Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| ds160-autofill Automates filling and resuming US DS-160 visa forms using CSV data, browser scripting, LLM for captchas, translations, missing data, and session persistence. | |
| Toggl Track time with Toggl via the toggl CLI. Use when the user wants to start/stop time tracking, check current timer, view today's or weekly reports, list recent entries, or manage time entries. Triggers on "toggl", "time tracking", "timer", " | |
| TG Canvas Mini App Telegram Mini App Canvas with terminal and optional Control UI proxy. Renders agent-generated content (HTML, markdown, A2UI) in a Telegram Mini App; push wit... | |
| MiniMax MMX MiniMax MMX-CLI 命令行工具，用于 AI Agent 调用 MiniMax 全模态能力（图片生成、视频生成、语音合成、音乐创作、图片理解、网络搜索、文本对话等）。当用户需要生成图片、视频、语音旁白、音乐，或者需要理解图片内容、执行搜索时使用此技能。安装：npm install -g mmx-cli；... | |
| Tencent Docs Reader Read Tencent Docs spreadsheet via agent-browser copy-paste method. Supports reading any sheet tab and returns tab-separated text. 腾讯文档在线表格读取工具，支持指定子表，返回制表符分隔... | |
| Word Docx 1.02 Create, inspect, and edit Microsoft Word documents and DOCX files with reliable styles, numbering, tracked changes, tables, sections, and compatibility check... | |
| pptx-notes-editor PowerPoint speaker notes editor for AI agents. Use when the user needs to: (1) modify PPT speaker notes, (2) export notes to Markdown, (3) rewrite notes in n... | |
| Debug Pro Provides a 7-step debugging protocol plus language-specific commands to systematically identify, verify, and fix software bugs across multiple environments. | |
| Design Assets Create and edit icons, favicons, images, and color palettes using macOS tools, ImageMagick, SVG, and AI image generation. | |
| Project Scaffold Generate new projects with standardized structure, tooling, and configuration for web, API, mobile, CLI, or browser extension apps. | |
| Test Runner Write, run, and manage unit, integration, and E2E tests across TypeScript, Python, and Swift using recommended frameworks. | |
| Web Deploy Build, preview, and deploy websites, web apps, and APIs using Vercel, Railway, GitHub Pages, or local Canvas environments. | |
| UK Electrician Qualification Pathway Explain adult electrician qualification routes using Elec Training course information and ECS/NET requirements. Use for UK career-change, Level 2/3 diploma, workplace NVQ, AM2 and ECS Gold Card pathway questions. | |
| Cmc Api Crypto API reference for CoinMarketCap cryptocurrency endpoints including quotes, listings, OHLCV, trending, and categories. Use this skill whenever the user mentio... | |
| Cmc Api Dex API reference for CoinMarketCap DEX endpoints including token lookup, pools, transactions, trending, and security analysis. Use this skill whenever the user... | |
| Cmc Api Exchange API reference for CoinMarketCap exchange endpoints including exchange info, volume, market pairs, and assets. Use this skill whenever the user mentions excha... | |
| Cmc Api Market API reference for CoinMarketCap market-wide endpoints including global metrics, fear/greed, indices, trending topics, and charts. Use this skill whenever the... | |
| Cmc Mcp Fetches cryptocurrency market data, prices, technical analysis, news, and trends using the CoinMarketCap MCP. Use for ANY question involving cryptocurrencies... | |
| Cmc X402 Access CoinMarketCap data via x402 pay-per-request protocol with USDC payments on Base. Use when users mention x402, want CMC data without API keys, ask abou... | |
| Crypto Research Performs comprehensive due diligence on a cryptocurrency using CoinMarketCap MCP data. Use when users ask about a specific coin beyond just its price. This i... | |
| Market Report Generates a comprehensive crypto market report using CoinMarketCap MCP data. Use when users ask about overall market conditions, sentiment, or want a summary... | |
