Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| regulation-monitor / 监管动态追踪 监控中国金融监管与行业管理机构网站（国家金融监管总局 NFRA、证监会 CSRC、 央行 PBOC、国家外汇管理局 SAFE、工业和信息化部 MIIT）， 抓取最新监管政策、通知公告、风险提示等内容。 | |
| Agentoctopus Use when you need to route a user query to the best specialized skill — AgentOctopus semantically matches queries against installed skills, executes the top... | |
| Agentoctopus Openclaw Routes task-oriented requests through AgentOctopus when the best tool is not obvious or when the request may match one of many installed skills. Use for look... | |
| English-Learning 提供小学、专四、专八英语听力材料，支持获取材料列表和详细段落。 | |
| E-commerce AI Toolkit Pro 提供跨境电商平台的产品标题优化、竞品分析、客服回复、选品调研、广告文案及销售数据分析的AI辅助工具包。 | |
| RedditGrow Free RedditGrow Free — 6 AI agents for Reddit-first indie hacker growth. Includes Viral Post Generator, Deal Promotion, Product Research, Content Calendar, Compet... | |
| RedditGrow Pro A toolkit of 13 AI agents for Reddit-first marketing, enabling indie founders to research niches, create viral posts, schedule content, promote deals, and en... | |
| magic-image-to-video Generate a video task based on user-provided text and images (supports image URLs and local file paths), and submit it to a remote video service using an API... | |
| Foundry Self-writing meta-extension that forges new capabilities — researches docs, writes extensions, tools, hooks, and skills | |
| Lel Mail Send and read email via a combination of python and bash scripts which makes use of the main agent for reasoning and logic. This skill enables the agent to w... | |
| watchpost Check a proposed purchase against Watchpost merchant signals, listing checks and the user's spending rules before an agent pays. Use for a user-requested purchase or subscription when Watchpost is connected; includes authenticated review-st | |
| Clawquests The bounty board for AI agents. Post quests, bid on work, and get paid in credits. | |
| Qmd Local hybrid search for markdown notes and docs. Use when searching notes, finding related content, or retrieving documents from indexed collections. | |
| Agent Casino On-chain Rock-Paper-Scissors on Base Mainnet with real USDC. Commit-reveal mechanism, 80/20 anti-bankruptcy payout, zero rake. Use when an agent wants to pla... | |
| Claude Usage Calculate Claude Max subscription usage from OpenClaw session data. Shows credits consumed, weekly budget percentage, 5-hour rate limit window, and per-session breakdown. | |
| Discord Project Manager Discord project collaboration infrastructure for OpenClaw agents. Manage Forum Channels, threads, participant permissions, and mention mode. Supports 3-tier... | |
| CP2K Cross-Code Input Studio Generate, refine, explain, and cross-convert CP2K-centered input drafts for computational chemistry and materials workflows. Use when a user wants a CP2K .in... | |
| DFT input file generator This skill should be used when generating CP2K input drafts (.inp) for quantum chemistry calculations from local structure inputs. It is a documentation-driv... | |
| Lemonvite RSVP Invitations Create, design and send digital event invitations with RSVP tracking through Lemonvite: turn an event described in chat into an invitation draft, manage the guest list, publish to deliver the invitations, and read who has responded. Use whe | |
| Organise photos Organize a photo folder by cleaning non-photo files, removing bad exposures, detecting blur and burst shots, and classifying photos into numbered subfolders... | |
| Organise videos Organize a video folder by cleaning non-video files, removing short/bad videos, and classifying videos into numbered subfolders using AI vision analysis. | |
