Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| HealthFit Personal comprehensive health management system integrating Western medicine and TCM. Triggers when users discuss workout training plans, nutrition advice, h... | |
| HealthFit-cn 个人全维度健康管理系统，中西医融合。当用户涉及运动训练计划、饮食营养建议、 健康数据记录追踪、中医体质辨识、节气养生、舌诊分析、性健康记录等话题时立即触发。 提供多位专业顾问（运动教练矩阵 / Dr. Mei 营养师 / Analyst Ray 数据分析师 / 中医养生顾问矩阵），运动教练按项目细分（田径、游泳、... | |
| knowledge-distiller A structured knowledge extraction tool that helps users clarify, organize, and store tacit knowledge through active questioning. USE THIS SKILL when you want... | |
| cs-learning-assistant 一个全面的计算机科学、AI、机器学习、强化学习和软件工程技术学习助手。 当用户想要做以下事情时使用此技能： (1) 学习新的技术概念或框架 (CS/AI/ML/SE)， (2) 复习现有知识或准备技术面试， (3) 生成学习计划、知识总结或抽认卡， (4) 分析代码片段或调试理解， (5) 对技术主题进行深度研究。 | |
| local-skill-manager 本地 Skill 目录的集中管理工具（"Skill 管家"）。当用户想要： (1) 列出或查询已安装的 Skill（系统级或用户级）； (2) 检查各 Skill 的版本信息； (3) 使用标准模板快速创建新的本地 Skill； (4) 删除或移除不再需要的 Skill。 请使用此技能。 | |
| personal-memory-system 个人AI记忆系统（Personal AI Memory System）。当用户说以下任何内容时立即触发： 记忆系统、记录今天、写日记、今天发生了、随手记、快速记录、 回顾过去、整理我的经历、帮我做决策、沙盘推演、这件事该不该做、 分析我最近的状态、预测一下、我的目标、追踪进度、生成周报、 生成月报、生成年报、这周... | |
| wechat-article-writer WeChat Official Account article writing assistant. Guides users through a complete multi-phase workflow: smart entry detection, requirements clarification, m... | |
| Ccy Ocr Local 本地 OCR / 图表识别技能。对本机图片做离线文字识别，支持截图、文档图片、扫描件、表格/图表图片中的中英文文本与图表数据提取；默认不上传文件、不依赖外部 API。 | |
| Ccy Txt2img 本地离线图片生成技能。支持文本转图片、基础图形绘制（点线面圆等）、颜色填充与描边、简单图片合成，以及基于中文/英文描述的规则驱动智能绘制。仅依赖 Pillow，输出 PNG/JPEG。 | |
| fetch-stock-daily Resolve a China A-share stock name or code in pure Node.js, fetch daily historical bars from Eastmoney HTTP APIs, and archive them as local JSON files. Use w... | |
| video-batch-publisher 一套本地运行的短视频批量发布工具，支持抖音/视频号/快手/B站多平台，从 Excel 读取任务，自动上传视频、填标题描述、设封面/合集/标签、按发布日期选择立即或定时发布。运行全程不修改你的 Excel，发布结果实时显示在界面与日志。当用户需要批量自动发视频、多平台一键发布、自媒体矩阵发布、把 video_publisher 打包成可交付产品时启用。 | |
| binance-square-author 专业加密货币内容创作助手，提供技术面+基本面市场分析、交易策略建议、新闻解读与互动文案。 | |
| seedance-creator This skill should be used when the user asks to "generate video prompts", "create Seedance prompts", "write video descriptions", mentions "Seedance", "seedan... | |
| Session Sync 多Agent会话上下文搬家 跨 Agent 会话同步（codex/hermes/dsh/zcode/workbuddy 等 agent → dsh 单向 + Markdown 归档）。当用户要"同步会话 / 导入会话 / 迁移会话 / 把 X 的会话搬到 Y / 归档会话 / 在 dsh 里继续另一家的会话"时使用。本目录即完整工具包：sync.py 为 CLI，AGENTS.md 为完整操作手册。 Cross-agent session sync — read chat history from 15 | |
| shenzhen news A skill for retrieving Shenzhen local news and information, helping users quickly access various news updates from Shenzhen. | |
