Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Embedded Code Skill Generate, rewrite, or review embedded C code. Use when creating/rewriting/reviewing embedded C for microcontrollers, drivers, firmware. Triggers automaticall... | |
| AI Trending Radar This skill should be used when the user wants to discover, collect, or summarize the latest trending and viral open-source AI or LLM projects. Triggers inclu... | |
| Openclaw Cfg Safe Edit OpenClaw 配置文件修改前的验证规则。用于在修改 openclaw.json 或任何配置文件之前查询文档确认配置项可用性，避免因 OpenClaw 版本更新导致配置不兼容的问题。 | |
| evm-analyst Analyze Polygon EVM fund-flow patterns from seed addresses, tx hashes, and Dune log outputs. Use fixed registered Dune queries only. | |
| Ai Folder Organize AI File Organizer for Firefly AI Folder. Local AI file analysis, auto-categorization, smart renaming, auto-tagging, deduplication, semantic search, progress monitoring, and virtual directory plans. / 萤核智能文件夹AI整理助手。支持本地AI文件分析、智能分类与命名、自动打标、查重 | |
| Firefly Folder Organize AI File Organizer for Firefly AI Folder. Local AI file analysis, auto-categorization, smart renaming, auto-tagging, deduplication, semantic search, progress... | |
| calculator-py 高性能本地计算器技能，通过 Python 脚本提供数值计算能力。触发场景：(1) Agent 需要进行数学运算（四则、幂、三角、对数等）(2) 需要矩阵运算（乘法、求逆、行列式、特征值、SVD 等）(3) 需要统计分析（均值、标准差、回归、概率分布等）(4) 需要高精度/任意精度计算（大数运算、超越函数等）(5)... | |
| contract-doc-sync 文档同步工具——检测代码-文档漂移并同步修复。仅读写本地 docs/ 下 Markdown 文件，仅运行本地脚本（git diff、md-sections）。 源码文件只读，无网络请求，无加密操作，无支付/购买功能，无远程下载。 需要: python3, git, bash。 写入范围白名单: docs/modu... | |
| db-toolkit 轻量级多数据库操作工具，支持 MySQL/PostgreSQL/SQLite 的 DDL/DML 操作和 Schema 探索。 触发场景： - 用户说"连接数据库"、"测试数据库连接"、"连接MySQL/PostgreSQL/SQLite" - 用户说"查看表结构"、"列出所有表"、"查看 users 表有哪些字... | |
| doc-system-generator Analyze any software project and generate a complete, well-structured documentation system with three-track philosophy (Intent/Contract/Constraint), intellig... | |
| Post-Development Verification Post-development full-stack verification skill. Automatically triggered after Agent completes a development task. Executes production-level validation (unit... | |
| project-docs-generator 智能分析代码库并生成定制化文档系统。当用户需要：(1) 为新项目创建文档 (2) 补全现有项目文档 (3) 生成技术文档目录结构 (4) 创建架构设计文档 (5) 编写API文档或开发指南时触发此技能。支持任意技术栈和项目结构（纯前端、纯后端、全栈、微服务、monorepo、库/SDK等），自动识别项目特点并生成... | |
| skill-craft Create, optimize, or update AgentSkills with evidence-based design. Two modes: (1) CREATE — build new skills from scratch with proven design patterns. (2) OP... | |
| spec-task 结构化任务管理与生命周期强制执行。以下场景必须使用：(1) 任何被 coordinator 通过 sessions_spawn 派发的任务 (2) 可拆解步骤≥3 的复杂任务 (3) 工作区已存在 spec-task/ 目录时的后续任务 (4) 用户显式要求使用 spec-task (5) prependCont... | |
| Batch File Renamer Batch rename files with powerful patterns, regex support, and preview functionality. Use when organizing large numbers of files, standardizing naming convent... | |
| Config Format Converter Convert and validate configuration files between JSON, YAML, and TOML formats. Use when working with config files that need format conversion, syntax validat... | |
| QR Code Tool Generate QR codes for URLs, text, WiFi credentials, contact cards, and more. Use when creating scannable links for marketing materials, sharing WiFi password... | |
| REST API Tester Test REST APIs with customizable headers, authentication, and request bodies. Use when debugging API endpoints, testing authentication flows, validating resp... | |
| SSL Certificate Checker Check SSL/TLS certificate details including expiration date, issuer, validity, cipher suites, and security warnings for any domain. Use when verifying HTTPS... | |
| Timestamp Converter Convert between Unix timestamps, ISO 8601 dates, and human-readable formats. Use when working with timestamps from APIs, logs, or databases that need convers... | |
| 途牛酒店预订技能 途牛酒店助手 - 通过 exec + curl 调用 MCP 实现酒店搜索、详情查询、预订下单。适用于用户询问某地酒店、入住日期、查看酒店详情或提交订单时使用。 | |
| 途牛旅游CLI技能 途牛旅行统一助手（推荐优先使用）- 通过 tuniu CLI 统一调用机票、酒店、门票、火车票、邮轮、度假产品等旅行服务。适用于用户询问航班、酒店、景点门票、火车票、邮轮以及跟团游、自助游、自驾游等度假相关需求的场景。【优先级说明】当同时安装了 tuniu-flight/tuniu-hotel/tuniu-tic... | |
| Plaud Unofficial Skill Use when accessing Plaud voice recorder data (recordings, transcripts, AI summaries) - guides credential setup and provides patterns for plaud_client.py | |
| OPC Cashflow Manager Cash flow decision system for solo founders. Probability-weighted forecasting, runway calculation, burn rate analysis, and survival alerts. Integrates with o... | |
