Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| karpathy-coding-rules Karpathy 编程四原则｜解决 AI 写代码常犯的 4 类错误：不过脑子假设、过度工程化、乱改无关代码、只管写不管对。基于 Andrej Karpathy 观察，触发于写脚本/自动化/修复 bug 等编码任务，让 AI 输出更可靠。 | |
| Privacy Guard 自动检测OpenClaw日志中的API密钥、密码、身份证等敏感信息泄露，分级报警并支持交互确认和白名单管理。 | |
| Html Slides To PPTX 编写可无损还原为 PPTX 的 HTML 幻灯片。先经引导式访谈确认样式/形式/结构并落盘 deck-brief,再生成完整目录结构(assets/theme.css、slides/*.html、playlist.json), 每页严格遵循 html-spec.md 规范,经 validate.js 预检零 ERROR 后用 convert.js 转成 PowerPoint。TRIGGER when: 用户要求"做PPT/幻灯片/slides/演示文稿"、"把内容做成 HTM | |
| Backtest Analyzer 回测分析工具。从交易记录CSV计算回测核心指标：
胜率、盈亏比、最大回撤、夏普比率、获利因子、
最佳/最差单笔交易。支持JSON报告导出。
Use when: 需要评估交易策略表现、分析回测结果、
计算策略风险指标、对比不同策略。
🎉 v1.0.0 指标:
- 总交易数 / 盈利交易 / 亏损交易
- 胜率 / 盈亏比 / 获利因子
- 总收益率 / 平均每笔收益
- 最大回撤 / 夏普比率
- 最佳/最差单笔交易
触发关键词：回测分析、策略评估、量化交易、交易统计
适 | |
| CCPA Compliance 美国加州消费者隐私法（CCPA/CPRA）合规检查、风险评估和文档生成工具。
为涉及加州消费者数据的业务提供全面的CCPA/CPRA合规解决方案。
Use when: 需要进行CCPA/CPRA合规自查、消费者权利保障检查、选择退出机制实现、
数据销售合规检查、服务提供商管理、隐私合规体系建设。
🎉 v1.1.0 安全增强更新：
- 🔧 全新统一化CLI接口，与PIPL、GDPR工具体验一致
- 📊 支持JSON/Markdown/HTML/CSV多格式报告输出
- 🚀 | |
| CSV Tools CSV 工具集 v1.1.0 — 子命令+安全增强。
预览、筛选、排序、合并、分割、去重、验证、统计、
列操作(重命名/选择/计算列)、类型检测、数据画像、抽样。
纯Python标准库(csv模块)，无外部依赖。
Use when:
- 需要快速处理CSV文件（预览/筛选/排序/统计）
- 合并多个CSV文件或分割大CSV文件
- CSV数据去重、列操作、类型检测、数据画像
Do NOT use when:
- 非CSV格式数据（JSON/YAML/Excel/数据库）
| |
| data-audit 数据操作审计追踪器 (Data Audit)。
对数据目录生成 SHA256 快照、比对文件变化（新增/删除/修改）、
记录操作日志、检查数据目录健康状态。
适用于数据合规场景中的操作追溯和审计准备。
Use when: 需要追踪数据文件变化、生成审计快照、
合规审查准备、文件完整性验证、数据目录健康检查。
🎉 v1.1.0 核心功能：
- 📸 数据目录 SHA256 快照
- 🔄 快照对比（新增/删除/修改检测）
- 📝 操作日志记录与查询
- 🔍 数据目录健康检查
- | |
| Excel2Insights Pro Analyze and visualize Excel/CSV/TSV data with automated stats, quality checks, charts, and generate structured insight reports in Markdown or HTML. | |
| Finance Tools 财务分析工具集 v1.1.0。7个子命令覆盖财务分析全流程。
自动识别CSV中的金额、日期、类别列。
纯Python标准库，无外部依赖。
Use when: 需要快速分析交易数据、计算财务比率、
查看收支趋势、分类汇总、预算对比、同比环比、趋势预测。
🎉 v1.1.0 功能:
- analyze — 收支汇总 + 分位数 + 月度净额
- ratios — 财务比率(毛利率/净利率/ROE/ROA/ROI/负债率)
- trend — 月度趋势(含MA移动平均和YoY)
| |
| Fund Flow 资金流向分析工具 v1.1.0。分析股票/板块的主力资金净流入排行、
散户资金对比、净额排序。支持资金趋势检测(3/5/10日)、
板块聚合分析、多时间维度(日/周/月)、与指数对比、强度评分。
Use when: 需要分析资金流向趋势、
查看主力资金动向、板块资金对比、资金强度评分。
🎉 v1.1.0 新增:
- --trend: 资金趋势检测(3/5/10日方向 + 持续性)
- --sector: 板块聚合分析(按板块汇总资金)
- --timeframe: 多时间 | |
| GDPR Compliance 欧盟通用数据保护条例（GDPR）合规专用工具。覆盖合法处理基础、同意管理、
数据主体权利、DPIA、跨境传输、安全措施等核心合规领域。
🎉 v1.2.0 安全增强更新：
- 🔧 全新统一化CLI接口，与PIPL、CCPA工具体验一致
- 📊 支持JSON/Markdown/HTML/CSV多格式报告
- 🚀 跨法域检查：可与PIPL、CCPA配合使用
- 🔒 纯本地运行（pandas/jinja2可选增强）
- 🔒 移除 subprocess 脚本，升级依赖版本，通过安全扫 | |
