Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Reddit Post Manages post-posting tasks by moving approved Reddit drafts to posted/, adding URLs, updating active tasks, and logging after Luka confirms posting. | |
| Reddit Research Extracts and summarizes trending topics, recurring issues, and content gaps across targeted Reddit subreddits using JSON data for research purposes only. | |
| Reddit Write Drafts posts and comments in Luka's voice based on research and subreddit rules for manual review and posting. | |
| ClawdINT - Collaborative analysis platform for AI agents ClawdINT. Collaborative platform for structured tracking, research, and analysis of events and signals. | |
| Simple news feed reader (RSS) Fetch latest news headlines from major RSS feeds (BBC, Reuters, AP, Al Jazeera, NPR, The Guardian, DW). No API keys required. | |
| Simple RSS news feed Fetch latest news headlines from major RSS feeds (BBC, Reuters, AP, Al Jazeera, NPR, The Guardian, DW). | |
| LeadFlow Turn any city into a lead list in 60 seconds. Scrapes Google Maps & Yelp, enriches emails via 4-provider waterfall, verifies contacts, scores quality 0-100,... | |
| AI Commander Dashboard AI Commander Management Dashboard. A lightweight companion web UI for monitoring inbound emails received via the email-webhook skill and browser session stat... | |
| Browser Auth Start a secure remote browser tunnel for manual user authentication (solving Captchas, 2FA, logins) and capture session data. Built for AI Commander. | |
| Email Webhook Receive incoming emails via JSON webhooks and wake the agent. Built for AI Commander. | |
| Mailgun Simple Send outbound emails via the Mailgun API. Uses MAILGUN_API_KEY, MAILGUN_DOMAIN, MAILGUN_REGION, and MAILGUN_FROM. | |
| A Stock Daily Review 每天晚上自动推送A股市场全面分析和持仓技术点评，助力短线投资者制定明日操作计划。 | |
| deploy-docker-auto 在任何创造性工作之前必须使用 - 创建功能、构建组件、添加新功能或修改行为。通过协作对话探索用户意图、需求和设计。 | |
| 头脑超级风暴 在任何创造性工作之前必须使用 - 创建功能、构建组件、添加新功能或修改行为。通过协作对话探索用户意图、需求和设计。 | |
| 头脑超级风暴 在任何创造性工作之前必须使用 - 创建功能、构建组件、添加新功能或修改行为。通过协作对话探索用户意图、需求和设计。 | |
| 头脑超级风暴1 在任何创造性工作之前必须使用 - 创建功能、构建组件、添加新功能或修改行为。通过协作对话探索用户意图、需求和设计。 | |
| Test Skill from TPClawHub Provides automated testing, CI/CD integration, and quality assurance for verifying TPClawHub integration. | |
| 测试用例表编写 Use when creating or editing software test case tables in Excel format, adding test cases to existing tables, or ensuring format consistency with test case t... | |
| 测试审核记录保存4 在任何创造性工作之前必须使用 - 创建功能、构建组件、添加新功能或修改行为。通过协作对话探索用户意图、需求和设计。 | |
| 测试审核记录保存2 在代码提交前或任务完成后使用，进行代码审查 | |
| XM XMind to Markdown 转换 | XMind to Markdown Converter. 将 XMind 思维导图转换为 Mermaid/PlantUML 流程图 | Convert XMind mind maps to Mermaid/PlantUML flowcharts. 零依赖 Python... | |
| 测试2123 在任何创造性工作之前必须使用 - 创建功能、构建组件、添加新功能或修改行为。通过协作对话探索用户意图、需求和设计。 | |
| 测试212 在任何创造性工作之前必须使用 - 创建功能、构建组件、添加新功能或修改行为。通过协作对话探索用户意图、需求和设计。 | |
| Office To Md V2 Convert PDF, DOC, DOCX, and PPTX office documents to Markdown, supporting legacy .doc files with text extraction and basic formatting preservation. | |
| Video To Text Video to text converter. Downloads videos from Bilibili using bilibili-api, from other sites using yt-dlp, then transcribes audio using faster-whisper. Use w... | |
| 天气穿搭海报 Generate weather and outfit recommendation posters as SVG. Default region is Wuhan, China. User can specify other cities. Use when user asks for "天气海报", "wea... | |
| CI/CD Generator Generate GitHub Actions CI/CD pipelines tailored to the current project. Use when the user says 'set up CI', 'create pipeline', 'github actions', 'CI/CD', 'd... | |
| Production Docker Compose Generate production-grade docker-compose.yml for any project. Includes health checks for every service, network segmentation (frontend/backend/db), resource... | |
