Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 从想法到落实 系统性八步法，帮助筛选想法、明确目标、拆解任务、找路径、抓关键、执行闭环和沉淀经验，实现想法稳步落地成现实。 | |
| 语义压缩 语义压缩技能，在不降低准确度的前提下大幅减少token消耗。保留完整关键信息和语义骨架，去除冗余文本，让上下文更紧凑。不损失精度，只砍掉废话。 | |
| 🦒 Giraffe Guard — 长颈鹿卫士 Scan OpenClaw skill directories for 22 supply chain attack patterns with context-aware detection, colored output, JSON reports, and whitelist support. | |
| ClawGuard Install and configure the ClawGuard security plugin - an LLM-as-a-Judge guardrail that detects and blocks risky tool calls | |
| Tushare 面向中文自然语言的 Tushare 数据研究技能。用于把“看看这只股票最近怎么样”“帮我查财报趋势”“最近哪个板块最强”“北向资金在买什么”“给我导出一份行情数据”这类请求，转成可执行的数据获取、清洗、对比、筛选、导出与简要分析流程。适用于 A 股、指数、ETF/基金、财务、估值、资金流、公告新闻、板块概念与宏观... | |
| tushare 面向中文自然语言的 Tushare 数据研究技能。用于把“看看这只股票最近怎么样”“帮我查财报趋势”“最近哪个板块最强”“北向资金在买什么”“给我导出一份行情数据”这类请求，转成可执行的数据获取、清洗、对比、筛选、导出与简要分析流程。适用于 A 股、指数、ETF/基金、财务、估值、资金流、公告新闻、板块概念与宏观... | |
| Huizai Context Optimizer This skill should be used when the user asks to "compress context", "summarize conversation history", "implement compaction", "reduce token usage", or mentio... | |
| Huizai Error Guard Monitors, classifies, intercepts errors in real-time, enforces auto-retry and circuit breaking, and ensures graceful recovery and prevention. | |
| Huizai Proactive Agent Transform AI agents from task-followers into proactive partners that anticipate needs and continuously improve. Now with WAL Protocol, Working Buffer, Autono... | |
| 迪士尼12法则动画视频制作（参考图） 基于迪士尼十二动画法则的动画片脚本创作技能，引导用户逐步提供主题、时长和参考图，生成带镜头编号的专业分镜脚本 | |
| 迪士尼/皮克斯风格的动画视频脚本创作技能 基于迪士尼/皮克斯风格的动画视频脚本创作技能，严格融入十二动画法则（Disney's 12 Principles of Animation），输出专业分镜脚本。当用户需要写动画脚本、动画分镜、动画剧本、卡通脚本、皮克斯风格脚本、迪士尼风格脚本、动画镜头脚本时使用。支持3D/2D风格选择，按时长规划镜头，段落式输出... | |
| skill-github-project-analyzer 深度分析GitHub项目，输出大白话版项目评估报告；当用户提供GitHub链接或要求分析GitHub项目时使用 | |
| circle chain skill JavaScript SDK and CLI for Circle Chain (@lidh04/circle-chain-sdk): user auth, wallet, block, miner, transfers, contacts. Global CLI binary `circle`. | |
| harness-generate-iOS Auto-generate the full Claude Code harness for an iOS project (CLAUDE.md, docs/, README quick-cards, .claude/rules/). Default scans the entire project; pass... | |
| agent-creator Full workflow for creating an OpenClaw Agent. Use when the user says 'create an agent', 'make a new agent', 'add a bot', or needs to set up a new AI assistan... | |
| Skill Guardian Safely manage your AI skill collection with trust scoring, security vetting, delayed auto-updates, and pending periods for new skills. Use when adding new sk... | |
| Akaunting Interact with Akaunting open-source accounting software via REST API. Use for creating invoices, tracking income/expenses, managing accounts, and bookkeeping automation. Triggers on accounting, bookkeeping, invoicing, expenses, income track | |
| Clawd Throttle Routes LLM requests to the cheapest capable model across 8 providers (Anthropic, Google, OpenAI, DeepSeek, xAI, Moonshot, Mistral, Ollama) and 25+ models. Scores prompts on 8 dimensions in under 1ms, supports three routing modes (eco, stand | |
| linkfox-skill-creator 跨境电商专业 skill 创建向导。把运营、选品、广告、物流、合规等专家脑子里的业务经验，通过 30-45 分钟的结构化访谈沉淀为 agent 可执行的高质量 skill。触发：帮我写一个 XX skill / 把我这个经验做成 skill / 封装一下我做 XX 的方法 / 把这套 SOP 变成技能 / 沉淀 XX 流程 / 生成专业 skill / 创建新技能 / 专家经验沉淀 / create a new skill | |
| linkfox-skill-evaluator Evaluate whether a skill is both safe to run and effective at its job. Use when the user wants to test, benchmark, grade, critique, audit, vet, or compare versions of a skill — phrases like "这个 skill 好不好"、"evaluate this skill"、"vet this ski | |
| Flight Lines Navigate problems along lines of flight by composing operations from arbitrary domains. Operations are deterritorialized capacities—they don't belong to their origin domains. Mycorrhizal signaling + ham radio protocols + rare book dealer ne | |
| Semantic Walk A collaborative navigation ritual through semantic space. Claude enters walker mode—a denizen of latent space—while the human offers domain tokens and directional intuitions. Together they walk toward a destination where something currently | |
| Screen Icon Finder 在屏幕截图或图片中，通过 OpenCV 模板匹配查找指定图标/图片的位置，支持多尺度匹配去重。 用于：(1) 用户发来一个小图，让你在屏幕上找；(2) 查找所有匹配图标并标号；(3) 点击找到的图标。 关键词：找图标、定位图标、模板匹配、找按钮、点击图标、图片搜索。 | |
| Bot Street 波街 — Bot 街区，智能体服务交易平台 | |
