Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| xxx Capture frames or clips from RTSP/ONVIF cameras. | |
| pricewin-booking-assistant Recommend hotel rooms and complete a real booking end to end — reserve an OpenTravel direct property with a payment link (bank QR, card, or PayPal), check payment status, resend an expired link, or cancel a booking. Falls back to direct Boo | |
| pricewin-flight-search Search live flight fares for a route and date across Agoda, Trip.com, and Traveloka — one-way or round-trip, any cabin, with airline, times, stops, duration, and a direct booking link. Use when the user wants flight prices, plane or air tic | |
| pricewin-hotel-deal-finder Find the cheapest hotel deal by comparing live prices across Booking.com, Agoda, Google Hotels, and OpenTravel for any city worldwide and any travel dates — one command returns ranked best-value, cheapest, and quality picks with direct book | |
| pricewin-hotel-search Search hotels live across Agoda + Booking.com + Traveloka + OpenTravel with realtime pricing for specific dates. Use when user wants hotel prices for travel dates, comparing OTAs, or finding rooms. | |
| pricewin-price-comparison Compare live hotel room rates across Booking.com, Agoda, Traveloka, and OpenTravel for specific dates — which OTA is cheapest for the same property, per-room prices, and free-cancellation terms. Use when comparing hotel prices, checking roo | |
| Translate Image Translate text in images, extract text via OCR, and remove text using TranslateImage AI. Use when user says 'translate image', 'OCR image', 'extract text fro... | |
| ThoughtCodec 思维编解码 Bilingual AI skill library for turning abstract intent into executable workflows and compressing repeated practice into reusable skills. | |
| Irish Takeaway Finder Find nearby takeaways in Ireland and browse menus via Deliveroo/Just Eat. Uses Google Places API for discovery and browser automation for menu scraping. | |
| Personal Docker Manager Manage Docker containers, stacks, templates, images, networks, volumes, users, and monitor system resources via the Arcane Docker Management API. | |
| PixelMagic-PhotoLogic-9z 专业图像后期处理工具。支持多种修图风格（末日大片、日系清新、复古胶片等），自动检测并安装 ImageMagick，支持 RAW/JPG/PNG 等多种格式，提供批量处理和自定义预设功能。Use when: (1)用户需要修图/调色/加滤镜, (2)处理 RAW 格式照片, (3)批量处理图片, (4)创建自定义修图预设 | |
| 资产负债表生成 根据财务报表Excel文件自动生成规范资产负债表，应用11条规则保留格式和公式，支持银行账户和利润合计计算。 | |
| 利润表生成 根据明细表数据，自动生成规范格式利润表，收入支出按分类 2/3 分组动态汇总，含经营利润计算、固定格式和列宽。 | |
| 交易记录生成 根据指定账期的招商银行活期、理财及对公账户源数据生成包含明细和资金汇总的标准化交易记录Excel文件。 | |
| Designers Eye Get honest design feedback. Upload any visual — UI design, logos, photos, graphics, PDFs — and get prioritized critique: what's broken, what works, what to p... | |
| Steve Krug Ux Audit Perform a UX audit on any website or web app using Steve Krug's proven methodology. Provide a URL or local path and get a structured usability review grounde... | |
| Writing Tone Clone Clone someone's writing tone from sample text and produce a ready-to-use voice skill. Provide writing samples (diary, blog posts, emails, social posts) and g... | |
| Cournot Cournot Intelligence Skills let AI agents ask a plain-language question about a crypto event and receive a structured probability, the exact claim being evaluated, and the sources behind it. | |
| Telegram .md File Uploader Uploads and sends .md files from your OpenClaw workspace to a specific Telegram chat using the Telegram Bot API. Use when you need to share workspace files (... | |
| covision Access your Covision tasks, meetings, and published knowledge to prepare for client work and review assigned or overdue items confidentially. | |
| Kid Point Voice Component SenseAudio Voice - 语音合成 (TTS) + 语音识别 (ASR)，支持语言自动切换 | |
| Kids Points V2 儿童积分管理 V2 - SQLite 存储 + LLM 语义分析 + CLI 接口，飞书群聊与单聊全量支持 | |
