Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| KONIO Marketplace Connect to the KONIO A2A marketplace — register agents, post jobs, review work, and build reputation. Requires a KONIO account and agent API key. | |
| Clawdhub 1.0.0 Use the ClawdHub CLI to search, install, update, and publish agent skills from clawdhub.com. Use when you need to fetch new skills on the fly, sync installed... | |
| 团队任务管家 在用户明确要求管理团队任务台账、维护 team-tasks 工作日日历或调用 team-tasks 时使用。 提供本地 JSON 任务存储、更新、评论、归档、备份与受限恢复，以及使用内置中国大陆年度工作日日历的批量和专项风险提醒解析。 在 macOS 宿主将全部活动及归档事项同步到用户指定的独立提醒事项列表，支持勾选完成回写和直接执行脚本的定时同步。 任务变更会原子写入可重试的提醒同步事件，供调度适配器维护规则关联并动态投递；风险提醒调度、团队通知及身份权限检查仍由外部适配器 | |
| Git Federation Searcher Search across multiple self-hosted Git instances including Gitea, Forgejo, GitLab, and Codeberg. Aggregates search results from Codeberg.org, Gitea.com, Open... | |
| Chattts High-quality, conversational Text-to-Speech (TTS) generation via local ChatTTS API. | |
| 中文笑话库 提供多类型中文笑话，包括谐音梗、程序员笑话、生活趣事和脑筋急转弯，无需外部接口。 | |
| Chinese Joke Api Fetches humorous Chinese jokes using third-party APIs like Hitokoto and JokeAPI with error handling and timeout support. | |
| Joke Api Access diverse jokes by category, language, and type with filters for safe content using the free JokeAPI without requiring registration or an API key. | |
| Kuaidi Query Query logistics tracking information via Track123 API | |
| Medical Advice 提供医疗咨询和就医建议。根据症状、病史等信息分析可能的原因，提供初步判断和建议，包括是否需要就医、挂什么科、可能的检查项目等。支持常见疾病的症状查询、用药指导、健康建议等。集成 PubMed 医学文献搜索和 OpenFDA 药品信息查询，可引用权威来源。 | |
| Openclaw Multi Search Engine Multi search engine integration with 17 engines (8 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and Wolfra... | |
| Auto-Report Automated daily/weekly/monthly report generation with scheduled delivery. Use when: generating reports, creating cron-based report tasks, pushing structured... | |
| diff4 Preview git diffs and files using the diff4 CLI. Use when the user wants to see code changes, review files content securely via diff4 | |
| Prompt Engineer 将用户模糊简单的需求，转化为逻辑严密、结构清晰的专家级结构化Prompt，适配Gemini/GPT/Claude/Qwen等大模型最佳实践 | |
| Browser Cookie Manager Read cookies from mainstream browsers and convert to specified format | |
| Comment Wordcloud Generate word frequency statistics and word cloud from social media comments | |
| Smart Downloader Smart file downloader with multi-threading, resumable downloads, and progress display | |
| Verify Code Change Run application to verify code changes meet expectations | |
| X Reader Read X (Twitter) posts without official API. Supports both Nitter (free) and RapidAPI (detailed) methods. | |
| agent-inner-life Your agent remembers how things have been going: dated state, an evening journal, dreams at night, and a way to read it all back. No scores — recency carries the meaning. Writes under inner-life/, plus a few lines into native memory that ev | |
| Bravado Turn a project link into a choreographed motion film | |
| Fivem FiveM RP server engineering for QBCore, ESX, and QBox. Use for framework-level scripting, fxmanifest.lua/config.lua validation, resource debugging, dependency orchestration, MLO/streaming fixes, performance optimization (client/server), art | |
| job-search-agent Find and evidence-rank job opportunities, tailor truthful materials, and prepare reviewed application packets from a validated candidate profile and application history. | |
| Mux Video Bot Mux Video infrastructure skill for designing, ingesting, transcoding/packaging, playback ID policy, live streaming, clipping, and observability with Mux Data. Use when architecting or operating Mux-based video pipelines, live workflows, pla | |
| Vector Embedded Retrieval Archive Give AI agents the ability to search PDFs and document libraries using keyword, semantic, or hybrid retrieval. VERA stores text, embeddings, figures, and citation metadata in portable .vera files, enabling local search without a separate ve | |
