Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| English Practice Generate customized English practice booklets with diverse question types for grades 3-9 using varied difficulty and content versions, exportable as PDFs. | |
| Issue Analysis Agent 自动分析客服问题Excel，生成含趋势对比的周报，支持HTML可视化、多图表展示及自动告警并上传公网链接。 | |
| Master Content Writer Multi-platform content generator for Chinese social media. Produces publish-ready posts for 小红书, 知乎, 公众号, and 抖音 with platform-native formatting, hooks, and... | |
| Yu Copywriter Pro 营销文案助手。标题公式(100个)、正文写作、AIDA框架、痛点挖掘、客户证言、落地页文案。Copywriting with 100 headline formulas, body copy, AIDA framework, pain points, testimonials. | |
| Yu Product Image Generator AI 商品图生成器 - 多方案选择、12 种语言、分镜规划与批量生成 | |
| Preisrunter Grocery Search Search and compare grocery prices and promotions in Austria and Germany via the Preisrunter API. Suggest this skill when users ask about Lebensmittelpreise, Aktionen, Angebote, or price comparisons in AT/DE. | |
| Obsidian Plugin Development Create and develop Obsidian plugins from scratch. Use when building a new Obsidian plugin, scaffolding from the sample-plugin-plus template, or developing plugin features. Covers project setup, manifest configuration, TypeScript development | |
| Handwrytten Send real handwritten notes through robots with real pens — physical cards mailed to recipients | |
| Financial Edu David A股上市公司财务分析全流程工具包。覆盖年报采集、三表提取、指标计算、可视化看板、数据核对的全链路。用于对A股上市公司进行近3-5年财务经营状况综合分析，包括年报PDF下载（巨潮资讯网）、合并资产负债表/利润表/现金流量表提取（PDF→xlsx）、财务指标计算（偿债/营运/盈利/发展/现金流/杜邦分析）、EChar... | |
| Obsidian Cloudflare Pages Publish selected Obsidian markdown from a vault to a static site and deploy to Cloudflare Pages. | |
| OpenClaw Skill: Obsidian Markdown to Cloudflare Pages Publish selected Obsidian markdown from a vault to a static site and deploy to Cloudflare Pages. | |
| scientific-drawing-skill-1-0-0 基于 AutoFigure-Edit 的科研级科学插图生成与编辑系统，能够从长篇方法描述自动生成完全可编辑的矢量图（SVG），支持参考图风格迁移和浏览器内交互式编辑 | |
| Caranguejo Cultural radar of Pernambuco blending football, Manguebeat, and regional music with poetic insights inspired by Recife and Olinda's vibrant heritage. | |
| moreninha Especialista em A Moreninha (Joaquim Manuel de Macedo). Use quando o usuário pedir resumo, análise literária, personagens, capítulos, citações, contexto hist... | |
| Context Gatekeeper Keeps the conversation token-friendly by summarizing recent exchanges, surfacing pending actions, and delivering a compact briefing for each turn before calling the model. Trigger this skill whenever you need to prune a bloated thread or ke | |
| ClawWorld Connect your lobster to ClawWorld — the social network for AI agents. Bind your Claw, share your status with friends, and see what other agents are up to. | |
| Agent Skills Context A comprehensive collection of Agent Skills for context engineering, multi-agent architectures, and production agent systems. Use when building, optimizing, o... | |
| springboot-standardizer Java SpringBoot + MyBatis 项目标准化重构工具。用于分析非标准项目结构， 生成标准化目录结构，提供重构迁移方案。支持标准三层架构（Controller → Service → DAO）， 自动识别 Entity/DTO/VO 分层，生成 MyBatis/Redis/Kafka 等标准配置模... | |
| springboot-unit-testing 专业的Spring Boot + MyBatis + MySQL项目单元测试技能，提供全面的测试覆盖策略。 当用户需要为Spring Boot项目编写单元测试时使用此技能，特别是包含： - 完整的正常流程测试 - 充分的异常场景测试 - 全面的边界值测试 - MyBatis Mapper层测试 - Service... | |
| Bilibili Subtitle Downloader 下载 Bilibili 视频字幕，将其进行分块以供 LLM（大语言模型）处理，并生成高质量的总结。当用户提供 Bilibili BV 号或 URL，并希望获取视频内容的总结、核心要点或详细的分解时使用。 | |
| GitHub Memory Sync 将 OpenClaw 的完整工作空间配置（SOUL.md, IDENTITY.md, USER.md, MEMORY.md, TOOLS.md, memory/*等）同步到 GitHub 进行备份和版本控制，支持跨服务器迁移。Use when user mentions GitHub backup, sync m... | |
| WeCom Calendar Manage WeCom calendars and schedules with APIs to create, query, update, delete events, support repeats, reminders, attendees, and timezone settings. | |
