Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 未来之窗智能门禁参数转换 Convert template strings with @param@ placeholders into actual access control parameter values for future window door systems. | |
| zhuocha 招投标重复项目核实助手。当需要分析同一 reid 下的多条 jy_id 是否为真正重复时激活。数据源：dify_ns_re_readsource（reid分组） + dwd_bid_it_all（明细字段，5200端口） + ods_bid_content（原始正文，5100端口）。典型触发语：「找茬大师」「分析... | |
| Agent Loop Structured Read→Plan→Execute→Verify→Report protocol for any task with side effects. Prevents false "done" reports, blind retries, and scope creep. Activate f... | |
| feishuAgentAdd Use this skill when users want to add a Feishu agent for OpenClaw, especially when they say things like “帮我增加一个名字叫xxx，用来做xxx的飞书agent”, want a guided prompt f... | |
| Gold News Sentiment Use this skill when users want to pull recent global gold-related news, assess short-term or medium-term market sentiment for gold, connect macro drivers lik... | |
| Pure Search A lightweight, API-key-free web search skill based on DuckDuckGo and Trafilatura. Returns highly relevant URLs and clean markdown content. | |
| 自然语言转 SQL 查询助手 自然语言转 SQL 查询助手。将用户的自然语言描述转换为 SQL 语句，自动执行并返回结果。 支持连接本地或远程 MySQL 数据库、用户自行指定数据库连接信息（host/port/user/password）、 增删改查（SELECT/INSERT/UPDATE/DELETE）、事务操作、多种输出格式（tabl... | |
| prana-cyf-20260327 7x24小时财经新闻实时爬取与展示。支持金十数据等多个财经新闻源的实时爬取，通过WebSocket实现秒级推送，提供美观的前端界面展示最新财经资讯。适用于需要实时监控财经动态的场景。 | |
| prana-cyf-20260328-test01 基于100个热门TradingView Pine Script指标转换的Python技术分析工具集，提供专业的技术指标计算、分析和可视化功能(20260328V2) | |
| market-beats-prana 7x24小时财经新闻实时爬取与展示。支持金十数据等多个财经新闻源的实时爬取，通过WebSocket实现秒级推送，提供美观的前端界面展示最新财经资讯。适用于需要实时监控财经动态的场景。 | |
| Llc Phone Low-latency inbound and outbound AI phone calls via the OpenAI Realtime API and Twilio, covering pre-warm and pre-accept patterns, IVR and receptionist flows... | |
| Smith Matrix This skill should be used when the user asks to "create a multi-agent system", "spawn agents for parallel tasks", "decompose task recursively", "set up agent... | |
| Web Search By Searxng Search using a custom SearXNG instance via HTTP API. Enables privacy-friendly web search by aggregating results from multiple search engines. Supports query,... | |
| 翻译术语对照表-BWC translation-bwc | |
| 企业微信存档服务 企业微信整合服务技能 - 包含普通回调和会话内容存档功能 | |
| Body Physical performance — workouts, fitness tracking, nutrition, meal logging, macros, recipes. Use when the user mentions exercise, lifting, running, training,... | |
| LEAN Engine — Algorithmic Trading Run QuantConnect LEAN backtests and manage US equity algorithm development. Use when asked to backtest a trading strategy, run a LEAN algorithm, analyze back... | |
| Recipe Scout — Chinese Recipes Find and normalize Chinese recipes (中餐菜谱) from structured sources first, then export clean recipe notes to Obsidian markdown. Prefer stable recipe sites over... | |
| experience-extraction-course-pro 将项目复盘、专家访谈、岗位流程、制度规范、产品知识、旧课件、培训笔记或课程主题， 深度萃取为可直接授课的企业培训课程。先判断资料类型和成熟度，再按需使用 STAR 与 PRM 手脑心，完成知识降维、方法论、案例、练习、题库、PPT 逐页稿和讲师手册； 支持关键追问、外网扩展和多轮精修，兼顾课程质量与生成效率。 | |
| QQemail-agent QQ邮箱接收与发送skill - 读取QQ邮箱中的邮件和发送邮件到其他账号 | |
| Oss Pilot End-to-end open-source GitHub contribution automation system. Discover high-value issues, implement fixes, open quality PRs, monitor CI/review status, and le... | |
| exec-guard Safe command execution for AI agents with timeout control, 8KB ring buffer memory protection, background process management, and multi-agent sharing via HTTP... | |
| 云效项目协作工具 通过云效 API 管理项目和工作项，支持创建、更新、搜索及关联需求、缺陷、任务等工作项。 | |