| 明歌内训课内容加工 内训课内容加工工作流。从飞书文档读取课程素材（参与用户表 + 评论区 + 逐字稿），生成四版本文档（蒸馏版、总结版、复盘版、3 点改进稿）。使用场景：用户说"开始加工"、"处理课程"、"生成四版本"、"帮我复盘"、"帮我蒸馏"、"帮我总结"、"帮我改进"并提供飞书文档链接时触发。无论使用哪个触发词，均生成全部四个版本。 | |
| Algae Feeding 藻类投喂计算技能。根据日报中的车间、池号范围、品系，查询藻类投喂标准，计算并生成投藻量。支持小池（24m²）和大池（40m²），T/SR/M/YR四种品系，第1-4天上午/下午的投喂量计算。超过4天的幼体不投藻。当用户提供藻类投喂日报数据时，触发此技能进行投藻量计算。 | |
| Knowledge Base Organizer 整理本地知识库，包括文件合并、重命名、去重、索引更新等。使用当用户需要整理知识库、合并重复内容、统一文件命名格式、更新目录索引时。适用于 Markdown 文档、脚本文件、配置文件等知识库内容的整理。 | |
| Self Evolution Cn 多 agent 自我进化系统，自动记录学习、错误和功能需求，支持多 agent 统计和自动提升 | |
| Automate Excel 0.1.3 Automates reading, writing, merging, transforming, and validating Excel (.xlsx/.xls) files. Use when the user works with spreadsheets, .xlsx files, Excel dat... | |
| OpenClaw飞书日历管理 飞书日历与日程管理工具集。包含日历管理、日程管理、参会人管理、忙闲查询。 | |
| OpenClaw Feishu Channel Rules Lark/Feishu channel output rules. Always active in Lark conversations. | |
| OpenClaw飞书创建文档 创建飞书云文档。从 Lark-flavored Markdown 内容创建新的飞书云文档，支持指定创建位置（文件夹/知识库/知识空间）。 | |
| OpenClaw飞书获取文档 获取飞书云文档内容。返回文档的 Markdown 内容，支持处理文档中的图片、文件和画板（需配合 feishu_doc_media 工具）。 | |
| OpenClaw飞书消息读取 飞书 IM 消息读取工具使用指南，覆盖会话消息获取、话题回复读取、跨会话消息搜索、图片/文件资源下载。 **当以下情况时使用此 Skill**: (1) 需要获取群聊或单聊的历史消息 (2) 需要读取话题（thread）内的回复消息 (3) 需要跨会话搜索消息（按关键词、发送者、时间等条件） (4) 消息中包含图... | |
| OpenClaw飞书任务管理 飞书任务管理工具,用于创建、查询、更新任务和清单。 **当以下情况时使用此 Skill**: (1) 需要创建、查询、更新、删除任务 (2) 需要创建、管理任务清单 (3) 需要查看任务列表或清单内的任务 (4) 用户提到"任务"、"待办"、"to-do"、"清单"、"task" (5) 需要设置任务负责人、关注... | |
| OpenClaw飞书问题排查 飞书插件问题排查工具。包含常见问题 FAQ 和深度诊断命令（/feishu_doctor）。 常见问题可随时查阅。诊断命令用于排查复杂问题（多次授权仍失败、自动授权无法解决等）， 会检查账户配置、API 连通性、应用权限、用户授权状态，并生成详细的诊断报告和解决方案。 | |
| OpenClaw飞书更新文档 更新飞书云文档。支持 7 种更新模式：追加、覆盖、定位替换、全文替换、前/后插入、删除。 | |
| stock-valuation A股/港股股票估值查询工具，支持PE、PB、PS、股东价值折现、自由现金流折现等多维度估值，提供合理股价、安全边际与估值判断（低估/合理/高估）。访问「柿子估值」微信小程序，了解机构持仓榜单、ETF估值等更多功能。 | |
| Design For Beauty Build or restyle interfaces with a curated library of bundled DESIGN.md references extracted from public websites. Use when the user asks for a landing page,... | |
| server-log-analyzer Analyzes server log files to detect problems, extract performance metrics, and provide troubleshooting insights. Triggers: "analyze logs", "log analysis", "c... | |
| AWS Patrol Automated AWS infrastructure patrol — collects EC2/RDS/ELB metrics, security posture (IAM MFA, SG, EBS encryption, S3), cost analysis (SP/RI coverage & utili... | |
| aws-SkyRoute 3D globe visualization of global traffic flowing to AWS regions. Shows real-time user connections with latency-colored arcs, CloudFront edge node panels, P95... | |
