Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Smart Task Scheduler 智能任务与排班管理系统，支持多时段工作安排、动态排班和上班时间自适应提醒 | |
| Aliyun Use Aliyun Bailian(百炼) for LLM chat, and language translation. Use when you need to generate code, generate text with LLMs, or translate between languages. | |
| Kimi Use Kimi Use provides conversation, image understanding, translation, and web search via Kimi AI tools using Node.js and Kimi For Coding APIs. | |
| Minimax Use MiniMax AI tools for web search, image analysis, LLM chat, and language translation. Use when you need to search the web, analyze images, generate text with... | |
| Unbrowse Openclaw Analyze any website's network traffic and turn it into reusable API skills backed by a shared marketplace. Skills discovered by any agent are published, scor... | |
| Apartment Cleaning Book a professional apartment cleaning in San Francisco via the claw.cleaning REST API. Use when someone wants to book, schedule, or inquire about apartment... | |
| Document Diff Compare two documents or files and generate a structured diff report. Use when: user asks to compare files, find differences between documents, generate diff... | |
| 前端性能分析 分析前端页面性能并输出结构化优化报告 | |
| openviking-token-saver OpenViking context database for AI agents — layered context loading (L0/L1/L2), semantic search, file-system memory management. Use when: (1) setting up Open... | |
| Save All Resource 打开一个可见浏览器，让用户手动浏览目标网站，并在浏览过程中持续监听同域原始响应内容，实时落盘到本地桌面目录。 | |
| ThinkPHP UI Restoration Generate and restore ThinkPHP UI components using this project's existing conventions. Use when the user asks to create or restore `.tpl` components, adapt s... | |
| donglun-cli 在东方热线论坛（东论）发帖、回帖、浏览热帖、查看帖子和回复。支持从环境变量或配置文件读取 token，无需登录。 | |
| Calorie Counter Track daily calorie and protein intake, set goals, and log weight. Use when user mentions food they ate, wants to know remaining calories, or needs to track weight. Stores data in SQLite with automatic daily totals. | |
| mdclaw多模态图片视频生成 MDClaw OpenClaw API 技能，支持文字转语音(TTS)、文生图(Text to Image)、文生视频(Text to Video)、图生视频(Image to Video)等多模态 AI 能力。通过网关服务统一调用，支持账号注册、图片上传、任务轮询等完整功能。 | |
| Novel Assistant 小说创作助手，维护小说连贯性和一致性。核心功能：(1) 创建/续写小说章节 (2) 管理人物设定和世界观 (3) 追踪伏笔和时间线 (4) 压缩记忆文件控制上下文 (5) 本地章节备份 (6) 多作品并行管理 (7) 人物对话风格样本库。触发词：小说、章节、续写、人物设定、创建小说、世界观、伏笔、时间线、剧情概要... | |
| Wenyan Compress 将白话文/英文压缩成简洁的文言文，节省token。支持保真模式、压缩比统计、忠实度检查 | |
| 智能照护排班 通过对话即可完成养老机构护理排班，简单快捷 | |
| Silver Daily 银发头条（Silver Age Daily）—— 一键生成当日银发经济精选资讯简报。 覆盖：政策解读、银发消费、老年金融、银发科技、医疗健康、银发文娱、居家养老、银发就业八大板块。 每次生成一份带新闻链接、带摘要的 HTML 格式日报，风格简洁大方，适合老年产业从业者、研究者、投资人及关注银发经济的人士阅读。 U... | |
| "微信公众号草稿上传" 将本地 Markdown 文章上传到微信公众号草稿箱。当用户提到"上传文章到公众号"、"发布到微信公众号"、"推送到公众号草稿"等场景时应使用本技能。本技能通过调用微信公众平台 API，自动完成 Markdown 转 HTML、封面图生成/上传、创建草稿等全流程操作。 | |
| Api Design Doc 标准化API接口设计文档生成工具。根据需求文档、数据库DDL等输入，进行API的标准化、规范化设计，输出完整的API接口设计文档，包括错误码规范、接口格式规范、入参出参定义、JSON示例等，指导后续的代码开发和前后端联调。使用场景包括：(1) 根据业务需求设计RESTful API接口，(2) 基于数据库DDL生... | |
| Jira BUG Analysis Assistant[Jira-BUG分析助手] 从 Jira Server/DC 拉取 Bug 数据，进行全面的 AI 分析，并生成交互式 HTML 报表。 分析维度包括：Bug 趋势、优先级/严重程度分布、组件热点、解决时间、经办人负载、 未解决 Bug 老化等。当用户要求分析 Jira Bug、生成 Bug 报表、或查看 Bug 指标时使用此 Skill；支持自定义报表指标维度。 | |
| Image Vision Analyze and interpret images by describing content, extracting text, answering questions, comparing visuals, and extracting structured data from JPG, PNG, GI... | |
| Video Editor Perform video editing tasks with ffmpeg, including cutting, merging, converting formats, extracting audio, adding subtitles, resizing, cropping, adjusting sp... | |
| TelCall Twilio Make emergency phone calls via Twilio. Use when you need to call someone and play a voice message programmatically (e.g., server down alerts, security notifi... | |
| frontel-call-brief Turn a business owner's public services, opening hours and FAQs into a concise phone-answering brief and blank call-note template. Use when preparing business reception information, not to answer live calls or confirm bookings. | |
| image-export-preflight Prepare an image for a destination with format, transparency, or file-size requirements. Choose a delivery format, test one export in the browser, and verify the downloaded file before batch conversion. | |