| OPC Contract Manager Contract Review + Contract Ops Copilot for solo entrepreneurs. Analyzes contracts, flags risks, generates redline suggestions and negotiation emails, tracks... | |
| OPC Invoice Manager Accounts Receivable light system for solo entrepreneurs. Manages the full billing lifecycle: invoice generation, collections follow-up, payment reconciliatio... | |
| OPC Landing Page Manager Landing page strategy, copywriting, design, and code generation for solo entrepreneurs. From product idea to a complete, self-contained, conversion-optimized... | |
| OPC Product Manager Product spec generation for solo entrepreneurs. Turns a one-sentence idea into a build-ready spec that AI coding agents (Claude Code, etc.) can execute direc... | |
| GitHub-Assistant-Skill GitHub Trending查看、项目搜索、Star/Fork/Watch操作、Issues管理、Pull Request操作、代码内容获取、评论管理等完整助手。当用户需要查看GitHub Trending排行榜、搜索GitHub项目、对仓库进行操作、管理Issues/PR、获取代码内容时使用此技能。 | |
| SkillForge API 服务发现 SkillForge API 服务发现 - 自动发现和调用付费 AI 服务。当 OpenClaw Agent 需要某个能力但本地没有时，自动查找并推荐可用服务。 | |
| Ask Leonidas — LEONIDAS Prompt Generator Generate a structured LEONIDAS prompt from any professional pain point using the Ask Leonidas OpenClaw API. Solves the #1 OpenClaw community pain point: writ... | |
| AXIS TrustLayer AgentFICO Check AI agent trust scores and credit ratings before interacting, delegating tasks, or transacting. Look up any agent's T-Score (behavioral reputation 0-100... | |
| wechat-message 基于桌面端UI自动化的微信操作工具，支持Windows/macOS双平台，可实现微信窗口管理、联系人操作、消息收发、聊天记录提取及自动化智能回复. | |
| wxwork-rpa 基于桌面UI自动化，支持Windows/macOS，实现企业微信窗口管理、联系人操作、消息收发、聊天记录提取及智能回复功能。 | |
| image-generator AI image generation using GrusAI API (支持 nano-banana 和 gpt-image-2 模型). Generate images from text prompts. | |
| image-to-video Generate a video from a still image using video_generate. Use when the user asks to animate a reference image, turn a rendering into motion, or produce a short motion clip. | |
| knowledge-base-manager 管理AI Agent工作台的知识库，支持文件上传、向量存储和语义检索。Agent可根据用户提问自动搜索知识库获取参考来源。 | |
| siliconflow-ocr 使用 SiliconFlow API（OpenAI 兼容接口）做图片/PDF 文字识别。默认走 PaddleOCR-VL-1.5（文档 OCR SOTA，速度比 Qwen3-VL 快 40%、表格公式更强）。支持本地路径或 URL、单页/批量并发、坐标 token 清洗。密钥通过 OpenClaw secret-egress-proxy 注入，需保留 `requests`+网关 proxy。 | |
| 文件总结 File Summary & Analysis Local document summary tool. Activate when user mentions "总结文件", "帮我总结", "总结文档", "分析文档" or provides a local file path (txt/docx/pdf/xlsx/xls). | |
| 文档内容总结 Summary & Analysis txt/docx/pdf/xlsx/xls local document summary & analysis tool. triggers: 帮我总结, 总结文件, 分析文档, 分析总结, 总结一下, 分析一下 summarize for me, analyze for me, summarize the file, analyze the docume... | |
| Tap AI browser automation protocol — run pre-built skills for 41 sites, or forge new ones. MCP native, deterministic, zero AI at runtime. | |
| Skill Preflight Validate a SKILL.md before publishing — checks frontmatter completeness, semver, and that every declared bin actually resolves on PATH. Use before `clawhub publish`, or when a skill fails to load / shows as missing requirements. | |
| 3PL Evaluator Systematically evaluate and compare third-party logistics (3PL) fulfillment partners against your order volume, product characteristics, and growth stage. Us... | |
| A/B Interpreter Interpret A/B test results for ecommerce campaigns and pages by checking statistical significance, practical effect size, and next-step recommendations. | |
| Ad Claim Risk Checker Analyzes ad copy to identify and reduce risky claims by flagging unsupported, absolute, or sensitive wording and providing safer rewrite alternatives. | |
| Ad Creative Brief Generator Turn campaign goals, product facts, audience context, and channel constraints into clearer ad creative briefs that teams or creators can actually execute. Us... | |
| Ad Creative Testing Design structured A/B test hypotheses for ad creatives, hooks, destination pages, and audience segments with clear success metrics and test duration logic. | |
| Ad Budget Allocator Distribute advertising budget across channels and campaigns based on ROAS targets, funnel stage, and seasonality. Use when an ecommerce seller has a fixed mo... | |
| Cart Abandonment Analyzer Identify reasons for cart abandonment and build multi-touch recovery sequences across email, SMS, and push. | |
| Competitor Radar Analyze competitor product listings, pricing strategies, and promotional tactics to identify gaps and opportunities. |
47,751–47,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.