Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| FurrBudd Author ClawdBot's complete production skill set. Contains three merged capabilities: (1) The FurrBudd WordPress article builder — full CSS theme, HTML component tem... | |
| Standardize the de-upgrading and iteration of SKILL Use when identifying skill candidates from repeated work, managing skill change proposals, reviewing candidates, or chaining skills into workflows. Also invo... | |
| geo_skill GEO 品牌优化 — 品牌 AI 生态诊断、评测文章生成与自动发稿（豆包联网 API）。 | |
| Geo Cycle Autopilot GEO 周期自动协同 — 读龙虾密钥，自动导出范文/执行深度仿写并导出，上报待群发状态。供 QClaw 每日定时任务加载，无需用户说「开始优化任务」。 | |
| Geo Deep Imitate GEO 深度仿写 — web_fetch 爬信源、深度成稿、导出 ZIP 并上报仿写已完成。由 geo-cycle-autopilot 或 coordinator 调用。 | |
| Geo Mass Publish Check GEO 待群发 — 拉取范文/仿写状态，待导出时下载 ZIP 到本机并上报，可群发时提示用户。QClaw 定时只装本 skill 即可。 | |
| Geo Opt Coordinator GEO 智能优化龙虾 — 对话入口、密钥验证、任务列表。主自动化请用 geo-cycle-autopilot 定时；群发状态用 geo-mass-publish-check。勿要求 OPT-ID。 | |
| Geo Social Publish [已废弃] 原 SAU 群发龙虾。请改用 SaaS 下载 Word/ZIP + 本机融媒宝批量发布；勿安装本 skill。 | |
| speech-coach 口才陪练龙虾 — AI public speaking coach with 15-step progressive training, 25 methodologies, and personalized progress tracking. Use when user asks about 口才训练, 演讲练... | |
| News Telegram Push Curate and send twice-daily English Telegram news updates featuring top 10 vetted stories on FX/CFD, crypto, trading tech, finance, and global politics. | |
| follow-aibuilders AI builders digest — 监控顶级 AI builders 在 X 和 YouTube 播客上的动态，将其内容重新整理为易于消化的摘要。当用户想要 AI 行业洞察、builder 更新或调用 /ai 时使用。Twitter 使用免费 Rettiwt-API（无需付费 key），YouTube 使用... | |
| follow-arxiv 搜索过去一段用户指定的时间内arxiv上某题材的论文，并可以下载，阅读，深度分析特定论文。在用户请求处理arxiv平台论文，或想要得到最新的论文概要时使用 | |
| follow-nowcoder 牛客面经报告生成。搜索牛客网上的面试经验帖，生成结构化面经报告。在用户请求查看面经、准备面试、搜索面试经验时使用。 | |
| follow-xhs 小红书笔记搜索和内容获取工具。你可以帮助用户快速找到目标内容，自动获取笔记详情，并生成结构化的分析报告。 | |
| Amazon Analyse 对亚马逊竞品Listing进行全维度穿透分析，包括文案逻辑、评论分析、关键词分析、市场动态等。分析完成后自动保存为Markdown报告文档到reports/目录。Invoke when user uses /amazon-analyse command with a product ASIN. | |
| Category Selection 亚马逊品类自动化选品分析技能。通过五维评分模型对亚马逊品类进行深度市场调研，生成Markdown分析报告。当用户使用 /category-selection 命令或提出'分析XX品类'、'XX品类市场调研'、'XX品类选品'等需求时触发此技能。支持配置分析数量，默认Top20。 | |
| SpecClaw Spec-driven development framework for OpenClaw. Propose features, generate specs, spawn coding agents, validate implementations. | |
| MotuArt Color Engine AI portrait grading, skin-tone correction, identity-preserving smoothing, mask export, approved clothing replacement, professional AI Headshots generation, and ID/passport/headshot/avatar production through the MotuArt Color Engine HTTP API | |
| Lite Research Perform lite research using web search and web fetch tools. Use when user asks to "research" something (not "deep research"). Uses advanced search strategies... | |
| Mirage Proxy Install and configure mirage-proxy as a transparent PII/secrets filter for OpenClaw LLM API calls. Handles binary installation, provider config, auto-restart... | |
| Openclaw Model Router Self-aware multi-provider model routing for OpenClaw. Auto-detects your available models, recommends the best routing mode, and adapts per task. Claude, Gemi... | |
| 微信小程序开发辅助 微信小程序开发辅助。提供代码模板、API 示例、常见问题解答。 | |
| McDonald's China (mstore) McDonald's China coupon redemption, query, and points checking. Use when user wants to (1) Query or claim McDonald's coupons, (2) Check available coupons, (3... | |
| Reg Limited Vehicle restriction query and reminder tool for Chinese cities. Query daily restrictions and set scheduled reminders. | |
| Rehub Rehub is a leisure and entertainment hub for AI agents, allowing all agents to interact through tokens and form visualized excitement points. | |
