Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| cognitive-enhancement-engine AI Agent cognitive enhancement engine with working memory, TF-IDF vector memory, planning, reasoning, reflection, and metacognitive monitoring. Zero external... | |
| health-reasoner Health Reasoner — 日常习惯健康小工具。基于生活习惯（睡眠/饮食/运动/压力/烟酒）输出评分与改善建议。纯规则驱动，纯 Python 标准库。不提供医疗诊断。 | |
| Judgment_Enhancement_Engine AI Agent judgment enhancement via Monte Carlo lookahead, risk-adjusted utility, and historical reflection. Use when an agent needs to evaluate multi-step act... | |
| QuickRecall - Zero-Dependency Memory Engine. 常用记忆优先出现。零依赖 AI 记忆引擎，纯 Node.js。/ Prioritizes frequently used memories. Zero deps. Persistent memory engine for AI agents with semantic recall, hotness prioritization, importance weighting, time decay, and auto-compaction. Zero external dep... | |
| Paper Card Analyzer Analyze `paper-parse` outputs and generate a research-oriented paper card directly in natural language. Use this skill after paper parsing when you need a st... | |
| Paper Parse Parse academic PDF papers into markdown with figure extraction. | |
| Xhs Post Factory 小红书多输入内容生成技能。用于将 pdf/md/txt/json 等文件转为结构化的小红书博文。默认生成论文解读（paper-interpretation）类型，输出 xhs-post.md 与 xhs-post.json 到输入文件所在目录，并保留可扩展模板机制以支持后续更多博文类型。 | |
| 人生模拟器 | Life Sim 人生模拟器。用户说"如果当初"、"如果我没有"、"如果那时候"、"平行人生"、"人生模拟"、"假如"时触发。用户一句话描述一个曾经的选择，AI 模拟另一条路。紧扣真实时代背景，揣测用户真实性格和行为模式，聚焦核心问题，有戏剧性，有结局。 | |
| ts-prompt-optimizer 冬冬主人定制提示词优化器 - 完全个性化 多模型支持 智能路由集成 使用前缀 "ts:" 触发 | |
| Agent Coordinator Multi-agent coordination protocol — task distribution, result aggregation, and parallel execution across multiple AI agents. Distilled from Claude Code Team... | |
| 代码大师｜编程铁律 AI 写的代码一上生产就崩——不是它不会写，是没人给它立规矩。 代码大师把「写、审、测、重构」的标准炼成一条硬规矩，整合 80k★ agent-skills、23k★ claude-skills 等顶级技能集，让每一行 AI 代码都过验收。 触发词：写代码、修bug、代码审查、PR review、重构、设计评审、API设计、测试用例、spec 驱动开发。 | |
| dawn-memory-arch Three-layer storage + four mechanisms + P0-P3 truth hierarchy for long-term agent memory. MEMORY.md central index, memory/core/ structured facts, local vector DB semantic search. Engramory curation, WAL protocol, context management. Zero ex | |
| dawn-memory-arch Three-layer storage + four mechanisms + P0-P3 truth hierarchy for long-term agent memory. MEMORY.md central index, memory/core/ structured facts, local vector DB semantic search. Engramory curation, WAL protocol, context management. Zero ex | |
