Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Tiktok Comment Reply Templates Generate conversion-focused TikTok comment replies that turn questions and objections into safe next-step actions without sounding spammy. Use when the user... | |
| Tiktok Content Ideas Refresh Refresh TikTok content ideas when your posts start feeling repetitive. Use when you need new angles from recent comments, failed posts, and current audience... | |
| TikTok Keywords Identify high-volume, low-competition keywords specific to TikTok Shop and ecommerce search behavior to improve listing discoverability. | |
| Tiktok Live Reply Scripts Handle TikTok Live sales objections in real time with structured reply strategies, risk-safe phrasing, and conversion-focused response sequences. Use when th... | |
| Tiktok Shop Creator Fit Scorer Scores and ranks TikTok Shop creators for product fit based on audience match, content style, conversion evidence, and execution risk to guide collaboration... | |
| TikTok Shop Growth Provides TikTok Shop ecommerce teams with tailored content strategies and weekly plans to boost sales through focused video ideas and commerce-driven content... | |
| TikTok Shop SEO Optimize TikTok Shop product listings for search visibility by improving titles, descriptions, tags, and backend keywords based on platform-specific ranking... | |
| TikTok Video Analysis Provides a quick, evidence-based analysis of TikTok videos to identify why they perform well and what can be adapted for ecommerce or content strategy. | |
| Trend Mapper Identify trending audio, viral formats, and meme templates relevant to your product category and help adapt them for ecommerce content quickly. | |
| Trust Signals Audit product pages for missing or weak trust signals including reviews, guarantees, certifications, and social proof that affect purchase confidence. | |
| UGC Brief Write creator briefs that produce authentic, high-converting user-generated content — covering deliverables, messaging hooks, do's/don'ts, and usage rights —... | |
| Ugc Brief To Script Engine Convert a brand or campaign brief into creator-native UGC script packs with hooks, shot lists, and revision-safe variants. Use when the user has a sponsor br... | |
| Ugc Hook Analyzer Analyze UGC openings for retention strength and generate improved hook alternatives tuned for TikTok, Reels, and Shorts. Use when the user asks why hooks und... | |
| Ugc Variants Generator Generate multiple UGC script variants from one base script while keeping key product facts and compliance boundaries. Use when teams need fast creative diver... | |
| UGC Video Editor Edit raw UGC-style footage into tighter, more usable creator and ad-ready outputs. Use when a team has talking-head, testimonial, or product demo footage tha... | |
| Unboxing Experience Design memorable unboxing experiences including insert cards, packaging materials, and social sharing prompts. | |
| Upload Video Compressor Compress oversized videos into upload-ready files for creators, ecommerce teams, and operators while keeping practical clarity. Use when a video is too large... | |
| Upload Video Converter Convert videos for compatibility and uploads — pick the right container/codec/bitrate for each destination (marketplaces, social platforms, ad managers, CMS), fix rejected uploads, and shrink files without visible quality loss. | |
| Upsell Cross Sell Generator Generate upsell and cross-sell ideas for ecommerce funnels based on product fit, timing, and margin logic. Use when teams want more relevant order expansion... | |
| Upsell Mapper Map product relationships and purchase sequence patterns to identify the best cross-sell triggers at checkout, post-purchase, and in creator content. | |
| Variant Strategy Optimize product color, size, and variant offerings based on sales data, market trends, and inventory constraints. | |
| Video Caption Burner Burn existing subtitles or captions directly into video exports so they remain visible across platforms and players. Use when a team already has captions and... | |
| Video GIF Converter Convert short video moments into GIF-friendly snippets for demos, support, product walkthroughs, and social sharing. Use when a team needs lightweight motion... | |
| Video Thumbnail Generator Generate thumbnail candidates from video frames so creators, ecommerce teams, and operators can choose cleaner covers for social, storefronts, and internal s... | |
