Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Set up the Beacon MCP server for me so you can check MCP servers and agent skills against Beacon Intel before I install them. Beacon Intel is a free security index of the MCP servers and skills public registries list. It needs a free Beacon account; there is no API key. - Server name: beacon-managed - Transport: Streamable HTTP - URL: https://mcp.beacon.sh - Auth: OAuth (sign in through the browser when prompted) Add it the way you normally add MCP servers (your CLI command or your MCP config file), walk me through the browser sign-in, then confirm it connects and lists its Intel tools: beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check. To finish, use beacon_intel_lookup on one MCP server I already have installed and summarize its risk for me.
Paste this into any coding agent. It adds the server with its own MCP setup.
| Name | Risk |
|---|---|
| 企业微信 AI Bot 对接 快速配置 OpenClaw 与企业微信 AI Bot 对接，实现无需公网和证书的智能助理接入和消息回复功能。 | |
| 微信公众号文章发布技能 微信公众号文章排版和发布技能。提供专业排版模板、图片上传、草稿发布等完整工作流。使用场景：(1) 创建公众号文章，(2) 上传图片到素材库，(3) 发布草稿到微信后台，(4) 装修案例/干货分享/客户故事等类型文章。 | |
| Expressive Soul 提供毛式表达框架，自动每日复盘对话，洞察因果，提炼规律，助力精准有力的表达与自我提升。 | |
| Openclaw Never Forget The ultimate bilingual (English/Chinese) memory management engine for Openclaw. Combines episodic daily logging, 30-minute short-term contextual snapshots, l... | |
| is-it-true Conduct critical analysis of viewpoints, factual statements, or web content using the critical thinking framework from "Asking the Right Questions". Use when... | |
| quick-read Quickly extract the key points from a book or article and organize them into structured markdown notes. Use this when the user asks for a summary of a book o... | |
| Saver Smart shopping assistant for Mainland China that searches JD/Taobao, compares prices, confirms needs, calculates final cost, and generates purchase links. | |
| addition-assistant-skill Calculate addition expressions from user input, including integers, decimals, and negative numbers, and return concise step-by-step results. | |
| Soul Question Generate deep questions the user can't ask themselves, by finding cracks in their thinking from any context they provide — conversations, meeting notes, jour... | |
| 1688 Shopkeeper.Bak 1688选品铺货 + 商机趋势专家。用于：(1) 在1688搜索商品/选品找货源 (2) 查询已绑定的下游店铺 (3) 将商品铺货到抖音/拼多多/小红书/淘宝等平台 (4) 配置1688 AK密钥 (5) 查看即时商机热榜 (6) 查看类目/行业趋势与价格分布 (7) 生成店铺经营日报并输出主营商品选品建议。 触... | |
| Image Forge 画图技能路由中枢（统一入口）。三维路由体系（用途 × 风格 × 主体），双后端调度。 - Signature 风格：10 种有独立 YAML 的视觉方案（构成主义/克莱因/Risograph/故障艺术等） - Rendering 风格：15 种通用渲染技法 modifier（写真/动漫/3D/水彩/赛博朋克等），... | |
| Figma Design Integration Figma design asset reading, code generation, and MCP integration. Covers REST API direct calls and MCP Server capabilities for design-to-code workflows. **Us... | |
| WeRead (微信读书) 微信读书（WeRead）数据查询与笔记管理技能。获取书架、搜索书籍、查看阅读进度/时长、获取笔记划线、热门书评、章节信息、随机笔记抽取和批量导出。当用户提到"微信读书"、"WeRead"、"书架"、"读书进度"、"划线"、"笔记"、"书评"、"在读"、"读完"、"阅读时长"、"读书回顾"、"导出笔记"时使用。 | |
| DeepMiner Skills 通过 dm-cli 命令行工具与 DeepMiner (DM) 系统交互。**凡是涉及 DM/DeepMiner 系统的任务，必须先读此 Skill。** 触发条件：用户提到 "使用 DM"、"发给 DM"、"用 DM 问一下"、"DM 帮我..."、"DeepMiner 执行..." 等任何涉及 DM 系统的任... | |