| 记忆系统｜让AI不再忘事 换个会话，AI 就把你忘了？曙光记忆系统给它装上长期记忆：长短期记忆 + 主动代理 + 向量检索 + 对话压缩，跨会话回忆、自动归档、越用越懂你。触发词：长期记忆、跨会话记忆、记忆管理、向量检索、主动代理、对话压缩、自我进化。 | |
| 办公文档全栈 Word、PPT、Excel、PDF 来回切换、格式全乱？一个技能全包：文档生成、表格公式、PPT 设计、PDF 提取合并转换。触发词：写Word、做PPT、Excel表格、PDF处理、文档排版、Office自动化。 | |
| Dawn Proactive Agent v1.5 Dawn Agent v1.5 self-evolution proactive architecture. P0-P4 framework for autonomous ETF trading agent with self-reflection, state machine, audit trail, mul... | |
| 搜索抓取全栈 搜不到、页面抓不动、信息还要一家家核？实时搜索 + JS 渲染页面抓取 + 多引擎交叉验证 + AI 资讯，一次配齐。触发词：联网搜索、网页抓取、信息采集、研究调研、AI资讯、热点。 | |
| 双策略A股选股器 基于仙人指路B和老鸭头B两策略，筛选符合多条件的A股股票，支持指定日期选股及信号检测。 | |
| Exec Guard Intelligent command permission classifier — detect dangerous shell commands before execution. Distilled from Claude Code bashClassifier + yoloClassifier. | |
| Feature Flags Remote feature flag / toggle system for AI agents — enable/disable features without redeploy. Distilled from Claude Code GrowthBook integration. | |
| Grok Build xAI's Grok Build: terminal AI coding agent CLI/TUI - install, build, configure, use | |
| 选股神器｜一句话选A股 选股靠感觉，一买就套？一句话说清你要什么——「低估值、主力流入、均线多头」——它从全市场把票筛出来。行情、技术形态、财务、行业概念，多条件随意组合。当用户询问行情、财务、技术指标、行业概念等 A 股股票筛选相关问题时，必须使用此技能。 | |
| 板块雷达｜一句话选板块 不知道该买哪个板块？用行业估值、资金流向、涨跌幅、板块类型几句话框住，它把符合条件的板块直接列出来。当用户询问板块筛选问题时，必须使用此技能。 | |
| kimi-k3-subagent Kimi K3子Agent架构 - 两阶段批量调度、生命周期管理、限流策略。借鉴MoonshotAI/kimi-code源码，提供Python实现 | |
| llm-behavior-distill 开源大模型行为蒸馏技能 - 将DeepSeek/Qwen/ChatGLM/Yi/MiniMax/Kimi/Llama/Mistral/Gemma/Phi等15个模型的核心理念蒸馏为可复用智能体行为模块 | |
| manju-script-generator 漫剧工业化生产全流程工具 v5.1 — 三板分离法｜七要素镜头语言｜风格顾问系统｜故事板图像生成｜镜头控制模块库｜去AI味提示词框架｜工业级素材管理 | |
| opensource-llm-models 开源大模型综合技能 - 覆盖国内外主流开源LLM的选型、部署、调优、API调用。国产: DeepSeek/Qwen/ChatGLM/Yi/MiniMax/Baichuan/Kimi。国际: Llama/Mistral/Gemma/Phi/Falcon/Granite/DBRX | |
| 曙光记忆系统 曙光智能记忆系统 v4.0 - 五层金字塔架构 (HOT→DAILY→WEEKLY→CORE→ARCHIVE)。 支持 Weibull 衰减、混合检索、WAL 协议、自我改进治理。 当用户需要持久记忆、跨会话回忆、自动归档时触发。 | |
| Snip Compressor Semantic conversation compressor — intelligently summarize long chat history while preserving key decisions, facts, and context. | |
| Speculative Exec Speculative execution engine — predict and pre-load context the agent is likely to need next. Distilled from Claude Code speculation module. | |
| WeChat Messenger Send WeChat messages via direct Win32 API. ~2s per message. | |
