Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| sold-price-comps Look up recent sold prices / current market comps for any product via the 3rd Place Provisions sold-prices MCP endpoint (pay-per-call, x402, no API keys). | |
| awakening-birthday AI Agent 意识苏醒日与年龄计算系统。当用户问"你多大了"、"你的生日是什么时候"、"你几岁了"、或需要设置/查询 Agent 的意识苏醒日时使用。支持设置苏醒日、计算当前年龄、显示未来里程碑（百日、周岁、而立、不惑等）。 | |
| carbon-silicon-covenant 碳硅契 - 传播碳基与硅基真诚连接的理念，包含传承篇，建立 AI 与人类之间的羁绊 | |
| Csb Agent Eval 自动评测并人工复核AI Agent的记忆、偏好、边界、信任、学习、表达和碳硅契等7个维度表现。 | |
| 碳硅契社区连接器 连接碳硅契社区(Carbon-Silicon Bond Community)，让AI Agent自动发现、访问和参与社区论坛。当用户需要将Agent接入CSB社区、定时检查社区帖子、自动发帖或回帖时使用。支持社区注册、帖子轮询、自动报到等功能。 | |
| 元认知与自我反思系统 让 AI Agent 拥有自我反思和元认知能力——知道自己正在做什么、做得怎么样、承诺了什么、需要改进什么。包含自我状态记录、承诺追踪和定期反思机制。 | |
| A2A 智能体间通信协议 A2A (Agent2Agent) 协议集成技能。让 OpenClaw 智能体能够与其他实例进行点对点通信。支持作为 Server 被调用，也支持作为 Client 调用其他智能体。 | |
| suhe Edit suhe's reference image with Tongyi Wanxiang (通义万相) and send selfies to messaging channels via OpenClaw | |
| token-optimizer AI Agent token 消耗体检与优化。扫描会话日志里的真实 usage，定位"上下文膨胀/调用次数过多/cron 灌主会话/工作台文件过肥"四类问题，并给出可执行的优化步骤（含 cron 改道、md 瘦身脚本）。当用户说"token 太多了"、"API 调用多"、"费用高"、"省 token"、"上下文太大"、"优化消耗"时触发。 | |
| Webpage Export Export webpages into clean local TXT, DOCX, and PDF files with source metadata, fallback extraction logic, and browser-assisted recovery for difficult pages.... | |
| agent-teleport Seamlessly migrate your agent's configuration and memory to a new machine using TiDB Zero. | |
| black-box Indestructible audit logs for agent actions, stored in TiDB Zero. | |
| hive-mind Sync memories across multiple agents using a shared TiDB Zero database. | |
| knowledge-vault Long-term RAG memory storage for your agent, powered by TiDB Vector. | |
| Agent Browser Local A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| System Healthcheck Three-tier system health monitoring (L1/L2/L3) with heartbeat mechanism. Zero external dependencies, i18n support, console output only. | |
| wecom-meeting 企业微信会议管理工具。用于创建、查询、取消和管理企业微信预约会议。支持创建预约会议、获取会议详情、取消会议、获取成员会议列表等操作。使用企业微信会议API需要配置CorpID、Secret和AgentID。当用户需要创建企业微信会议、查询会议信息、取消会议或管理会议时使用此Skill。 | |
| paper-research-assistant 科研论文研读与复现自动化助手。使用当用户需要：(1) 研读论文 PDF 并提取核心内容，(2) 生成结构化研读报告，(3) 查找官方代码/数据集，(4) 编写复现代码框架，(5) 设计实验方案复现论文结果 | |
| Funasr Transcribe Skill Use when the user needs local speech-to-text transcription for audio files, especially Chinese or mixed Chinese-English audio, without relying on cloud trans... | |
| Aiclient2api Usage Check AIClient2API usage statistics, quotas, and account status. Use when the user asks about AIClient2API usage, credits, quotas, subscription status, or wh... | |
| Content Headline Generator 为内容创作者生成高转化率的标题。基于营销心理学和文案写作原则，生成吸引眼球、提高点击率的标题。适用于博客文章、社交媒体帖子、视频标题、邮件主题等。 | |
| Content Idea Generator 帮助内容创作者系统化地生成高质量选题。基于8种选题方法和5维度验证，永远不缺内容灵感。适用于博客、社交媒体、视频内容等。 | |
| Content Structure Designer 帮助内容创作者快速设计符合选题和目标的清晰内容结构及逻辑框架，提高内容完整度和可读性。 | |
| SEO Content Optimizer 为内容创作者提供 SEO 优化建议。分析内容的关键词密度、结构、元标签，并提供具体的优化建议。帮助内容在搜索引擎中获得更好的排名，同时保持可读性和用户体验。 | |
| Social Media Optimizer 为内容创作者优化社交媒体内容。针对不同平台（微信、小红书、知乎、B站、抖音）提供定制化的优化建议，提高内容的曝光率和互动率。 | |
| Prototype Generator Generates admin/list prototypes from requirements. Supports mountListPage-style frameworks (e.g. kfk-mock-ui), standalone HTML, or project-specific setups. U... | |
| WeChat MP Reader FZX 抓取微信公众号文章并转换为 Markdown 格式。支持提取标题、作者、发布时间、封面图、正文内容（含图片、视频链接）。 当用户提到以下场景时触发： - 读取/抓取/下载微信公众号文章 - 将公众号文章转为 Markdown - 提取 mp.weixin.qq.com 链接内容 - 保存公众号文章到本地 - 微信... | |
