Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| frp-tunnel Share local development servers via self-hosted frp tunnel with custom domains and auto HTTPS. Use when you need to share localhost with others, demo to clie... | |
| OpenClaw Tmux Persistent Process Run programs that survive OpenClaw exec session cleanup and gateway restarts via tmux. Use when you need long-running servers, dev servers, tunnels (ngrok/cl... | |
| Service Persistence macOS 服務持久化與重啟恢復。管理 LaunchAgent、tmux bootstrap、wrapper daemon 三層架構， 確保電腦重啟後所有服務自動恢復。Use when: (1) 新增需要常駐的服務，(2) 把現有 tmux session 升級成 LaunchAgent， (3) 為互動式程式建... | |
| Share Local Site Share a local development server with anyone via a public URL. Use when you need to demo a site to a client, let a colleague preview your work, test on mobil... | |
| claude-session-warmer Align your Claude Pro/Max usage window to your working hours. Claude's 5-hour usage window is anchored to your FIRST message of a session, so claude-session-... | |
| yt-agent Generate summaries, highlights, Q&A, presentations, daily digests, or cross-video reviews from YouTube videos using cached transcripts and semantic search. | |
| yt-mem Use when the user wants to run any yt-ai operation from Claude Code — ingest a video, discover subscription uploads, batch-fetch pending, search the library, rate/recommend, compile highlights, build a supercut, check status, or run a full | |
| yt-mem-ai Use when the user wants to run any yt-ai operation from Claude Code — ingest a video, discover subscription uploads, batch-fetch pending, search the library, rate/recommend, compile highlights, build a supercut, check status, or run a full | |
| Dashpass Encrypted credential vault on Dash Platform for AI agents. Store and retrieve API keys, tokens, and passwords — encrypted on-chain, decryptable only by you.... | |
| DashClaw Governance Protocol Governance behavior for AI agents governed by DashClaw. Teaches the governance protocol: when to call guard (risk thresholds), how to interpret decisions (al... | |
| DashClaw Platform Intelligence DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via `python -m livingcode query`, or `GET {ba... | |
| Self Improving Agent2 Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Godot Game Claw Bridge Godot 4.x Project Generator CLI. Create 2D/3D games with 80+ CLI commands: projects, scenes, scripts, levels, UI (menu/HUD/dialog/inventory), game components... | |
| Pans Case Writer 自动将客户成功案例包装为 Case Study（案例研究）。支持背景 / 挑战 / 方案 / 成果四段式结构化模板，支持 Markdown / PDF / HTML 多种格式导出， 提供交互式创建模式逐步引导输入关键信息。 触发词：案例研究, case study, 客户案例, 成功案例, 案例包装, 客户故事,... | |
| Pans Churn Predictor AI算力销售客户流失预警工具。分析用量趋势、支持ticket、合同状态，识别流失风险客户。 支持风险分级、原因分析、挽回建议生成。 触发词：流失预警, 客户健康度, 续约风险, churn prediction, 客户成功 | |
| Pans Competitor Compare AI算力销售竞品对比分析器。实时对比AWS/GCP/Azure/火山引擎/阿里云GPU定价和规格。 支持按GPU型号、云厂商、区域筛选，输出对比表格或CSV。 触发词：竞品对比, GPU价格, 云厂商对比, 定价分析, competitor analysis, pricing comparison | |
