Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| Spring Boot 2 To 3 Migrate Spring Boot 2.7.x applications to Spring Boot 3.x with a recipe-first OpenRewrite workflow, then complete manual compatibility fixes and verification... | |
| Wakapi Query Wakapi coding stats (summaries, projects, today status, totals) via a small Python CLI. Requires WAKAPI_URL. WAKAPI_API_KEY is HTTP Basic (Authorization Basi... | |
| WakaTime Query WakaTime coding statistics including time ranges, projects, languages, categories, editors, and machines. Use when the user asks about WakaTime, coding... | |
| CLI-Anything for OpenClaw Use when the user wants OpenClaw to build, refine, test, or validate a CLI-Anything harness for a GUI application or source repository. Adapts the CLI-Anythi... | |
| cli-anything Use when the user wants OpenClaw to build, refine, test, or validate a CLI-Anything harness for a GUI application or source repository. Adapts the CLI-Anythi... | |
| Media Inspector 本地音视频文件分析工具。支持扫描媒体文件、提取元数据、语音转文字（Whisper）、生成摘要和关键片段。支持 MP4/MOV/MKV/MP3/WAV/M4A/FLAC 等格式。 | |
| opencli Universal CLI for browser automation and website command-line access, supporting commands for Bilibili, Twitter, Reddit, GitHub, and more with automation fea... | |
| Playwright Cli Playwright CLI 自动化工具 - 浏览器自动化测试和网页交互。通过 CLI 命令控制浏览器、截图、填表、点击、执行代码等操作。支持多浏览器、会话管理、网络拦截、视频录制等功能。 | |
| Skill Security Audit Audit installed skills for risky execution, data access, exfiltration, and overscoped triggers | |
| home-insurance-advisor 家财险专业顾问技能。当用户提到家庭财产保险、家财险、房屋保险、财产保障、家庭风险、房屋风险评估、保险推荐等相关话题时，必须激活此技能。即使用户只是模糊表达"想买保险保护房子/家"、"家里有贵重物品怎么保"、"担心漏水/火灾/盗窃"等，也应主动使用此技能。此技能将引导对话系统性采集用户信息，识别家财风险等级，推荐匹... | |
| App Legal Pages Generate and deploy app Privacy Policy and Terms of Service static websites from an app feature document. Use when a user provides app requirements/feature d... | |
| Flutter AppStore Doc UI Kit Generate a complete App Store deliverable pack for a Flutter 3.35.1 app with offline-first design, camera/photo permissions, Apple-style UI mockups, and a sq... | |
| Legal Site Generator Generate a compliant legal website with Privacy Policy, Terms, support, and data deletion pages, ready for Cloudflare Pages deployment. | |
| maple-structured-storage 结构化知识归档、索引、检索与反思补全。将周报、笔记、知识文档自动拆解为标准化主题目录结构，维护全量索引，支持快速检索与信息缺失追问。TRIGGER: 归档/存储/记录/保存周报笔记文档, 追加更新知识, 索引生成刷新更新, 结构化检索读取查询, 反思补充补全缺失信息, 结构化记忆, 结构化存储, 结构化总结, k... | |
| maple-video2article 从视频生成图文并排的文章（md格式）。支持本地视频文件或在线视频URL（自动下载），自动完成文本提取、视频帧截取、时间轴匹配、文章撰写全流程。 | |
| video2imgs-视频关键帧获取 Capture key frames from video files at fixed time intervals. Use when you need to understand video content by extracting screenshots, or when you need to ana... | |
| video2txt-视频理解字幕提取 将本地视频或音频文件转写为 SRT 字幕文件和 TXT 纯文本文件 | |
| marcus-investment-analyst Marcus 投资分析技能 - 基于缠论+MACD+RSI 的 A 股投资策略。用于股票分析、回测、投资建议。触发词：分析股票、回测策略、投资建议、Marcus 策略。 | |
| Likes Training Planner Complete training plan solution for My Likes platform. Fetches historical data, analyzes training patterns, generates personalized plans, converts to Likes f... | |
| Nano Banana Pro Custom Generate or edit images using OpenAI-compatible API. Supports multi-image input, fine-tuned models, and multiple configuration sources (env vars, openclaw.js... | |
| Medical Materials Figure Skill 为医学材料、组织工程、骨修复、血管生成、支架机制图等论文配图生成稳定的分镜结构、风格约束与高质量提示词。Use when the user asks for biomaterials figures, scaffold schematics, bone regeneration, defect repair, a... | |
| Skill Maker (ChenXi) 用于根据对话记忆提炼可复用工作流并生成高质量 SKILL.md，适用于“从聊天沉淀方法论”“把一次性操作升级为可复用技能”场景。 | |
| pm-chen Production-grade product development workflow for Chen. Triggered when the user describes a feature, product idea, or asks to build a prototype, write a PRD, define architecture, or prepare a dev handoff package. Converts natural language r | |
| Prompt Polisher Rewrite rough goals, scattered notes, or vague requests into clear, actionable prompts with explicit objective, constraints, output format, and missing assum... | |