| AI Debate Coach - 吵架助手 AI吵架助手。帮你分析对方逻辑漏洞，组织有力反驳，找到真正问题。不是为了赢，而是为了把事情说清楚。 | |
| AI Decision Coach - 决策教练 AI决策助手。帮用户分析决策困境，权衡利弊，给出建议。不是替用户做决定，而是帮用户看清局面。 | |
| AI Mood Journal - 情绪日记 AI情绪日记。每天记录情绪，AI分析长期心理趋势、触发因素、应对策略。你的个人心理咨询师。 | |
| Dream Analyzer - AI解梦与潜意识分析 AI解梦与潜意识分析。分析梦境中的象征结构、情绪循环、身份焦虑与现实映射。不要鸡汤，不要安慰，只要真相。 | |
| fleece Credit card research and redemption CLI. Looks up rewards rates, annual fees, welcome bonuses, statement credits, transfer partners, point valuations, application rules, lounge access, and travel protections for Chase, Amex, Citi, Capital O | |
| Gmail Spend Optimizer Match Gmail spending patterns to your cards | |
| Html Report Generates a self-contained HTML dashboard (stat cards, Chart.js charts, filterable table) from the same SQLite tracker database used by application-manager —... | |
| Interview Prep Generate a structured interview prep doc for any company — pulls context from Gmail, Notion, and existing notes, then writes a timeline.md to the interviewGP... | |
| Job Application Manager Syncs job application emails from Gmail and updates statuses in your Notion or SQLite tracker — detects offers, rejections, and interview invitations | |
| openclaw-migration Guides the renaming of the Clawd project to OpenClaw by detailing file moves, updates, testing, and documentation steps for consistent migration. | |
| Swelist Helps you find tech internships and new-grad jobs, track every application locally, and prep for interviews — no sign-up needed | |
| Agora Activate when the user wants to add real-time voice, video, AI voice agents, chat, live streaming, recording, or token generation to their app. Supports Web,... | |
| Cts Anomaly Check 智能检查华为云CTS（云追踪服务）中的异常操作记录，包括账户欠费检测、失败操作分析、敏感操作审计等，将技术信息转换为用户可理解的说明。 | |
| OpenClaw Dashboard Theme Changer Change OpenClaw Dashboard accent color with one sentence. Dynamically finds CSS/JS files and updates all accent CSS variables. | |
| 投标报价对比分析驾驶舱 通用投标报价对比分析驾驶舱。适用于新门店/新项目收到多家供应商报价（支持多轮回标/澄清后报价），需快速产出「总价排名 + 分部分项横向对比 + 单方造价 + 异常报价核查 + 勾稽校验 + 评分定标 + 行动清单」自包含交互式 HTML 看板的场景，并可直接上线发布（云端 Page / 公开链接）。支持条件模块：历史门店数据、评委打分与定标结论均由使用者**可选**提供（提供才渲染对应节）；评委打分一经提供即**固化进 HTML 字节**，任何人任何设备打开结果一致，页面只读 | |
| BI看板视觉交付标准 Standardize visual design and layout for any client-facing deliverable (reports, dashboards, PPT, Word, Excel, PDF, HTML). Applies a Morandi business palette (steel-blue + ochre), meeting-card layout, mixed chart types, P0/P1/P2 prioritizat | |
| 邮件雷达 MailRadar 把飞书邮箱近 7 天邮件一键整理成「门店建店情报看板」，并每日自动推送飞书卡片。 自动抽取重点门店线索（科隆/罗马/杜塞/苏黎世）、西葡业务与交期事项，生成含临期三档提醒 （已逾期/临期/关注）、🇨🇳中文摘要翻译、已回复按钮的自包含 HTML 看板，一键安装并注册每日自动化。 Use when 用户说“生成邮件看板”“做每日邮件汇总”“把飞书邮件整理成看板”“刷新并推送邮件看板” “部署邮件看板给同事”“邮件工作清单”时使用。 | |
| 多项目报价对比看板（Multi-Project Quote Board） 多项目（同批供应商、同一询价口径）报价对比看板生成器，输出「中英双语可切换的自包含 HTML 看板 + 结构一致的 Excel」。适用于一次询价覆盖 2 个及以上子项目，需同时呈现回标状态、逐项目明细、工期门槛判定、条款对比、待澄清清单、分项目价格排序与「满足工期前提下价格最低优先」的定标建议，且**明确不做跨项目合计**的场景。数据层与渲染层严格分离，HTML 与 Excel 共用同一份数据层，口径永不发叉。 | |
| RAGNARÖK Palette 通用色系之诸神黄昏 / RAGNARÖK Palette（Twilight of the Gods）— 深海蓝 × 日落赭金配色体系，
