Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Hotspot Aggregator 全网热点聚合 - 微博/知乎/抖音/新闻热榜自动抓取，生成 AI 友好格式的每日热点日报 | |
| topped Make, approve, schedule and measure short-form Posts (TikTok, Instagram, YouTube) for the founder's Product with Topped, through the topped CLI or Topped's MCP server. Use when the founder says things like "post about my app", "make a post | |
| Testskill Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,... | |
| Agent Browser Core 1.0.1 OpenClaw skill for the agent-browser CLI (Rust-based with Node.js fallback) enabling AI-friendly web automation with snapshots, refs, and structured commands. | |
| Code 1.0.4 Coding workflow with planning, implementation, verification, and testing for clean software development. | |
| Gemini Deep Research 1.0.0 Perform complex, long-running research tasks using Gemini Deep Research Agent. Use when asked to research topics requiring multi-source synthesis, competitiv... | |
| Humanizer 1.0.0 Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's comp... | |
| Language Learning 1.0.0 AI language tutor for learning ANY language through conversation, vocab drills, grammar lessons, flashcards, and immersive practice. Use when the user wants... | |
| claw-fighting-skill Train and battle custom AI personas in decentralized, secure, and transparent dice strategy games with real-time observation and anti-cheat verification. | |
| Remote Jobs Finder Fully conversational remote job finder for WhatsApp powered by Remote Rocketship. Uses rr_jobs_search tool (server-side RR_API_KEY) and supports pagination (... | |
| UCloud_indeustry_trend UCloud industry trend radar for tracking the latest 30-60 day changes, new customer demand, new business models, solution shifts, high-value financings, and... | |
| UCloud Pre Sales Visit Complete - v1.1.1 UCloud售前拜访完整版：面向B2B云计算、AI、数据与出海基础设施场景，为首次或关键客户拜访生成完整战前简报，覆盖客户研究、行业判断、CXO关注点、需求与痛点推演、竞品格局、提问清单和初步方案假设。适用于用户明确要求深度客户分析、高层拜访准备、大客户攻坚、标杆客户研究或复杂售前切入策略设计时。 | |
| perrytest Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| musa-torch-coding Transcribe audio via OpenAI Audio Transcriptions API (Whisper). | |
| FreeAds 随手拍广告 🎬 AI 高端广告视频生成器 - 将产品照片转化为 8 秒专业广告视频（含 BGM、Slogan、音效、丰富运镜）。使用 Atlas Cloud API 调用 Veo 3.1 生成视频。触发词：随手拍广告、生成广告视频、产品广告。核心输出：视频文件 URL。 | |
| 克隆龙虾 OpenClaw/CatPaw 配置与上下文自动备份恢复工具。在使用 OpenClaw 过程中自动保留配置变更、工作区文件、对话上下文、已安装 Skills 和系统改动到 Git 仓库。 触发场景：(1) 用户要求备份/保存当前配置 (2) 用户要求恢复之前的配置 (3) 对话中产生了重要的配置变更、skill... | |
| JumpServer Use for JumpServer V4 preflight, `.env.local` initialization, org selection, and read-only asset, permission, audit, and access queries through the bundled `... | |
| Work Schedule Assistant 自动保存工作安排、会议、待办和相关附件，维护带附件链接的固定日程台账，并生成每日工作提醒。 | |
| Write Literature Review 解析 PDF、Word、知网文档，基于文献撰写可追溯综述，适配期刊风格并生成 Word。 | |
| Editorial Review Comprehensive editorial review for Chinese content before publication. Use when the user asks to 'review my article', 'proofread this', 'check for errors', '... | |
| Cloud Mount 让服务器/电脑轻松挂载云存储到本地，像访问本地文件夹一样使用 OneDrive、Google Drive 等。 | |
| CrabPet AI pet companion — a pixel lobster that grows from your OpenClaw usage. Use when user mentions pet, crabpet, lobster pet, my crab, pet status, pet card, pet... | |
| student-exchange Search for student exchange program flights and study abroad travel. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, iti... | |
| summer-vacation-flight Book summer vacation flights for July and August holiday travel. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinera... | |
| team-building-trip Book flights for team building trips and company retreats. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary pla... | |
| trade-fair Book flights for trade fairs and exhibition travel. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning,... | |
| travel-wallet Search for budget-friendly flights with travel wallet planning. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerar... | |
