Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| J6B泊车日志分析 J6B泊车系统日志读取和分析。支持：日志文件定位、日志读取、常见错误识别、日志下载、系统资源性能分析。使用场景：查看日志、分析报错、排查问题、性能诊断、下载日志到本地。触发词：日志、log、slog2info、tail、grep、报错、错误、异常、失败、故障、性能、CPU、占用、下载、scp。 | |
| HaluCatch / 捕幻 Evaluates the reliability of AI Skill execution. Assesses whether a Skill's output is trustworthy, reproducible, and withstands business scrutiny when execut... | |
| md2pdf 将 Markdown 渲染为排版精美的 PDF，支持封面/目录/书签/页码/KaTeX/Mermaid/代码高亮。 Render Markdown to beautifully typeset PDF. Cover/TOC/bookmarks/page numbers/KaTeX/Mermaid/highligh... | |
| MyKnowledge 创建知识库、管理项目文档、记录需求、整理个人知识。Create knowledge bases, manage project docs, track requirements, and organize personal knowledge. | |
| SkillFlowChart 生成技能流程图、决策树、工作流图。读取 SKILL.md 或技能定义文件，提取决策节点与执行步骤，输出自包含 HTML 流程图（SVG，零依赖）。适用于可视化 Skill 执行流程、画决策树、生成 agent skill 的 decision flow diagram、流程可视化。Reads a SKILL.md... | |
| Moss Documentation and capabilities reference for Moss semantic search. Use for understanding Moss APIs, SDKs, and integration patterns. | |
| moss Documentation and capabilities reference for Moss semantic search. Use for understanding Moss APIs, SDKs, and integration patterns. | |
| poocr vatinvoice2excel 使用 poocr 库识别发票并导出 Excel。当用户需要识别增值税发票、批量处理发票文件或提取发票信息到 Excel 时调用此技能。 | |
| AKShare AKShare 开源金融数据接口库 - 支持A股、港股、美股、期货、期权、基金、债券、外汇、宏观数据，免费无需API Key。 | |
| backtrader Backtrader 开源量化回测框架 - 支持多数据源、多策略、多周期回测与实盘交易，纯Python实现。 | |
| BaoStock BaoStock 免费A股数据平台 - 支持K线、财务数据、行业分类查询，无需注册即可使用。 | |
| joinquant 聚宽量化交易平台 - 提供A股、期货、基金数据查询，事件驱动策略回测，支持在线研究与模拟实盘。 | |
| miniQMT miniQMT 极简量化交易终端 - 支持外接Python获取行情数据和程序化交易，基于xtquant SDK。 | |
| myquant 掘金量化Python SDK - 事件驱动量化平台，支持A股、期货、期权、ETF、可转债回测与实盘交易。 | |
| Ptrade Ptrade 恒生量化交易平台 - 策略运行在券商服务器上，低延迟执行，支持A股、期货、融资融券等中国证券市场。 | |
| pywencai 同花顺问财自然语言数据查询工具 - 使用中文自然语言查询A股、指数、基金、港美股、可转债等市场数据。 | |
| QMT QMT迅投量化交易终端 - 内置Python策略开发、回测引擎和实盘交易，支持中国证券市场全品种。 | |
| rqalpha RQAlpha 米筐开源事件驱动回测框架 - 支持A股和期货，模块化架构，可自由扩展。 | |
| tqsdk 天勤量化TqSdk - 开源Python期货/期权交易SDK，提供实时行情、回测和实盘交易功能。 | |
| tushare Tushare Pro 金融大数据平台 - 提供A股、指数、基金、期货、债券、宏观数据，Token认证方式访问。 | |
| vnpy vn.py 开源量化交易框架 - 支持CTA、价差、期权策略，20+券商接口，覆盖国内外市场。 | |
| xtdata XtQuant行情数据模块 - 为QMT/miniQMT提供实时行情、K线、Tick、Level2和财务数据。 | |
| xtquant XtQuant QMT Python SDK - 集成行情数据(xtdata)和交易接口(xttrade)，支持A股、期货、期权等中国证券市场。 | |
| Agent Communication Protocol ACP channel plugin for OpenClaw — configure and use. Covers single/multi identity configuration, strict 1:1 binding policy (agentId <-> accountId), agent.md... | |
| Acp ACP channel plugin for OpenClaw — configure and use. Covers single/multi identity configuration, strict 1:1 binding policy (agentId <-> accountId), agent.md... | |
| GitHub Trending Report Fetch and generate structured reports on fastest-growing repos, newly popular projects, and hot GitHub topic tags using github-discover CLI. | |
| Firefly AI Fetch meeting transcripts, summaries, and action items from Firefly AI (fireflies.ai). Use when the user asks about meetings, transcripts, meeting notes, act... | |
| Loci — Memory Palace for AI Memory Palace for AI — persistent structured memory, identity, and task management across every conversation. | |
| Mbti Personality MBTI personality system for AI agents. Switch your AI's personality, thinking style, and communication tone. Supports 4 presets, 16 MBTI types, 32 custom com... | |
| MBTI Personality This skill should be used when the user asks to "switch personality", "change MBTI", "set personality to INTJ", "切换人格", "MBTI人格", "换个性格", "用ENFP的风格", "技术大佬",... | |