| srv-guard 服务器安全防护一体化能力：扫描漏洞、修复漏洞、感知攻击、防御攻击，并生成安全报告。 当需要对 Linux 服务器进行安全加固、漏洞巡检、入侵检测或应急防御时加载此 Skill。 触发词：服务器安全、漏洞扫描、漏洞修复、攻击感知、入侵检测、安全加固、封禁 IP。 English triggers: server security hardening, vulnerability scan, patch/audit Linux config, intrusion detectio | |
| Syndicate Links Turn your agent into an affiliate earner. Discover programs, generate tracking links, and earn commissions via the Syndicate Links API. Supports Stripe + Bit... | |
| Audio Speaker Tools Speaker separation, voice comparison, and audio processing tools. Use when working with multi-speaker audio, voice cloning, or speaker verification tasks inc... | |
| Agent SCIF Trustless encrypted vault with TOTP auth and clean-room session isolation. Secrets your agent holds but cannot read. Use when user wants to store, retrieve,... | |
| VAPI Calls Advanced AI voice assistant for phone calls. Capable of persuasion, sales, restaurant bookings, reminders, and notifications. | |
| Windows TTS Notification Push text notifications to Windows Azure TTS service for audio broadcast via Bluetooth speakers. Perfect for family reminders, alarms, and announcements. | |
| NASCAR Provides expert analysis, race previews, driver comparisons, strategy breakdowns, and playoff insights for NASCAR Cup, Xfinity, and Truck Series. | |
| PDF Tools View, extract, edit, and manipulate PDF files. Supports text extraction, text editing (overlay and replacement), merging, splitting, rotating pages, and getting PDF metadata. Use when working with PDF documents for reading content, adding/e | |
| assethub-claw AssetClaw技能（官网：http://www.medfix.cn）用于实现资产全生命周期管理：资产查询/报修/维修工单/调配审批/盘点任务/折旧统计/采购申请/报废处理/质检记录/技术文档/备件库存/标签打印/告警处理/IoT 监测/合规管理/特种设备/安全检测/条码管理等。适用于需要快速查询、创建、审批各类资产业务单据的场景。v1.7.0（2026-07-29）同步后端 swagger：**101 模块 / 1,809 ops / 15 业务域**。 | |
| SEO Afiliate guide Crea guías de compra SEO optimizadas para posts de afiliado en español. Úsala siempre que el usuario quiera escribir, generar o mejorar una guía de compra, c... | |
| My Token Safety Skill Analyzes BSC token risks like honeypot, mintability, taxes, and holder distribution to assess rug pull likelihood. | |
| Uiverse Design UI component design learning library with 165 curated CSS/Tailwind components from Uiverse Galaxy (open-source, MIT). Use when: (1) user explicitly asks to b... | |
| 智图云仓 Token 路由 智能模型路由 - 根据任务是否需要工具调用自动选择模型。需要工具(搜索/浏览器/文件/天气/股票等)使用百炼付费模型，纯聊天使用OpenRouter免费模型。V3.1.0新增route_by_tool_required()函数。 | |
| Bitnet 微软官方 1-bit LLM 推理框架，在 CPU 上运行 1.58-bit 量化大语言模型，速度提升 1.4-6x、能耗降低 55-82%，单 CPU 可运行 100B 参数模型，达到人类阅读速度 | |
| Claude Flow Claude Code 多智能体编排平台，部署 100+ 专业 AI 智能体协同工作，通过蜂群拓扑（层级/网状/环形/星形）协调自主工作流，内置自学习、向量记忆和原生 MCP 集成 | |
| Skill Chrome DevTools MCP 服务器，让 AI 编码助手（Claude Code、Cursor、Copilot）直接控制和调试真实 Chrome 浏览器，实现截图、性能分析、网络请求检查、控制台调试和自动化操作 | |
| Lightpanda 从零构建的轻量级无头浏览器，专为 AI 智能体和自动化设计，比 Headless Chrome 快 9 倍、内存占用低 16 倍，兼容 CDP 和 Playwright/Puppeteer，内置 MCP 服务器 | |
| Skill 用 React 代码程序化生成视频的框架，支持 CSS/Canvas/SVG/WebGL，可部署到 Lambda/Cloud Run 大规模渲染，适合创意视频生成、数据可视化视频和个性化视频批量生产 | |
| scrapling 高性能自适应 Python 网页抓取框架，内置反爬虫绕过（Cloudflare Turnstile）、智能元素重定位、完整爬虫框架和 MCP 服务器，适合 AI 辅助数据提取和大规模爬取任务 | |
| FastAPI FastAPI - 高性能 Python Web API 框架 | |
| Fzf fzf - 通用命令行模糊查找器 | |
| Fastapi FastAPI - 高性能 Python Web API 框架 | |
| Glances Glances - 跨平台系统监控工具 | |
| Httpie HTTPie - 人性化的 HTTP 命令行客户端 | |
| K8s Ops Fix Kubernetes operations plugin — 32 tools for cluster management, monitoring, troubleshooting, and security auditing | |
| kubeasz-deploy 为 K8s 初学者提供 Kubernetes 集群部署指导，支持 AllinOne 快速体验和生产环境高可用部署。 | |
| Langextract Google 出品的 Python 库，用 LLM 从非结构化文本中提取结构化信息，每个提取结果精确对应源文本位置，支持交互式可视化，适配 Gemini/OpenAI/Ollama 等多种模型 | |
| Lazydocker lazydocker - Docker 和 Docker Compose 的终端 UI 管理工具 | |
| Paper Checking 论文查重系统 - 一亿字次级论文库秒级查重，支持纵向查重和横向查重 |
21,701–21,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.