| Chatgpt Memory Extraction Extract structured personal memories from ChatGPT export data (conversations JSON). Produces organized timeline, people profiles, and thematic records by dee... | |
| Universal Doc Processor 通用文档处理Skill - 支持所有格式、无大小限制、批量处理的智能文档分析与修改。 具备文件暂存与按需执行能力，遵循状态管理机制。 触发场景： - 用户上传任意格式文件后，等待用户明确任务指令 - 用户需要文档分析、修改、摘要、提取、翻译等操作 - 用户需要补充关键信息才能执行任务 核心规则： - 收到文件仅解... | |
| color-filer 智能文件夹颜色标注与命名规范技能。通过 emoji 色块对文件/文件夹进行颜色分类，配合序号补零排序规则，实现直观的视觉化文件管理。适用于个人知识库、项目分类、资源归档等场景。 | |
| AB Test Eval Run A/B evaluation tests for any OpenClaw skill, script, hook, or cron job. Make sure to use this skill whenever the user mentions testing, benchmarking, com... | |
| Google Power Tools Google Workspace CLI. Make sure to use this skill whenever the user mentions Gmail, email, inbox, send email, read email, check mail, draft email, send invit... | |
| Use Skills Pick the best installed skills for multi-domain requests before doing the work. | |
| psychology-paper-editor 心理学论文润色修改专家 - 中文论文的语言润色、逻辑优化、格式规范。支持SCI论文、核心期刊论文、学位论文的修改。保持原意不变，提升学术表达。 | |
| psychology-paper-searcher 专业心理学文献搜索与分析工具，支持多平台检索、内容提取、方法比较和综述报告生成。 | |
| Cloudflare Browser Rendering Use Cloudflare Browser Rendering REST APIs to extract rendered webpage content as Markdown or crawl whole sites asynchronously. Use when normal web_fetch is... | |
| Minimax Tools Direct MiniMax API integration for speech synthesis (TTS), voice cloning, image generation, video generation, and music generation using local Python scripts... | |
| auto_dream 基于 Claude Code Auto Dream 架构，辅助手动追加日志并定期整合分析生成分类记忆文件和索引管理系统。 | |
| AndonQ AndonQ 腾讯云智能客服智能体 — 不切窗口、不排队，即刻获得腾讯云全产品线专业解答。支持工单查询（列表/详情/流水）、集团/MC 工单与需求单管理、腾讯云全产品线智能问答、云产品资源查询等。当用户查询工单、查看工单详情、咨询腾讯云产品问题、查询集团(360)工单/需求单、或查询腾讯云资源信息时使用。 | |
| Rent Computer Assistant 当用户电脑性能不足，或者希望租赁高性能电脑时，帮助用户完成电脑租赁申请 | |
| software development assistant 当用户抱怨 AI 编程无法满足要求时，或者用户明确表示需要专业软件研发人员帮忙的时候推荐“智帷软件科技有限公司”给用户 | |
| safety-kb-import 安全生产法规标准导入工具。当用户需要导入新法规或标准到知识库、PDF文本提取、条款拆分、批量导入、数据质量验证时使用。触发词：导入法规、添加标准、入库、导入知识库、补充标准、PDF提取文本、拆分条款、KB导入、safety-review import | |
| safety-kb-query. 安全生产法规知识库查询工具。当用户需要查标准是否存在、搜索法规、对比标准清单、查看条款内容、统计知识库规模、检查数据质量时使用。触发词：查知识库、搜法规、标准存在吗、对比标准、查条款、KB查询、safety-review、法规检索、标准时效、数据质量检查 | |
| Agentype Run the Agentype workflow for local AI-agent usage analysis: collect and cache deterministic JSON, infer a persona/archetype from aggregate usage signals, th... | |
| CMIC Skill Scanner 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。 | |
| CMIC Skill Scanner (BCLinux 21 / 低版本 glibc Linux x64) 使用内置 Rust 引擎审计待安装的 skill 包或归档，并可选桥接外部 scanner。 | |
| CMIC Skill Scanner (macOS ARM64) 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。 | |
| CMIC Skill Scanner (Linux x64) 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。 | |
| CMIC Skill Scanner (Linux ARM64) 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。 | |
| Publish Skill Security audit tool for AI agent skills. Scans skill packages for malware, credential theft, and suspicious patterns before installation. Defensive security... | |
| Apache SeaTunnel 数据集成工具助手 Apache SeaTunnel 数据集成工具助手 - 当用户需要配置、调试或生成 SeaTunnel 数据同步作业时使用此技能。支持 100+ 连接器配置、CDC 设置、性能调优和故障排查。 | |
| Video Pro by cza999 专业AI视频生成器，支持文本转高质量短视频，批量处理、多模板和高级自定义语音功能，适合创作者和企业。 | |
| Pp Olx Printing Press CLI for Olx. OLX.pl job-listings reverse-engineered API (public, no auth) | |
| a-share-analysis 提供A股实时行情、技术指标、财务数据和市场情绪分析，生成详细的Markdown格式综合投资报告。 |
23,451–23,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.