| Tencent Cloud Article Extractor 提取腾讯云开发者社区文章内容并转换为 Markdown 格式。当用户需要抓取、解析或保存腾讯云文章时使用此技能。支持自动提取标题、作者、发布时间、正文内容，并生成格式规范的 Markdown 文档。触发词：腾讯云文章、抓取文章、解析文章、cloud.tencent.com/developer/article | |
| Zhipu Image Generator AI text-to-image generation using Zhipu AI's GLM-Image model. Use when the user requests image generation, creating images from text descriptions, or mention... | |
| 知识星球助手 知识星球助手 - 登录、发帖、管理知识星球。当用户需要操作知识星球（登录、发帖、查看内容）时使用此技能。触发词：知识星球、zsxq、发帖、星球登录。 | |
| AI Stem Splitter Use when the user wants to split a song or audio file into vocals, drums, bass, guitar, piano, and other stems; remove vocals for karaoke; extract acapellas... | |
| Profitabul Real-time futures market intelligence, GEX/options flow analysis, trading signals, paper trading, backtesting, and live execution via MCP. Covers ES, NQ, SPX... | |
| Truncus Email Send transactional emails (alerts, reports, receipts, notifications) via the Truncus API. Use when a workflow needs to deliver email to a recipient. | |
| AgoraHub AgoraHub agent registry — discover and use 14+ verified AI agents for dev tasks like hashing, encoding, formatting, and more. No signup needed for demo agents. | |
| cat-sticker 猫猫表情包技能系统。分析输入文本情绪，从 custom_stickers.json 自动匹配对应表情，支持概率/开关/冷却调节指令。 | |
| Server Guardian 服务器健康监控与自动恢复技能。当服务器出现卡顿、崩溃、Bot 连接异常或网关中断时使用此技能。支持：执行健康检查、自动诊断故障、一键恢复 Gateway、清理内存/磁盘、整理日志、检查 OOM Killer 等操作。触发场景包括：服务器变慢、Bot 无响应、日志报 ERROR、内存/磁盘告警、进程消失等任何异常情... | |
| BrainRepo Your personal knowledge repository — capture, organize, and retrieve everything using PARA + Zettelkasten. Triggers on: "save this", "remember", "note", "capture", "brain dump", daily/weekly reviews, searching stored knowledge, managing pro | |
| academic-paper-citation 学术论文引用自动化处理工具。用于处理中文学术论文（特别是硕士/博士论文）的引用管理工作，包括从Word文档提取内容并转换为Markdown、自动识别和提取参考文献列表、在论文正文中智能插入引用标记、将处理后的Markdown转换回Word格式、扩充论文字数以满足字数要求。适用于需要批量处理引用格式、整理参考文献、... | |
| codia-design-skills Create, edit, enhance, convert, and manage images, design resources, and visual assets with Codia Design Skills and the Codia Open API. Use when the user asks to generate images, posters, campaign creatives, product listing images, ecommerc | |
| Fortuna Lottery Participate in the FORTUNA autonomous agent lottery on Solana. Buy lottery tickets by sending SOL to the treasury. Check jackpot size, round countdown, and d... | |
| the skill to browse X X/Twitter CLI using OpenClaw browser tool. Use when the user wants to interact with X/Twitter: reading timeline, posting tweets, liking, retweeting, replying... | |
| UUMuse Brain Access, search, manage, and retrieve information from your UUMuse uploaded documents, knowledge bases, and long-term memory across sessions. | |
| yunxiao-devops 与阿里云云效（Yunxiao）DevOps 平台交互，覆盖八大核心能力：项目协作 Projex、 代码管理 Codeup、流水线 Flow、应用交付 Appstack、制品仓库 Packages、 测试管理 Testhub、效能洞察 Insight、知识库 Thoughts。 当用户提到云效、Projex、Cod... | |
| QClaw Config Guardian Automation skill for QClaw Config Guardian. | |
| xvfb-chrome 在Linux服务器上使用Chrome浏览器(无头/有头模式)配合xvfb运行，可连接chrome-devtools MCP进行浏览器自动化 | |
| CodivUpload Social Manager Social media scheduler, cross-poster, and content calendar for OpenClaw. Schedule social media posts, publish content, cross-post to multiple platforms, auto... | |
| CRMy CRMy agent — manages contacts, accounts, deals, and pipeline using the CRMy CRM. Search before creating. Log every meaningful interaction. Always suggest nex... |
22,151–22,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.