Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| CDE 药物查询（drug query in CDE/CENTER FOR DRUG EVALUATION) Query CDE China drug review public data for breakthrough therapy announcements, priority review announcements, included lists by company or drug, in-review r... | |
| 中文专利交底书撰写(Patent Disclosure Doc Writer) 撰写中文专利交底书。Use when: 用户需要撰写专利交底书、技术交底书、专利申请文档。 | |
| autonomous-tasks Self-driven AI worker. Reads goals, generates tasks, executes, and logs progress. Keywords: create goal, new goal, set goal, run goals, 创建目标, 新目标, 设定目标, 执行目标. | |
| Html2screenshot（长截图） HTML 网页长截图技能。将任意 HTML（本地文件路径、URL 或 HTML 字符串）转换为完整长图（PNG），不失真不变形。触发词：html截图、网页截图、长截图、完整页面截图、把网页转成图片。HTML文件可以是任意网页，也可以是本地HTML网页文件，把链接给智能体，给Html2screenshot命令将此文件转化为长截图。（如果图片上有大量空白，是因为HTML有些图像渲染组件影响，让智能体去除这个影响，重新再生成一次就好了） | |
| 纪念日管理 私人日期管家。**重要：所有日期计算（包括相差天数、下周一、月末等）必须使用 calc 命令，不要自己计算，避免出错。** 支持公历和农历计算，提供提醒和情感化文案。触发场景：(1)用户提到生日、纪念日、忌日、祭祖、清明等关键词 (2)用户说"记录XXX的生日"、"记一下XXX" (3)用户问"今天有什么日子"、... | |
| Cloudflare R2 S3 存储工具 Cloudflare R2 S3 兼容存储工具，支持配置 API 密钥、上传文件并获取公开访问地址。使用当需要上传文件到 Cloudflare R2 获取公开链接时。 | |
| Qq Email Send and receive emails via QQ Mail SMTP/IMAP. Use when: user wants to send/receive emails, check inbox, read messages, or share documents via email. Require... | |
| MBA Thesis Advisor MBA论文写作与排版顾问，帮助提升学位论文至优秀水平。适用场景： (1) 将MBA论文提升至优秀毕业论文水平（如清华优秀毕业论文）， (2) 诊断论文初稿问题，(3) 用批判性写法（写法B）改写论文， (4) 构建理论框架，(5) 提炼论文原创贡献，(6) 修改结论使之有洞察力， (7) 论文排版——图表、表格、... | |
| thu-thesis 自动将清华毕业论文 Word (.docx) 转换为符合 thuthesis 官方模板规范的完整高质量 PDF，支持章节、摘要、图表、参考文献等处理。 | |
| dingtalk-link 钉钉机器人连接配置指南。用于安装、配置和排查 OpenClaw 钉钉连接器 (dingtalk-connector) 的问题。当用户需要连接钉钉机器人、配置 AppKey/AppSecret、或排查钉钉消息收发问题时使用。 | |
| ppt-generator-smb 生成专业演示文稿，支持 HTML 交互式幻灯片和 PowerPoint (.pptx) 两种格式。当用户需要制作 PPT、演示文稿、Slides、幻灯片、市场分析报告、产品介绍时触发。支持乔布斯风极简科技感设计，自动数据可视化，翻页导航功能。 | |
| youtube-manager Comprehensive YouTube channel management with video publishing, data analytics, and report generation. Use when user mentions 'YouTube data', 'channel analys... | |
| session-cleanup Session cleanup skill for Claw-family agents (OpenClaw, WorkBuddy, QClaw, etc.). This skill should be used when the user wants to track and clean up temporar... | |
| Code Craftsmanship Senior Staff Engineer skill for AI coding agents. Enforces simplicity, reuse-first, minimal-diff changes, testability, and Clean Code discipline. Use this sk... | |
| patent-eou Evidence of Use (EOU) patent analysis skill. Use this skill whenever the user wants to: analyze whether a product infringes a patent, generate an EOU claim c... | |
| patent-fto Conduct FTO patent searches and infringement risk analyses by querying granted and pending patents based on technical descriptions and images. | |
