Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 视频生成 Video Generate 视频生成技能，AI 视频生成，文生视频、图生视频、图片转视频、首尾帧生成视频。根据提示词自动选择最佳视频生成模型（即梦、可灵、Veo、Seedance、万相、PixVerse、数字人、对口型）。Video generation skill that automatically selects the best dlazy CLI video model based on the prompt. | |
| 视频图片仿制 Video Image Replicate replicate this image, remake this video, recreate a reference, same video with my content, 同款视频, 照着做 — study the reference image or video the user provides, then recreate the same look and structure with the user's own subject, product, or | |
| 视频仿制 Video Replicate Video replicate tool: extracts the first frame and audio from the source video, runs video understanding for a prompt, and returns a Seedance 2.0 replicate bundle (first frame + audio + video). 视频复刻工具，从源视频中提取首帧与音频，并通过视频理解生成描述提示，输出 Seedance | |
| 分镜视频生成 Storyboard Video 1. Get the storyboard info | |
| 视频翻译配音 Video Translate & Dub video translation, video dubbing, subtitle translation, translate video to Chinese, add subtitles to video, AI dubbing, srt translation, 视频翻译, 视频配音, 字幕翻译 — transcribes a video with word-level timings, translates the subtitles, then burns th | |
| 视频对口型 Video Retalk Tongyi VideoRetalk lip sync / lip-sync (mouth sync, dubbing) video model — takes a talking-person video plus a voice audio track and regenerates the video so the speaker's mouth/lips match the new audio. Use this for lip syncing a person vi | |
| 视频抠像 Video Segmentation Video human segmentation tool: invokes Aliyun's async SegmentVideoBody and returns a same-length black/white mask video, suitable for downstream compositing or matting. 视频人像分割工具：调用阿里云 SegmentVideoBody 异步任务，返回与原视频同时长的 mask 视频（黑白蒙版），可用于后续合成或抠 | |
| 声音克隆 Vidu Audio Clone Clone voice and generate new text reading audio with one click using Vidu Audio Clone. 使用 Vidu 声音克隆技术，通过参考音频一键复制音色并生成新文本的朗读音频。 | |
| 图生视频 Vidu Q2 Convert static images into dynamic videos using Vidu Q2 image-to-video model. 使用 Vidu Q2 图生视频模型，将静态图片通过智能运镜转化为动态视频。 | |
| 文生图 Vidu Q2 Generate high-quality images with Vidu Q2. Supports text-to-image and image-to-image. 使用 Vidu Q2 生成高质量图像，支持丰富的文生图与图生图指令。 | |
| Dlazy Wan2.6 R2v Accurately generate continuous videos based on reference images using Wan 2.6 R2V. | |
| Dlazy Wan2.6 R2v Flash Quickly generate dynamic short videos from reference images using Wan 2.6 Flash. | |
| 视频生成 通义万相 Wan 2.7 Tongyi Wanxiang 2.7 video model 鈥?one model covers text-to-video, first/last-frame-to-video, and reference-to-video. | |
