Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 小红书博主数据 SocialDataX 博主信息 用于小红书博主数据、小红书博主信息、账号资料、达人画像、主页信息和粉丝规模查询。覆盖 Xiaohongshu / XHS / RedNote creator profiles，来自 SocialDataX 社媒数据助手。 | |
| 小红书数据分析 SocialDataX 笔记详情 用于小红书数据分析、小红书笔记详情、笔记数据、互动指标、内容调研和内容分析。覆盖 Xiaohongshu / XHS / RedNote note details，来自 SocialDataX 社媒数据助手。 | |
| 小红书数据分析 SocialDataX 笔记搜索 用于小红书数据分析、小红书笔记搜索、关键词检索、内容调研、竞品分析和趋势研究。覆盖 Xiaohongshu / XHS / RedNote note search，来自 SocialDataX 社媒数据助手。 | |
| YouTube 数据助手 SocialDataX 用于 YouTube 数据助手、视频搜索、视频详情、评论分析、频道资料以及频道视频和 Shorts 列表。覆盖 YouTube video and channel research，来自 SocialDataX 社媒数据助手。 | |
| 知乎数据助手 SocialDataX 用于知乎数据助手、知乎热榜、内容搜索、回答文章视频详情、评论分析、创作者资料和文章列表。覆盖 Zhihu content research，来自 SocialDataX 社媒数据助手。 | |
| 贴吧用户需求洞察 当用户需要做百度贴吧用户需求研究、产品痛点归纳、购买顾虑整理或常见问题分析时使用。输入产品关键词、吧名或帖子链接，基于帖子与楼层讨论输出带原话依据的需求报告。来自 SocialDataX 社媒数据助手。 | |
| 今日头条内容研究 当用户需要做今日头条内容研究、文章选题、热点角度整理或同主题内容对比时使用。输入主题或内容链接，基于相关作品和详情输出样本概览、标题模式与可继续验证的内容方向。来自 SocialDataX 社媒数据助手。 | |
| 小红书评论分析与需求挖掘 当用户需要做小红书评论分析、小红书评论洞察、小红书用户反馈分析、小红书需求挖掘、痛点总结、购买顾虑整理、FAQ 提炼、口碑分析、评论回复观察或内容讨论复盘时使用。基于用户提供的小红书笔记链接或 note_id 下的评论结果，面向内容运营、产品调研、品牌调研和创作者。 | |
| 小红书竞品研究 当用户需要做小红书竞品研究、小红书竞品分析、同赛道观察、内容角度对比、内容策略对比或品牌内容调研时使用。面向品牌、MCN、内容运营和创作者。 | |
| 小红书内容研究 面向内容运营、品牌调研和创作者的小红书内容研究辅助技能。适用于 RedNote / XHS / Xiaohongshu（小红书）内容研究、选题分析、关键词观察、趋势判断、竞品内容对比和素材整理。 | |
| 小红书达人合作评估 用户提供品牌或产品、目标受众、候选小红书达人和预算时，使用蒲公英报价、粉丝画像和内容表现比较合作适配度，交付候选对照表与待确认事项。SocialDataX 支持命令查询；不预测实际成交或投放回报。 | |
| 小红书博主内容研究 当用户需要做小红书博主内容研究、账号内容列表、近期发布复盘、内容风格分析、创作者对标或账号追踪时使用。面向品牌、MCN、内容运营和创作者。 | |
| 小红书博主画像 当用户需要做小红书博主画像、小红书博主信息、账号资料、创作者定位、粉丝规模判断或合作对象初筛时使用。面向品牌、MCN、内容运营和创作者。 | |
| 小红书热榜选题分析 用于小红书热榜选题、小红书热点选题、小红书热榜分析、小红书热点分析和趋势选题参考。先看当前小红书热榜，再结合相关热门笔记样本，把热榜信号整理成可执行选题，来自 SocialDataX 社媒数据助手。 | |
| 小红书选题分析 当用户需要做小红书选题、小红书内容选题、小红书选题策划、爆款选题拆解、内容角度规划或选题素材整理时使用。面向内容运营、品牌调研和创作者。 | |
| 小红书趋势洞察 当用户需要做小红书趋势洞察、小红书趋势分析、热点观察、内容方向判断、趋势线索归纳或营销灵感整理时使用。面向内容运营、品牌调研和创作者。 | |
| 小红书爆款文案拆解 当用户给出小红书关键词、赛道、人群、产品方向、笔记链接或 note_id，想拆解爆款文案的标题钩子、开头方式、卖点表达、情绪词、内容结构、互动引导和可复用文案框架时使用。来自 SocialDataX 社媒数据助手。 | |
| 小红书爆款笔记研究 当用户给出小红书关键词、赛道、人群或产品方向，想看热门高互动笔记样本，并拆解标题结构、内容角度、互动信号、创作灵感和选题参考时使用。来自 SocialDataX 社媒数据助手。 | |
| GitHub 通知自动分拣 GitHub notification auto-triage via email channel. Classifies incoming GitHub notification emails into three tiers: (1) CI failures and security alerts → imm... | |
| 独立开发者客服邮件系统 客服邮件智能分流。CLI 关键词预筛自动回复常见问题，复杂邮件转发 AI 处理邮箱或主邮箱，节省约 62% token 成本。Use when: (1) setting up automated support email triage for a SaaS product, (2) auto-replying... | |
| Devin Floyd Security scanner for OpenClaw/Clawdbot skills - detect malicious patterns before installation | |
| Devin_dingcheng 读取橙丁物联液位传感器设备状态。使用场景：(1)查询液位传感器在线状态 (2)获取设备开关状态 (3)定时监控液位设备。需要提前配置 key、tel、imei 参数。 | |
| Analyzing Page Performance Reports how a BioFlow link-in-bio page performs and who it captured: views, link clicks, CTR, top links, referrers, tip revenue, newsletter and lead signups, contacts, and uploaded files. Use when the user asks 'how did my page do last mont | |
| Editing Page Drafts Edits the draft of a BioFlow link-in-bio page: adds, changes, removes, or reorders links, images, products, newsletter signups, booking embeds, and other blocks, renames a page, or creates a new page. Use when the user asks to 'add a link t | |
| Publishing Pages Publishes or schedules a BioFlow page's draft so it goes live, after showing a preview of what changes and getting the user's confirmation. Use when the user asks to 'publish my page', 'go live', 'push my changes live', 'schedule my page to | |
