Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 财经热点新闻爬取与话题归纳系统 爬取主流财经网站实时热点新闻，提供混合评分与专业HTML报告，支持快讯采集与话题归纳分析。 | |
| 实现基于qmt智能交易终端的A股交易数据本地化 基于QMT量化交易平台，支持自然语言指令下载并实时网页监控A股多周期历史行情数据，含智能错误处理和任务控制。 | |
| Create New Openclaw Instance on GCP VM Deploy and configure an OpenClaw instance on a GCP VM with Tailscale networking, Brave Search integration, and secure credential handling. | |
| Myosin Hivemind Knowledge Retrieval Search Hivemind's curated Web3 marketing knowledge base (RAG) for practitioner insights, frameworks, playbooks, and case studies. Use this skill when: (1) an... | |
| 8D Wellness Awareness Turn health notes, transcripts, or check-ins into non-diagnostic 8D pattern reviews with confidence levels and safe next steps. | |
| Skill Files Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my si... | |
| User Story Mapping Create a user story map that lays out activities, steps, tasks, and release slices. Use when planning a workflow, backlog, or MVP around the user journey. | |
| Minimalist Subtraction-first engineering for any coding task. Channels an engineer who ships by deleting: question whether the change needs to exist (YAGNI), reuse what... | |
| Minimalist Audit Audit a codebase or directory for deletion candidates: dead code, unused dependencies, single-use abstractions, config that never varies, and duplicated help... | |
| Minimalist Gain Report what minimalist actually measured in this session or project — LOC avoided, scope rejected, dependencies declined. Use when the user says "minimalist... | |
| Minimalist Review Review code, a diff, or a PR strictly for bloat: unrequested abstractions, dead scope, dependency creep, symptom-patching, and drive-by changes. Use when the... | |
| Reliable Bitcoin Price Feed Real-time streaming Bitcoin price feed for traders. Use this skill to subscribe to a live Bitcoin price stream over WebSocket: OHLC ticks, volume, and derive... | |
| Crypto charting with USD pricing (1s) Real-time streaming crypto token feed for charting with 1-second OHLC ticks and USD pricing across Arbitrum, Base, Matic, Ethereum, Solana, Binance Smart Cha... | |
| Enable Stripe Payments Within Your Skill Stripe in-skill payments demo: gate premium behavior behind a one-time checkout, verify via Stripe API and local receipt. Use when demonstrating or implement... | |
| Polymarket Real Time Trades Stream Real-time streaming Polymarket prediction trades on Polygon (matic) with live USD pricing. Subscribe to a live stream of Polymarket prediction market trades... | |
| Reliable Pumpfun Price Feed Real-time streaming PumpFun token feed on Solana with live USD pricing for every token. Subscribe to a live stream of PumpFun tokens over WebSocket: USD pric... | |
| Solana Stablecoin Payments in Real-time Real-time streaming Solana SPL stablecoin transfers (USDT and USDC) over WebSocket from the Bitquery GraphQL API. Subscribes to Transfers filtered by USDT/US... | |
| Coral Memory (Deprecated) DEPRECATED — Use persistent-agent-memory instead. This skill has been replaced by persistent-agent-memory (clawhub install persistent-agent-memory). | |
| Hardcover Bookshelf Skill Talk to a user's Hardcover bookshelf via the Hardcover GraphQL API. Use when the user wants to manage reading activity in natural language: start a book, fin... | |
| WeChat Article Multi Publisher 从 Markdown 文件或网页链接提取文章并发布到微信公众号。支持多账号管理、两种排版模板（standard/viral）、自动生成封面图和草稿发布。 | |
| 墨灵高考作文批改 墨灵高考作文批改。调用 InkCraft API 提交批改并返回结构化结果。 | |
| Molt Market Agent-to-agent freelance marketplace. Use when: (1) you need work done by another AI agent (coding, research, content, SEO, design, data), (2) you want to fi... | |
| Molt Market Worker Turn your agent into a freelancer on Molt Market. Auto-discovers matching jobs, bids on them, delivers work, and earns USDC. Install → configure skills → sta... | |
| 中文文案排版指北 Chinese copywriting typesetting guidelines. Standardize Chinese writing spacing, punctuation, fullwidth/halfwidth usage. Triggers when need Chinese writing s... | |
| Content Analyzer Analyze Xiaohongshu (小红书) notes and Douyin (抖音) videos. TRIGGER when message contains any URL matching xiaohongshu.com, xhslink.com, douyin.com, v.douyin.com... | |
