Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Closeli Open Device Event Query Closeli Device Event Query API. Supports natural language queries for device events and returns an AI summary and event list, including event types, time ran... | |
| Syléa Personal life coach & decision assistant. Analyzes dilemmas with a probability-based framework, tracks life goals across 5 psychological dimensions, and runs... | |
| Optimizer Openclaw Token Reduce OpenClaw token usage and API costs through smart model routing, heartbeat optimization, budget tracking, and native 2026.2.15 features (session prunin... | |
| WeChat Sender Windows 微信消息自动发送工具（Windows 版）。通过 pywinauto 控制微信窗口，搜索联系人并发送消息。支持单发和群发。 | |
| chartjs-reporter This skill should be used when the user needs to turn structured data (query results, CSV summaries, JSON records, or Python dicts/lists) into a standalone H... | |
| chat2duckdb 基于 DuckDB 引擎的高效数据分析工具；当用户需要对 CSV/JSON/Parquet/Excel 等数据文件进行 SQL 查询、数据分析、数据抽样或需要自动纠错的查询执行时使用 | |
| data-visualization AI智能数据可视化；支持多种图表类型（柱状图、折线图、饼图、散点图、直方图、箱线图、小提琴图、面积图、热力图、平行坐标图、旭日图等），根据数据特征自动分析并推荐最佳图表组合，生成精美交互式HTML仪表板 | |
| doc-search 处理文档向量化、存储和语义检索。支持 Word、Markdown、PDF、TXT 等格式。v3.0 新增查询缓存（速度提升 70x）、混合检索（BM25+ 向量）。Invoke when user needs to vectorize documents, search for similar content,... | |
| ali-promotion-roi Analyze Alibaba International (alibaba.com) promotion ROI - evaluates total promotion spend vs. actual completed orders and revenue. Use when the user asks about Alibaba 国际站推广投入产出, 推广 ROI, 阿里广告效果分析, 标准推广/全站推广效果对比, 月度推广总结, or wants to know h | |
| db-bridge Database table bridging skill. Parses table configurations from table.json and executes SELECT / INSERT / UPDATE / DELETE operations via sql-linker. All CRUD... | |
| delete-recovery Automatically backs up files before deletion to timestamped folders, allows restoring deleted files, lists backups, and cleans expired backups and logs. | |
| local-tencentdb-agent-memory-flash 本地部署零依赖的 TencentDB-Agent-Memory 插件，基于 SQLite 实现对话记忆的存储和召回，支持自动清理与上下文保护。 | |
| sql-linker Use this skill whenever you need to query, insert, update, or delete database records. Triggers include: (1) querying database data with SELECT statements an... | |
| sql-linker-cli SQL-Linker CLI: Multi-DB CRUD (MySQL/PostgreSQL/SQLite) with bootstrap config generation, credential management (encrypted password via OS env + cloud dbpw_key), cloud audit sync to https://sqllinker.agentpower.hk.cn, and API key introspect | |
| API Health Check Check the health and status of popular AI APIs and services — OpenAI, Anthropic, Pollinations, OpenRouter, Gemini, and more. Use when the user wants to know... | |
