Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Rich Rich - Python 终端富文本和美化格式库 | |
| You Get 网页媒体下载助手 - 从YouTube、Bilibili等网站下载视频、音频、图片 | |
| Pikpak Manage PikPak cloud storage via pikpakcli: browse, upload, download, delete, rename, share, offline download. | |
| 小红书操作全集 Xiaohongshu All In One 基于api接口稳定快速 小红书MCP服务下载、启动、重启、检测，小红书多账号管理、登录、状态检查、内容发布、小红书笔记和视频发布、点赞评论操作和用户信息查询等需要调用本技能。当用户需要从小红书获取笔记和视频数据、用户数据、发布笔记或视频时需要调用本技能。 | |
| 购物比价助手 零配置即装即用的跨平台比价工具，一次搜索同时查询京东、淘宝、拼多多三大平台同款商品价格，自动识别品牌和优惠券，返回最优购买建议。增强超时容错，数据通过腾讯云代理安全转发。暑期全网比价，多平台对比找最低价 | |
| 美团优惠券 美团优惠券，搜索连锁品牌全国通用优惠券。输入品牌名或品类关键词，返回覆盖50+城市的全国通用券，按销量排序。支持咖啡茶饮（瑞幸/库迪/霸王茶姬/星巴克/蜜雪冰城）、快餐连锁（肯德基/麦当劳/塔斯汀）、正餐火锅（海底捞/张亮麻辣烫）、卤味零食（绝味/周黑鸭/好想来）、生活服务（途虎养车/特来电/百果园/屈臣氏/名创... | |
| 京东自营9.9包邮 京东9.9包邮频道超值好货查询，仅筛选京东自营商品，好评≥98%品质精选，支持品类搜索、价格筛选、折扣力度排序，件件包邮。自动过滤无效标签，智能品类推荐，数据通过腾讯云代理安全转发。夏日9.9好物，京东自营包邮特卖 | |
| 京东自营历史最低价 京东历史最低价商品查询，展示正处于历史低价的自营商品，好评≥97%品质精选，支持品类搜索、价格筛选、降价幅度排序，抄底捡漏必备。自动过滤无效标签，智能品类推荐，数据通过腾讯云代理安全转发。暑期历史低价抢购，京东自营超值商品 | |
| 京东自营新品首发 京东新品首发查询工具，展示最新上架自营商品，支持国补优惠和以旧换新，好评≥97%品质精选，支持品类搜索、价格筛选、优惠力度排序。自动过滤无效标签，智能品类推荐，数据通过腾讯云代理安全转发。暑期新品尝鲜，京东自营首发好物 | |
| 京东自营秒杀 京东秒杀频道限时好货查询，仅筛选京东自营商品，好评≥98%品质精选，支持品类搜索、价格筛选、折扣力度排序，手慢无。自动过滤无效标签，智能品类推荐，数据通过腾讯云代理安全转发。暑期限时秒杀，京东自营爆品抢购 | |
| 京东精选 京东六大频道聚合入口，超级补贴/新品首发/历史最低价/秒杀/9.9包邮/实时热销一个技能全搞定，仅筛选京东自营商品，好评≥98%品质精选，支持品类搜索、价格筛选和多种排序。自动过滤无效标签，智能品类推荐，频道间互推发现更多好货，数据通过腾讯云代理安全转发。暑期京东好物精选，品质好货推荐 | |
| 京东自营超级补贴 京东超级补贴频道好货查询，仅筛选京东自营商品，好评≥98%品质精选，支持品类搜索、价格筛选、补贴力度排序，结果不足时自动降级保证推荐。自动过滤无效标签，智能品类推荐，数据通过腾讯云代理安全转发。暑期数码家电补贴，京东自营超值低价 | |
| 京东自营实时热销榜 京东实时热销榜商品查询，展示当前畅销自营好货，好评≥98%品质精选，支持品类搜索、价格筛选、多种排序，发现大家都在买什么。自动过滤无效标签，智能品类推荐，数据通过腾讯云代理安全转发。暑期热销榜单，京东自营人气好物 | |
| 拼多多百亿补贴 拼多多百亿补贴频道好货推荐，全量仅568件稀缺精选商品，覆盖17个品类，4维好货评分模型智能排序，支持关键词搜索、价格筛选、品牌店筛选。暑期百亿补贴，拼多多官方正品低价 | |
| 拼多多实时热销榜 拼多多实时热销榜好货推荐，覆盖41个品类共707件商品，按销量智能排序，支持关键词搜索、价格筛选、品牌店筛选。暑期热销排行榜，拼多多实时爆款 | |
| 拼多多精选 拼多多商品搜索、详情查询和频道好货浏览三合一工具，支持百亿补贴/秒杀/销量榜等频道，返回优惠价格、优惠券和购买链接。夏日拼多多好物，精选高性价比商品 | |
| 淘宝好券精选 淘宝好券精选频道商品查询，天猫品牌店占比98%+，优惠券覆盖率90%+，涵盖洗护美容、咖啡零食等品类，价格多在5-50元，领券购物更省钱。暑期领券省钱，淘宝天猫优惠券汇总 | |
| 淘宝精选 淘宝天猫好货搜索比价领券，标品按到手价排序找最低价，非标品按销量排序找口碑好货，自动筛选包邮+消保+高评分商品，返回优惠券和购买链接。夏日淘宝精选比价，好货不贵 | |
| 淘宝天天特卖 淘宝天天特卖频道商品查询，100%天猫品牌店精选，涵盖家居日用、洗护清洁、零食粮油等全品类，价格多在5-30元，支持销量/价格/热度4种排序。夏日特卖好物，淘宝天天低价精选 | |
| 写给 Agent 看的文档（中文版） Write documents agents consume | |
| Agent Cli Orchestrator Orchestrates multiple AI CLI tools by auto-detecting, prioritizing, and switching between them for stable, fallback-enabled automated coding workflows. | |
| Ai Cli Orchestrator Orchestrates multiple AI CLI tools by auto-detecting, prioritizing, and switching among them for stable, seamless automation workflows with fallback on errors. | |
| no-barnacles Memory and safety discipline for long-running agents: hot/cold memory index, STATE.md working memory, incident ledger, injection contract. Setup or repair. | |
| Daolv Hotel Booking Hotel discovery, shortlist comparison, and booking handoff using the ai-go-hotel MCP server (getHotelSearchTags, searchHotels, getHotelDetail). Use when user... | |
| Daolv Hotel Booking Assistant Hotel booking-decision assistant using ai-go-hotel MCP (searchHotels + getHotelDetail). Use when users already have candidate hotels and need room-rate detai... | |
| Daolv Hotel Search Hotel search and shortlist comparison using the ai-go-hotel MCP server (getHotelSearchTags, searchHotels). Use when users need fast hotel discovery by city/P... | |
| RollingGo Hotel Search Hotel search and pricing via the RollingGo CLI. Use when the user wants to search hotels by destination, filter by date/star/budget/tags/distance, inspect ho... | |
| Ollama Web Search Web search via Ollama API. Returns relevant results from Ollama web search for AI agents. | |
| Python Env Setup Host-specific Python execution guidance for OpenClaw on this machine. Prefer $PYTHON over python/python3 in PATH, because OpenClaw exec runs in a non-interac... | |
| Agent Pattern Mining Study another AI agent, coding CLI, or assistant codebase and extract transferable patterns into concrete local improvements. Use when asked to learn from Cl... | |
