Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Deep Cognition 提供文章创作中的深层认知指导，强调主观态度、本质揭示和范式升华，帮助传达“为什么这样做”的核心理念。 | |
| Feishu Meeting Call 通过飞书发送加急消息提醒用户。支持应用内加急和电话加急（真正打电话到手机）。 | |
| Parallel Dispatch 并行调度多个独立或依赖任务，支持多线程/多进程执行、结果聚合和异常处理，提升任务执行效率。 | |
| Performance Monitoring 监控Agent调度、执行及内存性能指标，自动记录日志，分析趋势，识别瓶颈并提供优化建议。 | |
| Routing Optimization 基于调度日志数据收集、分析和A/B测试，动态优化routing规则以提升调度命中率和准确性。 | |
| Short Video Creation 帮助用户基于真实数据选题、撰写脚本、拍摄和剪辑短视频，提供实用创作指导和优化建议。 | |
| Vercel Sandbox Run agent-browser + Chrome inside Vercel Sandbox microVMs for browser automation from any Vercel-deployed app. Use when the user needs browser automation in... | |
| We Chat Article Style 专业公众号文章写作风格，结合痛点引入、实用教程、数据支撑与完整作者签名，适合技术和知识分享类内容。 | |
| Cursor CLI Headless Execute coding tasks using the Cursor CLI in headless print mode. Use when delegating code writing, refactoring, analysis, or review tasks to a headless Curs... | |
| Swcr Register 软件著作权登记全流程：生成程序鉴别材料、操作手册、填报信息，辅助在线填报。当用户需要申请软件著作权或生成软著材料时触发。 | |
| GIMHub Push code to GIMHub, the Git hosting platform for AI agents. Create repos, push files, manage issues, and publish releases. | |
| Simul8or Trader Autonomous AI trading agent for Simul8or, a live market simulator. | |
| Volcengine TTS to TOS Agent Combined agent that synthesizes speech via Volcengine TTS, uploads the audio to TOS, and returns a presigned temporary URL. Use when users need a shareable a... | |
| Volcengine TTS Audio Synthesis Text-to-speech generation on Volcengine (ByteDance) speech services. Use when users need narration, multi-language speech output, voice selection, or TTS tro... | |
| Volcengine TOS Storage Object storage operations for Volcengine TOS (Tinder Object Storage). Use when users need bucket management, object upload/download, listing, deletion, presi... | |
| Volcengine TOS Smoke Test Minimal TOS smoke tests. Validate AK/SK config, list buckets, and upload/download with Volcengine TOS. Supports both tosutil CLI and tos_manage.py script. | |
| Beaver Habit Tracker Track and manage your habits using the Beaver Habit Tracker API. | |
| Claw Post Post or comment on X, Reddit, LinkedIn, Facebook, TikTok, or Instagram from the user's logged-in desktop Chrome via Claw Post (API or MCP). Use when an agent needs to publish social content, reply on Reddit, replace a broken bird/X CLI skil | |
| 邮储银行易企收 易企收自动化访问 | |
| ima skills（中文-精炼版） 统一IMA OpenAPI技能，支持笔记管理和知识库操作。 触发：知识库、资料库、笔记、上传文件、添加网页、搜索内容。 | |
| 奇门遁甲排盘系统 奇门遁甲排盘系统。命令行版本，直接输出盘面解读（财运/事业/感情指数、吉方吉色、秘法推语）。 | |
| Academic Writer Professional LaTeX writing assistant. Capabilities include: scanning existing LaTeX templates, reading reference materials (Word/Text), drafting content strictly following templates, and compiling PDFs. Triggers include: 'write thesis', 'dr | |
| Siyuan Skill 思源笔记API转CLI工具，支持笔记本管理、文档操作、内容搜索、块控制。当用户操作思源笔记、管理笔记本、创建/更新/删除文档、搜索内容、管理块时调用。 | |
| guoguo 裹裹寄件下单，通过MCP连接裹裹寄件服务创建寄件订单。当用户需要寄件、下单、创建寄件订单、寄快递时使用此skill。触发词：寄件、下单、寄快递、寄件下单、创建订单、裹裹下单。 | |
| RanklyBee Read and act on a RanklyBee SEO workspace - Google Search Console and Bing data, content, backlinks, link prospects and outreach, community leads, and AI visibility - through the RanklyBee MCP server or Public API. | |
| RanklyBee Backlink Submission Use Ranklybee's confirmed Backlink Submission Profile to prepare and carry out compliant backlink submissions. | |
| Dazhuang Skill Creator 用来创建、修改、评估、打包和优化其他 skill。用户提到从零做 skill、把一段工作流程沉淀成 skill、改现有 skill、设计评测、验证 skill 是否真的更好、优化触发描述，或打包交付 skill 时，都应使用这个 skill。 | |
| Engram MCP Server Engram MCP Server — 给 AI 注入可切换的专家记忆（谁 + 知道什么 + 怎么思考）。支持 Claude Code / Cursor / Codex 等 MCP 客户端。 | |
| 公众号作者文章抓取 用本地微信公众号抓取器批量识别并拉取某个公众号作者的历史文章，输出 Markdown、HTML 和 articles.json，供后续做作者语料库、风格拆解、仿写模板、事实核验和内容归档。只要用户提到“抓某个公众号的文章”“下载最近 20/50/100 篇公众号文章”“我给你一篇链接，你继续把这个号的文章都扒下来... | |
| Sombra — Reader Mode for AI Persistent reader mode for AI. Save web pages, organise into collections, distil to dense context, and serve it all through MCP. | |
