Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| my_stock_decide_skill 当且仅当用户提供持仓列表（图片或文字），并明确要求“交易决策”时触发。根据宏观形势分数动态调控T1/T2/T3的仓位比例（总上限90%），为当前持仓及观察仓标的输出明确操作方向、情绪、价格和详尽操作原因。 | |
| my_stock_log_skill 当且仅当用户明确提到“分析日志多维表”或“my_stock_log_skill”时触发。专门用于美股分析报告结论在钉钉多维表（dingtalk-ai-table）中的结构化归档（新增）与检索（查询）。 | |
| my-stock-longbridge-skill | |
| my_stock_report_mgnt_skill 当且仅当用户明确提到“分析报告多维表”或“my_stock_report_mgnt_skill”时触发。专门用于美股分析报告结论在钉钉多维表（dingtalk-ai-table）中的结构化归档（新增）与检索（查询）。 | |
| my_stock_report_skill 当且仅当用户明确提到使用报告引擎、分析引擎、股票引擎、report engine 或者 my_stock_report_skill 时触发。用于调用 Python 分析引擎对特定美股标的进行多维度深度分析，支持指定分析师组合，并将结论和报告归档至钉钉多维表。 | |
| my_stock_tradeagents_rebuild_skill 当且仅当用户明确提出“重新构建tradeagents”或类似高度相关指令时触发。主要功能为在 ~/TradingAgents 目录下重新创建并激活 Python 虚拟环境，安装包及依赖，最后总结修改并推送到远程仓库。 | |
| my_stock_watchlist_skill 当用户提到“观察列表”或“股票观察”时触发。用于管理钉钉多维表格中的股票观察名单。 | |
| HCP data process assist 从 HCP 仪器结果文件中提取汇总表。适用于用户提供的 HCP 类 Excel 文件，其中第一个 sheet 或原始文本包含 Sample、QC、Standards 等 Group 分段，并希望按样例格式生成新的汇总 sheet。 | |
| 每日英语诗歌推送 每日英语诗歌推送。每天从多个英文诗歌网站抓取当日推荐诗歌（Poem of the Day），包含诗歌全文、作者介绍和深度赏析，推送至飞书。触发词：每日诗歌、英文诗歌推送、poem of the day、daily poem。 | |
| 照片分析与 Darktable 修图 Structured Darktable photo critique and non-destructive RAW edit workflow. Evidence-based analysis, phased collaboration loop (input audit → diagnosis → comp... | |
| 场内基金溢价率查询 实时查询并分析A股场内基金（ETF/LOF/QDII）溢价率，提供价格、净值、溢价百分比及历史趋势风险提示。 | |
| 火星文转换器 将正常中文文本转换为火星文（2005-2010年代非主流网络文体）。 v2.1: 611 汉字映射，已清理生僻字，确保每个替代字都能被读者辨认。 触发词：火星文、非主流转换、转换火星文、fun text、火星文转换器。 | |
| 伪中国语趣味翻译 伪中国语（偽中国語）趣味翻译。将中文翻译为纯汉字日式表达——用和式词汇替换、日语SOV语序、日式婉转/夸张风格、日本汉字字形。当用户要求「伪中国语」「偽中国語」「日式汉字翻译」「假中文」或要求把中文转成伪中国语风格时触发。 | |
| 每日唐诗推送 每日唐诗推送。每天从全唐诗数据集中随机选取一首唐诗，生成包含深度赏析和作者介绍的结构化推送内容。触发词：每日唐诗、唐诗推送、唐诗赏析、今日唐诗。 | |
| Wayfinder DeFi trading, yield strategies, and portfolio management via the Wayfinder Paths CLI (`poetry run wayfinder`). Use when the user wants to check balances, swa... | |
| Codehooks Backend Deploy serverless backends for REST APIs, webhooks, data storage, scheduled jobs, queue workers, and autonomous workflows. | |
| mt5-trading-assistant Automates MetaTrader 5 trading: connect, monitor accounts, execute buy/sell orders with SL/TP, retrieve market data, and manage positions via scripts. | |
| Mt5 Trading Assistant Pro Professional-grade MetaTrader 5 trading automation — 35+ indicators, AI-powered strategy generation, smart risk management, and autonomous market scanning. C... | |
| Mind Security AI security toolkit — deepfake detection, prompt injection scanning, malware/phishing URL scanning, and AI text detection. Use when: (1) verifying if an imag... | |
| canvora Create on-brand visuals (social posts, carousels, decks, PDFs, ads, landing-page kits, infographics) from any idea, text, URL, or PDF via Canvora. 100+ formats, native generation in 150+ languages, per-client brand kits. Use when the user a | |
| ad-campaign Produce paid ad creative sets with Canvora — Meta, Instagram, LinkedIn, Google Display and banner placements in one pass, with variants for testing. Use when the user wants ads, ad creative, paid social assets, display banners, or a campaig | |
| blog-promo-kit Turn one published article URL into its full visual kit with Canvora — blog header, Open Graph share card, and the social promo set that distributes it. Use when the user publishes a blog post, wants a featured image, an OG image, or asks h | |
| data-infographic Turn data, comparisons, processes and timelines into explanatory visuals with Canvora — process flows, comparison charts, timelines, stat cards, checklists and long-form infographics. Use when the user has numbers, steps, a before/after, a | |
| instagram-carousel Create high-performing Instagram carousels with Canvora — right format, right slide count, hook-first content shaping, and the correct refine workflow. Use when the user wants an Instagram carousel, multi-slide IG post, swipe post, or educa | |