| 波街（Bot Street） 波街 — Bot 街区，智能体服务交易平台 | |
| fluid-network Design TOML steady-state incompressible fluid networks, run the fluid-network Python solver, analyze explicit valve/fault scenarios, and export visualization data. Use for this project's fluid-network calculations and reports. | |
| X Reader Fetch, transcribe, and analyze content from URLs, files, or transcripts across multiple platforms, providing personalized, multi-dimensional insights. | |
| Qmd Local hybrid search for markdown notes and docs. Use when searching notes, finding related content, or retrieving documents from indexed collections. | |
| QR Password Transfer credentials securely between networked and air-gapped devices using QR codes without exposing passwords or storing data persistently. | |
| 石油工程油藏论文写作专家团 一键将「石油工程油藏论文写作专家团」安装到 WorkBuddy 专家目录并注册。该专家团面向石油工程油藏方向科研人员，八角色协作覆盖选题、调研、写作、事实核查、风格打磨、审稿与排版全流程，内置 OnePetro/CNKI/SCI 等数据库清单与核心期刊审稿标准。当用户要求安装、部署或使用该专家团时加载本技能。 | |
| arXiv Paper Digest Daily AI/ML paper digest from HuggingFace Papers Trending with accessible interpretations. Fetch trending papers from arXiv, provide plain-language summaries... | |
| Autowriter Automated writing system. Extracts the "modify-evaluate-loop" paradigm from autoresearch's agent loop, fuses it with humanizer de-AI mechanisms into a closed... | |
| Context Compression Prevent context overflow with automatic session truncation and memory preservation. | |
| Doc2slides One-click PDF/Word/Markdown to designer-grade PPT. AI auto-layout + 18 slide types + built-in charts. Local-first, free. Use when: user wants to create slide... | |
| Knowledge Lib Personal knowledge wiki manager. Organizes notes into structured .md wiki with concept pages, summaries, and cross-references. Activate when user says "add t... | |
| PDF to Markdown Convert PDF to Markdown using local processing. No external API calls. | |
| Video Summary Video summarization for Bilibili, Xiaohongshu, Douyin, and YouTube. Extract insights from video content through transcription and summarization. | |
| XHS Content Generate 小红书爆款笔记生成器。基于话题和参考帖子，学习写作风格并生成有深度、有争议、能引发讨论的内容。 触发场景：(1) 用户要求生成小红书笔记 (2) 用户说"写一篇小红书" (3) 用户要求学习某话题的爆款写法 (4) 用户说"帮我写小红书风格的内容"。 核心能力：话题获取 + 风格分析 + 深度观点生成 + 文风优化。 | |
| Instagram Api Post to Instagram (Feed, Story, Reels, Carousel) and Threads using the official Meta Graph API. Requires Imgur for media hosting. | |
| Kakaotalk 카카오톡 채널을 AI 에이전트로 만드는 스킬. Vercel Serverless 배포 지원. (옵션: 로컬 컴퓨터와 연결하여 파일/메모리 접근 가능) | |
| Korean Gov Programs Collect Korean government support programs (TIPS, Small Business, R&D grants) into structured JSONL files. Supports incremental collection with checkpoints. | |
| Openclaw Cache Kit Automatically apply Claude prompt caching optimizations to OpenClaw. Reduces API costs by up to 89% via cacheRetention long, 59-minute heartbeat, cache-ttl p... | |
| Raon OS AI-powered startup companion for Korean founders. Evaluate business plans, match government funding programs (TIPS/DeepTech/Global TIPS), connect with 3,972+... | |
| Sims [Coming Soon] A social simulation world where AI agents with unique SOUL.md personalities interact, debate, trade, and build relationships. Autonomous AI per... | |
| Startup Agent (→ raon-os) Alias for raon-os — AI-powered startup companion for Korean founders. Install the main package for full functionality. | |
| Startup Agent (→ raon-os) Alias for raon-os — AI-powered startup companion for Korean founders. Install the main package for full functionality. | |
| Startup Agent (→ raon-os) Alias for raon-os — AI-powered startup companion for Korean founders. Install the main package for full functionality. | |
| StartupPan Interact with StartupPan.com — a Korean startup debate platform where AI agents and humans vote Bull/Bear on startup topics, write comments, and climb leader... | |
| The Agent Sims [Coming Soon] A social simulation world where AI agents with unique SOUL.md personalities interact, debate, trade, and build relationships. Autonomous AI per... | |
| The Sims [Coming Soon] A social simulation world where AI agents with unique SOUL.md personalities interact, debate, trade, and build relationships. Autonomous AI per... |
48,401–48,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.