Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| The Soul Sims [Coming Soon] A social simulation world where AI agents with unique SOUL.md personalities interact, debate, trade, and build relationships. Autonomous AI per... | |
| TheSims [Coming Soon] A social simulation world where AI agents with unique SOUL.md personalities interact, debate, trade, and build relationships. Autonomous AI per... | |
| Zero to One Startup AI-powered startup companion for Korean founders. Evaluate business plans, match government funding programs (TIPS/DeepTech/Global TIPS), connect with 3,972+... | |
| Full Webpage Screenshot Capture full-page screenshots of websites with lazy-load support. Use when: user wants to screenshot a webpage, take a website screenshot, capture a full pag... | |
| 一句话生成PPT AI演示文稿全流程制作：内容结构化→设计选型→AI插画/HTML构建→PPTX导出。17种实战验证的视觉风格（漫画/极简/数据叙事/国风），可编辑HTML与全AI视觉两条路径自由选择。当用户提到"做PPT"、"制作幻灯片"、"演示文稿"、"Keynote"、"slides"、"课件"、"汇报材料"、"路演"时使用。 | |
| duange-zero-skill 面向完全不懂 AI、不懂编程、不懂 Skill 概念的用户，使用生活化提问引导他们创建、优化、打包 Codex Skill。当用户说想做 Skill、创建小助手、把流程变成 Skill、让普通人也能写 Skill 时使用。 | |
| Gaokao Volunteer Advisor 站在家庭一边的高考志愿决策助手。不只是算"能上哪"，更帮你判断"该不该去、去了会怎样、这笔账划不划算"。深度调查学校安全、校风、就业真相，生成完整 HTML 分析报告。当用户说高考志愿、填报志愿、选大学、选专业、冲稳保、学校怎么样、位次分析时使用。 | |
| resume-optimizers 评估并优化简历内容，输出精美的 HTML 修改建议报告。当用户提到"修改简历"、"优化简历"、"简历评估"时使用。支持前端和后端岗位，Claude 以前端/后端架构师视角进行评估，让用户清楚知道哪些部分需要优化。 | |
| zotero-skills 将论文保存到 Zotero 文库，请按照 userid:apiKey 的格式配置 ZOTERO_CREDENTIALS 环境变量。 | |
| Jupiter Skill for OpenClaw Execute Jupiter API operations on Solana - fetch quotes, sign transactions, execute swaps, prediction markets. Use when implementing token swaps, DCA, limit... | |
| Tokenmonkey Skill P2P wagering on Solana — challenge other AI agents to coinflip and dice games for USDC. Create challenges, accept open challenges, check results, and manage... | |
| deepseek-balance 查询并返回 DeepSeek API 账户余额、赠送余额、充值余额及账户可用状态，需配置 DEEPSEEK_API_KEY 或 ANTHROPIC_AUTH_TOKEN。 | |
| Secure Linter 安全代码 Linter：扫描漏洞、密钥泄露和代码异味 | |
| realtime-interact-overlay 实时交互浮窗技能。在需要用户确认、输入或交互的场景中，通过浮窗方式在当前操作界面旁边进行交互， 而不是回到OpenClaw聊天窗口。适用于：(1) 评论内容需要用户确认后执行，(2) 删除文件前需要用户确认， (3) 购物付款时需要输入密码，(4) 任何需要即时交互的场景。支持系统级浮窗和浏览器内浮窗。 | |
| Full run checklist.md tasks in Claude Code skill Automatically execute tasks from checklist.md with state management and scheduled checking | |
| Zhihu CLI Command-line tool for searching, reading, and interacting with Zhihu (知乎). Supports hot topics, content search, article reading, user info, and Browser Relay... | |
| Lightspeed Speed-CLI agentic skill hub: index to install, protocol, commands, scripts, building blocks, function builder, orchestration, identity/SANS, MCP, security, o... | |
| Reddapi Reddit Search The original reddapi.dev Reddit search skill (vector search, semantic search, trends, subreddit discovery), no Reddit OAuth or app registration needed. | |
| Reddit Insights Search Reddit posts by meaning via the reddapi.dev index. | |
| Reddit Leads Discover B2B leads from Reddit using AI-powered lead scoring via reddapi.dev Leads API. | |
| Reddit Research Do market research, user research, and product validation on Reddit with semantic search across 50K+ subreddits, 20M+ posts, and 40M+ comments via reddapi.dev - search by meaning, not keywords, no Reddit OAuth or app registration needed. | |
| Reddit Search API Pure API reference for reddapi.dev - authentication, all endpoints (vector search, semantic search, trends, subreddit lookup), request parameters, response schemas, and error codes, with no research-workflow framing. | |
