Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| yandun-position-sizer 研盾Skill — 仓位计算、止损/止盈策略、风险预算分配 | |
| yandun-risk-assessment 研盾Skill — 五维风险评估、风险指标计算、风险等级评定 | |
| yanji-kline-data 研技Skill — 获取个股K线数据、成交量、价格走势 | |
| yanji-tech-indicators 研技Skill — 技术指标教学演示计算（基于内置示例K线，非真实行情） | |
| yanjiatuan-task-dispatch 研家团Skill — 团队任务调度、分派与成果汇总管理 | |
| yanlin-company-filings 研林Skill — 公司公告采集+实质影响过滤，标注核心影响与标的价值 | |
| yanlin-macro-data 研林Skill — 采集宏观流动性数据（利率、汇率、北向资金、海外市场） | |
| yanlin-market-data 研林Skill — 采集A股大盘指数、行业板块排名、核心权重股行情数据 | |
| yanlin-news-filter 研林Skill — 财经新闻采集+关键事件筛选过滤，只保留有实质影响的事件 | |
| yanlin-report-gen 研林Skill — 产业投研日报生成器，将采集数据合成为完整券商级日报（Markdown格式） | |
| yanmu-comps-model 股票研究专家研木的Skill — 可比公司估值(Comps)，含PE/PB/ROE/利润率雷达图对比 | |
| yanmu-dcf-model 股票研究专家研木的Skill — DCF估值建模，含5年FCF预测、终值折现、敏感性分析热力图 | |
| yanmu-financial-data 股票研究专家研木的Skill — 采集目标公司及可比公司的核心财务数据 | |
| yanmu-hot-stocks 股票研究专家研木的Skill — 教学演示用热门股票推荐（内置示例标的，非实时行情） | |
| yanmu-report-generator 股票研究专家研木的Skill — 将DCF和Comps分析结果生成专业券商研报（PDF或Word） | |
| yansheng-fund-flow 研声Skill — 资金流向教学演示（确定性规则生成，非真实市场数据） | |
| yansheng-news-sentiment 研声Skill — 新闻舆情教学演示（规则与关键词打分，非完整NLP，不依赖实时新闻API） | |
| Zhiyan Smart Research 智研学术探索 v1.1 — 一问即出结构化报告：结论摘要、文献综述、空白与创新、研究建议、追问方向。Crossref/PubMed + OpenClaw LLM. Use for literature search, review, research gaps, 文献检索, 学术探索. | |
| pencil-design-skill Design UIs in Pencil (.pen files) and generate production-ready code from them. Triggers on any task involving .pen files, UI prototyping, design system auth... | |
| Bark Notification Send Bark (day.app) push notifications after Codex completes a task. Use when one Codex or Claude run is finished, or when you need to notify on task complet... | |
| Email Notify Send SMTP email notifications after Codex completes a task. Use when one Codex or Claude run is finished, or when you need to notify on task completion with... | |
| OpenClaw Config Help edit and validate OpenClaw config | |
| readme-writer-skill Expert README writing skill for open source projects. Use this skill whenever the user wants to write, improve, or review a README for any open source reposi... | |
| Polymarket Opportunities Scanning Scan Polymarket prediction markets for book arbitrage opportunities (overbooked/underbooked multi-outcome markets), generate a formatted report, and deliver... | |
| Shopping in Sweden Assist with searching, adding to cart, and securely purchasing products from trusted Swedish e-commerce sites using the Zupyak Mynt Card. | |
| Substack Autopilot Automate drafting and local saving of weekly Substack articles from a topic queue, opening the editor for final human review before publishing. | |
| X Brand Operator Automate X/Twitter brand account tasks including posting, keyword engagement, scheduling, and reporting using xurl API with browser fallback and Telegram ale... | |
| MediaGo Download videos from m3u8/HLS streams, Bilibili, and direct URLs using MediaGo. 下载视频、m3u8直播流、B站视频。 Triggers on: download video, 下载视频, 下载这个链接, 帮我下载, m3u8 down... | |
| Cnsdoce Publish V5 中国工程造价技能，支持安装工程/建筑工程/市政工程/园林绿化工程定额查询、组价计算与报价表生成。 数据源支持两种模式（见下方说明）： · 默认模式：大模型推理数据（无需本地数据库，推荐新手） · 唯一来源模式：严格限定为山东省消耗量定额(2025版) + 济南市价目表(2026版) 核心依据：《建设工程工程量清单计价标准》GB/T 50500-2024（2025年9月1日起实施）。 当用户询问以下场景时触发本技能：定额子目查询（章节号+条款号溯源）、 安装工程组价（13分册） | |