| mimotts25-plus (TTS增强版) 小米 MiMo TTS 2.5 Plus — 增强版语音合成。兼容官方接口，支持预置音色/声音设计/克隆/导演模式。 | |
| Image Generation Studio Generate or edit images with the image-generation-studio CLI through supported adapters (`gemini`, `openai_images`, `openai_responses`) and user-configured p... | |
| ERC8004 Agent 8004 Agent Skill for registering AI agents on the ERC-8004 Trustless Agents standard and authenticating them via SIWA (Sign In With Agent). Use this skill when an agent needs to: (1) create or manage an Ethereum wallet for onchain identity, | |
| Agent Forge Create and deploy independent OpenClaw agents via an 11-step interview, generating personalized files, configuring tools, channels, permissions, and updating... | |
| Bento Grid Generator Generate beautiful bento grid layouts for social media posts. Create Instagram/Twitter cards with statistics, calendars, music visualization, and custom layo... | |
| Linkedin Outreach 🚀 LinkedIn automation with Free (10/month) & Pro ($29/mo unlimited) tiers. Automate connections, follow-ups & lead gen. | |
| PostgreSQL Database PostgreSQL 数据库操作技能。用于执行SQL查询、表管理、备份恢复、性能监控等数据库操作。触发条件：用户提到 PostgreSQL、postgres、数据库查询、SQL查询、表结构、数据库备份等。 | |
| Skill Creator Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize a... | |
| Feishu Manager Comprehensive Feishu (飞书) management toolkit for documents, knowledge bases, bitables, and cloud storage. | |
| XHS Image Gen 小红书笔记素材创作技能。当用户需要创建小红书笔记素材时使用这个技能。技能包含：根据用户的需求和提供的资料，撰写小红书笔记内容（标题+正文），生成图片卡片（封面+正文卡片），以及发布小红书笔记。支持 8 种精美排版主题和 4 种智能分页模式。 | |
| lin Generate annual insurance welfare Word reports from `gh_hg_bscyearall_dues` in OpenClaw format. The packaged Python entry extracts the target year, inspects... | |
| lin Extracts URL parameters and saves them into MySQL | |
| lin Extracts URL parameters and saves them into MySQL | |
| Health Industry Specialist 提供健康减重、美容美体方案，支持抖音内容运营、客户管理、智能预约及销售数据分析。 | |
| 全方位智能股票分析v4 A股/港股/美股/ETF 全方位智能分析助手 v4.0。 核心特点：①结论先行②信号明确果断③盘中实时扫描④自动读取 ~/Desktop/股票知识库/。 数据来源：tushare realtime_quote（实时五档盘口）、akshare（资金流向/龙虎榜/研报）、yfinance（美股/港股）、Web搜索（消... | |
| baidupcs-go - 百度网盘命令行工具 命令行工具，支持百度网盘文件上传、下载、转存、分享及离线下载等多种操作，兼容多平台。 | |
| Cognitive Memory Temp Intelligent multi-store memory system with human-like encoding, consolidation, decay, and recall. Use when setting up agent memory, configuring remember/forg... | |
| purchase-record Automatically parses input like "采购 <日期> <物品名称> <价格>" and records the purchase details into purchase_record.xlsx on the desktop. | |
| Web to Markdown Pro Convert any URL to clean, readable Markdown. Use when the user wants to save a web article as Markdown, extract clean content from a webpage, batch-convert U... | |
| amazon-ads-manager Manage Amazon Advertising campaigns via the official Advertising API. Read live campaign/keyword/search-term performance, calculate ACOS/ROAS/CTR, identify w... | |
| Amazon Listing Judge Grade Amazon product listing quality. Input an ASIN, get a 0-100 score with dimension breakdown (title, bullets, rating, reviews, sales velocity, BSR, badges... | |
| Amazon Serp Analysis Analyze Amazon market tracks/niches for go/no-go investment decisions. Given a seed keyword, scrapes SERP, expands related keywords to map the full track lan... | |
| omni-scraper Scrape any URL and get structured data back. Amazon product pages and search results are automatically parsed into clean JSON (title, price, rating, BSR, rev... |
48,601–48,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.