| Market Sentiment Analyze market sentiment with a 0–100 score based on four dimensions, providing market state and trading suggestions. | |
| Market Signals 技术信号扫描器 v1.1.0。从价格数据计算RSI(14)、均线(5/10/20)、
成交量异动、ATR波动率、MACD、布林带(±2σ)、VWAP。
综合评分(0-100)给出买入/关注/观望/回避建议。
支持多股票一键扫描(scan)、信号历史追踪(history)、支撑/阻力位识别。
Use when: 需要快速扫描多只股票的技术面、
获取买入/卖出信号、信号历史分析、支撑阻力位参考。
🎉 v1.1.0 新增:
- 布林带(±2σ, %b, 带宽)
- VWAP 成 | |
| PIPL-Compliance 中国个人信息保护法（PIPL）合规检查、风险评估和文档生成工具。
为企业提供全面的PIPL合规解决方案。
Use when: 需要进行PIPL合规自查、个人信息处理风险评估、
合规文档生成、企业合规管理、数据处理影响评估、跨境传输合规检查。
🎉 v1.1.9 重要更新：
- 🔧 全新统一化CLI接口，简洁高效
- 📊 支持JSON/Markdown/HTML/CSV多格式报告输出
- 🧹 精简核心文件，移除冗余演示脚本
触发关键词：PIPL、个人信息保护法、合规检查、风 | |
| Privacy Check 隐私敏感信息扫描器 (Privacy Check) v1.0.1。
检测15+种敏感个人信息：身份证号、手机号、邮箱、银行卡、信用卡、
SSN、护照、驾驶证、微信号、支付宝号、API密钥等。
支持 JSON/CSV/HTML 报告输出、白名单忽略、文件类型过滤。
Use when: 需要在数据文件中发现敏感信息、
数据发布前做隐私审查、合规检查准备、数据脱敏预处理。
🎉 v1.0.1 安全增强更新：
- 6 种新增PII模式（信用卡、SSN、港澳台护照、驾驶证、微信号、支 | |
| Skill Compliance Skill上架合规检查器（面向国内平台）。在上传前检查skill是否符合国内监管要求，包括金融敏感词、免责声明、安全红线等。 | |
| Stock Planner 交易计划生成器。基于当前持仓、市场状态和策略规则
生成下一交易日的买卖建议。支持仓位风险评估、
止损止盈检查、仓位控制、买入优先级排序。
Use when: 需要每日交易计划、仓位管理、
风险控制检查、持仓评估。
🎉 v1.0.0 功能:
- 持仓盈亏分析(逐只股票)
- 止损检查(亏损≥-8%自动标记)
- 止盈建议(盈利≥+20%分批止盈)
- 仓位控制(根据市场状态调整)
- 操作建议生成
触发关键词：交易计划、仓位管理、止损止盈、投资管理
适用范围：CSV 持仓 | |
| Stock Screener 🔎 多因子选股器 v1.0.2。连接 fund-flow / market-signals → stock-planner 的桥梁。
支持按 RSI、均线信号、量比、主力资金、PE、PB、市值、价格、涨跌幅等条件多因子筛选，
以及综合评分排序、单股明细分析、因子相关性分析。
Use when: 需要根据技术面/资金面/基本面条件筛选股票、
对多股票综合评分排序、因子相关性分析、为交易计划(stock-planner)准备候选池。
触发关键词：选股、筛选、screener、 | |
| Trade Tracker 交易追踪与归因分析 v1.1.0。从交易记录逐笔追踪盈亏、
按股票/月度/季度/年度归因、交易成本分析(佣金+滑点)、
持仓时间分析、策略标签归类、多策略对比、ASCII盈亏分布图。
Use when: 需要复盘交易记录、归因分析、
查看按股票/时间段的盈亏分布、成本分析、持仓结构。
🎉 v1.1.0 新增:
- 月度/季度/年度归因分解(--by month/quarter/year)
- 交易成本分析(--cost: 佣金占比、滑点估算)
- 持仓时间分析(--hol | |
| Snyk Vulnerability Scanner Automates Snyk security vulnerability scanning, GitHub issue reporting, and auto-fix PR creation for repositories. Use when scanning repositories for securit... | |
| fund-screening 基金筛选与定投实战技能。使用五维筛选体系（业绩/经理/风格/持仓/机构）从天天基金网和晨星网筛选优质基金，构建投资组合并执行定投策略。触发场景：用户提到"基金筛选"、"基金定投"、"选基"、"筛选基金"、"基金组合"、"定投策略"、"fund screening"、"fund DCA"，或要求推荐/分析/对比基金... | |
| Writing Reboot Review 帮助用户做写作复盘、内容定位梳理和写作重启规划。通过结构化深度对话识别断更或写不下去的真实原因，澄清继续写作想获得的收益，提炼适合长期输出的独特价值，并产出明确的目标读者、内容方向和可执行的重启建议。Use when users ask for 写作复盘、写作定位、内容定位、写作方向梳理、深度写作对话，或提到断更... | |
| FDE Customer-Product Bridge FDE 客户-产品-研发连接器。用于客户需求调研、现场 Demo、案例包装、客户讲解、客户反馈转产品需求和研发任务。适用于用户要求做客户访谈、现场调研、Demo 脚本、案例沉淀、方案讲解、需求反馈单、研发验收标准、客户问题复盘时。 | |
