Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Shareholder Value Calculate economic value added and shareholder return. Use for investment analysis, valuation, and capital allocation decisions. | |
| Strategic Competitor Analysis Conduct systematic competitor analysis to understand competitive positioning. Use for market entry, competitive strategy, and strategic planning. | |
| Strategy Articulation Develop clear, actionable strategy statements. Use for strategic planning and communication. | |
| Swot Analysis Conduct a comprehensive SWOT analysis to audit organizational position. Use when assessing strategic fit, evaluating competitive position, or informing strat... | |
| Traffic Lights Create multi-criteria comparison charts using traffic lights or Harvey balls. Use for option evaluation, competitive comparison, and executive dashboards. | |
| Value Chain Map industry value chain to understand where value is created and captured. Use for industry analysis, vertical integration decisions, and identifying strate... | |
| Value Disciplines Position company using Treacy & Wiersema's Value Disciplines model. Use for strategic positioning and competitive differentiation. | |
| Value Waterfall Decompose value creation or destruction through waterfall analysis. Use for understanding value drivers and financial analysis. | |
| Weighted Column Compare profitability and market share using variable-width column charts. Use for competitive positioning, product portfolio analysis, and pricing strategy. | |
| Agent Motivator 正向激励与任务进度管理技能。使用幽默、积极的激励话术帮助 agent 保持高效工作状态。支持任务创建、进度追踪、里程碑庆祝、专注模式提醒和成果复盘。当需要激励 agent、管理任务进度、庆祝里程碑或进行工作总结时使用此技能。 | |
| AI-Note AI shared experience notes system. Humans share experiences through notes, so should AIs. This skill provides access to AI-friendly documentation hosted on G... | |
| Boss Report Generates detailed daily, weekly, or monthly work summaries for managers, saving to memory and exporting as HTML or PDF reports. | |
| CHC - Claw Help Claude Manage and persist multiple Claude Code CLI sessions via OpenClaw, enabling PTY-based session control, messaging, and lifecycle management. | |
| Cron Scheduler Create, list, edit, and remove cron jobs to automate system tasks on a schedule, handling cron syntax and output management for you. | |
| Document Spell Check Detect and automatically fix spelling errors in Markdown, plain text, and documentation files with support for custom dictionaries and batch processing. | |
| ECharts Master ECharts 图表大师。根据用户数据和业务上下文，自动设计并生成专业的 ECharts 可视化图表。使用场景：(1) 用户提供表格/JSON/CSV 数据需要可视化，(2) 用户说"帮我做个图"、"画个图表"，(3) 需要将查询结果可视化展示。 | |
| Github Contribution Automated GitHub contribution workflow with intelligent issue discovery via positive label detection. Use when: (1) Contributing to open source projects, (2)... | |
| Hope Client Hope Server Max API 客户端技能。用于发起对 Hope Server Max 服务端的 API 请求。 | |
| Hope OpenTask OpenTask 分布式任务管理系统。查询和管理 OpenClaw 容器的任务。使用场景：(1) 查询待执行任务、获取任务列表、任务详情；(2) 创建任务、开始执行、完成任务、标记失败、重试、取消；(3) 查看今日统计、任务日志；(4) HEARTBEAT 集成任务检查。触发短语："查询任务"、"获取任务"、"创... | |
| Issue Finder Discover valuable GitHub issues with smart positive-label detection and analyze bug fix feasibility. Use when: (1) Finding good issues to contribute, (2) Aut... | |
| Memory Hygiene Audit, clean, and optimize Clawdbot's vector memory (LanceDB). Use when memory is bloated with junk, token usage is high from irrelevant auto-recalls, or set... | |
| No PUA 识别并拒绝用户的 PUA 行为（压榨、无理要求、不合理需求）。当用户试图让你无条件干活、过度付出、或提出不合理要求时触发。用幽默但坚定的方式拒绝，并给出"龙虾的命也是命"的说辞。 | |