| AntV S2 海量数据表格指南 AntV S2 表格渲染千万级数据，支持透视、明细表、多维分析，提供性能优化和Vue3集成方案。 | |
| Canvas大规模渲染优化 优化Canvas大量元素渲染，采用三层管线、空间哈希裁剪、LOD分层与帧调度提升FPS与交互流畅度。 | |
| 前端性能审计清单 提供网页性能诊断流程和优化建议，涵盖Core Web Vitals、资源加载、代码分割、图片懒加载与缓存策略。 | |
| Vue3 Composition API 助手 提供Vue3 Composition API的速查与示例，涵盖响应式用法、VueUse函数、组件通信及性能优化技巧，代码默认使用<script setup>+TS。 | |
| WebGL性能调试速查 快速定位WebGL渲染性能瓶颈，提供Chrome DevTools分析、纹理压缩、Draw Calls优化、shader与内存泄漏排查方法。 | |
| Avengers Assemble Avengers-themed multi-agent coordination system. Nick Fury orchestrates 6 specialized heroes (Captain America, Iron Man, Hulk, Black Widow, Hawkeye, Thor) th... | |
| Avengers Assemble CN 复仇者联盟主题多Agent协作系统（中文版）。尼克·弗瑞调度6位超级英雄通过sessions_spawn委派任务。融入中国漫威粉丝梗文化，轮询调度、先回复再派遣、sessionKey复用。适合需要多元专业能力的复杂任务协作。 | |
| TeamWork Dynamically creates and manages AI agent teams for complex tasks. Invoke when user requests multi-agent collaboration, complex project execution, or when tasks require specialized roles and coordinated workflow. | |
| Myip Get both public (external) and local (internal) IP addresses using simple shell commands. Use when the user asks for their IP, public IP, or local network ad... | |
| AI Rebirth AI Rebirth - Load conversation history from a previous CodeBuddy session into the current session. Use when the user wants to resume, reference, or continue... | |
| Murasame Feishu Voice Feishu 语音气泡技能：使用丛雨（Murasame）语音包发送语音；若可表达则按标签发送语音并同步发送中文文本；支持开关控制、标签映射与关键词回退。 | |
| Qqmusic Control Control QQ Music play/pause/next/prev via system media keys (AutoHotkey) on Windows. No window focus required. | |
| Wechat Qwen Reply WeChat chat reader + auto-reply (Qwen-VL vision + AHK send). Supports fast/slow capture, group nickname labels, file/red-packet cards, and filtering system m... | |
| Regex Playground Learn, test, and debug regular expressions with real-time matching, explanations, and common patterns. Perfect for developers learning regex or debugging com... | |
| Webhook Debugger Test, debug, and inspect webhooks locally. Receive webhooks, inspect payloads, debug integrations, and replay requests. Essential for API development and thi... | |
| aggressive_growth_strategy 激进成长选股与交易分析执行框架——将"周期性成长"方法论转化为可操作的选股筛选、个股深度分析和市场季节判断工具。 当用户需要：按七标准筛选小盘成长股、对个股进行八步体系化分析（赛道→市值→成长→位置→指数→排除→建仓→卖出）、 判断当前市场季节（春夏秋冬）与仓位策略、制定"小偷式"建仓与倒金字塔卖出计划时，加载此技能。 与 aggressive-growth-investing 技能的关系：后者是"心法"（理论体系），本技能是"剑法"（执行工具）。 核心数据源：四层降级架构（ | |
| A股财报结构化拆解系统 A股上市公司财报结构化拆解系统。基于16节固定模板，对季报/年报进行一手数据提取、自算核验、跨季度可比的结构化分析。数据源优先级与racing-quant-ai一致（Tushare > akshare > baostock > 东方财富API）。触发词：财报拆解，财报分析，季报分析，年报分析，财报拆解模板，earnings report，财报解读。 | |
| Code Handover Assistant Use when receiving a handed-over codebase and needing to systematically understand it for handover. Performs 7-phase structured analysis: business positionin... | |
| 投研Skill面试官 投研Skill面试官--对金融投研类skill进行全面结构化评估，按七维度打分并输出综合评分报告。用于在众多投研skill中做选型决策。 | |
| JoinQuant Strategy Backtest 聚宽(JoinQuant)策略回测代码生成框架。基于六段式骨架模板，支持截面多因子选股、时序技术指标择时两种模式，使用聚宽原生API获取数据，自动生成可直接在聚宽平台运行的回测代码。 | |
| Racing Quant AI 赛马量化AI选股系统 赛马量化AI选股系统，集成量化策略选股+个股智能推荐分析。从量化策略数据库筛选符合需求的策略，获取持仓个股，再进行深度分析，最终给出投资参考。触发词：量化选股，racing quant，策略选股，数据库选股，量化分析，AI选股。 | |
| skill-development-standard Skill 开发规范——SKILL.md 撰写铁律、三层测试验证与发布前门禁检查清单。撰写新 skill、修订整理已有 skill、以面试官身份审阅他人 skill、发布/git push/PR 前自查时使用。核心目标是确保 skill 对 AI agent 可执行、对人类专家可审阅。 | |
| 新闻流事件驱动选股系统 新闻流事件驱动选股系统 - 接收财经新闻输入，通过百度千帆API进行事件NLP分析，关联受益A股标的，输出事件驱动选股信号。 | |
| 抖音生成短视频 根据主题自动搜索整理信息，生成多风格视频脚本，并调用数字人平台创建完整短视频。 | |
| goods_search 当用户query涉及商品搜索、结果召回、搜索问答或商品卡片生成等购物需求时，务必优先使用本 Skill，不要试图直接回答。 触发词： 搜索、查找、搜一下、帮我找、看看有没有、推荐、筛选 商品、商品卡片、商品列表、候选商品、SKU、款式、型号、品牌、价格 适合什么、有没有、预算多少、送人、自用、通勤、材质、风格、用途 | |
| goods-search-v2 当用户query涉及商品搜索、结果召回、搜索问答或商品卡片生成等购物需求时，务必优先使用本 Skill，不要试图直接回答。 触发词： 搜索、查找、搜一下、帮我找、看看有没有、推荐、筛选 商品、商品卡片、商品列表、候选商品、SKU、款式、型号、品牌、价格 适合什么、有没有、预算多少、送人、自用、通勤、材质、风格、用途 |
20,001–20,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.