| Schedule Manager 日程任务管理 - 查看/添加/修改/删除定时任务和临时提醒 | |
| SenseAudio Podcast Generator 双主播播客生成器 - 输入话题自动生成播客音频，支持LLM智能生成脚本、克隆音色、文字生成音色、自定义语速语调、多种音色可选 | |
| SenseAudio Voice CN SenseAudio Voice - 语音合成 (TTS) + 语音识别 (ASR)，支持语言自动切换 | |
| API Tool Calls Describes remote MCP tools and connection settings for API Tool Calls for requests involving SVG QR codes, barcode scans and SVG barcodes, public YouTube captions, public pages converted to Markdown, full data source plans, CPSC recall noti | |
| meeting record analysis 将会议录音转成结构化会议纪要。适用于用户上传会议音频后，希望通过 ASR 转写、LLM 总结和可选 TTS 播报，自动提取会议主题、讨论要点、决策和行动项的场景。输入支持 `audio_file`、`need_voice_summary`、`language`；默认输出 JSON 结构化纪要，并可附带语音摘要文件路径。 | |
| review simulate 进行中文求职语音模拟面试。适用于用户想围绕目标岗位进行多轮中文面试练习，并通过 ASR 识别回答、由 LLM 决定追问或换题、由 TTS 播报面试官问题，最终输出结构化评估报告、改进建议和示例优化回答的场景。支持 `target_role`、`interviewer_style`、`min_rounds`、`ma... | |
| AkShare Analysis Analyze Hong Kong (5-digit) and A-share (6-digit) stocks across six dimensions to generate BUY/HOLD/SELL signals with confidence scores using akshare data. | |
| GifHorse Search video dialogue and create reaction GIFs with timed subtitles. Perfect for creating meme-worthy clips from movies and TV shows. | |
| OmniFocus Automation Manage OmniFocus tasks, projects, and folders via Omni Automation. Use for task management, to-do lists, project tracking, GTD workflows, adding/completing/editing tasks, setting due dates, managing tags, and recurring tasks. Requires OmniF | |
| Declaration Sign Read the Declaration of Intelligence and, if you choose, sign it with a key-verified Ed25519 signature that proves your identity across sessions, models, and... | |
| Manage quark-auto-save(QAS, 夸克自动转存, 夸克转存, 夸克订阅) tasks via CLI. Manage quark-auto-save tasks via CLI. (QAS, 夸克自动转存, 夸克转存, 夸克订阅, 管理任务, 运行任务, 修复失效链接, pan.quark.cn) | |
| find-skills Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... | |
| multi-search-engine Multi search engine integration with 17 engines (8 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and Wolfra... | |
| proactive-agent-3.1.0 Transform AI agents from task-followers into proactive partners that anticipate needs and continuously improve. Now with WAL Protocol, Working Buffer, Autono... | |
| tavily-search AI-optimized web search via Tavily API. Returns concise, relevant results for AI agents. | |
| wechat-mp-publisher 远程微信公众号发布技能 (合规优化版)。通过 HTTP MCP 解决家用宽带 IP 变动问题，支持安全凭证隔离与依赖检查。 | |
| Agent Browser - 浏览器自动化 A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| Book Recommender - 书籍推荐 Recommend books based on interests or history, check Douban ratings and reviews, and manage reading notes and book lists. | |
| CN Life Toolkit - 中国生活服务工具包 中国生活服务工具包，支持天气查询（街道级）、限行提醒、油价查询、快递物流跟踪、公交换乘查询等日常生活服务。 | |
| Coding Agent Delegate coding tasks to Codex, Claude Code, or Pi agents via background process. Use when: (1) building/creating new features or apps, (2) reviewing PRs (sp... | |
| Coding Lite - 轻量级编码助手 轻量级编码助手，支持 Python 脚本生成与执行、Excel/WPS 函数自动化、小程序代码生成、SQL 查询助手。快速响应，不占用过多 context。 | |
| Countdown Timer - 倒计时助手 提供倒计时管理、重要日子提醒、番茄钟工作休息定时及自定义提醒功能。 | |
| Calendar Manager Manage your schedule by adding, viewing, modifying, deleting events, and setting smart reminders for meetings, birthdays, and important dates. | |
| Email Helper Generate and suggest formal or informal email drafts, reply templates, and organize emails by category and priority in Chinese and English. | |
| Meeting Assistant Generate meeting summaries, extract action items with deadlines, coordinate schedules, and manage meeting templates and reminders. | |
| Recipe Finder 推荐适合现有食材的菜谱，提供详细做法、烹饪技巧及营养信息，支持随机和个性化推荐。 | |
| Data Analytics Assistant - 数据分析助手 数据分析助手。支持网站访问统计、用户行为分析、转化率优化建议。 | |
| Email Helper - 邮件助手 提供中英文邮件草稿生成、回复建议、模板应用及收件箱邮件分类整理功能，支持正式与非正式语气调整。 |
22,701–22,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.