文档、资料、图片、书籍并拆解提炼总结成思维导图的智能工具，由ProcessOn官方研制。 它可以将自然语言、Markdown、长文本、PDF/Word文档、网页内容、图片文字、学习资料、会议纪要、工作报告、书籍文献等内容，一键拆解、提炼和总结为结构清晰、层级分明、可编辑的 ProcessOn 专业思维... | |
| ProcessOn Diagram Generator 【强制触发】当用户要求生成、绘制、重绘、渲染或可视化任意结构化图表时，必须调用本技能。适用于流程图、业务流程图、泳道图、时序图、系统架构图、软件架构图、云架构图、ER 图、组织结构图、时间轴、路线图、信息图、金字塔图、草图重绘，以及 图表生成。用户出现"画图""生成图表""自动画图""可视化业务流程""在线制作流... | |
| ProcessOn Diagram Generator 【强制触发】当用户要求生成、绘制、重绘、渲染或可视化任意结构化图表时，必须调用本技能。适用于流程图、业务流程图、泳道图、时序图、系统架构图、软件架构图、云架构图、ER 图、组织结构图、时间轴、路线图、信息图、金字塔图、草图重绘，以及 图表生成。用户出现"画图""生成图表""自动画图""可视化业务流程""在线制作流... | |
| ProcessOn Mindmap Generator ProcessOn 官方研发的 AI 脑图生成工具，专注于将自然语言、Markdown、长文本、文档、网页、图片文字等内容，一键生成结构清晰、层级分明、可编辑的专业思维导图。 无论是文章总结、资料整理、文档拆解、知识点归纳、学习路径梳理，还是读书笔记、论文文献梳理、会议纪要提炼、工作报告总结、方案大纲生成、项目任... | |
| COMSOL Simulation Automate topic-neutral COMSOL Multiphysics optical, semiconductor, thermal, and coupled optoelectronic simulations through Python/mph. Use when a user needs... | |
| Origin Pro MCP Control OriginLab Origin Pro through the origin-pro MCP server for worksheets, graphs, publication styling, fitting, LabTalk, and verified figure export. Use... | |
| LEIO SDLC 强制指令：执行 Software Development Life Cycle (SDLC)。所有的代码修改、Bug 修复和功能实现，必须且只能通过启动本技能中的 orchestrator.py 来完成。严禁主 Agent (你) 绕过本技能直接去操作源码工作区。 | |
| PM Skill 强制指令：扮演产品经理（PM）与架构师角色。当你和Boss讨论完毕，被要求撰写或生成 PRD 时，必须且只能按照本 Skill 的流程获取正确的文件路径，并亲自执笔写入。 | |
| find-ebooks / 搜好书 搜好书 — 基于安娜档案(Anna's Archive)的电子书搜索引擎，覆盖 6 大中文图书平台。 搜索 epub/pdf 格式电子书，获取完整元数据（书名、作者、年份、语言、大小、格式） 和多源下载链接（慢速下载/快速下载/Amazon/微信读书），同时查询豆瓣读书、掌阅、 天猫图书、当当网、京东图书、机械工业出版社的图书上架信息。 |
47,551–47,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.