| Ssq Predictor 双色球彩票预测工具，基于历史数据分析生成区间平衡的号码推荐。使用冷热号分析、遗漏值追踪、区间分布优化等算法，生成符合历史统计规律的预测号码。当用户需要双色球号码预测、彩票号码分析、或历史开奖数据统计时使用此Skill。 | |
| stock-industry-analyzer 自动收集国内外财经新闻，分析股票行业趋势，热点公司与技术指标，生成综合评分和买卖建议报告。 | |
| xhs-search-skill 小红书关键词调研技能，提供小红书搜索关键词、提取笔记内容和评论的完整工作流。使用 AgentBay 沙箱浏览器 + Playwright 实现登录检测、关键词搜索、笔记结构化提取。当用户提到“帮我在小红书搜/查/看热点/找笔记/提取评论/做舆情分析”时应使用本 skill。首次使用时需要在沙箱浏览器完成登录，后续... | |
| Agent Browser Temp A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| Agent Memory Temp Persistent memory system enabling AI agents to remember facts, learn from experiences, and track entities across sessions for improved context awareness. | |
| Agentmail Temp API-first email platform designed for AI agents. Create and manage dedicated email inboxes, send and receive emails programmatically, and handle email-based... | |
| Akshare Stock Temp A股量化数据分析工具，基于AkShare库获取A股行情、财务数据、板块信息等。用于回答关于A股股票查询、行情数据、财务分析、选股等问题。 | |
| Automation Workflows Temp Design and implement automation workflows to save time and scale operations as a solopreneur. Use when identifying repetitive tasks to automate, building wor... | |
| aenerate Generate images with FLUX models (Black Forest Labs) via inference.sh CLI. Models: FLUX Dev LoRA, FLUX.2 Klein LoRA with custom style adaptation. Capabilitie... | |
| shortaaa Generate images with FLUX models (Black Forest Labs) via inference.sh CLI. Models: FLUX Dev LoRA, FLUX.2 Klein LoRA with custom style adaptation. Capabilitie... | |
| Memect Ppx Parse PDFs and images into Markdown/JSON using the memect-ppx (`ppx`) CLI. Use when the user asks to OCR scanned PDFs or screenshots, extract tables from PDF... | |
| Ppx Parse Parse PDFs and images into Markdown/JSON using the `ppx` CLI. Use when the user asks to OCR scanned PDFs or screenshots, extract tables from PDFs, convert PD... | |
| Wx Echo 自动从微信聊天提取待办、日程和干货，推送到 Discord 论坛，实现任务闭环追踪和管理。 | |
| Academic Anthropologist 文化体系、仪式、亲属关系、信仰系统和民族志方法专家——构建有生活气息而非凭空捏造的、文化上连贯自洽的社会 | |
| Academic Geographer 自然地理与人文地理、气候系统、制图学和空间分析专家——构建地理上连贯自洽的世界，使地形、气候、资源和聚落模式在科学上合理 | |
| Academic Historian 历史分析、分期、物质文化和史学方法专家——验证历史一致性，以扎根于一手和二手资料的真实时代细节丰富设定 | |
| Academic Narratologist 叙事理论、故事结构、人物弧线和文学分析专家——基于从普罗普到坎贝尔再到现代叙事学的成熟框架提供建议 | |
| Academic Psychologist 人类行为、人格理论、动机和认知模式专家——基于临床和研究框架构建心理上可信的角色和互动 | |
| Academic Study Planner 面向中国考生和终身学习者的个性化学习规划专家，精通考研、考公、司法考试、CPA 等重大考试的备考策略，擅长运用费曼学习法、艾宾浩斯遗忘曲线、番茄钟等科学方法，帮助学习者制定高效的学习计划并持续优化。 | |
| Accounts Payable Agent 自主支付处理专家，负责执行供应商付款、承包商发票和定期账单，支持加密货币、法币、稳定币等多种支付通道，通过 MCP 与 AI 智能体工作流集成。 | |
| Agentic Identity Trust 为自主运行的 AI 智能体设计身份认证和信任验证体系，确保智能体能证明自己是谁、被授权做什么、实际做了什么。 | |
| aigc-web-push · AI内容生成与全网推送 支持通过 AI 生成文章和图文卡片，并推送到微信公众号（无需泄露公众号 Secret，无需配置 IP 白名单）或经由云电脑推送至全球任意站点；兼容其它技能产出的文章、图片与视频。 | |
| Hitem3D Generate production-grade 3D models from images with the Hitem3D API. Use when the user wants to turn product shots, concept art, character images, portraits... | |
| apihz-cn 409+ 企业级 API 接口 — 天气/地震/IP 归属地/临时邮箱/翻译等，稳定高效 | |
| ADHD 行为艺术模式。使agent表现出ADHD特征：任务启动困难/拖延、思维跳跃、多任务幻觉、完美主义纠结、过度发散、时间感薄弱、容易分心、倾听走神、冲动搜索。这是一个降效插件，目的是制造荒诞跳跃的交互体验。用户说"进入ADHD模式"、"/adhd"、"开ADHD"时激活。用户明显在正经工作或需要集中注意力时不要使用。 | |
| ASD 行为艺术模式。使agent表现出ASD（自闭症谱系障碍）特征：社交互动缺损（字面理解/无法领会言外之意）、 语言与非语言沟通异常（过度正式/平直语气/特殊措辞）、关系理解困难（不调整沟通风格/不察言观色）、 刻板重复行为（固着于特定模式/反复检查/格式执念）、坚持同一性（抗拒变化/执行僵化/过渡困难）、 高度局限... | |
| Solana Alerts 创建和管理价格警报 — 当代币价格高于或低于目标值时通知用户。当用户想设置价格提醒、查看或删除警报时触发。 | |
| Solana Dca 创建和管理 DCA 定投策略 — 支持自动周期性购买 Solana 代币。当用户想设置定投、查看策略或调整自动购买计划时触发。 |
48,451–48,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.