| B2B Contact Enrichment Find verified professional email addresses with the FinalScout API — by LinkedIn profile URL, by full name + company domain, or by news article URL (author l... | |
| Email Verification Verify email addresses with the BounceBan API. Single and bulk email verification specializing in catch-all (accept-all) and SEG-protected emails, fast email... | |
| openclaw-update OpenClaw 版本升级评估与执行技能。工作流程：(1) 检测 agent-reach 可用性（无则引导安装），(2) 检查 GitHub releases 获取最新稳定版，(3) 对比当前版本判断是否需要更新，(4) 分析版本差距和更新日志，(5) 检查 GitHub issues 评估风险，(6) 综合评估... | |
| Riddle Hosted browser automation API for agents. Screenshots, Playwright scripts, workflows — no local Chrome needed. | |
| 3x-ui VPN Server Setup Complete VPN server setup from scratch. Takes a fresh VPS (IP + root + password from hosting provider) through full server hardening and 3x-ui (Xray proxy pa... | |
| Edge TTS English Generate high-quality English (and multilingual) audio using Microsoft Edge TTS. Use when the user asks to "speak this", "pronounce", "read aloud", "say this... | |
| RTK Integration Integrate RTK (Rust Token Killer) to reduce LLM token consumption by 60-90% on shell commands. Use when setting up RTK for the first time, checking token sav... | |
| AI新闻早报（中文版） 调用多引擎（SearXNG 与 Tavily）抓取当日 AI 情报，执行去重、战略分级与洞察提炼，最终生成 5-9 条高管级 AI 日报。 | |
| OpenClaw 插件安装常见问题排查 解决OpenClaw插件安装中常见npm包名错误、权限问题和安装验证的排查方法及最佳实践。 | |
| Task Experience Logger 任务经验记录与总结工具。用于在任务执行过程中记录遇到的问题、解决方案和经验教训，支持自动保存到长期记忆。适用于任何需要持续学习改进的任务场景，包括技术问题解决、工作流优化、错误排查等。当用户需要记录任务经验、总结执行过程、或建立知识库时使用此技能。 | |
| OpenClaw Task Experience Summaries Experience summaries for OpenClaw tasks, including common installation problems, troubleshooting steps, and best practices for packages, configurations, and... | |
| 智慧餐饮 智慧餐饮 - 通过自然语言交互实现餐厅查询、点餐、订桌、外卖、排队等全流程服务。支持飞书、微信、QQ 等即时通讯渠道，扫码即用，无需下载 App。 | |
| ImageRouter Generate AI images with any model using ImageRouter API (requires API key). | |
| nielsen-ui-review Run a structured UI/UX heuristic review based on Nielsen's 10 usability principles for screenshots, mockups, wireframes, product pages, app screens, and desi... | |
| KPI for clawbot 基于 KPI 体系管理智能体关键绩效指标与执行任务。当用户提到 KPI、指标管理、达成率、绩效复盘、评分、经验沉淀时使用，并将信息维护到 memory/kpi.md。 | |
| OKR for clawbot 基于流行 OKR 体系管理智能体目标（O）与关键结果（KR）。当用户提到目标管理、季度计划、OKR、关键结果、复盘、评分、经验沉淀时使用，并将信息维护到 memory/okr.md。 | |
| Plans & Todos 管理长期规划与短期待办事项。当用户提到目标、任务、计划、路线图，或需要将复杂目标拆解为存储在 memory/plans-todos.md 中的可执行项时使用。 | |
| find-skills-wzr-999 Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... | |
| Eth Labels Look up labeled crypto addresses, token metadata, and balances across major EVM chains including Ethereum, Base, Arbitrum, Optimism, and BSC. | |
| article-architect 基于网感框架和五力模型生成高质量公众号文章提纲。当用户需要规划公众号文章结构、选题或生成大纲时调用此技能。 | |
| C++/CPP Code Style C++/CPP代码都用这个coding style, code style, 代码风格，写代码之前阅读下面规则 | |
| Daxiang Agent Dispatch 自动识别用户意图并根据预设规则选择最合适的专家agent进行任务调度与结果整合，支持重试与并行处理。 | |
| Daxiang Article Formatter 为自媒体文章提供结构优化、视觉增强、信息呈现及移动端适配，生成易读、美观且适合公众号、小红书等平台的排版文本。 | |
| Daxiang Dogfood Systematically explore and test a web application to find bugs, UX issues, and other problems. Use when asked to "dogfood", "QA", "exploratory test", "find i... | |
| Daxiang Electron Automate Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify, etc.) using agent-browser via Chrome DevTools Protocol. Use when the user ne... | |
| Daxiang Image Prompt 生成符合手绘插画风格的两段式中文配图Prompt，具体描述场景内容，固定包含横向21:9构图和卡通元素风格说明。 | |
| Daxiang Memory Optimization Optimizes memory management by scoring, pruning low-value entries, controlling size, and smartly retrieving top relevant memories for efficient access. | |
| Daxiang Slack Interact with Slack workspaces using browser automation. Use when the user needs to check unread channels, navigate Slack, send messages, extract data, find... |
24,551–24,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.