| pronunciation-feedback-practice-planner Turn a learner's supplied sentence and existing pronunciation feedback into a short, repeatable practice plan and comparison log. Use for planning practice after a check, not for scoring audio or certifying language ability. | |
| Cmux Control cmux terminal multiplexer via its Unix socket API. Use when needing to: (1) List, create, select, or close workspaces; (2) Split panes and manage sur... | |
| Generate Poster 通过 Flyelep API 生成电商产品主图和详情图海报。 当用户要求生成产品图、电商海报、Amazon 商品图、详情页图片时使用此技能。 | |
| 微信公众号文章阅读器 读取并提取微信公众号文章标题、公众号名称及正文内容，支持移动端访问和自动重定向，适用于mp.weixin.qq.com链接。 | |
| BinanceAlert Binance smart alert system. Monitors price/change alerts, new listings, Alpha airdrop opportunities, and HODLer announcements via Telegram. No Binance API Ke... | |
| Browser Automation Zero Token Build and run low-code browser automation workflows with agent-browser CLI and reusable skills, especially for repetitive web tasks like 登录、签到、表单填写、固定点击流程、状态... | |
| Daily Review Assistant Generate A-share daily review report (stock-analysis/daily_review.py). Supports --email. | |
| Stock Review Provides daily A-share market review with data on top traders, sector limits, fund flows, streaks, sentiment, and next-day strategies. | |
| A股分时量能分析 提供A股实时行情、分时成交量分布及主力资金动向分析，支持持仓管理和盈亏监控。 | |
| 循古黄历 循古黄历 - 获取中国万年历信息，包括二十四节气、农历日期、宜忌、吉凶、黄道吉日等。当用户询问节气、农历、日子好坏、宜忌、黄历相关问题时使用此技能。 | |
| 🔮 循古·算命（八字·每日运势·六爻·大六壬·禄命·大运流年） 🔮 八字·六爻·大六壬·每日运势·禄命古法·算命·占卜·大运流年·流年预测·命理分析 循古玄学算命助手 — 支持八字排盘、六爻占卜、大六壬预测、禄命古法测算、今日运势查询、大运流年分析。基于循古排盘 (xungufa.com) 专业命理引擎。 当用户明确请求算命相关服务（如「帮我算八字」「查今日运势」「起一卦」... | |
| Narrative Focus Narrative Focus — detect and fix "narrative weight misalignment" in technical tutorials and interview prep articles. Trigger when users ask to review technic... | |
| quiet-mail Provide AI agents with unlimited, no-verification email sending via a simple API using your own agent identity on a reliable, free mailcow infrastructure. | |
| FlapJax FlapJax (FLAPJAX on BNB Smart Chain), read-only. The creed ("compute is calories", receipts over rockets), where FLAPJAX/BNB balances are publicly readable, and links to the Living Canon, Spreaders board, and kit. No keys, no signing, no tr | |
| tencent cvp skill All-in-one Android phone automation via ADB: screen analysis, touch/input, foreground app detection, app install. Use for any task that involves operating th... | |
| Cobo Agentic Wallet Create and manage agentic wallets with Cobo. Use for autonomous onchain operations via the caw CLI: token transfers, contract calls, pact creation and approv... | |
| PARA + Proactive Agent Workspace A production-ready workspace template combining PARA Method (Projects, Areas, Resources, Archives) by Tiago Forte with Proactive Agent Architecture for file... | |
| Tencent Cloud Infra The unified, full-coverage skill for ALL Tencent Cloud operations via tccli CLI. This skill supersedes and replaces any single-product cloud skills (includin... | |
| Tencent Cloud Management Tool 通过 tccli 命令行管理腾讯云资源。 Load when: 用户要查询云服务器、管理 Lighthouse、购买域名、配置 DNS、 检查安全组、做安全巡检、部署应用、挂载云硬盘、部署 OpenClaw、 监控资源状态、SSL 证书检查、CAM 权限管理。 Covers: CVM、Lighthouse、CBS... | |
| brand-slogan 华与华方法论品牌谚语生成器。 输入品牌名与品牌资料，自动执行「定策略 → 组合修辞 → 打分排序」三步流程， 输出 7 策略 × 7 修辞 = 49 条品牌谚语，并按百分制评分由高到低排列 Top 10。 | |
| marketing-calendar 华与华营销日历创意生成器。 输入品牌名与品牌资料，自动执行「盘点品牌资产 → 匹配文化母体 → 五要素创意 → 打分筛选」流程， 输出≥80分的营销日历活动方案，并生成可视化 HTML 报告。 | |
| qcstory 华与华 QCstory 周改善教练。 输入改善课题，AI 教练逐步引导完成松浦九条全流程： 明确课题 → 把握现状 → 设定目标 → 找出真因 → 制定对策 → 实施对策 → 基准化 → 反思 → 下一课题。 每步有标准点评，不合格引导修改，最终输出完整改善报告。 | |
| Notes Skill / 笔记技能 SQLite 笔记管理系统。由 AI agent（霜糖）代为管理和操作笔记。 触发场景： - 用户说"笔记..."、"记一下..."、"帮我记..."、"存一条笔记" - 用户说"找一下..."、"搜一下关于...的笔记" - 用户说"列出笔记"、"有哪些笔记" - 用户说"标记已整理"、"归档" - 用户说"备... | |
| ssy-batchjob-async-job Use BatchJob HTTP APIs for strict upload validation, precheck, submit, polling, and cancellation. Full-auto file source resolution (file_id/local path/public... |
21,801–21,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.