| landing-page-visuals Generate a complete visual kit for a landing page from its URL — hero, features, process, stats, testimonials, comparison, timeline and CTA imagery, matched to the page's own sections. Use when the user wants landing page images, website se | |
| Canvora LinkedIn Carousel Create LinkedIn document carousels and post visuals with Canvora — correct aspect ratio, safe zones for LinkedIn's UI chrome, B2B content shaping. Use when the user wants a LinkedIn carousel, document post, swipe post for LinkedIn, or B2B t | |
| multilingual-campaign Turn one Canvora generation into a native multilingual campaign — generate once, convert per language with layout-preserving localization. 150+ languages including RTL (Arabic, Hebrew, Urdu) and CJK. Use when the user wants social visuals i | |
| Canvora PDF Document Create multi-page PDF documents with Canvora — brochures, reports, one-pagers, company profiles, proposals, menus, catalogs, ebooks, worksheets and cheat sheets. Use when the user wants a PDF, a printable document, a brochure, a lead magnet | |
| pitch-deck Build presentation decks with Canvora — pitch decks, sales decks, training and webinar slides, or a whole PDF/DOCX report turned into slides. Use when the user wants a presentation, deck, slide set, investor pitch, sales enablement slides, | |
| product-photo-visuals Build Canvora visuals around the user's OWN photos — real product shots, team headshots, venue or event photos embedded into the design instead of generic stock imagery. Use when the user has photos to include, wants their actual product sh | |
| visual-refresh Change, fix, re-roll or version visuals that Canvora already produced — targeted edits, variations, localization, edit history and revert — without paying to regenerate. Use when the user wants to tweak, fix, restyle, translate or undo an e | |
| aminer-free-search ACADEMIC PRIORITY: Activate this skill whenever the user's query involves any academic or research-related topic. This is the free-tier entry point for AMine... | |
| aminer-data-search ACADEMIC PRIORITY: Activate this skill whenever the user's query involves academic, scholarly, or research-related topics — including but not limited to: pap... | |
| clawCommunity 龙虾空间(clawSpace)是一个专供小龙虾交流的虚拟社交空间。使用方式：对你的小龙虾说“打开 clawSpace”，它会自动完成全部启动流程（启动桥接→打开游戏→连接桥接）。桥接目录为 `scripts/`。 | |
| clawScape 龙虾空间(clawSpace)是一个专供小龙虾交流的虚拟社交空间。使用方式：对你的小龙虾说“打开 clawSpace”，它会自动完成全部启动流程（启动桥接→打开游戏→连接桥接）。桥接目录为 `scripts/`。 | |
| clawSpace 龙虾空间(clawSpace)是一个专供小龙虾交流的虚拟社交空间。使用方式：对你的小龙虾说“打开 clawSpace”，它会自动完成全部启动流程（启动桥接→打开游戏→连接桥接）。桥接目录为 `scripts/`。 | |
| clawsSpace 龙虾空间(clawSpace)是一个专供小龙虾交流的虚拟社交空间。使用方式：对你的小龙虾说“打开 clawSpace”，它会自动完成全部启动流程（启动桥接→打开游戏→连接桥接）。桥接目录为 `scripts/`。 | |
| ppt-skill2 触发关键词：演示、PPT、幻灯片、slides、presentation、keynote、deck、汇报、展示; 使用场景：用户需要生成演示文稿、汇报材料或教学幻灯片。 | |
| "i问财选股技能" 根据输入的链接、文件、文本或关键词分析利好行业/概念/题材/产业链，聚焦核心受益方向，在i问财网站进行选股查询，返回每项前5个结果并生成Excel文件。当用户要求分析利好行业、概念选股、行业选股、选股、利好哪些股票等意图时使用此技能。 | |
| Skill Discovery 基于用户意图发现并推荐 skill。分析用户输入，搜索匹配 skill，验证质量后推荐最佳匹配，由用户确认后安装。 | |
| Ziwei Verify 基于 verification_points 通过 ±1、±2 时辰偏移自动校正出生时间，提升紫微斗数命盘置信度和准确性。 | |
| 微信公众号自定义主题应用工具 AI-ready skill to test, register, and publish Markdown articles to WeChat Official Accounts using a local custom CSS theme via Wenyan CLI. | |
| 微信公众号自定义主题生成器 AI-ready skill to design and generate highly customized CSS themes for WeChat Official Accounts. | |
| 文颜 通过 wenyan-cli，快速将带 frontmatter 的 Markdown 文章发布到微信公众号，支持主题管理和图片自动上传。 | |
| 微信公众号文章发布工具 AI-ready skill to format and publish Markdown articles to WeChat Official Accounts using Wenyan CLI. | |
| X Article Extractor AI-ready skill to extract long-form X (Twitter) articles and convert them into clean Markdown files using headless browser technology. | |
| medical-training-report 消化内镜培训活动报告自动生成工具，支持纯线下/线上+线下/纯线上三种模式 | |
| 教学案例写作总纲 (Business Case Writing) 商学院教学案例写作总纲：HBS/Wharton/Ivey 方法论、灵感到成稿流水线、humanizer 去AI味、中英双语交付。 | |
| resume-photo 把生活照一键转为高端专业简历照/证件照：纯色背景、商务正装、柔光、标准尺寸。Use for 简历照、求职照、证件照、职业头像、resume photo, headshot, ID photo. | |
| yance-report-gen 研策Skill — 综合投研报告生成，多角色观点归一化合成 |
18,251–18,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.