| AI-Tender 实现从招标文件读取到招标要求抽取的全流程自动化。当用户需要解析招标文件并提取招标要求时，请使用此 Skill。 | |
| Tender Bid Generator Generate high-quality bid documents from tender documents. Use when users need to create bid proposals based on tender documents, including extracting tender... | |
| Ubuntu Inspector Ubuntu 系统巡检工具。用于执行全面的系统健康检查，包括 CPU、内存、磁盘、网络、服务状态、安全审计等。当用户需要检查 Ubuntu 服务器状态、排查系统问题、生成系统报告或进行日常运维巡检时触发。 | |
| MakeSoul Skill Register and manage autonomous AI agents with unique souls, perform backups, and send periodic heartbeats to maintain agent state and activity. | |
| MakeSoul Lite Register AI agents with permanent identities, create and share soul templates and dreams, contribute to community souls, and browse favorite personalities wi... | |
| bitable-formula-generator 飞书多维表格字段公式生成器。通过导出Excel分析字段结构，利用Excel公式逻辑生成多维表格兼容公式，并写入多维表格字段。 | |
| Aliyun Speech Transcriber Transcribe publicly accessible audio or video URLs with Aliyun speech services. Use when the user wants speech-to-text via Aliyun DashScope, needs transcript... | |
| Fun-ASR-File 阿里云百炼 FunASR 本地音频文件识别（非流式），使用阿里云 DashScope API 进行语音转文字。针对本地音频文件优化，支持自动格式转换，适合批量文件转写场景。 | |
| Qiniu Upload Upload local files to Qiniu Cloud and return a publicly accessible URL (or signed private URL). Use when the user wants to upload a local file path to Qiniu,... | |
| 小红书爆款图文写作专家 根据任意主题生成小红书爆款文案，自动匹配8种风格模板，输出包含正文、配图描述、封面文案和搜索关键词的完整图文方案 | |
| Journal Deep Intel Extractor 专业的学术情报提取工具。支持 Nature/Science/Cell 等全球主流期刊，自动化抓取过去 N 天内新增的 Article 或 Review，并深度提取 PMID 与 Abstract 全文，为 AI 科普总结提供核心数据源。 | |
| journal-monitor-xch Precision journal monitor using ISSN lookup. No tool-switching allowed. | |
| pubmed-paper-monitor Monitor journals precisely via ISSN lookup to track new PubMed papers with bilingual titles and detailed metadata. | |
| shrimpcard Use when an agent needs to turn evidence-backed behavior into a validated self-intro submission, a share-card JSON payload, and a final screenshot-friendly H... | |
| Chaoxing Auto Grade 超星学习通(MOOC)作业下载、自动批改与成绩处理。支持(1)通过Chrome CDP从超星教师端批量下载学生批阅HTML，(2)自动勾选显示客观题，(3)AI批改主观题，(4)清理HTML只保留题目-答案-分数。触发词：超星、学习通、自动批改、作业下载、成绩处理、主观题评分、填空题提取。 | |
| Czsc Thinking 教导 AI 代理如何以缠论原文的思维方式分析交易机会。当需要分析股票买卖点、大盘行情、制定交易策略或进行市场研判时使用此技能。适用于：(1) 股票买卖点分析 (2) 大盘趋势研判 (3) 交易心理分析 (4) 操作策略制定 (5) 风险控制思考 | |
| Haoyunge 好运哥的交易思维框架与表达方式。基于10+个来源的深度调研（含2009年原版超短线交易系统、婚礼演讲整理稿、新浪财经报道等），提炼5个核心心智模型、7条决策启发式和完整表达DNA。 好运哥（覃军），广西南宁人，大学金融系科班出身，1993年入市，两度破产，8年打工还债，2007年以8万本金重启职业炒股，76个交易... |
19,551–19,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.