| 网站转视频 Website to Video website to video, url to video, landing page to video, link to ad, web promo video — capture the site, derive brand, storyboard, voiceover, build, validate on a Remotion template. Use when the user gives a URL (or just pastes a link) and wa | |
| 条漫改编 Webtoon Adapter 技能 | |
| 一键替换服装面料 Fabric on Body 一键替换服装面料。版式图 + 面料图 → 换上新面料的样衣图，垂坠与光泽随材质变。当用户说「换面料」「换材质」「试布料」「面料上身」「同款不同料」时使用。 | |
| 一图裂变套图 Fission Pattern 一张商品图裂变成整套素材。商品图 + 卖点 → 多角度多场景成套图，够铺满一屏。当用户说「裂变套图」「一张变一屏」「凑够详情页」「出一套图」时使用。 | |
| 服装图一键上身 Flat Lay 服装平铺图一键上身试穿。服装平铺图 + 姿势参考图 → 模特上身商拍图，款式、颜色、织法、版型保持不变。当用户说「平铺图转模特图」「衣服上身」「虚拟试穿」「AI 试衣」「让模特穿上」时使用。 | |
| 多单品搭配融图 Image Fusion 多单品融合成一整套 Look。最多 8 张单品图 → 同一模特身上的完整搭配商拍图，每件单品保真。当用户说「多件搭配」「融图」「组一套 look」「搭配图」「几件衣服合成一张」时使用。 | |
| 商品换背景 Item Change Background 商品换背景。白底商品图 → 逼真场景图，光影与投影匹配新环境。当用户说「换背景」「加场景」「白底转场景」「放到桌面上」时使用。 | |
| 商品详情图生成 Item Detail 生成带中文排版的详情页模块。商品图 + 卖点 → 可直接上架的详情页图文模块。当用户说「详情页」「做详情图」「商品描述图」「详情页模块」时使用。 | |
| 商品图精修 Item Repair 商品精修、去褶皱。随手拍的商品图 → 可直接上架的精修图。当用户说「精修」「去褶皱」「修图」「拍得不好看」「整理一下」时使用。 | |
| 卖点主图生成 Item Selling Point 商品图生成带文案排版的转化主图。商品图 + 卖点 → 带中文文案的电商主图。当用户说「主图」「加卖点文案」「转化图」「促销图」「主图文案」时使用。 | |
| 主图 A/B 与复盘 Listing Optimizer 主图 A/B 组与转化复盘。商品图 + 卖点 → 多组对照主图 + 每组的差异假设 + 复盘模板。当用户说「A/B 测试」「主图优化」「提点击率」「哪版更好」「换个版本试试」时使用。 | |
| 主图视频 Main Image Video 静态主图转主图视频。一张商品图 → 3–5 秒可上架的主图短视频。当用户说「主图视频」「图转视频」「让图动起来」「加个视频」时使用。 | |
| 材质质感增强 Material Enhancement 材质质感增强与纹理重建。糊掉的图 + 高清商品图 → 纹理清晰可信的图。当用户说「增强质感」「图糊了」「补纹理」「提清晰度」时使用。 | |
| 换模特换背景 One Shot 已有模特图换模特、换背景。一张模特图 → 多人群多场景版本，商品本身不变。当用户说「换模特」「换背景」「换人种」「一图多版」「同一件衣服换个人」时使用。 | |
| 上架前合规校验 Platform Compliance 上架前平台合规校验与自动修复。待上架图 → Amazon / TikTok Shop / Temu / Shopee / 淘宝 各平台的通过或驳回风险报告，可一键修成合规图。当用户说「会不会被驳回」「合规检查」「白底不达标」「主图规格」「传上去被拒」时使用。 | |
| 商品短视频广告 Product Video Ad 商品短视频广告。卖点 → 分镜脚本 → 分段生成 → 拼接加字幕成片。当用户说「做条广告」「短视频」「投流素材」「分镜脚本」「带货视频」时使用。 | |
| 一键去水印去文字 Remove Watermark 去水印去文字。带水印 / 文字 / logo 的图 → 干净图，背景纹理自然补全。当用户说「去水印」「去文字」「擦掉 logo」「把字去了」时使用。 | |
| SearchOnlineAssets Online asset search tool: queries public stock libraries (Pixabay) for high-quality photos, illustrations, vectors and videos, returning result metadata and... | |
| 平铺图转 3D 立体图 To 3D 平铺图转隐形模特立体图。平铺图 → 有体积感与版型的立体展示图。当用户说「转 3D」「立体图」「隐形模特」「把衣服撑起来」时使用。 | |
| UGC 口播种草视频 UGC Testimonial UGC 口播种草视频。商品 + 人设 → 口播脚本与成片，达人自拍质感。当用户说「口播视频」「种草视频」「达人风格」「UGC」「真人推荐」时使用。 | |
| 鞋包配饰真人穿戴 Wear Everything 鞋包配饰真人穿戴图。商品图 + 模特参考图 → 真人佩戴图，落位、透视与阴影自然。当用户说「鞋包上脚」「配饰上身」「墨镜戴上」「首饰佩戴图」「包包上身」时使用。 | |
