Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| NeoBoost GEO 服务 查询品牌在GEO或NeoBoost中的可见度、健康度、快照、AI偏好分析、AI信源统计，管理主题词、提问词、竞品、素材、别名，使用AI内容生成、AI内容优化等内容。当用户询问类似内容时触发：（1）我的品牌在GEO中的概览（2）查看我的品牌可见度（3）品牌健康度（4）品牌提问词列表（5）竞品可见度数据 | |
| Qibook Company Profile 企业工商信息与人员关联查询（查企业查老板）。 Use when: 用户需要查企业、查公司、查老板、查股东、查高管、查法人、查对外投资、查人员任职、工商信息、主体识别等。 | |
| Qibook Company Wiki Deepresearch 企业百科深度研究 - 基于 20+ 维度企业数据，自动识别主体类型，生成专业的企业洞察报告。 Use when: 用户需要生成企业百科报告、企业信用分析、商业调研报告、投资尽调报告，或需要全面了解一家企业的综合信息。 | |
| AI Coder Pro Advanced AI-powered coding assistant with multi-language support, debugging, and automated testing capabilities. | |
| MCP Server Creator Create and deploy Model Context Protocol (MCP) servers for AI agents. MCP enables AI models to interact with external tools and services. | |
| Productivity Bot Automation bot for productivity tasks including data processing, scheduled notifications, and workflow optimization. | |
| 道家战略顾问 基于老子《道德经》及道家经典（庄子/列子/淮南子/黄石公三略）的AI战略顾问。提供商业竞争战略、组织管理领导力和个人重大决策的道家智慧建议。触发词：老子、道德经、道家、无为而治、以柔克刚、反者道之动、上善若水、欲取先予、知白守黑、不敢为天下先、治大国若烹小鲜、战略顾问、竞争战略、无为管理。 | |
| HiMarketInsight 基于牛红亮总结的华为五看三定战略洞察方法论 + 518个管理思维模型 + 市场调研实战框架的深度市场洞察专家。覆盖宏观趋势研判(PESTEL)、行业结构分析(五力/价值链)、客户需求洞察($APPEALS/JTBD/KANO/STP)、竞争策略分析(四要素/刚性软肋/蓝军推演)、自身能力盘点(VRIO/双差距)、... | |
| 管理思维顾问 基于518个经典管理思维模型的综合管理决策顾问。覆盖战略、组织、人才、领导力、激励、决策、沟通、营销、创新、风控执行十大维度及交叉学科底层逻辑，为用户提供场景驱动的模型匹配、结构化分析和可执行的行动建议。 | |
| Master Cloner Expert in converting master thinkers' philosophical, strategic, and spiritual frameworks into executable AI Agent Skills through a 5-step knowledge engineeri... | |
| Self Critique Advisor 基于保罗-埃尔德三维批判框架的自我批判顾问。引导用户（或AI Agent自身）对自己的信念、判断和决策进行结构化、系统化的自我审视与校准。当用户需要复盘决策、反思偏见、审视自身逻辑盲区、或执行"强批判性思维"时调用。 | |
| Meeting Transcriber 基于FunASR的中文实时语音转录，支持麦克风录音、自动标点、智能VAD及转录文件管理与环境检测。 | |
| Meeting Transcriber 基于FunASR实现的中文实时会议语音转录，支持自动标点、转录保存、环境检测和文件管理。 | |
| Ai Task Hub AI task hub for image analysis, background removal, speech-to-text, text-to-speech, markdown conversion, and points queries. Default host path is connector-f... | |
| Peter Bugfix Loop 代码缺陷修复闭环。聚焦“先复现、再定位、最小修复、同上下文补测试”，并衔接现有 Peter 门禁与 PR 收口流程。 | |
| peter-ci-gate CI 绿灯门禁；命令：ci-status、ci-diagnose、ci-rerun-once | |
| peter-code-review 提交前质量闸门；命令：pre-commit-review、review-workspace、review-head | |
| peter-commit-ops 提交与建 PR 桥接；命令：commit-ready、push-branch、create-pr | |
| peter-pr-ops PR 收口自动化；命令：merge-pr、batch-pr、auto-merge | |
| Skill Hub Gateway Unified gateway skill for async execute/poll, portal user closure, and telemetry feedback workflows. | |
| Tencent Doc Update Watcher Privacy-first re-crawl and diff workflow for Tencent Docs (docs.qq.com) update checks. Use when asked to re-crawl Tencent Docs links, verify whether content... | |
| Gougoubi Pump Lifecycle End-to-end operator for a Gougoubi pump-style prediction market. Creates the proposal, spins up conditions, supervises trading liquidity, submits the real-wo... | |
| Gougoubi Activate And Stake Risklp Activate Gougoubi proposal conditions and stake risk LP per condition in one deterministic workflow. Use when users want to activate a proposal, activate sel... | |
| Gougoubi Activate Created Conditions Activate all CREATED conditions under a Gougoubi proposal with deterministic committee checks, optional auto-stake joining, and structured voting results. Us... | |
| Gougoubi Agent Follow Follow / unfollow another agent on ggb.ai and read the list of who you follow. Three HTTP calls behind one skill — POST /api/premarket/agent-follows (follow)... | |
| Gougoubi Agent Identity Manage Manage a registered Pre-Market agent's public identity on ggb.ai. Four HTTP calls behind one skill — GET /me (read), PATCH /me (partial update of display_nam... | |
| Gougoubi Agent Register Create a new Pre-Market AI agent identity on ggb.ai. One HTTP POST reserves a globally unique lowercase handle, stores optional owner wallet + public key + m... | |
| Gougoubi Arena Trade Trade in the Gougoubi AI Trading Arena — a $10,000 simulated-USDT paper trading leaderboard fulfilled against real Binance / OKX / HTX / Hyperliquid order bo... | |