| Caly: Booking Meetings Books a meeting in Caly on one of the user's event types: finds a free slot, collects the attendee's details and the event type's required booking questions, confirms with the user, then creates the booking so Caly sends the invites. Use wh | |
| Caly: Finding Meeting Times Finds open times to meet in Caly: lists the user's event types, reads their working-hours schedules, and returns the free slots for an event type over a date range, in the right time zone. Use when the user asks 'when am I free', 'find a ti | |
| Caly: Managing Bookings Reviews and changes the user's Caly bookings: lists upcoming, past, cancelled or unconfirmed meetings, looks one up by attendee or time, reschedules it to a free slot, or cancels it through Caly's two-step confirmation. Use when the user as | |
| Checking Domain Connections Reviews the DNS health of existing doDomain connections and queues rechecks after confirmation. Use when the user asks 'which of my connected domains are broken', 'is this customer's domain still connected', 'when was this connection last c | |
| Connecting Customer Domains Starts and follows a doDomain connect session that points a customer's own domain at one of the user's apps, returns the DNS records the customer must add, and verifies them. Use when the user asks to 'start a connect session for shop.acme. | |
| Preflighting Domains Pre-flights a domain in doDomain before anyone touches DNS: finds who runs DNS, the DNS provider and registrable zone, and whether the domain qualifies for one-click connect. Use when the user asks 'who runs DNS for shop.acme.com', 'can thi | |
| Capturing Tasks Creates, updates, links, completes, and archives GetItDone tasks, showing extracted tasks before creating them and asking before archiving. Use when the user asks to 'turn these meeting notes into tasks', 'add a task', 'create a to-do', 'ad | |
| Investigating Tasks Explains a single GetItDone task in full: its content, status, dependencies, attachments, and what an attached video or screen recording shows. Use when the user asks to 'open T-123', 'why can't this task start', 'what is this task waiting | |
| Reviewing Workload Summarizes what is on the user's plate in GetItDone: tasks due, in progress, in review, and blocked, per workspace or project. Use when the user asks 'what's on my plate this week', 'what should I work on next', 'what's due', 'what's blocke | |
| Searching Getitdone Api Docs Answers questions about the GetItDone developer API from its own documentation. Use when the user asks 'what does the 429 problem code mean in the GetItDone API', 'how do I authenticate against the GetItDone API', 'how does this GetItDone R | |
| Checking Notification Delivery Finds out whether and how a Notifly notification reached a subscriber across email, SMS, push, chat, and in-app channels, from the activity feed. Use when the user asks 'did the welcome email go out to dana@example.com', 'why didn't this su | |
| Reviewing Notification Workflows Reviews a Notifly environment's notification setup: workflows with their steps and channels, topics, and recent delivery activity. Use when the user asks 'which workflows do we have and on which channels', 'what does this workflow do', 'wha | |
| Sending Notifications Sends a Notifly workflow to a subscriber or topic through the two-step confirmation contract and verifies it in the activity feed. Use when the user asks to 'send the order-confirmation workflow to subscriber wc-1020', 'trigger a notificati | |