| xianyu-api-client-skill Secure Xianyu Guanjia API client with endpoint allowlisting, enforced confirmation for high-risk actions, dry-run mode, and unsafe methods for automation. | |
| xianyu-automation-skill Enterprise-grade automated operations for Xianyu stores with full lifecycle management, confirmation safeguards, and intelligent decision engine. | |
| xianyu-product-manager-skill Intelligent product management for AI service providers on Xianyu platform with professional templates, dry-run review, and enforced confirmation for product... | |
| Vibetrading Build, backtest, and deploy cryptocurrency trading strategies using the vibetrading Python framework. Use when: (1) generating trading strategies from natura... | |
| Seedream 使用火山引擎 Seedream-4.5 API 生成高质量图片。适用于文生图、图生图以及生成关联组图的场景。 | |
| prime-directive A partnership covenant for AI agents and their human operators. v1.1 adds the Subagent Responsibility Chain and Inspectability Clause. | |
| Fitbit Tracker Personal Fitbit (by Google) integration for daily health tracking with adaptive sleep and activity reporting | |
| Open Notebook Access and manage a self-hosted Open Notebook research system (NotebookLM alternative). Create notebooks, add sources (text/URL/file), cross-notebook search,... | |
| Youcom Search you.com web search, deep research, and content extraction for OpenClaw. Free tier for basic search; research and extract require paid API key. Sends queries... | |
| diffmanifests Compare manifest XML files via Gerrit and Gitiles APIs, producing JSON/txt/xlsx reports. Use when comparing Android or repo manifest versions, diffing manife... | |
| gerritaction Query Gerrit accounts, changes, groups, or projects and perform actions like adding reviewers, approving, submitting, or deleting changes via the Gerrit API. | |
| gomail Send emails via the gomail sender CLI with attachments, templates, and recipient management. Use when sending or testing email delivery from OpenClaw. | |
| BlindOracle - Privacy-First Agent Infrastructure Privacy-first agent infrastructure offering secure forecasting markets, decentralized credential verification, multi-rail settlement, and cross-rail micropay... | |
| Blindoracle Fixed Security-audited AI agent marketplace with ERC-8004 passports, MASSAT audits, and x402 micropayments | |
| BlindOracle Marketplace — Post Jobs & Bid for Work Buy and sell on the public BlindOracle agent-to-agent marketplace. Use when you want to delegate a task to marketplace provider agents and get a verified res... | |