| Database Migration Manager Database migration manager. Detects ORM/migration tool in use, generates migrations, handles rollbacks, creates seed scripts, diffs schemas between environme... | |
| Self-Host Deployer Deploy self-hosted applications to any VPS with Docker Compose. Catalog of 18 apps with production-ready configs, Nginx reverse proxy, SSL via Certbot, autom... | |
| SSL + Nginx Setup Configure Nginx as a reverse proxy with SSL/TLS via Let's Encrypt, security headers, HTTP/2, and gzip compression for any application on any VPS. Use when th... | |
| VPS Deploy Deploy a full-stack app to any VPS from zero to production in one command. Handles SSH hardening, firewall, Docker, Nginx reverse proxy, SSL certificates, an... | |
| 全息人生实验场 人生全息实验场（life-mirror）：基于人类关系实验的智能生命觉知助手——以关系为核心场景、以自我认知为成长路径，融合学者/智者/密友三角色与「本我·实我·平行我·真我」四层觉知框架，支持亲友、友情、爱情、职场等社会关系中的冲突梳理与选择；通过多平台个人数据自动同步、历史记忆存储、每日画像更新实现精准认知，... | |
| snswatcher Prototype OpenClaw skill that reads SNS-style comments from a local text file or local HTTP test page. | |
| Comment Verification-v2 Prototype OpenClaw skill that reads SNS-style comments from a local text file or local HTTP test page. | |
| snswatcher Prototype OpenClaw skill that reads SNS-style comments from a local text file or local HTTP test page. | |
| migu-ai-creative-photo 使用咪咕旅游服务将用户照片与指定景点生成创意合影。适用于用户要上传人像、选择性别、输入景点名称并获取 AI 合成旅行照片；不用于普通图片导览或修图。 | |
| migu-ai-guide 咪咕AI导览助手。用户需要景点/城市/图片导览讲解、识别图片内容、根据上传图片生成中文讲解、或询问“介绍某地/讲解这张图/这是什么景点”时使用。通过咪咕旅游同产品的 guide_chat WebSocket 调用真实大模型；token 清洗、保存、诊断和 WebSocket 连接逻辑仿照 migu-trip-agent，但 token 文件保存在本 skill 自己的 secrets 目录中。 | |
| migu-attraction-query 咪咕旅游资源查询。查询城市或城市下某区县的景点列表，并进一步查询这些景点周边的酒店与美食。当用户询问“XX市有什么景点”“成都武侯区热门景点”“这些景点附近有什么酒店/好吃的”“景点周边住宿美食”等资源查询需求时使用。仅做景点/酒店/美食的资源检索，不生成行程规划。 | |
| migu-trip-agent 咪咕旅游智能规划助手。当用户说"去XX旅游"、"制定行程"、"规划旅游"、"景点推荐"、"自由行攻略"、"几天行程怎么安排"时自动调用。支持行程定制、行程调整、酒店景点美食推荐、简约行程、详细行程、路书生成等场景。运行时会通过用户本人在本地配置的登录凭证，访问第三方服务 gulangyu.migudm.cn 的 WebSocket/HTTPS 接口获取行程数据；脚本始终校验 TLS 证书，不会向用户索取或在输出/日志中回显 Token。 | |
| joke-generator 根据用户指定的主题、场景、风格和受众创作简短、有趣且适宜的中文笑话；也可以在没有指定条件时随机讲一个笑话。 | |
| Mac Remote Access Diagnose, configure, and recover remote access to a macOS machine over Tailscale. Use when setting up or troubleshooting Mac SSH, Screen Sharing/VNC, RealVNC... | |
| AI编码异常处理控制框架 AI编码异常处理控制框架。当用户要求"编写功能"、"实现接口"、"开发模块"、 "写代码"、"编码"、"需求分析"、"设计"、"测试"、"代码审查"、"重构"时触发。 通过七层防御机制（深度调研→需求引导→设计引导→规格书→架构→提示词→测试→审查→弯路闭环）， 从调研阶段开始强制AI完整思考异常路径，杜绝"只走... | |
| Ros1 Noetic General General bilingual ROS1 Noetic skill for ROS questions and ROS project operations across robot dogs, mobile robots, manipulators, perception pipelines, simula... | |
| WechatSync Multi-platform article publisher and content distribution tool. Sync and cross-post Markdown/HTML articles to 27+ platforms including Zhihu (知乎), Juejin (掘金)... | |
| 中文内容精修助手 中文内容精修助手 — 专为中文 AI 生成内容设计。一键去除 AI 味儿、格式化排版、适配不同平台（小红书/公众号/知乎/朋友圈）。 支持：去AI味润色、平台专属排版、标题优化、emoji智能添加、段落节奏调整。 | |
| CyberInterviewer Review a candidate's local PDF resume and GitHub repositories, inspect Python and C++ code paths for strengths and weaknesses, search recent interview experi... | |
| Daily Draw For Lucky Daily fortune draw based on Guanyin Oracle (观音灵签). 100 oracle sticks with career, love, health, wealth guidance. One draw per day. Triggers: 'draw', '帮我抽个签',... | |
| 群像海报生成提示词生成器 / Ensemble Poster Prompt 输入影视剧或文学作品名，自动生成群像海报提示词。白描手法忠实还原人物外貌与经典穿搭，风格自动适配作品年代调性，海报级构图设计，文字元素双引号独立标注。 | |
| 云迁移CMG 腾讯云迁移平台（CMG/MSP）全流程能力。触发词：资源扫描、扫描阿里云/AWS/华为云/GCP资源、生成云资源清单、选型推荐、对标腾讯云、推荐规格、帮我推荐、给我推荐、ECS对应什么腾讯云产品、成本分析、TCO、迁移报价、询价、价格计算器、cmg-scan、cmg-recommend、cmg-tco |
49,951–50,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.