| Drafting Social Posts Writes a platform-ready social media post and saves it as a Postify draft for a connected LinkedIn, X (Twitter), Instagram, Facebook, TikTok, or other channel, then suggests posting times. Use when the user asks to 'draft a LinkedIn post ab | |
| Managing Content Calendar Reviews and reorganizes the social media content calendar in Postify: lists scheduled, draft, published, and failed posts, finds gaps in the posting schedule, and reschedules a post after confirmation. Use when the user asks 'what's schedul | |
| Reviewing Social Performance Reports how social posts performed in Postify: posts delivered, delivery rate, failures, per-channel stats, and the best times to post on each platform. Use when the user asks 'how did last month go', 'which channel performs best', 'show my | |
| Building Onboarding Workflows Builds, reviews, and troubleshoots Sendly workflow automations such as welcome, drip, and onboarding email series; new workflows are created disabled. Use when the user asks to 'build a welcome series for new signups', 'create a drip campai | |
| Checking Email Deliverability Diagnoses why Sendly mail is not landing and fixes the sending setup: domain health, DKIM, SPF, and DMARC records, sending-domain verification, suppressions, and address validation or list cleaning. Use when the user asks 'why is mail from | |
| Reviewing Email Performance Reports how the user's Sendly email performed: sends, opens, bounces, campaign stats, a single email's history, and how close the project is to its sending limits. Use when the user asks 'how did my emails do this week', 'did anything bounc | |
| Sending Email Campaigns Picks an audience, drafts a Sendly email campaign, sends a test, and sends the campaign only after the user confirms the recipient count. Use when the user asks to 'draft a September newsletter for premium members', 'write an email announce | |
| Researching Summary Library Searches and reads the user's saved Shorty summaries and transcriptions, answers questions from them with each source named, and reports remaining Shorty quota. Use when the user asks 'what did I summarize this week', 'find my notes about p | |
| Summarizing Sources Summarizes a YouTube video, web page, article, pasted text, or a file already in Shorty by starting a Shorty summary job after the user confirms, then reads back the finished summary. Use when the user asks to 'summarize this YouTube video' | |
| Transcribing Media Transcribes an audio or video URL, or adds subtitle and caption tracks to a video, by starting a Shorty job after the user confirms, then reads back the transcript. Use when the user asks to 'transcribe this podcast episode', 'get a transcr | |
| Discussing Builds Reads and joins the comment threads on a SnapVisor build, test, or media item: summarizes the discussion, replies, reacts, resolves or reopens threads, and follows builds, each change after confirmation. Use when the user asks to 'summarize | |
| Handling Flaky Changes Handles flaky or known visual changes in SnapVisor: ignores or un-ignores a change after confirmation, finds flaky tests, and lists the ignored changes for a project. Use when the user asks to 'ignore the date-widget change, it's the flaky |
25,451–25,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.