| Pans Contract Generator AI算力销售合同生成器。根据商定条款（客户名称、GPU型号、数量、价格、期限） 生成标准 GPU 租赁协议 Markdown 草案。内置服务范围、价格条款、SLA、 数据安全、违约责任、知识产权、保密条款、争议解决等关键条款模板。 触发词：合同生成, 销售合同, GPU租赁协议, 框架协议, POC协议, 补充协... | |
| Pans Crm Sync AI算力销售 CRM 同步工具。对接 Salesforce 和 HubSpot 双平台， 自动同步客户状态、更新 Pipeline、生成 CRM 报表，支持双向/增量同步 和冲突检测与解决。 触发词：CRM同步, 客户同步, Salesforce, HubSpot, pipeline同步, 客户状态更新, CRM... | |
| Pans Daily Sales Brief AI算力销售每日简报生成器。自动汇总待跟进客户、到期合同、新线索和竞品动态。 维护客户pipeline数据，生成每日工作简报。 触发词：销售简报, 每日报告, 客户跟进, pipeline, 销售日报, daily brief, sales report | |
| Pans Deal Coach AI算力销售谈判教练。输入客户异议，输出专业应对话术和策略。 覆盖价格、竞品、技术、流程、安全等20+常见异议场景。 触发词：谈判话术, 客户异议, 应对策略, 销售教练, objection handling, deal coaching | |
| Pans Discovery Playbook AI算力销售发现阶段话术与框架工具。根据沟通场景（首次电话/需求介绍/POC/ 续约增购）和行业（科技/金融/医疗/自动驾驶/内容/制造/学术/政府） 自动生成访谈问题清单、行业背景知识、话术建议和异议处理策略， 输出 Markdown 或 JSON 格式发现指南。 触发词：发现阶段, 客户访谈, 话术指南, 异... | |
| Pans Excel 全功能智能 Excel 处理专家。功能：数据分析 | 图表可视化(7种) | 数据处理 | 报表模板(7种) | AI智能 | CSV/JSON导入导出 | 数据验证 | PDF导出 | 数据清洗。 触发词：Excel处理, 表格分析, 数据可视化, 图表制作, 公式生成, 报表生成, 销售看板, 财务分析, 对... | |
| Pans Github Scout 扫描 GitHub 寻找潜在 AI 公司客户。支持按 AI/ML repos、大模型项目、训练代码 等维度搜索，筛选 star 数、活跃度、公司规模，输出 CSV 或 JSON 格式线索列表。 触发词：GitHub扫描, AI公司线索, 客户发现, github scout, AI startup discove... | |
| Pans Gpu Calculator AI算力销售GPU配置计算器。输入模型参数量和需求，自动推荐最优GPU配置并估算成本。 支持训练和推理场景，覆盖H100/A100/L40S/A10G等主流GPU。 触发词：GPU计算, 算力配置, 模型部署成本, GPU选型, 显存估算, 训练成本, 推理成本, GPU推荐 | |
| Pans Gpu Monitor AI算力销售GPU监控工具。接入客户GPU使用数据，生成用量/效率周报，识别优化机会。 支持成本分析、异常告警、容量规划建议。 触发词：GPU监控, 用量报告, 效率分析, 成本优化, 周报生成 | |
| Pans Gpu Solution Builder GPU 算力方案构建器。根据客户的工作负载类型（训练/推理/微调/批量推理/开发测试）、 部署规模（小型/中型/大型/企业级）和月度预算，自动推荐最优 GPU 配置 （H100/A100/L40S/A10G/RTX 4090 等），生成含 GPU 型号、数量、算力、 月度/小时成本的配置表、扩展路线图和技术建议，... | |
| Pans Lead Miner AI算力销售线索挖掘器。输入行业关键词，自动搜索筛选潜在客户，识别算力需求信号。 通过SearXNG聚合多数据源（Crunchbase/GitHub/LinkedIn/新闻），按融资和算力需求排序。 触发词：线索挖掘, 客户发现, AI公司搜索, 融资动态, 算力需求, lead generation, pros... | |
| Pans Linkedin Outreach AI算力销售 LinkedIn 外联助手。批量生成个性化 LinkedIn 消息， 支持 Connection Note（连接邀请附言）、InMail（私信消息）、 Follow-up（跟进消息）三种类型，自动适配 300 字符限制。 触发词：LinkedIn消息, 连接邀请, InMail, 跟进消息, 外联文... | |
| Pans Meeting Summarizer AI算力销售会议智能总结工具。从会议录音或文字记录自动生成结构化纪要、行动项和客户洞察，支持同步更新CRM系统。 触发词：会议纪要, 会议总结, 录音转文字, 待办提取, 客户洞察, meeting minutes, call notes, action items, CRM更新 | |
| Pans Poc Tracker AI算力销售POC追踪器。管理POC全生命周期，记录技术卡点，提醒跟进，生成转化报告。 支持阶段跟踪、团队协作、风险预警。 触发词：POC跟踪, 测试管理, 技术验证, POC进度, proof of concept, trial tracking | |
| Pans Pricing Engine AI算力销售定价引擎。根据客户规模、合同期限、预付金额计算阶梯折扣价。 支持数量/时长/预付三重折扣累乘，生成报价单。 触发词：定价计算, 折扣报价, GPU价格, 阶梯折扣, pricing engine, quote generator | |
| Pans Roi Analyzer AI算力销售 ROI 分析器。对比当前方案与新方案的成本和性能，计算 ROI、 TCO（总拥有成本）和投资回收期。输入 GPU 配置和业务指标， 生成投资回报分析报告，支持成本优化建议和竞品对比。 触发词：ROI分析, 成本对比, TCO计算, 投资回报, 成本优化, ROI calculator, TCO co... | |