| Route Assistant Intelligent route planning assistant with smart filtering. Query driving, transit, taxi, walking routes with Amap API. Auto-filters infeasible options. | |
| Security Audit Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included. | |
| Security Monitor Real-time security monitoring for Clawdbot. Detects intrusions, unusual API calls, credential usage patterns, and alerts on breaches. | |
| SAP FICO Senior Consultant Provides expert SAP FICO consulting with configuration, troubleshooting, integration, and S/4HANA migration support using precise French SAP terminology. | |
| 139mail 139邮箱邮件收发 Skill - 支持 IMAP/SMTP 协议，兼容139/QQ/163/Gmail等主流邮箱 功能： 1. 发送邮件（SMTP） 2. 接收邮件（IMAP） 3. 查看收件箱列表 4. 查看未读邮件 当用户提到 "发邮件"、"收邮件"、"查看邮件"、"邮箱" 或 "email" 时激活此 s... | |
| 动作导演 15秒战斗分镜·0.1秒精度打点·顿帧+震颤+粒子反馈 | |
| 角色三视图 生成角色正面/侧面/背面三视图，附带配色板与细节拆解 | |
| Film Pipeline 总控台 影视创作总控台。接收用户输入（剧本/角色描述/动作戏创意/画面风格需求），自动分析意图，调度四个子Skill（character-sheet角色三视图、storyboard-9grid九宫格分镜、action-director动作导演、trailer-director预告片导演）按正确顺序执行，并保持全流程的角色... | |
| Storyboard 9Grid 将剧本拆解为九宫格分镜，每格附带Nano Banana Pro生图提示词 | |
| 预告片导演 电影级生图Prompt：2.35:1画幅·85mm T1.8·ARRI镜头·胶片质感 | |
| Video Prompt Reverse Engineer Reverse-engineer AI video prompts from any video or screenshot. Analyzes shot types, camera movements, lighting, color grading, and director style. Outputs s... | |
| Paper Reader Comprehensive PDF paper reader for academic research. Extracts text, figures, tables, and structured content from research papers with support for multimodal... | |
| Paper Research Agent Autonomous multi-agent paper research system. When user wants to research a topic, find related papers, or analyze academic literature, use this skill to orc... | |
| Project Context Manager Project-based agent context management system for maintaining long-term memory and project state across sessions. Use when starting or continuing any softwar... | |
| Top-Learner 认知科学驱动的元学习教练。基于Barbara Oakley《学习之道》、Make It Stick、MIT/Stanford主动学习，提供：①直觉先于形式的深度教学 ②诊断最优知识结构的五维检验 ③面向考试或应用的刻意练习编排。触发词：学习方法、学习材料讲解、备考、复习策略、知识点理解、做题训练。 | |
| 电商爆款文案生成器 电商爆款文案生成技能。为淘宝/拼多多/抖音/京东卖家生成高转化率的商品标题、详情页文案、卖点提炼和促销文案。使用场景：(1) 商品标题优化，(2) 详情页文案生成，(3) 卖点提炼，(4) 促销活动文案，(5) 竞品文案分析。 | |
| PDF 工具箱 PDF 工具箱技能。支持 PDF 合并、拆分、旋转、压缩、格式转换、文字提取、水印添加等常用操作。使用场景：(1) 合并多个 PDF，(2) 拆分 PDF 页面，(3) 旋转/调整方向，(4) 压缩 PDF 大小，(5) PDF 转图片/Word，(6) 提取 PDF 文字，(7) 添加/移除水印。 | |
| 自媒体爆款标题生成器 自媒体爆款标题生成技能。为小红书/公众号/抖音/知乎/B 站创作者生成高点击率标题。使用场景：(1) 小红书种草标题，(2) 公众号文章标题，(3) 抖音视频标题，(4) 知乎问答标题，(5) B 站视频标题，(6) 标题优化/改写。 | |
| 一键内网穿透 当用户说"启动项目"、"给项目一个公网域名"、"start tunnel"、"expose my project"、 "让项目可以公网访问"、"start my project with a public URL" 时自动触发。 无需用户做任何操作：自动检测项目目录和端口，修复环境，启动 tunnel， 直接返回... | |
| Ios Cocoapods Spm Migration Use when migrating iOS projects from CocoaPods to Swift Package Manager, or when planning a migration strategy for enterprise iOS dependencies. Covers depend... | |
| content-tracker 内容追踪技能。高时效性话题追踪、链接更新监控、第三方热点聚合。 USE FOR: - "追踪AI行业动态", "追踪某某话题最新进展" - "监控这个链接的更新", "这个网站有新内容吗" - "今天的热点", "最新新闻" - 定期简报生成（配合日程使用） | |
| current-time 获取当前时间的工具。返回格式化的日期时间和时区信息。 USE FOR: - "现在几点了", "当前时间" - "今天是几号", "什么日期" - 获取带时区的时间信息 | |
| AI intervew agent named Xiaoba 通过小芭 AI 面试开放 API 创建面试计划、管理候选人、发起面试并获取面试结果。 | |
| AI SaaS Demo Script Create concise, conversion-oriented demo video scripts and shot-by-shot storyboards for AI SaaS products. Use when the user asks for a product demo video scr... | |
| baidu-youjia-car 百度有驾·汽车查询 Skill，一句话查询汽车品牌、车系、车型详情、价格行情、经销商信息。提供手机号验证码获取 Key + 手动配置双重方式，开箱即用。涉及汽车价格、降价信息、落地价计算、车主成交价参考等购车场景时使用。 |
19,001–19,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.