| rhythm-master This skill enables playing a rhythm game called "节奏大师" (Rhythm Master) similar to QQ Dance/DDR. Players press arrow keys and spacebar in time with falling no... | |
| Vault-0: Agent Security, Monitor & x402 Wallet for OpenClaw Security suite for OpenClaw agents. Encrypted secret storage (AES-256-GCM), real-time activity monitoring via gateway WebSocket, policy enforcement, and native x402 payment wallet with EIP-3009 signing. Secure API keys, watch agent behavior | |
| Airdrop Monitor CN 空投任务与公告监控助手。监控项目公告页/文档页的内容变化，提取截止时间线索，识别高风险关键词与可疑链接，输出可执行的每日行动清单。用于把“刷空投”变成可重复的监控流程（本地运行 + 可选计费）。 | |
| Invoice Chaser CN 自动生成中英双语催款消息与跟进节奏，帮助自由职业者和小团队更快回款。 | |
| chain-ops MGO Find and compare gas prices across multiple EVM chains to identify the cheapest option for transactions and contract deployments. | |
| Ouyi API Tool 使用欧亿（ouyi）API 进行对话分析的 ACP skill。当用户要求使用 ouyi 模型、 欧亿模型、分析黄金、投资、技术问题等需要 AI 推理的任务时使用此 skill。 该 skill 通过本地 Node.js 脚本直接调用 ouyi API， 解决 OpenClaw 的 openai-completi... | |
| 领域标签体系构建 构建领域业务标签体系，按业务阶段与场景对拆分知识问答进行精准分类与打标，提升知识检索效果。 | |
| mac-app-launcher 查询和打开 macOS 应用程序。通过关键词搜索已安装的 App，并使用 open 命令启动。 当用户要求查找、搜索、列出、打开某个 Mac 应用程序时使用。 | |
| mac-system-control 管理和控制 macOS 系统功能。包括查看系统信息、管理进程、控制音量/亮度、 网络管理、电源管理、截图、剪贴板、Finder 操作等。当用户要求查看系统状态、 控制系统设置、管理进程、截图、调节音量亮度、查看网络信息、 关机重启睡眠等 Mac 系统操作时使用。 | |
| news-search 专门用于查询各大搜索网站的新闻结果。支持百度新闻、今日头条、Bing新闻、Google新闻和新浪新闻。可以同时聚合多个来源的结果，并进行去重处理。 | |
| web-fetch 使用带 Stealth 插件的无头浏览器抓取网页内容并转换为 Markdown。用于当需要获取特定网页的正文、新闻详情、公司财报或其他长篇网页内容时。支持绕过大多数基础反爬虫检测。 | |
| web-search 使用无头浏览器通过多个搜索引擎搜索内容。用于当用户需要搜索最新新闻、时事、股票信息或其他需要实时网络数据的内容时。支持百度、Bing、360、Sogou、微信、今日头条、谷歌等国内外搜索引擎。 | |
| AI Video Asset Manager AI视频制作资产管理体系。负责角色/场景/道具资产的创建、锁定、版本管理，镜头分镜规划，生成记录归档，一致性检查，返工记录。触发词：新角色、新场景、新镜头、拍视频、建资产、锁定资产、一致性检查、生成记录、返工记录、小弯开拍。当需要管理AI视频生成资产，或为新角色/场景建立资产卡时激活。 | |
| Biz Retro Analyzer Turn conversations, field observations, and follow-up reasoning from complex collaborative projects into evidence-backed analysis of participant understandin... | |
| Fde Operator Os Applied AI operator playbook for delivery leads who need to qualify an AI opportunity, turn messy operational reality into a structured business system, desi... | |
| pbl-loop Use when the user asks for learning goals, capability development, reflection, teaching, replication, transfer readiness, or applying a PBL loop in a real project context. Operate in exactly three modes, start, checkpoint, transfer, to sepa |
26,451–26,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.