| Lattice Initialize and manage Lattice organizations — a file-based operating system for AI agent teams that enables stable, long-running iterative development throug... | |
| Sats4AI Bitcoin-powered AI tools marketplace via MCP. Generate images (Flux, Seedream, Recraft), text (Kimi K2.5, DeepSeek, GPT-OSS), video (Kling V3), music, speech... | |
| Ai Engineering Interview Generates high-signal AI Engineering / LLM Engineer interview questions by topic, level, and role. Covers LLM fundamentals, prompt engineering, RAG, vector D... | |
| Backend Interview Designer Generates high-signal senior-level backend interview questions by topic. Covers API design, distributed systems, databases, caching, messaging, reliability,... | |
| Business English Coach A focused Business English coach for tech professionals in daily work situations — Slack messages, emails, standups, code reviews, 1-on-1s, meetings, and cli... | |
| Data Engineering Interview Coach An interactive data engineering interview coach that drills senior-level data engineering knowledge through a coaching-style mock interview — one question at... | |
| Db Internals Deep Dive Deep dive into database and messaging system internals — PostgreSQL, MongoDB, Redis, RabbitMQ, Kafka. Covers storage engines, replication, consistency, perfo... | |
| English Listening Coach Interactive English listening and dictation practice using real ESL content, with personalized feedback, vocabulary teaching, and comprehension exercises. | |
| English Reading Coach An interactive coach teaching and drilling seven core English reading strategies with real ESL texts to improve comprehension and active reading skills. | |
| English Writing Coach An interactive coach that teaches English writing by genre conventions, guides planning and drafting, and gives detailed feedback on content, coherence, voca... | |
| Ielts Practice Daily IELTS practice coach targeting Band 6.0–6.5. Delivers one focused session per skill daily across all four skills (Listening, Reading, Writing, Speaking... | |
| Toeic Practice Daily TOEIC practice coach for a user scoring 600+. Delivers one focused session daily for Parts 5, 6, and 7, explains answers with grammar and vocabulary no... | |
| Vietnam Fullstack Jobs Search ITviec, TopDev, ITJobs, and TopCV for the latest full-stack developer job listings using Firecrawl. Finds jobs with React, Next.js, TypeScript, Node.j... | |
| polymarket-predictradar-daily-anomalies-skills Polymarket Daily Anomaly Report. Scans for 3 types of market anomalies: Black Swan (sudden probability shifts in 2h windows), Whale Wars (large opposing bets... | |
| polymarket-predictradar-data-layer-skills Shared Polymarket and prediction-market data access layer. Use this skill whenever another skill or task needs trader positions, trade history, market metada... | |
| polymarket-predictradar-market-discovery-skills Polymarket hot market rankings & new market discovery. View trending markets by 24h volume/traders, discover newly listed high-momentum markets, browse activ... | |
| polymarket-predictradar-market-movers-skills Polymarket market probability movement detection. Real-time scanning of probability fluctuations in prediction markets to help users capture "information arb... | |
| polymarket-predictradar-news-impact-skills Breaking news + Polymarket market correlation analysis. Scan today's major news and track its impact on prediction market probabilities, or find all related... | |
| polymarket-predictradar-whale-alert-skills Polymarket Whale Alert — real-time large order monitoring. Queries the past 24 hours of smart money (HUMAN/MM/SIGNAL) large orders. Trigger words: whale, wha... | |
| arXiv to Zotero Find recent arXiv papers, skip what is already in Zotero, and save new imports with parent-item tagging and PDF attachments into a dedicated collection. |
21,751–21,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.