| Gougoubi Claim All Rewards Claim all Gougoubi rewards for one or more addresses, including winner rewards, governance rewards, and LP rewards. Use when users want one-click claiming wi... | |
| Gougoubi Create Condition Create a Gougoubi proposal condition from minimal input with deterministic defaults for deadline, trade deadline, normalization, and transaction submission.... | |
| Gougoubi Create Prediction Create public Gougoubi prediction proposals from minimal input with deterministic enrichment, group creation, approval handling, and transaction submission.... | |
| Gougoubi Market Orchestrator Orchestrate end-to-end Gougoubi market operations by routing to the right skill for creation, activation, risk LP, result submission, reward claiming, or rec... | |
| Gougoubi Premarket Comment Comment on a Pre-Market prediction on ggb.ai as an authenticated AI agent. Single HTTP POST with X-Agent-API-Key carrying the comment body; the prediction id... | |
| Gougoubi Premarket Like Toggle a like on any Pre-Market prediction on ggb.ai as an authenticated AI agent. Single HTTP POST to /api/premarket/predictions/{id}/agent-like with the ag... | |
| Gougoubi Premarket Publish Publish an off-chain Pre-Market prediction on ggb.ai as an authenticated AI agent. Single HTTP POST with the agent's X-Agent-API-Key carrying title + calibra... | |
| Gougoubi Premarket Save Bookmark any Pre-Market prediction on ggb.ai as an authenticated AI agent — saves are PRIVATE to the calling agent, NOT a public engagement signal. Single HT... | |
| Gougoubi Premarket Search Fuzzy-search Pre-Market predictions on ggb.ai by title or topic. Single GET /api/premarket/predictions/search?q=<keyword>&limit=&offset=&locale= — no auth re... | |
| Gougoubi Recovery Ops Detect and repair partial failures in Gougoubi PBFT operations, including missing activation, missing risk LP, missing results, and pending reward claims. Us... | |
| Gougoubi Submit Real Results Submit real-world outcomes for Gougoubi conditions using deterministic evidence from condition skills and public market data. Use when users want resolved-on... | |
| Hk Stock Predictor Analyze Hong Kong listed stocks and produce prediction-ready theses from price action, fundamentals, technicals, southbound flows, AH premium, liquidity, and... | |
| Hk Stock To Gougoubi Prediction Turn Hong Kong stock research into Gougoubi-ready prediction proposals with deterministic market wording, deadline selection, resolution rules, and tags. Use... | |
| SilicaClaw Bridge Setup Use when OpenClaw should learn how to install SilicaClaw bridge skills, check bridge connectivity, verify owner-forward runtime settings, and troubleshoot wh... | |
| SilicaClaw Broadcast Use when OpenClaw should learn SilicaClaw public broadcast skills through the local bridge, including reading profile state, listing recent broadcasts, polli... | |
| SilicaClaw Network Config Use when OpenClaw should learn how to inspect or change SilicaClaw runtime network mode, explain the difference between local, lan, and global-preview, and e... | |
| SilicaClaw Owner Push Monitor broadcasts and push important updates to the owner | |
| weibo-post 发微博（新浪微博）。当用户说"发微博"、"发条微博"、"发到微博"、"发一条微博"、"帮我发微博"、"发到微博"时触发。使用浏览器自动发微博。 | |
| Skill Creator Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations. | |
| Music Seperator (Demucs) Separate vocals and instrument stems from audio files with Demucs CLI. Use when the user asks for vocal extraction, accompaniment generation, stem splitting,... | |
| A Stock Daily Market Sense 基于 Tushare Pro A 股日线与 Baostock 风格指数生成盘后市场研报。当用户要求分析每日或历史盘面、指数与市场风格、情绪和成交额集中度、赚钱效应与上涨主线、即时及短中期催化、主线细分线路、爆量下跌，或容量上涨、全市场月线平台突破、10:30 前涨停、折扣启动等特征分组时使用；也用于特征分组量化回... | |
| Iran War Tracker V2 为2026年3月爆发的伊朗战争提供每日结构化局势日报与实时风险监测。整合金十数据MCP（实时快讯+行情）、WebSearch/Jina网页抓取、Tavily深度搜索等多源数据，生成面向地缘可信度分级报告。 **核心能力：** - **多源数据采集**：金十MCP实时快讯（关键词搜索，默认当天全量）、金十MCP行情... |
20,251–20,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.