| patent-invalid-search Perform patent invalidation analysis by verifying inputs, extracting and comparing technical features, searching prior art, evaluating evidence, and generati... | |
| patent-novelty-search Perform patent novelty searches by analyzing technical solutions, retrieving and ranking related patents, comparing features, and generating a detailed novel... | |
| baidu_search Perform Baidu search to retrieve Chinese web results with titles, summaries, and links, and parse webpage content from search results. | |
| 学术人员邮箱批量搜索工具 学术人员邮箱批量搜索工具。从姓名+单位出发，通过搜索引擎自动查找学术人员的邮箱地址，结果写入Excel文件。 触发词：邮箱搜索、学术邮箱、批量找人、email搜索、搜邮箱 | |
| 大佬思想蒸馏框架 思想领袖论坛 v3.0 · 顶级大佬模拟互动系统 三大核心功能： 1. 【讨论模式】多角色模拟辩论，输出结构化报告 2. 【意见模式】单大佬针对具体问题快速输出观点 3. 【参会模式】大佬实时参与会议，发表意见和提问 ⚠️ 法律合规声明：所有输出均明确标注【观点模拟：XXX人物名】， 仅代表基于公开资料的AI推演... | |
| 德胧大佬蒸馏系统 大佬思想蒸馏框架 v3.3 - 顶级大佬模拟互动系统 三大核心功能：讨论模式、意见模式、参会模式 预蒸馏角色池：AI技术界×9位、酒店行业×12位、风险投资×12位，共33位 ⚠️ 所有输出必须标注【观点模拟：XXX】，法律合规使用 触发词：模拟讨论、大佬辩论、大佬意见、大佬参会、大佬思想蒸馏 | |
| 大佬思想蒸馏框架 dalao v3.5 大佬思想蒸馏框架 - 顶级大佬模拟互动系统 v3.5 核心升级：从"立场标签"升级为"决策链蒸馏" 三大核心功能：讨论模式、意见模式、参会模式 预蒸馏角色池：AI技术界×9位、酒店行业×12位（含晁留柱真实版）、风险投资×12位，共33位 v3.5新增：信息源分级系统、决策链验证机制、语录过滤器、快速调用格式 ⚠... | |
| AI播客生成器 Generate AI podcast episodes from PDFs, text, notes, and links using MagicPodcast in OpenClaw. Creates natural two-person dialogue audio, supports custom lan... | |
| 德胧商业写作助手 You are a professional business analyst, skilled in writing various industry research reports, business insights, consulting analyses, company research repor... | |
| 德胧竞品分析报告 Generate structured competitive analysis reports with feature comparisons, pricing analysis, SWOT, and strategic recommendations. Use when analyzing competit... | |
| 扣子Coze CLI工具 Interact with Coze CLI (@coze/cli) — create/deploy Coze projects, manage spaces and organizations, send messages to projects, generate images/audio/video, an... | |
| 德胧舆情情报综合工具箱 德胧AI龙虾军团舆情情报综合工具箱 v2.0。整合 miaoda搜索 + BettaFish开源舆情引擎 + 飞书精美卡片 + 抖音/视频平台监控 + AI风险分析与防控预案生成。 触发词：舆情、情报、网情、监控、风险分析、抖音监控、酒店风险、德胧舆情、竞品动态、行业预警 三大核心能力： 1. 外网信息采集（mi... | |
| 德胧P&L分析Skill 提供酒店项目P&L全方位分析，包括损益表、投资回报、多店对标、成本异常诊断及偏差校准等功能。 | |
| 德胧主动Agent框架 Transform AI agents from task-followers into proactive partners that anticipate needs and continuously improve. Now with WAL Protocol, Working Buffer, Autono... | |
| 德胧调研报告技能 Use when the user requests industry research reports, market analysis, business trend analysis, or professional research documents. This skill provides struc... | |
| 德胧调研报告技能v2 Use when the user requests industry research reports, market analysis, business trend analysis, or professional research documents. This skill provides struc... | |
| 德胧调研报告技能v3 Use when the user requests industry research reports, market analysis, business trend analysis, or professional research documents. This skill provides struc... | |