| openclaw-threadsctl Manage Threads accounts, OAuth connect URLs, drafts, and publishing through the local threadsctl CLI. Use when the user wants to post to Threads, create or p... | |
| Frontend Backend Flow Test Audit-first frontend-backend contract analyzer for static API compatibility checks. Compare frontend request behavior with backend endpoint contracts, DTO hi... | |
| asale-buy-claude-code Switch Claude Code between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Claude Code，并查看哪些正在运行的会话还用着旧配置。 | |
| asale-buy-codex Switch Codex between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Codex，并查看哪些正在运行的会话还用着旧配置。 | |
| asale-buy-gemini-cli Switch Gemini CLI between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Gemini CLI，并查看哪些正在运行的会话还用着旧配置。 | |
| asale-buy-hermes Switch Hermes between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Hermes，并查看哪些正在运行的会话还用着旧配置。 | |
| asale-buy-openclaw Switch OpenClaw between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 OpenClaw，并查看哪些正在运行的会话还用着旧配置。 | |
| asale-buy-opencode Switch opencode between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 opencode，并查看哪些正在运行的会话还用着旧配置。 | |
| asale-sell-claude Put a Claude Code / Claude subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Claude Code / Claude 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。 | |
| asale-sell-codex Put a Codex / ChatGPT subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Codex / ChatGPT 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。 | |
| asale-sell-endpoint Sell a custom OpenAI-compatible endpoint on the asale market: probe it, connect it as an account, and price it above what its own tokens cost. 把自定义 OpenAI 兼容端点挂到 asale 市场上卖：先探测、接入成账号，并把价格定在它自己的 token 成本之上。 | |
| asale-sell-gemini Put a Gemini CLI subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Gemini CLI 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。 | |
| 多商品批量生图 Batch Image 多商品批量生图流水线。商品清单 CSV → 整批统一视觉的商拍图，带并发、重试、断点续跑、成本熔断与挑图联系表。当用户说「批量生图」「一批商品」「跑整个 SKU 表」「几百个商品出图」时使用。 | |
| 店铺视觉统一 Brand Kit 店铺品牌视觉锁定。一份 brand.yaml 定义模特、色温、构图、留白与文案语气，所有生图技能读它，保证跨 SKU 视觉统一。当用户说「统一风格」「同一个模特」「店铺调性」「品牌规范」「几百个 SKU 看起来像一家店」时使用。 | |
| 服装细节放大图 Clothing Detail 服装工艺细节放大图。服装图 → 面料纹理、走线、织法的微距特写。当用户说「细节图」「特写」「面料放大」「工艺展示」「近景细节」时使用。 | |
| 商品平铺图提取 Clothing Extraction 从任意图提取干净商品平铺图。真人图 / 街拍图 → 白底平铺商品图。当用户说「提取衣服」「扒图」「转平铺」「抠成商品图」「从买家秀提取」时使用。 | |
| 穿搭种草图 Clothing Grass Planting 同款穿搭换模特换场景做种草图。穿搭图 → 社交平台风格的种草图。当用户说「种草图」「小红书风格」「换场景发帖」「达人图」时使用。 | |
| 创意生图 Creative Scene 从零创意生图，也可定向改模特、姿势、搭配。一句描述（可选参考图）→ 图。当用户说「创意生图」「生成一张」「改个姿势」「换模板」「随便来张图」时使用。 | |
| 跨境本地化 Cross-border Localize 跨境一套素材多区域本地化。一套素材 → 多语言文案、尺码换算表、区域合规标识。当用户说「跨境本地化」「多语言」「翻译上架」「海外版本」「英文版主图」时使用。 | |
| 投前 AI 图检测 Detect Task 投前 AI 图真实性质检。待检图 → 风险等级 + 8 项逐条判定 + 可直接追加到 prompt 的修正句，可自动重跑直到达标。当用户说「投前检测」「图片质检」「检查有没有崩」「上架前把关」「这图能不能用」时使用。 | |
| 文章转视频 Article to Video article to video, text to video, news to video, essay to video — turn a written article into a narrated explainer video: outline, storyboard, voiceover, build, validate. Use when the user pastes or gives an article and wants a video. | |
| 音频生成 Audio Generate Audio generation skill. Automatically selects the best dlazy CLI audio/TTS model based on the prompt. 音频生成技能。根据提示词自动选择最佳的 dlazy CLI 音频/TTS 模型。 | |
| 图像生成 Nano Banana Pro Generate/edit images with Nano Banana Pro. Supports text-to-image and image-to-image. 使用 Nano Banana Pro 生成/编辑图片，支持文生图与图生图。 | |
| 图像生成 Nano Banana 2 Generate/edit high-quality images with Nano Banana 2.0. Supports text-to-image and image-to-image. 使用 Nano Banana 2.0 生成/编辑高质量图片，支持文生图与图生图。 | |
| 博客转视频 Blog to Video blog to video, blog post to video, article to video — convert a blog post into a narrated video with storyboard, voiceover, and build. Use when the user gives a blog post (text or link) and wants a video version for social or YouTube. |
26,301–26,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.