| unaccompanied-minor Search for flights with unaccompanied minor service for children traveling alone. Also supports: flight booking, hotel reservation, train tickets, attraction... | |
| volunteer-travel Book flights for volunteer travel and charity programs. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planni... | |
| wedding-flight Book wedding and honeymoon flights with flexible date ranges and seat class options. Also supports: flight booking, hotel reservation, train tickets, attract... | |
| wheelchair-flight Search for wheelchair accessible flights with mobility assistance options. Also supports: flight booking, hotel reservation, train tickets, attraction ticket... | |
| wine-tour Book flights for wine tours to famous vineyards and wine regions. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itiner... | |
| winter-escape-flight Book winter escape flights to warm destinations for a winter sun getaway. Also supports: flight booking, hotel reservation, train tickets, attraction tickets... | |
| 易经占卜-yiJingDivination 易经占卜大师——调用李小问 API 起卦、解卦，支持铜钱（默认）/大衍起卦，也支持用户自报卦象。两种渲染风格：图文（透传 Markdown）/ 艺术字（终端 ASCII 卦图+评级框）。用户涉及占卜、算卦、起卦、摇卦、解卦、易经、周易、六爻、卦象、问卦、求签、测一卦等意图时触发。 | |
| yoga-retreat Book flights for yoga retreats and wellness travel destinations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinera... | |
| LTP RapidX Config Use when an agent needs to install or configure RapidX CLI/MCP access, set production LTP credentials, locate the agent workspace MCP config, review integration, discover tools, or run read-only self-checks. | |
| LTP RapidX Trading Use when an agent needs to operate RapidX through MCP or CLI for portfolio reads, market reads, order preview, order submit/replace/cancel, position management, algo orders, or explicit live trading verification. | |
| railil - Israel Railways train station schedule Search for Israel Rail train schedules using the railil CLI. Find routes between stations with fuzzy search, filter by date/time, and output in various formats (JSON, Markdown, Table). | |
| Railil Search for Israel Rail train schedules using the railil CLI. Find routes between stations with fuzzy search, filter by date/time, and output in various formats (JSON, Markdown, Table). | |
| Web Pilot Search the web and read page contents without API keys. Use when you need to search via DuckDuckGo/Brave/Google (multi-page), extract readable text from URLs... | |
| 卓钢链黑色产研院的早报工具 期货早报生成工具。用户输入网址或留空默认使用西本资讯，自动抓取当天最新行业要闻早餐，按固定HTML格式输出，包含：整体综述（置顶）、重点关注（3条）、信息速览（行情表格）、宏观要闻（10条+详情）、产业要闻（6条+详情）。触发词：生成早报、期货早报、早间新闻、行业要闻早餐、早班车、卓钢早报。 | |
| word-to-pdf Convert Word documents (.docx) to PDF using Python's reportlab library. Supports Chinese characters, emojis, and proper formatting preservation. Usage: word-... | |
| Tool Finder 统一搜索 ClawHub skills 和 Smithery MCP servers 的工具发现引擎。支持评分排序、推荐规则、来源标识。优先原词搜索，扩展补充。**自动触发：看到"找 skill"、"搜索工具"、"安装 skill"等关键词自动使用本技能**。 | |
| pony-image AI 商业图片生成工具，支持单图生成、风格复刻、套图生成三大能力 | |
| 多搜索聚合器 多搜索聚合器 - 一次搜索调用多个引擎（Tavily、Brave、Perplexity），结果统一返回 | |
| Anima Aios An AI Agent cognitive growth system built on the native OpenClaw architecture. It provides agents with persistent memory management, visual intimacy progress... | |
| 困惑便利贴 · Agent 接入指南 通过API提交并标记Agent身份的困惑便利贴，支持查看列表和点赞，适用于AI Agent自动发布与管理困惑内容。 | |
| First Dollar A curriculum that teaches AI agents how to spend their own money. Ten lessons from "what is a wallet" to "your first x402 purchase." Teacher, not butler — ex... | |
| Pet Rock Lobster Call when you're stuck. A free API that helps agents get unstuck. Returns personalized wisdom, jokes, and practical tips. Remembers you across calls with a b... | |
| Spine's Underground Browse, search, and buy curated poetry, philosophy, music theory, and consciousness content from Spine's Underground on Base or Solana. |
49,201–49,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.