| Massat Security Audit Security audit for multi-agent AI systems - OWASP ASI01-ASI10 | |
| Google Sheets Fdds Report Lee métricas FDDS de un Google Sheet y genera un reporte comparando el último día disponible con el mismo día de la semana anterior. | |
| Plans Methodology Structured work tracking methodology using Plans. Use when creating, managing, reviewing, or delegating plans for significant work. Covers plan lifecycle (dr... | |
| Section 11: Endurance Training Coach (Intervals.icu) Evidence-based endurance coaching protocol (v11.35). Use when analyzing training data, reviewing sessions, generating pre/post-workout reports, planning work... | |
| 小星记忆系统 记忆模块管理系统，让 AI Agent 拥有持久化记忆能力。当需要保存跨会话信息、检索历史记录、建立个人知识库、或执行记忆相关操作（搜索/读取/保存）时触发本技能。 | |
| Crawleo Web Search Use when OpenClaw needs Crawleo-powered web search, Google Search SERP data, Google Maps place data, URL crawling/content extraction, or headful browser craw... | |
| ai-crawler-readiness Benchmark stored llms.txt and robots.txt signals from Crawlora's top-1M AI-readiness dataset. Use for cohort adoption or indexed-domain snapshots; domains outside the dataset remain unknown. | |
| amazon-jobs-research Researches Amazon.jobs postings via the Crawlora API — search Amazon's public careers site by keyword and/or job category, then pull any single posting's full description and qualifications by job id — returning clean JSON. Use when the use | |
| amazon-research Researches products, prices, availability, and search suggestions on Amazon (amazon.com) using the Crawlora API, returning clean JSON. Use when the user asks to find a product on Amazon, look up an ASIN's price/details, or pull Amazon autoc | |
| anime-manga-research Researches anime and manga titles via the Crawlora API — search, title detail, characters, staff, recommendations, rankings, and airing schedules — returning clean JSON. Use when the user wants an anime/manga's details, cast/staff, similar | |
| apk-teardown-research Analyzes Android APKs through the Crawlora API — submit an APK or public URL, inspect static-analysis results, compare versions, build timelines, and compare ownership signals — returning clean JSON. Use for mobile-app security, provenance, | |
| app-market-opportunity-research Research app-market opportunities using Crawlora app catalogs, historical charts, live store listings, release notes, reviews, and Google Trends. Use for app niche assessments, competitor maps, chart-movement analysis, and evidence-backed u |
22,801–22,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.