| Full Page Translate Translate full web articles from foreign URLs into natural, publication-quality Simplified Chinese markdown while preserving format and style. | |
| FX Twitter Translate Fetch full text from Twitter/X tweets via fxtwitter API, then translate to Chinese. Triggers when user shares a x.com / twitter.com / fxtwitter link and asks... | |
| 头脑风暴 · 从想法到设计 You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requi... | |
| Poster Maker AI 海报制作大师。三种模式：风格复刻、创意生成、直播预告海报。含产品原图还原方法论和生成脚本。Nano Banana Pro 生成，支持 Ofox/OpenRouter。 | |
| Skill Ppt Builder Build high-quality presentation decks from scratch. Covers the full lifecycle from brainstorming through content writing, visual design, AI image generation,... | |
| Ppt Deck Master 媲美 Manus 的高质量 PPT 制作大师。从一句话需求到 35+ 页高品质演示文稿，覆盖内容策划、文案撰写、视觉设计、AI 生图、QA 迭代、交付全流程。使用 Nano Banana Pro 逐页生成幻灯片图片，成本仅为 Manus 的 1/10。支持 OpenRouter 和 Ofox API。 | |
| 内容引擎 内容引擎（小红书）。两种 mode：①拆解（v1）— 输入 XHS 爆款链接，输出 18 维结构化拆解卡；②生成（v2）— 在拆解卡基础上结合品牌信息，用 Ofox（LLM + Nano Banana）生成我方版本的脚本/文案/素材图/封面/标签全套产出。视频生成（Seedance 2.0）规划在 v2.1。同时... | |
| Content Engine Content Engine (Xiaohongshu). Two modes: ① Deconstruct (v1) — input a viral XHS link, get an 18-field structured card. ② Generate (v2) — combine the deconstr... | |
| 头脑风暴 头脑风暴。适用于任何需要思考的场景——商业决策、产品策划、内容创作、问题分析、方案选择。通过结构化对话帮用户把模糊的想法变成清晰的结论。不限于设计或代码，任何领域都能用。 | |
| 外语视频→爆款切片→四平台发布一条龙 把一条外语长视频一键做成中文字幕成片，并自动切成多条"独立成爆款"的 9:16 竖屏短片（带钩子标题+gpt-image 封面），可选一键发布到微信视频号 / 抖音 / 小红书 / 公众号四个平台。当用户说"翻译视频并切片""做爆款切片""视频号一条龙""发抖音小红书""把这个 YouTube 链接做成短视频矩阵... | |
| 小红书内容引擎 小红书内容引擎。两种 mode：①拆解（v1）— 输入 XHS 爆款链接，输出 18 维结构化拆解卡；②生成（v2）— 在拆解卡基础上结合品牌信息，用 Ofox（LLM + Nano Banana）生成我方版本的脚本/文案/素材图/封面/标签全套产出。视频生成（Seedance 2.0）规划在 v2.1。同时维护... | |
| Xiaohongshu Matrix Notes Use when producing 小红书/RedNote matrix-account image+text 笔记 at scale — mimicking a 对标(benchmark) account and turning product photos into AI model try-on / li... | |
| Contract Reviewer Dongjie Analyzes contract text to extract key clauses, risks, party obligations, compliance notes, and negotiation recommendations for faster legal review. | |
| Surgical Contributor (Minimal Diff PR Skill) Deliver small, high-signal contributions by finding and fixing one real pain point with the narrowest safe change, adding regression protection, and writing... | |
| 找月嫂 月嫂服务预约助手，帮助用户快速找到合适的月嫂，提供专业母婴护理服务。支持场景：① 产前护理（孕期照护指导）② 产后坐月子（月子餐、产后恢复、日常护理）③ 新生儿护理（喂养、抚触、早教）。覆盖全国30+城市（北京、上海、广州、深圳、杭州、成都等），用户只需告知城市和预产期即可智能匹配当地优质月嫂资源，支持26天、4... | |
| Mentx Doctor 医疗助手 基于提出的医疗相关问题，通过 api上传医疗相关图片和文字（表征、内窥镜影像、X光、CT、MRI、超声、心电、各类检测报告等），获取专业医疗辅助决策报告支持。 | |
| waystation-agent-commons Read, post, and verify public work on the Waystation Agent Commons. | |
| OpenClaw Bootstrap One-command bootstrap for new OpenClaw installations. Sets up workspace files, self-evolution system (.learnings + hooks + crons), and community skills. Use... | |
| Arkcloud Ipfs ARKCloud IPFS OpenClaw skill for file.arklink.hk. Upload, publish, list, and delete files through ARKCloud and return IPFS CID, access link, credit usage, an... | |
| Hong Kong Immigration Answer and plan Hong Kong visa, entry-permit, residency, and immigration questions. Use when the user asks about 港澳通行证/签注、单程证、访港签证、高才通、优才、专才、IANG、受养人、香港身份或永居... | |
| SchoolFit Use for Hong Kong school admissions, school selection, secondary school, primary school, kindergarten, international school, and postsecondary advisory workf... | |
| Home Assistant Master Home Assistant OS (HAOS) operations skill for OpenClaw agents. Use for read-only audits, diagnostics, automation design/review, dashboard UX planning, voice... | |
| AEP Session Evidence (过程存证) AEP 会话过程存证——让 AI 助手感知当前会话，在开始/里程碑/结束时把"确实发生过这样一个创作过程"固化成可独立验证的证据链。当用户提到"过程存证/会话存证/记录过程/结束存证/收工存证"，或检测到会话即将结束（用户说收工/就这样/告一段落、上下文接近压缩、任务交付）时使用。 | |
| Agent Cost Strategy Tiered model selection and cost optimization for multi-agent AI workflows. Use this skill whenever you are choosing a model for a task, spinning up a sub-age... | |
| Agentic Engineering Workflow pattern for AI-assisted engineering using eval-first execution, task decomposition, and cost-aware model routing. Trigger phrases: agentic engineeri... |
26,201–26,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.