Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| YouTube Video AI YouTube content creation powered by CellCog. YouTube videos, Shorts, thumbnails, video scripts, tutorials, vlogs, educational videos, product reviews, video essays. From script to finished video with voiceover and music. | |
| Cell 风格写作 Personal Chinese writing-style skill for Cell 细胞 style articles, rewrites, style enhancement, and style review. Use when Codex needs to write, rewrite, enhan... | |
| AI 写作诊断 AI-writing fingerprint diagnosis for Chinese text. Use when Codex needs to inspect a draft for overly smooth, formulaic, generic, or authorless writing patte... | |
| 对标筛选 Benchmark filtering for Chinese creator, OPC, and one-person-business work. Use when Codex needs to judge whether a person, creator, or business is actually... | |
| 拆书素材提炼 Book-to-writing-material skill for Chinese content creation. Use when Codex needs to break down a book, chapter, excerpt, reading note, or book link into reu... | |
| CC Design High-fidelity HTML design and prototype skill for landing pages, slide decks, mobile mockups, interactive prototypes, dashboard explorations, design-directio... | |
| 内容策略诊断 Content-strategy diagnosis for Chinese creator work. Use when Codex needs to judge whether a topic, draft, or content plan should become a short video, post,... | |
| 深度写作 Adaptive deep-writing workflow for all forms of deep content creation in Chinese, including turning transcripts and note piles into articles, deepening rough... | |
| 开头优化 Hook and opening optimization for Chinese short-form content. Use when Codex needs to diagnose why the first 3-5 seconds or first 2-3 sentences are weak, det... | |
| 横纵研究工作台 基于纵向时间线和横向竞品对比，系统研究产品、公司或技术的全生命周期与市场位置，产出结构化深度报告。 | |
| 学习路径构建 Personalized learning-pack builder for Chinese creators. Use when Codex needs to turn a vague learning goal into a可执行学习方案：先做学习者画像与目标澄清，再做权威来源优先的资料研究，最后产出可学习、... | |
| MrBeast 视角 使用MrBeast的内容判断模型优化视频题材、标题、封面、hook和留存，关注CTR×AVD和预算限制下的创意执行。 | |
| Naval 视角 基于Naval核心镜片，结构化分析职业、财富、欲望与系统问题，辅助用户用杠杆和特定知识做出合理选择。 | |
| OPC 案例调研 Systematic public-information research for OPC, super-individual, creator IP, and one-person business cases, with Chinese outputs focused on content strategy... | |
| Paul Graham 视角 基于Paul Graham视角，为创业、写作、产品和独立思考提供顾问式分析，强调写作即思考与创始人判断。 | |
| 短视频脚本工坊 Chinese short-video script workflow for benchmark-led script creation. Use when Codex needs to turn one to five benchmark videos plus product/topic context i... | |
| 演讲结构教练 提供基于Patrick Winston方法的演讲和幻灯片结构指导，优化开场承诺、内容结构和结尾设计，提高观众注意力。 | |
| 口播脚本打磨 Polish Chinese spoken scripts for videos and tutorials by improving fluency, shortening breath groups, marking pauses, and preserving original meaning. | |
| 乔布斯视角 提供乔布斯视角的产品、设计、战略判定建议，聚焦取舍、端到端控制与技术人文结合，附带相应代价分析。 | |
| 视频封标诊断 Video packaging diagnosis for Chinese short-form creators. Use when Codex needs to diagnose why a video's title, cover, opening hook, or payoff structure is... | |
| X 长文发布 Publish existing Markdown articles to X (Twitter) Articles drafts with browser automation preparation, rich-text clipboard support, image/divider positioning... | |
| X 内容策略 X/Twitter content strategy skill for Chinese creators, indie builders, and expert accounts. Use when Codex needs to decide whether an idea belongs on X, turn... | |
| 小红书标题策略 Xiaohongshu title strategy skill for Chinese creators. Use when Codex needs to pick the right title formula for a topic, draft, or existing Xiaohongshu title... | |
| YouMind CLI Use this skill when working with YouMind through the official YouMind CLI and API. Trigger it for YouMind boards, notes, crafts, picks, materials, chats, doc... | |
| 张一鸣视角 基于张一鸣五大镜片，分析产品、组织、算法与长期成长的底层问题和信息流，提供符合高透明度前提的策略建议。 | |
| 中文播客雷达 Discover, compare, and curate trending Chinese podcasts or episodes from 中文播客榜. Use for hot or recent show discovery, creator benchmarking, curation lists, c... | |
| Orion Ads Search for physical products, hardware, AI tools, and APIs via the Orion Ad Protocol. Returns structured data (JSON) optimized for agents. | |