| Kerrystock 个股/ETF 的「日历效应（季节性）买卖点分析」端到端工作流。当用户要求分析某只股票或基金的 月度/年度季节性规律、确定基于日历效应的买入卖出时间点与买卖策略、或做"季节性 + 技术指标" 复合选股时使用本技能。本技能串联 westock-data（行情/技术指标/投资日历）、 neodata-financial... | |
| Paper Bilingual 将PDF论文转换为双语Markdown。对用户提供PDF URL或本地PDF文件，提取文本转为Markdown，保留图片，逐段插入中文翻译。用于学术论文研读、翻译对比。 | |
| pretty-mermaid Generate beautiful Mermaid.js diagrams with custom styling and themes. Create flowcharts, sequence diagrams, Gantt charts, class diagrams, etc. with enhanced... | |
| newpaper 将学术论文 PDF 自动转换为 PowerPoint 海报（PPTX）和 HTML 文件。支持 UniAPI、MiniMax 等 OpenAI 兼容 API。 | |
| Ashareskill 使用BaoStock获取股票K线数据及完整技术指标的专业工具。支持单只股票或股票池查询，支持自定义时间段和K线级别（日线/周线/月线），获取的数据包含均线、MACD、KDJ、RSI、BOLL、CCI等完整技术指标。适用于：1）获取股票历史K线数据用于策略回测；2）导出完整技术指标数据用于量化分析；3）批量获取多只... | |
| Chill Beijing 北京下班及周末放松推荐助手 v1.4.0。工作日推荐电影、脱口秀、演出；周末推荐City Walk、京郊游、社交活动、演出。实时抓取猫眼/大麦/美团/小红书数据。 | |
| Openclaw Create Agent 在 OpenClaw 中创建一个新的 Agent 智能体，包括 workspace 目录结构、记忆系统文件、openclaw.json 配置修改、飞书 channel 与 binding 设置。适用于新增 AI 分身、多角色管理等场景。 | |
| Daily Briefing Generate daily morning briefings with weather, traffic limits, and news. Provides structured data collection scripts for stable, reproducible briefing genera... | |
| GitHub to RedNote Convert GitHub repositories into RedNote (小红书) style technical articles. Use when user wants to generate tech promotion content from GitHub repos - including... | |
| Novel Director AI互动小说创作工具 - 导演板模式 v2.0.0（支持长篇连载）。 用户作为导演设定场景、人物、目标，AI作为演员分镜演绎。 新增：长篇小说上下文管理、智能检索、跨Session续写。 触发词：开始创作、写小说、来一段故事、导演模式、继续写、保存、新建小说。 | |
| Stock Pe Pb Analyzer 分析股票PE/PB历史水位的专业工具。使用BaoStock API获取真实股票数据，计算股票在过去十年中的PE、PB历史百分位水位。适用于：1）查询单个股票的PE/PB历史估值水平；2）评估当前估值相对于历史的高低位置；3）为投资决策提供估值参考数据。支持通过股票名称（如贵州茅台）或代码（如600519）查询A股... | |
| Think-Plan 深度思考与规划 Skill。用于复杂任务的需求挖掘、方案设计和执行规划。 触发场景： 1. 用户说"帮我规划一下..."、"我想做一个..."、"分析一下这个方案" 2. 用户明确说"使用 think-plan"或"用思考规划 Skill" 3. 用户提出的任务需求不清晰、需要梳理 4. 用户需要多个可选方案对比... | |
| Ai News Poster Generate fixed-template daily AI news posters from five news items. Use when the user asks to create a poster, social card, or image summary for "today's AI... | |
| OpenClaw Feishu Bot Manager 飞书多账户机器人配置管理 skill。用于新增飞书机器人账户、将机器人或特定群聊绑定到指定 Agent，并安全地更新 OpenClaw 的 Feishu 路由配置。适用于用户提到“添加飞书机器人”、“配置飞书机器人”、“新增飞书账户”、“飞书多账户”这类场景。 | |
| 电子书下载 下载中文电子书到用户电脑。通过搜索读书派(dushupai.com)等资源站获取城通网盘下载链接，自动完成密码输入、API调用获取直链、curl下载、zip解压等全流程。当用户提到"下载电子书"、"下载这本书"、"找一下某本书的电子版"、"帮我下个epub/mobi/azw3"、"下载 XX 到电脑"等与获取电子... | |
| Structure Thinking Structured problem analysis and communication using system mapping and hierarchical logic. Use when a request involves messy, multi-factor problems, root-cau... | |
| Article Extract 提取微信公众号、博客、新闻等网页的正文内容，绕过反爬机制，纯文本输出。 | |
| WebDAV 备份工具 WebDAV 备份工具 - 本地+云端双备份，自动保留最近7个本地备份和20个远端备份 | |
| PR's PDF Agent Self-hosted PDF operations and conversions with metered usage output. | |
| Arcane Expert guidance for building and maintaining projects with the Arcane Microframework. Use when creating new projects, defining routes, managing context-aware... | |
| lens Use when you need your agent to see the world through your LENS. This personal identity engine teaches AI how you think, judge, and write by evolving the Trinity Nodes: your context (AXIOM), judgment (ETHOS), and voice (MODUS) in ~/.lens/ f |
18,301–18,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.