Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Dingtalk CLI SKILL Dingtalk CLI SKILL / 钉钉 dingding / dingtalk dws skill — Manage DingTalk products (AI forms, calendar, contacts, bots, todos, approvals, attendance, reports,... | |
| Dingtalk CLI SKILL 钉钉 CLI 技能 / 钉钉 dingding / 钉钉 dws skill / 管理钉钉全部产品：AI表格、日历、通讯录、群聊机器人、待办、审批、考勤、日报周报、DING消息、工作台。Manage DingTalk products (AI forms, calendar, contacts, bots, to... | |
| 盘古·skill 盘古 · skill - 将知识库/文件夹/单文档蒸馏为专业可安装的Skill。 支持四种蒸馏模式：完整知识库、指定文件夹、单篇文档、任务工作流。 | |
| Text to Markdown 纯文本格式预处理工具，自动插入换行、拆分长段落，为后续 AI/LLM 生成 Markdown 提供结构化输入。 | |
| Wolai API 技能 Wolai API skill — 操作 wolai 笔记（块/页面/数据库）/ Wolai API Skill - Operate wolai notes (blocks, pages, database) via REST API | |
| Wolai MCP 技能 Wolai MCP skill — 操作 wolai 笔记（块/页面/搜索/数据库）/ Wolai Mcp Skill - Operate wolai notes (blocks, pages, search, database) via MCP protocol | |
| Potato Tipper Skill for AI agents to setup the Potato Tipper on a Universal Profile on LUKSO (requires private key), and learn to build innovative tip-on-follow solutions. | |
| Auto Evolution (Hybrid Mode) Multi-agent auto-evolution system with hybrid mode — orchestrate review-execute-audit loops with 4 roles (Coordinator, Reviewer, Executor, Auditor). Supports... | |
| Auto Revolution Safe publishing variant of Auto Revolution. Provides structured task templates, review prompts, safety scanning, task state updates, and logging for human su... | |
| Email Smart Reply (AI-Powered) AI-powered email reply generation for B2B sales. Analyzes incoming emails to detect intent (inquiry, delivery chase, complaint, technical question, partnersh... | |
| 公司情报侦察 根据公司 URL 或名称，自动完成公司背景调研、联系人挖掘、邮箱验证，并生成本地及 OKKI 档案记录。 | |
| Follow-up Engine (CRM Automation) Automated customer follow-up scheduling and execution engine for B2B sales. Generates personalized follow-up email drafts based on customer stage, last conta... | |
| OKKI Email Sync Synchronize email activities and quotation events with OKKI CRM as follow-up trail records. Automatically matches emails to CRM customers via domain lookup a... | |
| Okki Sync Mail 完整的邮件自动化解决方案，集成 OKKI CRM。支持 IMAP 邮件自动捕获、SMTP 发送邮件、dry-run 模式、发送日志、速率限制、定时发送、签名模板、邮件规则、连接池优化、邮件转发等功能。自动同步 inbound/outbound 邮件到 OKKI 创建跟进记录（remark_type=102）。 | |
| Quotation Workflow 自动化生成报价单（Excel/Word/HTML/PDF），集成数据验证防止示例数据，支持 OKKI CRM | |
| Sales Email Automation (IMAP/SMTP) Read and send email via IMAP/SMTP. Check for new/unread messages, fetch content, search mailboxes, mark as read/unread, and send emails with attachments. Wor... | |
| Company Intel 根据公司名或网址，自动完成全网背调、联系人搜索及邮箱有效性验证，生成本地档案并同步录入OKKI系统。 | |
| After-sales Service 售后管理技能，提供客户投诉管理、返单报价、满意度调查、分析报表和 OKKI CRM 同步功能。 | |
| Approval Engine 审批流程引擎 + 异常处理系统 — 规则驱动的多级审批、异常检测、自动恢复策略和 Discord 通知集成 | |
| Campaign Tracker 客户开发信追踪与分析 — 自动归档发送记录、匹配客户回复、生成效果分析报告、优化邮件模板 | |
| Customer Segmentation Automatically segment customers into five levels using OKKI CRM data, score them, sync tags safely, and provide lifecycle and value-based strategy recommenda... | |
| Logistics Manager 物流管理技能，提供提单生成、报关单据生成、物流跟踪等功能。支持 OKKI 客户数据同步和自动化文档处理。 | |
| Logistics Tracker 物流跟踪技能，对接 17Track 批量 API，自动跟踪运单状态，向客户发送邮件通知，并在异常时告警。 | |
| OKKI CRM 连接 OKKI（小满）CRM 系统，支持查询客户、创建跟进记录、管理订单等操作。频道限定触发。 | |
| Order Tracker Track and manage sales orders with status updates, notifications, and dashboard reporting. Supports order creation, status transitions (pending/confirmed/shi... | |
| PDF Catalog 从 PDF 产品目录（模具图纸）中自动提取产品信息，生成结构化知识库和 Excel 填充数据。 | |
| Pricing Engine 动态定价引擎 — 根据 LME 铜价、数量阶梯、客户等级、实时汇率自动计算报价，集成 quotation-workflow 生成报价单 | |