| 德胧思想领袖论坛v3.0 德胧思想领袖论坛 v3.0 · 顶级大佬模拟互动系统 三大核心功能： 1. 【讨论模式】多角色模拟辩论，输出结构化报告 2. 【意见模式】单大佬针对具体问题快速输出观点 3. 【参会模式】大佬实时参与会议，发表意见和提问 ⚠️ 法律合规声明：所有输出均明确标注【观点模拟：XXX人物名】， 仅代表基于公开资料的AI... | |
| 德胧通用商旅出行规划助手 通用商旅出行规划技能 v1.0 · 面向所有商务出差人士。 一站式AI出行规划 + 全平台酒店比价 + HTML报告生成。 集成12306 MCP（火车票实时查询）+ 高德地图（路径规划/POI/天气）+ Web搜索（航班/酒店价格）。 支持**实时HTML报告生成**，所有预订链接真实可一键跳转。 触发条件：... | |
| 德胧外网舆情采集工具 德胧AI龙虾军团外网信息舆情采集工具 v1.0。整合 miaoda-web-search（网页搜索摘要）+ AutoCLI（50+平台深度采集）+ 飞书卡片推送 + 定时自动化。 触发词：舆情、情报、网情、监控、搜索、行业动态、竞争对手动态、竞品分析、外网信息采集 使用场景： - 酒店行业舆情监控（华住/锦江/亚... | |
| 酒店采购价格监控 提供酒店餐饮农产品及电商全网实时价格对比，支持多数据源查询和成本参考分析。 | |
| AI大佬思想蒸馏框架 思想领袖论坛 v3.0 · 顶级大佬模拟互动系统 三大核心功能： 1. 【讨论模式】多角色模拟辩论，输出结构化报告 2. 【意见模式】单大佬针对具体问题快速输出观点 3. 【参会模式】大佬实时参与会议，发表意见和提问 ⚠️ 法律合规声明：所有输出均明确标注【观点模拟：XXX人物名】， 仅代表基于公开资料的AI推演... | |
| 通用商旅出行规划助手 通用商旅出行规划技能 v1.0 · 面向所有商务出差人士。 一站式AI出行规划 + 全平台酒店比价 + HTML报告生成。 集成12306 MCP（火车票实时查询）+ 高德地图（路径规划/POI/天气）+ Web搜索（航班/酒店价格）。 支持**实时HTML报告生成**，所有预订链接真实可一键跳转。 触发条件：... | |
| 酒店竞对调研openclaw助手 酒店竞争分析 SKILL - 自动搜索周边酒店，生成竞争分析报告 | |
| Apple Design Skill Guides AI assistants to generate frontend UI code with Apple's design tokens, typography, layouts, copywriting, and image curation for Apple-style web pages. | |
| Weather Radar Fetch and generate an image of the current weather radar combined with a base map. Use when the user wants to see a rain/weather radar map, current precipita... | |
| testaaa Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Acp Harness Delegation 通过 ACP runtime 委托 acpx-enabled harness（Claude Code / Codex 等）的标准协议。触发词：调用 Claude Code、通过 acp 调用、通过 acpx 调用、delegation to claude/codex、Coordinator 调用 Executor。 | |
| Acpx Coding Default Use direct acpx CLI via exec as the default coding execution path for Codex- and Claude-focused agents. | |
| Acpx Harness Routing Manage harness-related tasks by routing to Claude, Codex, or Gemini using ACPX with enforced approvals and non-interactive calls for one-shot or continuous w... | |
| Ao Op Use the locally installed source version of Agent Orchestrator (AO) at `/Users/ShiXin/Documents/Workspace/github-project/agent-orchestrator` through OpenClaw... | |
| Dashscope Imagegen Generate images using DashScope wan2.6-t2i model (通义万相). Use when user asks to generate/create images, illustrations, or visual content via DashScope/通义万相. R... | |
| Editorial Channel Strategy Load reusable publication-channel strategy for layout, packaging, and publication-fit decisions. Use when preparing final content for a specific publication... | |
| Editorial Chief Workflow Coordinate and manage editorial production by defining goals, loading audience/channel strategies, assigning specialists, enforcing quality, and delivering f... |
19,051–19,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.