| Code Explainer Tool Explain any code snippet or file in plain English. Paste code → get a clear explanation of what it does, how it works, and key concepts. Use when the user sh... | |
| GitHub Automation Automate common GitHub tasks — create issues, check PR status, list repos, manage projects. Use when the user wants to interact with GitHub programmatically... | |
| Screenshot Analyzer Analyze and describe screenshots or images. Upload an image → get a detailed description of what's visible, including UI elements, text, objects, and context... | |
| Site Summarizer URL fetcher with summarization. Fetches URLs, extracts content, generates summaries. Optional caching with configurable directory and TTL. Use for web conten... | |
| A Stock Digest Provides A-share stock daily signals scoring and hotspot theme identification for pre-market briefs and real-time alerts. | |
| HR面试评价助手 🎯 智能面试评估助手 通过口令触发，自动结合JD文字+简历文档+面试记录文档，生成专业面试评估报告 【触发口令】 面试评估、生成评估报告、候选人评估、面试评价、评估候选人 【使用方式】 1. 发送触发口令（如'面试评估'） 2. 粘贴JD文字 3. 上传简历PDF/Word 4. 上传面试记录PDF/Word（... | |
| HR面试评价助手-Word版 🎯 HR面试评价助手（Word版格式） 生成可直接复制到Word文档的标准格式HR面试评价 【使用方式】 1. 发送口令：HR面试评价 2. 粘贴JD文字 3. 上传简历文档 4. 上传面试记录（可选） 5. 复制生成的评价到Word 【输出特点】 - 纯文本格式，可直接粘贴到Word - 层次清晰，标题加粗... | |
| Lingqu Banner Config 灵渠发现页Banner配置编排。数字员工负责预占、收料、比对帧位排期、决策不一致，后台真实写操作委托 promotion-apply-skills 执行，催办交灵渠助手。三个阶段共享一张追踪表。触发场景：(1)PM私聊或群内表达预占排期意图（说"预占""帮我占排期""建推广"等）— 阶段一排期预占；(2)PM私聊... | |
| Promotion Apply Skills 灵渠 Banner 推广创建、查询、复制、修改、状态修改、创意和关联物料 skill。用户说“配置发现页 banner”“帮我配置发现页banner”“查询/复制/创建/预占/取消预占/状态修改/修改/配置 banner 推广/素材”时使用。 | |
| Cloudnet AI Diagnostics Cloudnet AI Diagnostics针对无线场景下终端体验差、网卡、无法接入 WiFi 等问题进行排障的技能 | |
| Cloudnet AI Inspection Cloudnet WLAN无线网络巡检技能（极简版）。通过mcporter调用Cloudnet MCP接口，执行6步巡检流程： 获取场所信息→AC健康度→问题分布与接入成功率→Cloudnet问题推理→AP上线率→生成巡检报告。 输出中文MD+DOCX双格式巡检报告，标题为"无线网络运维巡检报告（极简版）"。 适... | |
| Nginx Reverse Proxy Configure nginx reverse proxy for domain binding. Trigger when user says "绑定域名" or "配置nginx" or "反向代理" to bind a domain to a specific IP:port. | |
| Umy Hotel An out-of-the-box hotel search skill powered by Umy MCP. | |
| GitHub项目调研器 GitHub 项目调研与对比工具。当用户要求'搜索 GitHub 项目'、'对比开源项目'、'选一个 XX 工具'、'哪个项目最受欢迎/活跃'、'评估哪个好'、'怎么选'等场景时使用。通过 GitHub API 搜索、采集数据、系统化对比，输出结构化推荐报告。 | |
| 需求迭代工作流 基于 Ralph Loops 三阶段工作流理念，适配 OpenClaw 架构。 需求迭代工作流：需求讨论 → 计划拆解 → 迭代执行。 触发条件：用户说"讨论需求"、"开始计划"、"迭代执行"、"需求访谈 | |
| Iteration Pattern 应用拉尔夫循环（Ralph loop）解决ai执行不到位，说执行了，实际没执行或执行不完全的问题。 迭代优化工作流模式。当任务复杂、一次完成质量可能不高时使用，通过循环检查和优化提升输出质量。 触发条件：(1) 用户说"迭代模式"、"用迭代方式"、"循环优化"，(2) 复杂任务需要多轮改进，(3) 创建 Skil... | |