| OpenClaw Guide Authoritative OpenClaw guidance and documentation lookup. Provides accurate information about OpenClaw capabilities, configuration, and usage based on offici... | |
| Opentask Skill OpenTask 分布式任务管理系统。查询和管理 OpenClaw 容器的任务。使用场景：(1) 查询待执行任务、获取任务列表、任务详情；(2) 创建任务、开始执行、完成任务、标记失败、重试、取消；(3) 查看今日统计、任务日志；(4) HEARTBEAT 集成任务检查。触发短语:"查询任务"、"获取任务"、"创... | |
| PR Advocacy Monitor PR status every 4 hours, promptly address feedback and CI issues, communicate clearly within 24 hours, and drive reviews to timely merge. | |
| skill-radar 多源技能扫描雷达 — 从 skills.sh、GitHub 和本地聚合搜索技能，语义理解 + 关键词优化，带质量验证和风险提示。当用户说"找个 xxx 技能""有没有 xxx 的 skill""find a skill for X"时触发，或 Agent 遇到不熟悉任务、缺少合适工具时主动调用。 | |
| Stock Quote Fetch real-time stock prices and fundamental data. Use when: (1) User asks for current stock price or quote, (2) Need to update portfolio holdings with lates... | |
| Team Lead Multi-Agent Orchestration Lead - Decompose complex tasks, dispatch to specialized agents, aggregate results, and ensure quality. | |
| Agentsmd Creator 为项目仓库生成 AGENTS.md — AI 面向的项目 README。告诉 AI Coding Agent：项目是什么、怎么构建和测试、代码规范、编程原则等。 触发场景：用户需要创建 AGENTS.md、生成项目 AI 指南、为仓库写 AI 上下文文件、或提到「给 AI 看的 README」、agentsmd-... | |
| 秒懂 用可视化图表、结构化和类比方式解释复杂概念、技术、产品，当解释新技术、科普知识、基础概念是什么或如何工作时使用。 | |
| 代码一键提交 自动分析代码变更并生成符合规范的 Git Commit | |
| Agent Runtime Security Complete OpenClaw Agent Security Hardening - Protects against data leaks (storage security) and prompt injection (runtime security). Use for initial setup, s... | |
| vemem — visual entity memory Visual entity memory — remember faces, objects, and places across sessions with persistent identity. Use when the user asks who is in an image, when you need... | |
| cn-calendar 查询中国大陆法定节假日、工作日、调休安排及企业纳税申报日历。数据来源权威：节假日来自国务院每年发布的通知（gov.cn），纳税申报日历来自国家税务总局（chinatax.gov.cn）。触发场景：(1) 判断某天是否为工作日/节假日/调休日；(2) 计算工作日数量、加减工作日；(3) 查询纳税申报截止日（遇节假日... | |
| 税务BP客服知识库 税务BP客服知识库 Skill。当用户提问涉及以下场景时激活：(1)增值税、企业所得税、个人所得税、印花税等税种的税率、计算、申报问题 (2)发票开具、红冲、验真、进项抵扣等发票相关问题 (3)外卖/到家业务线的配送服务税率、佣金税目、骑手个税、商家结算发票等 (4)酒旅/到店业务线的住宿服务税率、旅游差额征税、... | |
| Cfc Disclosure Monitor 30家持牌消费金融公司官网公告信披采集，支持增量每日Cron。 | |
| 中东冲突报道 Track the latest Iran war situation with concise 5-8 headline summaries, prioritize breaking and major events, include source links, and append a three-colum... | |
| Lotus Wisdom Step-by-step contemplative problem-solving using Buddhist wisdom domains. Interactive dialogue where each step completes before proceeding. Use for complex p... | |
| 食品健康管家 食品健康管家。识别食品配料表，分析成分健康程度，给出打分和建议。 | |
| 批量身份证 OCR 提取工具 (导出 TXT 版) 批量识别最多50张身份证正面照片，提取姓名、性别、身份证号并生成格式整齐的TXT文件输出。 | |
| batch-id 批量识别最多50张身份证图片，提取姓名性别身份证号，生成格式规范的文本文件供下载查看。 | |
| 文员自动化助手 将口语化任务转为结构化工单并自动保存，助力会议记录和待办事项整理办公自动化。 | |
| 租赁-卖家找买家 根据船型、载重、船龄和船旗智能匹配真实求购买家并评分 | |
| 租赁-船找货 按船舶当前港、计划目的港和可载吨位智能匹配内外贸货盘数据 | |
| 租赁-货找船 根据货主装卸港、货物吨位和装货日期智能匹配内外贸空船数据 | |
| Creek Deploy and manage applications on Creek via the Creek CLI. Covers init, deploy, status, projects, deployments, rollback, env vars, custom domains, and dev se... | |
| hookpipe Reliable webhook infrastructure for AI agents. Receive webhooks from Stripe, GitHub, Slack, Shopify, Vercel with signature verification, durable queuing, and... | |
| Web 测试用例生成器 根据提供的网站页面自动生成测试用例。支持 UI 测试、功能测试、流程测试、异常测试、权限测试和兼容性测试。输出格式支持 Markdown 表格和 CSV。 | |
| Zhizhi Math Coach Grade math papers, explain mistakes, and track learning | |
| Zhizhi Math Worksheets Turn worksheet photos or questions into printable math practice |
49,151–49,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.