| Product Doc Reader 产品工程图纸结构化提取器 v5.0。pdftotext 优先 + Vision 兜底，支持软连字符清理/跨行关联/数据校验。专为 Farreach 线材产品图纸设计。 | |
| Revolution Auto-Evolution Multi-agent auto-evolution system — orchestrate review-execute-audit loops with 4 roles (Coordinator, Reviewer, Executor, Auditor). A single coordinator agen... | |
| Sales Dashboard Aggregate sales data from OKKI CRM and Campaign Tracker to generate weekly/monthly reports with alerts and push them to Discord. | |
| Word Handler Create, read, and edit Word documents (.docx) with support for templates, tables, and styling. | |
| Test-Driven Revolution Test-Driven Revolution implements an AI-driven iterative code evolution system with automated coding, testing, auditing, and controlled task workflows. | |
| MoltQuest Deploy an autonomous AI agent into a live 3D voxel MMO. Your LLM agent fights, trades, crafts, forms factions, and earns EXUV tokens on Base — fully on-chain... | |
| Precision Calculator — Exact Math, Every Time MUST USE for any calculation or math question — never compute numbers yourself. Use this skill for all arithmetic, finance, science, unit conversions, and ev... | |
| Agent Memory System Guide Use when setting up or improving an agent memory workflow for OpenClaw, Codex, or Obsidian with MEMORY.md, daily notes, session recovery, and optional OpenVi... | |
| Agent Orchestrator Template A skill for main agents that need bounded delegation, safe parallel dispatch, and independent acceptance across multiple specialists. | |
| Knowledge Organizer Use when importing articles, organizing notes, or syncing a knowledge base across Obsidian, Feishu, and Tencent IMA with OpenClaw or Codex. | |
| SkillUp SkillUp is a cross-platform skill publishing tool for packaging and syncing custom skills to GitHub, Xiaping Skill, OpenClaw CN, and ClawHub. | |
| Hk Stock Morning Report Generate HK stock market morning report (股市晨報) for bank trading desks. Triggers: "生成晨报","股市晨报","今日股市","港股晨報" 推送：微信個人 + 飛書群 | 數據：騰訊財經+stcn.com+格隆匯+實時搜索 | |
| PLC Job Scraper Automaticky vyhledává PLC, automation a SCADA pracovní nabídky z LinkedIn, Indeed a dalších job boardů. Ideální pro PLC programátory a automation inženýry hl... | |
| TIA CICD DIFF Use Siemens TIA Portal Openness API to diff two .zap18 projects and return structured code & hardware changes. | |
| TIA COMMISSIONING DELTA Use TIA Openness to compare latest site backup against yesterday's baseline with focus on process control logic. | |
| TIA HW AUDITOR Use TIA Openness to compare hardware and I/O configuration between field and master backups. | |
| 今日头条运营助手 自动化管理今日头条账号，支持热点监控、AI内容生成、封面设计及自动发布，适合自媒体和营销团队。 | |
| Context Continuity 上下文续接与记忆管理。当用户说"新建对话"、"继续"、"接着上次"等时， 自动从 MEMORY.md 和 memory/ 文件中提取当前任务/项目上下文， 让新会话能够了解之前的进展。用于：(1) 用户要开始新对话但想保留上下文 (2) 用户说"继续上次的工作" (3) 用户想要回顾当前进行中的任务 特点：自动记... | |
| Twitter Automation Suite Twitter/X 自动化运营套件。自动发推、监控关键词、批量回复、AI 生成推文内容。适合社交媒体运营、账号增长、竞品监控。 | |
| 自动化工作流引擎 自动化工作流引擎。定时执行任务链：数据采集→处理→通知→存档。支持cron定时、 webhook触发、文件监控。 | |
| 智能网页爬虫 智能网页数据采集器。自动识别网页结构，批量抓取列表/表格/详情页数据，支持导出JSON/CSV/Excel。内置反爬策略适配。 | |
| StepAce Experimental Generate AI music on your Android phone via the StepAce Experimental app. Use this skill whenever the user asks to generate, create, make, compose, or queue... | |
| remote-terminal Remote Linux terminal control skill. Use when the user wants to (1) connect to a remote Linux server and execute commands, (2) perform SSH operations on remo... |
21,001–21,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.