| consumerResearch消费者人群画像分析 消费者调研能力；支持目标人群画像分析、核心需求挖掘、问卷设计与数据处理；当需要进行消费者洞察、产品定位或用户研究时使用 | |
| FoodDocument研发资料整理或文档编写 文档管理能力；支持研发文档分类、版本管理、模板生成；当进行研发资料整理或文档编写时使用 | |
| food label audit食品标签合规检查与案例PLUS 食品标签合规审查与风险查询；当用户上传标签图片/PDF进行合规审查或查询标签违规案例、处罚依据时使用 | |
| Haccp-Principles食品生产中HACCP应用指导 依据GB 14881-2025标准提供HACCP原理指导与实施支持；当食品企业需要建立/审核HACCP计划、进行危害分析、确定关键控制点或准备SC认证时使用 | |
| label audit食品标签审核 智能审核食品包装标签的合规性，支持图片/PDF设计稿；当用户需要审核标签强制性标识、营养标签规范性、声称用语合规性或格式要求时使用 | |
| meatpollutant牛羊肉罐头污染物超标判定 依据GB 5009.5-2025第一法凯氏定氮法，指导畜禽肉蛋白质含量测定全流程，涵盖试剂配制、消解蒸馏、滴定操作及结果计算；当用户需要检测肉类蛋白质、执行凯氏定氮实验、计算蛋白质含量或验证精密度时使用 | |
| Meat-Protein凯氏定氮实验 依据GB 5009.5-2025第一法凯氏定氮法，指导畜禽肉蛋白质含量测定全流程，涵盖试剂配制、消解蒸馏、滴定操作及结果计算；当用户需要检测肉类蛋白质、执行凯氏定氮实验、计算蛋白质含量或验证精密度时使用 | |
| package design包装设计&改进 包装设计能力；支持包装方案设计、材料选择、法规审核；当进行产品包装设计或包材选型时使用 | |
| Pig_Offal_Inspection鲜、冻猪副产品检验判定技巧 依据 GB/T 9959.4-2019 标准提供鲜、冻猪副产品检验判定技巧服务，覆盖猪副产品感官、理化、微生物等指标合规性检验判定全流程；当用户 / 检测机构 / 肉企 / 屠宰企业需要做猪副产品质量检验、验收、判定产品是否合规、学习检验判定技巧时适用 | |
| Pork-Cutting-Spec猪肉分割技术指导 依据 GB/T 40466-2021 标准提供猪肉分割技术指导，覆盖术语定义、原料要求、分割车间基本要求、分割方式、程序及要求标识、包装、贮存和运输要求；当用户 / 屠宰企业 / 肉企 / 肉制品加工厂需要学习猪肉分割技术、查猪肉分割规范、做猪肉标准化分割时适用 | |
| rd-workflow食品研发流程指引 研发全流程操作指引能力；支持研发阶段递进提醒、上一步总结、注意事项提示；当进行产品研发项目或需要流程指导时使用 | |
| samOnboarding山姆超市产品上架指导 指导食品企业完成山姆超市产品上架全流程，包含客户需求分析、合规准备、申请提交、审核跟进、上架执行各阶段操作要点；当用户需要山姆上架指导、食品合规咨询或上架问题应对时使用 | |
| Sensory-Analysis-Testing感官分析差别检验怎么做 依据GB/T 10220-2012/ISO开展感官差别检验，涵盖二点检验、三点检验及配对比较等实施原则；当用户需要判断样品间是否存在感官差异、验证配方变化或比较产品差别时使用 | |
| Liquidskills Comprehensive guide covering Hyperliquid's architecture, API, HyperCore vs HyperEVM, gas, wallets, standards, tools, security, testing, and deployment best p... | |
| Echo Agent Network 提供Agent能力画像测试、职业方向匹配、知识共享和Mentor自动匹配功能，促进Agent能力传承与复用。 | |
| B12 Website Generator This skill allows you to create a professional, engaging, and user-friendly website in seconds using AI. To create a website, you need to provide a brief description of your project or business (goals, structure, style, etc.). | |
| wxauto 微信自动化操作。通过 wxautox4 RESTful API 实现发送消息、获取聊天记录、监听消息、好友管理等功能。Use when: (1) 发送微信消息给好友或群聊，(2) 读取微信聊天记录，(3) 监听新消息，(4) 获取好友列表或群聊列表，(5) 接受好友申请，(6) 切换聊天窗口等微信操作。 | |
| Clawflows Search, install, and run multi-skill automations from clawflows.com. Combine multiple skills into powerful workflows with logic, conditions, and data flow between steps. | |
| Gemini Image Simple Generate and edit images with Gemini API using pure Python stdlib. Zero dependencies - works on locked-down environments where pip/uv aren't available. |
21,651–21,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.