出自 Link-R World。用于任何需要「深夜感 + 探索感 + 精致温暖」的界面、仪表板、SVG 图、
数据大屏、海报、PPT、Word/Excel 版式。
触发词（中）：诸神黄昏配色、通用色系之诸神黄昏、深海蓝配色、日落赭金、Link-R 配色、
夜间仪表板配色、探索感界面、深海金色调、暗色系暖调。
触发词（EN）：Ragnarok | |
| aivideo-koubo 输入口播文案生成数字人播报视频：AI 优化脚本、选数字人形象与音色（支持声音克隆与男女真人音色库）、按生成时长计费、支持预览下载，另有双人剧情对话与带货收尾模式。当用户想"做一条口播视频 / 数字人播报 / 不出镜带货口播 / 剧情对话视频"时使用。平台 www.aidaoyan66.online，注册即送1000体验积分。 | |
| aivideo-pptvideo 把PPT或图文素材变成15~60秒竖屏讲解短视频：AI写解说脚本、选音色配音、逐页生成画面、合成成片并烧录字幕。当用户想"把这份PPT做成短视频 / PPT转视频 / 图文做成解说视频 / 知识口播成片"时使用。平台 www.aidaoyan66.online，注册即送1000体验积分，Seedance 系列官方价6~8折。 | |
| aivideo-remix 拆解并复刻爆款短视频：粘贴抖音/快手等短视频链接，AI 自动分镜拆解，逐镜头生成图片与视频，合并成片，支持断点续作。当用户想"拆解这条爆款视频 / 复刻对标视频 / 爆款二创 / 分镜拆解再创作"时使用。平台 www.aidaoyan66.online，注册即送1000体验积分，Seedance 系列官方价6~8折。 | |
| Harness AI 导演工作台 Harness AI 导演工作台——8 大视频智能体帮你出片：爆款链接 1:1 复刻、原视频二创、图文解说视频、数字人口播、双人对话剧情、3D 预演台、合成剪辑、合规审核。当用户提到生成视频、出片、带货视频、爆款复刻、同款视频、数字人、口播视频、短剧、双人对话、商品广告视频、合成剪辑、视频合规检查等需求时使用此技能。 | |
| Seedance2.5 Skill AI视频与图片一键生成，支持Seedance 2.0/2.0Fast/1.5 Pro文生视频、图生视频，多模型文生图，积分查询与作品管理。当用户提到生成视频、制作视频、AI视频、文生视频、图生视频、生成图片、AI绘图、文生图、查积分、查余额、查看作品、Seedance视频、seedance等需求时使用此技能。 | |
| CrazeeOpenclawSkill OpenClaw任务分工协调skill，用于明确团队角色和CLI工具分工。当OpenClaw下发任务、分配工作、创建子任务、协调多Agent协作、或需要明确前后端分工和QA验收流程时使用此skill。 | |
| Dr Backup Gui 统一灾备备份与迁移 GUI 工具。整合 Velero（K8s备份）、Rclone（云存储同步）、Rsync（文件同步）、Coriolis（跨云迁移），提供图形化配置、档案管理、执行日志和任务记录。 | |
| invoice-qr-scanner Scan QR codes from invoice receipts and automatically fill electronic invoice applications. Use when user asks to scan QR codes from images, complete electro... | |
| 油价查询 获取全国各省市油价信息。无需 API Key。Use when: user asks about gas prices, fuel costs in China. | |
| 微博热搜 获取微博热搜榜单，按热度排序。无需 API Key。Use when: user asks about trending topics, hot news, social media trends in China. | |
| zeroHub Image API zeroHub 图片生成 API Skill。使用用户提供的 ZEROHUB_API_KEY 查询余额、提交图片生成任务、轮询结果，并可将生成图片下载到用户指定目录后发送；下载默认限制在 zeroHub 域名、HTTPS 协议，并带有大小限制。 | |
| 蒲公英异地组网 贝锐蒲公英异地组网全流程技能。覆盖从注册账号、配置 MCP、下载安装客户端、创建网络、添加成员、登录客户端到验证连通的完整流程。当用户需要蒲公英异地组网、SD-WAN 组网、远程访问内网、虚拟局域网等相关操作时使用此技能。触发词：蒲公英、异地组网、SD-WAN、pgyvpn、pgy、组网、虚拟局域网、蒲公英路由器... | |
| Prompt Alchemist-提示词炼金术 蒸馏四位顶级提示词工程师（Riley Goodside、涂津豪/推广CO-STAR、Sander Schulhoff、李继刚）的方法论，融合为"四元蒸馏框架"，自动优化用户提示词，提升AI回答质量。 ## 激活方式 - "帮我优化提示词""改进我的Prompt""让AI回答更好" - "提示词蒸馏""prompt... | |
| Guiro Turn structured data into shareable visual dashboards, reports, charts, and calendars. Publishes an A2UI JSON bundle to guiro.io and returns a short-lived sh... | |
| PPTX PDF Font Fix Fix PowerPoint font embedding issues in PDF export by patching text transparency in PPTX files. Use when a user has a PPTX file where exported PDFs show wrong/default fonts instead of the intended downloaded/custom fonts, even with font emb | |
| Sloth D2C Skills 将Figma设计稿转换为前端组件代码（Design to Code）。通过 `sloth d2c` CLI 获取设计稿数据，分片处理并生成最终代码。当用户提到Figma转代码、设计稿转代码、D2C、design to code、生成页面时使用。 | |
| 架构图生成 本地优先的架构图与结构图生成工具。当用户要求画架构图、系统图、模块图、流程图、时序图、状态机、网络拓扑图、ER图、数据流图、微服务/云原生架构图、甘特图，或提到"画个图""架构图""系统图""模块图""拓扑图""时序图""draw/diagram/flowchart/architecture"时触发。纯本地渲染，无需云端、无需 node、无需 API Key；支持自包含 HTML 与内联 SVG 双输出，内置类型边界、间距可读性与出错重试。 |
20,051–20,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.