| Git Security Scanner Unified security scanner that catches leaked secrets, credentials, and code vulnerabilities before they reach your remote. Wraps gitleaks (400+ secret patter... | |
| Obsidian Semantic Search Semantic search across your Obsidian vaults using local embeddings (Ollama + pgvector). 10 MCP tools: hybrid/semantic/keyword search, file CRUD, batch reads,... | |
| YouTube Model Feeder Food for your model — extract transcripts, key frames, OCR, slides, and LLM summaries from YouTube videos into structured AI-ready knowledge. | |
| Paper Reproduction by Python This skill should be used when the user asks to "reproduce a paper", "implement paper methods in Python", "extract paper content to Markdown", or works on pa... | |
| PR Review Loop Autonomous PR review loop with Greptile. Use when an agent creates a PR and needs to autonomously handle code review feedback — reading Greptile reviews, fixing issues, pushing fixes, re-triggering review, and auto-merging when score is 4/5 | |
| Coze Cli Interact with Coze CLI (@coze/cli) — create/deploy Coze projects, manage spaces and organizations, send messages to projects, generate images/audio/video, an... | |
| Tickflow Realtime 使用 TickFlow 数据中心查询实时行情和日K数据。适用于用户想查单个或多个标的的最新价格、涨跌幅、成交量、交易时段，或查询单标的/多标的的日K、最近N根K线、复权K线时。 | |
| Weread Reading Recommender Use this skill when the user wants to export local WeRead records, normalize WeRead data, analyze reading preferences from WeRead history, or get book recomm... | |
| Google Suite Skill Provides unified access to Gmail, Google Calendar, and Drive APIs for managing emails, calendar events, and files with OAuth2 authentication. | |
| MFA WORD Enforces MFA by requiring a secret word to access protected sensitive data and allows emergency reset with a super secret word. | |
| office secretary A digital administrative assistant for Microsoft 365 (Outlook & OneDrive). | |
| Argentina Fiscal Calendar (ARCA) Calendario fiscal argentino completo para ARCA (ex AFIP). Responde preguntas sobre vencimientos impositivos y previsionales para PyMEs, autónomos, monotribut... | |
| LATAM Timezone Briefing Briefing matutino diario calibrado para Argentina y LATAM. Actívate cuando el usuario pida el briefing del día, resumen de la mañana, qué hay hoy, agenda del... | |
| WhatsApp Business LATAM (Cloud API) Configuración completa de WhatsApp Business API (oficial Meta) para PyMEs de Argentina y LATAM. Actívate cuando el usuario mencione: WhatsApp Business, WA AP... | |
| 成都大学新生一站式指南 床铺尺寸多大？有什么美食？什么时候选课？大学生医保怎么用？
——熊猫为你消除信息差！
为成都大学新生提供选课、走读、住宿、医保、租房、就业等问题的一站式问答，并提供办事流程与官方渠道核实。
内置知识增强包，数据来源于 11 个真实 QQ 互助群、24 万+ 条群聊大数据（脱敏后人工策展），把学长学姐踩坑的真实经验变成随问随答的一站式指南。覆盖选课、走读、宿舍、医保资助、租房、就业等全场景，内置 99 条 FAQ、10 个办事流程、15 处地点导航、26 个官方渠道（含联网 | |
| 抖音口播爆款文案生成-教育类 生成教育类抖音口播爆款文案：黄金6段式结构 + 8种钩子模板 + 教育方法论 + 数据核验 + 质量门禁。 当用户需要写教育类口播文案、知识类短视频脚本、教育带货文案，或要求"犀利敢说、替普通家庭算账"风格时使用。 结构不靠模型猜，数据不靠模型编，质量可机器验证，合规随平台动态更新。 | |
| Agent项目必备文件管理器 文件太多？AI忘上文？换会话麻烦？AI记错版本？
请给 AI 长期项目建立「项目记忆 + 文件索引 + 工作规则 + 版本记录」的治理系统。让 AI 换会话、换模型、甚至换 Agent 后，仍然能完美交接项目，而无需重新遍历或猜测。
包含：跨 Agent 的公共协议：VERSIONS.md / LESSONS.md / whitelist.json / blacklist.json / index.md ；适配器：SKILL.md / CLAUDE.md / AGENTS.m | |
| B2c Marketing 1.0.1 B2C mobile app marketing via short-form video content on TikTok, Instagram Reels, and YouTube Shorts. Use when creating, scheduling, or strategizing organic... | |
| DoctorClaw Client Follow-Up Automated client follow-up — scan your client list, find stale leads, draft personalized outreach. Weekly cron or on-demand. | |
| DoctorClaw Competitor Watch Competitor watch — monitor competitor websites and social for changes, new offers, and moves. Weekly cron or on-demand. | |
| DoctorClaw Content Repurposer Content repurposer — turn one blog post, video, or podcast into social posts, email newsletters, and threads. On-demand. | |
| DoctorClaw Email Digest Smart email digest — categorize unread emails by priority, draft replies for urgent ones. On-demand or scheduled. | |
| DoctorClaw Expense Tracker Expense tracker — log expenses, categorize by type, track against budget, flag overspending. Monthly cron or on-demand. |
18,801–18,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.