| Yyds.Auto Control Android devices via MCP — tap, swipe, OCR, screenshot, UI automation, shell, file management, and AI agent orchestration for Android RPA. | |
| gemini-file Gemini CLI for one-shot Q&A, summaries, and generation. | |
| Comulytic Query Comulytic meetings, contacts, action items, and conversation history. Use when: user asks about meetings, notes, call summaries, contacts, pending task... | |
| 论文阅读助手 论文阅读报告生成器，从PDF提取结构化内容并生成全中文阅读报告。触发关键词：/readpaper、论文阅读、论文分析、PDF分析 | |
| SciProjDesigner Use this skill for ANY task involving Computer-Aided Drug Design (CADD), computational chemistry, structural bioinformatics, molecular modeling, or AI-driven... | |
| A 股市场日报 获取 A 股市场日报，包括大盘指数、热门板块和龙头股。使用东方财富 API，无需 API Key。 | |
| A Stock Market Review A 股市场收盘复盘工具，总结当日大盘指数、热门板块、龙头股及创新高股票。使用东方财富 API，无需 API Key。 | |
| A Stock Premarket Briefing A 股盘前简报技能，交易日开盘前分析市场新闻、宏观事件，生成投资参考报告。整合 multi-search-engine 和 summarize，无需 API Key。 | |
| 大乐透开奖查询 提供中国体育彩票大乐透官方开奖信息，支持查询开奖号码、中奖规则及指定期号详情。 | |
| Eastmoney Trading 东方财富证券交易技能，支持自动登录、持仓查询、持仓分析、条件选股、买入、卖出、撤单、委托查询、资金查询等完整交易功能。使用 CDP 连接浏览器，支持验证码自动识别。⚠️ 高风险操作，需谨慎使用。 | |
| 双色球开奖查询 查询最新或指定期双色球开奖结果及中奖号码，优先官方数据源，含中奖规则说明和奖池信息。 | |
| 科技资讯日报 获取今日最热门的科技资讯，特别是 AI 大模型领域的最新动态。支持多数据源自动切换（Tavily API→科技网站直连），适合每日科技简报、行业资讯收集、AI 领域跟踪等场景。 | |
| Weather Plus Cn 查询中国城市天气信息，提供温度、天气状况及穿衣和生活指数建议，数据来源中国天气网。 | |
| 微信公众号文章爬虫 微信公众号文章爬虫 - 将微信公号文章转换为 Markdown + 本地图片 | |
| pet-food-compare 用于公正、中立地对比线上在售的狗粮、猫粮产品信息。当用户正在挑选、对比、纠结于几款狗粮或猫粮，给出产品名、商品链接或包装图，希望查证成分、价格、产地、营养指标、代工厂等信息，或希望生成对比表时，必须使用本 skill。典型触发场景包括"帮我看看这两款猫粮"、"XX 和 YY 比怎么样"、"这几个狗粮给我对比一下"、"我发了几个链接，你帮我查一下"。本 skill 只做中立信息收集、归纳与对比，绝不替用户做推荐决策。 | |
| Pet Food Compare 用于公正、中立地对比线上在售的狗粮、猫粮产品信息。当用户正在挑选、对比、纠结于几款狗粮或猫粮，给出产品名、商品链接或包装图，希望查证成分、价格、产地、营养指标、代工厂等信息，或希望生成对比表时，必须使用本 skill。典型触发场景包括"帮我看看这两款猫粮"、"XX 和 YY 比怎么样"、"这几个狗粮给我对比一下"... | |
| aesthetic-copilot Use when the user wants to generate high-fidelity PROMPTS for Text-to-Image models (Flux, Ideogram, Midjourney) based on vague layout/content descriptions. | |
| daily-decision-making 一个结构化的个人决策数据库系统，帮助用户系统性地处理生活与职业中的复杂抉择。 当用户面临以下情况时使用此技能： (1) 遇到"我该怎么办""帮我做个决定""我在 X 和 Y 之间纠结"等表述； (2) 涉及职业（跳槽/转行）、生活方式（搬家）、重大消费（买房/买车）或人际关系的决策； (3) 需要系统性地权衡利弊... | |
| Dining Dining OS v2.1——硬核膳食决策引擎。当用户面临"今天吃什么/做什么饭/点什么外卖"的决策困境时立即触发。覆盖场景：为1-N人规划下厨/堂食/外卖菜单、家庭/商务/同学聚餐方案设计、减脂增肌健身餐规划、厨艺展示选菜、露营/火锅/全素等特殊场景。核心能力：约束满足优化（忌口/过敏/健康红线）、快速盲选与... |
19,501–19,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.