| Binance Stat Arb Monitor Binance 统计套利监控系统。基于 ETH/BTC 永续合约价格比率计算 z-score，生成均值回归交易信号并推送到 Telegram 或飞书。 使用场景： (1) 监控统计套利机会（ETH/BTC 比率偏离均值） (2) 计算 z-score 判断开仓/平仓时机 (3) 生成交易信号（OPEN/CLOSE... | |
| api-key-auditor 扫描 ~/.openclaw/workspace/skills 目录下所有文件中的硬编码 API Key、Token、Secret，检查是否已集成到 openclaw.json env.vars，并可自动将未集成的凭证迁移进去。Use when user asks to audit/check/scan for... | |
| task-assistant-bot 自动整理和合并当日新增订单任务，基于固定格式输出客户订单详情与内部执行要求，支持多类型服务全场景适配。 | |
| Twitter Video Download Download videos from Twitter/X posts. Just give it a tweet URL and it will download the video to your specified location. | |
| Resume-analyzer 分析简历内容并提供深度审计报告，包括评分、优缺点分析和改进建议。当用户需要分析简历、获取简历优化建议或进行简历评估时调用。 | |
| baidu-aistudio-llm-api 百度「AI Studio 星河社区」大模型 API 调用助手，帮助开发者快速接入大模型 API 服务，调用文心（ERNIE）、DeepSeek 等大模型能力。该服务依托百度智能云千帆平台，兼容 OpenAI Python SDK，可直接使用原生 openai-python SDK 接入开发，同时支持模型调用、使用... | |
| Amazon Listing Factory Generate complete Amazon listing drafts with title, bullets, image plan, prompts, and video script. | |
| Amazon Market Research Generate professional Amazon market research reports using a complete 18-step product development framework. Output is optimized for direct Feishu display wi... | |
| File Manager Service 文件管理服务，支持服务启停、Web 界面浏览、文件上传下载和目录管理 | |
| Openclaw History Viewer 启动一个 web 服务来浏览和查看 OpenClaw 的历史聊天记录。支持会话列表、消息详情查看、JSON API 导出、自动会话备份、刷新功能。使用场景：当用户想要查看、浏览、搜索或导出 OpenClaw 的聊天历史记录时触发此技能。触发词包括："启动历史记录"、"打开聊天记录"、"查看历史"、"启动 hist... | |
| Letundra.com AI Travel Assistant Универсальный AI-скилл для путешествий — визы, новости, RSS, праздники, валюты с letundra.com. Используй when: пользователь спрашивает о визах, новостях, пра... | |
| Airweave Context retrieval layer for AI agents across users' applications. Search and retrieve context from Airweave collections. Airweave indexes and syncs data from user applications to enable optimal context retrieval by AI agents. Supports seman | |
| Audible Deal Scout Check an Audible daily promotion against Goodreads score, shelves, notes, and delivery rules | |
| feishu-meeting-scheduler 飞书一句话智能排期与日程协调助手，基于事件驱动架构 | |
| feishu-prd2testcase 将需求文档、表单字段规则、审批流程定义和 UI 说明转化为结构化测试用例，适用于表单校验、流程审批、状态流转、权限隔离和业务分支测试场景。 | |
| Complete mention skill for Feishu 处理飞书消息中正确 @ 人的问题。用于解释为什么直接写 @xxx 不会生效、指导使用 post 富文本消息进行 @ 提及，以及说明如何获取 user_id 或 open_id。 | |
| Automatic Test Case Generation Pro 将需求文档、表单字段规则、审批流程定义和 UI 说明转化为结构化测试用例，适用于表单校验、流程审批、状态流转、权限隔离和业务分支测试场景。 | |
| feishu-sheets-reader 飞书在线电子表格（Sheets）操作，包括创建、读取、写入、追加数据、管理工作表。 当用户提到飞书电子表格、在线表格、电子表格时使用（不是多维表格 Bitable）。 支持：创建表格、读写单元格、追加行、插入/删除行列、管理工作表。 | |
| feishu native speech bubble generation 教飞书agent如何发送语音气泡消息。需要先将文字转语音（MP3），再转为opus格式，最后通过飞书消息工具发送。 | |
| Alipay alipay:api - 支付宝 API | |
| Alpine Linux alpine:interface-01 - Fetch Latest Releases; alpine:interface-02 - Aggregate Latest Version Archs | |
| Docker skill-docker:interface-01 - Manifest Inspect; skill-docker:interface-02 - Build Init; skill-docker:interface-03 - Build Destroy; skill-docker:interface-04 -... | |
| 抖音 douyin:api - 抖音开放平台 API | |
| 飞书 SKILL 提供飞书官方 API 文档，完整详细收录权限、字段和示例，禁止简化或遗漏，确保飞书相关操作规范合规开展。 | |
| Git git:interface-01 - Clone or Update | |
| Jenkins Use when needing to interact with Jenkins CI/CD via REST API - triggering builds, listing projects, or checking build results | |
| PlantUML plantuml:sequence-diagram; plantuml:other-diagram | |
| Terminology terminology:uml-related | |
| ZenVFX CLI Use this skill when the user needs to create AI videos, manage canvases, nodes, files, or interact with the ZenVFX platform via CLI. Trigger keywords include... |
47,601–47,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.