| Pans Tech Profile 分析目标公司的技术栈和算力需求，为 AI 算力销售提供客户画像。 自动采集公司官网、招聘页面、GitHub、新闻等数据源，输出技术栈分析、 GPU 需求量级估算、推理/训练比例及销售切入建议。 触发词：技术栈分析、公司技术画像、tech profile、算力需求评估、客户技术调研 | |
| Pans Upsell Radar AI算力销售增购机会雷达。识别GPU利用率、团队扩张、新模型发布等增购信号。 支持机会评分、扩容方案生成、最佳时机预测。 触发词：增购机会, 扩容信号, upsell, 交叉销售, 客户增长 | |
| PansClaw Code Use the PansClaw Code CLI (Rust reimplementation of Claude Code) for AI-assisted coding. Triggers when: user wants to run coding tasks via pansclaw code, del... | |
| Panscrapling Web Scraper 强大的网页抓取技能。基于 Scrapling，自动绕过 Cloudflare/反爬系统。 触发词：抓取网页、爬取、scrape、fetch、抓取内容、提取网页、获取页面。 使用场景： (1) 抓取被 Cloudflare 保护的网页 (2) 提取页面内容 (3) 网页数据采集 (4) 动态渲染页面抓取 自动安装：... | |
| PansModel Manager PanSclaw 模型管理器 - 管理自定义模型接入和切换。 支持添加、删除、切换、列出模型配置。 触发关键词: 模型管理, 切换模型, 添加模型, 删除模型, 模型列表, 配置模型, 更换模型, 接入模型, 模型设置 | |
| Pansxng Websearch 自包含的本地元搜索引擎技能。基于 SearXNG，零配置，开箱即用。 触发词：搜索、搜一下、pansxng、联网搜索、私密搜索、searx、帮我搜、xxx是什么。 使用场景：(1) 联网搜索 (2) 多引擎聚合 (3) 隐私搜索 (4) 指定引擎搜索 无需任何前置条件——首次使用时自动安装全部依赖（Homebre... | |
| Hylo — GHL Automation Expert GoHighLevel (GHL) workflow automation expert with 102 verified actions, 70 triggers, and 494 API schemas. Use when asked about GHL, GoHighLevel, HighLevel, G... | |
| Vaikora Route OpenClaw LLM calls through Vaikora for real-time AI agent security monitoring. Every action your agent takes gets scored for risk, anomaly-flagged, and... | |
| daily-report-bian 自动生成并在指定时间通过飞书推送每日研究进展报告，内容涵盖今日进展、延续项目、明日计划及系统状态，字数不超1000字。 | |
| Auto Estimate Generator Automatically generate estimates from QTO data. Apply pricing rules to BIM quantities for cost estimates. | |
| Batch Cad Converter Batch convert multiple CAD/BIM files (Revit, IFC, DWG, DGN) with progress tracking, error handling, and consolidated reporting. | |
| Bim Cost Estimation Cwicr Automated cost estimation from BIM models using DDC CWICR database with 55,719 work items. AI classification + vector search for accurate pricing. | |
| Bim Qto Extract quantities from BIM/CAD data for cost estimation. Group by type, level, zone. Generate QTO reports. | |
| Cad To Data Convert CAD/BIM files to structured data. Extract element data from Revit, IFC, DWG, DGN files. | |
| Cost Estimation Resource Calculate construction costs using resource-based method. Estimate project costs from work items, physical resource norms, and current prices. | |
| Cost Prediction Predict construction project costs using Machine Learning. Use Linear Regression, K-Nearest Neighbors, and Random Forest models on historical project data. Train, evaluate, and deploy cost prediction models. | |
| Csv Handler Handle CSV files from construction software exports. Auto-detect delimiters, encodings, and clean messy data. | |
| Cwicr Cost Calculator Calculate construction costs using DDC CWICR resource-based methodology. Break down costs into labor, materials, equipment with transparent pricing. |
24,201–24,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.