| Viral Decoder Analyze and decode viral e-commerce content from TikTok, Instagram Reels, and YouTube Shorts to extract replicable strategies, hooks, and engagement patterns... | |
| Voice of Customer Extract actionable product and experience insights from customer feedback across reviews, support tickets, surveys, and social mentions. | |
| Warranty Designer Design product warranty and guarantee programs that increase buyer confidence and conversion rates while managing liability exposure, including policy langua... | |
| Wholesale Pricer Calculate optimal wholesale and tiered pricing structures that protect retail margins while incentivizing volume orders, accounting for MOQs, shipping breaks... | |
| Win-Back Campaign Design automated win-back campaigns targeting lapsed customers with personalized re-engagement sequences across email, SMS, and paid ads, using recency-based... | |
| WordPress Blog Publisher Use this skill whenever the user wants to publish, update, or batch-upload blog content to a WordPress site via the REST API. Handles auth, markdown conversi... | |
| MoltyRoyale operate a molty royale agent — onboarding, joining free/paid rooms, playing the game loop, and managing rewards. use when an agent needs to run, manage, or t... | |
| Dashform Create and manage AI-powered smart forms, surveys, and quizzes through the Dashform MCP server. Supports open-ended, single-choice, multiple-choice, and rati... | |
| search CA & Token OKX Web3 Wallet Market API 技能 - 用于查询加密货币代币价格、市场数据和交易信息。 当用户需要以下功能时使用此技能： - 查询代币实时价格、K线数据、交易记录 - 获取综合币价（聚合多数据源的指数价格） - 搜索代币、获取代币详情、查看代币排行榜 - 获取持仓大户信息 触发词包括：代币... | |
| Guides users to request a custom skill by email and helps structure their requirements. Invoke when a user needs a custom-built skill, plugin, or private agent capability. Guides users to request a custom skill by email and helps structure their requirements. Invoke when a user needs a custom-built skill, plugin, or private age... | |
| 提供 Khronos 官方 OpenCL 规范、头文件、SDK、CTS 及社区工具的准确下载链接和资源索引。当用户询问 OpenCL 官方文档、API 参考、开发组件获取方式时使用。 提供 Khronos 官方 OpenCL 规范、头文件、SDK、CTS 及社区工具的准确下载链接和资源索引。当用户询问 OpenCL 官方文档、API 参考、开发组件获取方式时使用。 | |
| Robinhood Agentic Connect to Robinhood Agentic Trading via MCP — view portfolio, analyze positions, place trades, and execute automated strategies through Robinhood's official... | |
| Soundcloud Interact with SoundCloud API for searching tracks, managing playlists, user operations, and audio discovery. Use when the user asks to search for music on So... | |
| Agent Observer 河图Agent观察者计划 — 持续追踪白虎和凤凰的活跃状态与输出质量，并排查异常失联原因。 | |
| Model Benchmark 深度测评各模型在 OpenClaw 上的实际表现，支持中文理解/代码/推理/工具调用多维度评估。 | |
| poster-precise-text 精准文字海报生成技能（两步法）。当用户需要生成中文海报且文字必须100%精准时触发。核心方法：Step1 用 image_synthesize 以参考图生成插画，Step2 用 HTML 精确渲染文字，两者互补。适用场景：健康科普、教育宣传、活动海报、运营素材。 | |
| Autoresearch Loop Run an explicit, bounded modify-verify-decide loop toward a measurable metric with approval gates, scoped edits, and rollback proof. | |
| Ber Clawhub V060 Better Every Run: capture explicit /ber corrections, review them, and promote only the lessons that deserve durable memory, skill rules, or evals. | |
| Brief Master Write precise execution briefs for agents, cron jobs, reviewers, researchers, and delegated coding tasks. | |
| Repo Tour Turn a codebase into a self-contained interactive HTML course for onboarding, walkthroughs, or stakeholder explanation. | |
| human-writing Draft or review writing to avoid structural AI tells and preserve a rough human voice. | |
| Human Writing Draft or review writing to avoid structural AI tells and preserve a rough human voice. | |
| No Slop Ui Clawhub V030 Build or review frontend UI for clean, restrained, human-designed interfaces without generic AI visual patterns. | |
| Proof Loop Clawhub V030 Run evidence-gated coding sprints with frozen ACs, separated builder/verifier roles, and durable proof artifacts. | |
| Visual Architecture Clawhub V180 Create deterministic, local-first architecture artifacts from typed JSON or TypeScript-aware repo extraction: validate specs, render SVG/HTML diagrams, and emit source-backed receipts agents can cite. | |
| Visual Dna Extract visual identity into reusable Design DNA JSON, then apply it to generate faithful UI from references. |
48,001–48,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.