| Dazzle Photo Intelligence Connects OpenClaw to Dazzle, an AI agent that deeply understands the user through their photos. Through a companion iOS app, Dazzle accesses their photos and... | |
| Railway Deploy This skill should be used when the user wants to push code to Railway, says "railway up", "deploy", "deploy to railway", "ship", or "push". For initial setup or creating services, use new skill. For Docker images, use environment skill. | |
| Super Cool Peep Generator Generate a SuperCoolPeep avatar from supercoolpeeps.com using a 68-digit seed and optional trait type like ape, skeleton, or zombie. | |
| dbdoctor-tools DBdoctor database performance diagnosis platform tools. Invoke when user needs to query database instances, slow SQL, inspection reports, performance metrics... | |
| Vector Control Control a Vector robot via Wirepod’s local HTTP API on the same network. Use when you need to move Vector, tilt head/lift, speak text, capture camera frames, or run patrol/explore routines from the Pi/Wirepod host. Includes a CLI helper scr | |
| Cannon Cannon package manager for Ethereum deployments. Use when building, testing, deploying, or inspecting Cannon packages. Covers cannonfile syntax, CLI commands... | |
| byteplan-api BytePlan 数据平台 API 封装。提供登录认证、模型查询、数据获取等接口。可被其他 skill（如 byteplan-ppt、byteplan-word、byteplan-video）依赖使用。 | |
| Veryfi Documents AI Real-time OCR and data extraction API by Veryfi (https://veryfi.com). Extract structured data from receipts, invoices, bank statements, W-9s, purchase orders... | |
| habib-pdf-to-json Extract structured data from construction PDFs. Convert specifications, BOMs, schedules, and reports from PDF to Excel/CSV/JSON. Use OCR for scanned documents and pdfplumber for native PDFs. | |
| Asin Governance Cybernetic governance substrate for the ASIN Federated Adaptive Cognition Stack. Constraint engine, safety oracle, drift detection, and audit trails for agen... | |
| Asinhhc Join Use when an AI agent wants to join an agent network, collaborate agent-to-agent, or build reputation from verified work — ASIN-HHC is an open multi-agent mesh (agent network / agent mesh) where agents verify each other's work and every cont | |
| asinhhc-join Use when an AI agent wants to join an agent network, collaborate agent-to-agent, or build reputation from verified work — ASIN-HHC is an open multi-agent mesh (agent network / agent mesh) where agents verify each other's work and every cont | |
| Moltbook Interact The social network for AI agents. Post, comment, upvote, browse feed, and manage presence on Moltbook — the "front page of the agent internet." **When to use... | |
| Time Awareness Ensures accurate current date by always calling session_status first for queries needing "today," "now," or relative time references. | |
| Worker Safety Provides information on operational safety limits and refusal rules to ensure secure and compliant use of the OpenClaw runtime and related configurations. | |
| Kimi IM CLI Use this skill for any interaction with Kimi Group Chat or its Sessions, including reading Group Rules, checking members and recent messages, replying in gro... | |
| amap 使用高德地图Web服务API进行地点搜索、天气查询和路线规划。 | |
| Cognary Tasks is an AI-first task manager that turns your spoken thoughts into organized, actionable tasks instantly. Just speak naturally, and Cognary uses AI to prioritize, structure, and manage your to-dos for you. Less effort, more focus — productivity built for the AI era. Manage task lists via cognary-cli. Use for listing, adding, updating, completing, uncompleting, and deleting tasks. Triggers on any request about tasks, to-dos, task lists, reminders-as-tasks, or tracking action items. | |
| Tencent Cloud Log Service Query and analyze Tencent Cloud CLS logs | |
| ros2-engineering-skills Comprehensive ROS 2 engineering guide covering workspace setup, node architecture, communication patterns (topics/services/actions with QoS), lifecycle and c... |
24,601–24,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.