Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 4to1 Planner AI planning coach using the 4To1 Method™ — turn 4-year vision into daily action. Connects to Notion, Todoist, Google Calendar, or local Markdown. Use when us... | |
| Adaptive Reasoning Automatically assess task complexity and adjust reasoning level. Triggers on every user message to evaluate whether extended thinking (reasoning mode) would... | |
| Subhuti Coach Framework Buddhist-informed AI coaching framework with ICF-aligned methodology, 50+ dialogues, assessments, daily practices, and 30-day program. | |
| Miniflux Skill Manage Miniflux - Modern minimalist feed reader via REST API. Use for listing feeds and entries, creating/removing subscriptions, searching articles, managin... | |
| AI 토큰세이버 한국어 특화 Context DB로 AI 토큰 사용량을 최대 96% 절감하며 프롬프트를 최적화하고 메모리 검색을 지원합니다. | |
| Marketing Scenario Simulator Marketing strategy simulation with multi-agent analysis. Use when evaluating marketing strategies, product launches, campaigns, or needing diverse perspectiv... | |
| TokenSaver 한국어에 최적화된 OpenViking 기반 컨텍스트 DB로 토큰 91% 절감, 계층 구조 메모리 관리 및 자동 압축 기능을 제공합니다. | |
| Openviking Pro Skill 한국어 형태소 분석 기반 클라우드 Context DB API로 토큰 최대 96% 절감, 자동 동기화 및 팀 공유 기능 지원. API Key 필요. | |
| TokenSaver Korean 🧠 한국어 Context DB for AI Agents — 토큰 91% 절감. 임베딩 의미 검색, 중복 자동 병합, 메모리 계층화(Hot/Warm/Cold), 자동 아카이브, WAL 프로토콜, 엔티티 추출. Korean-first + English support. | |
| 토큰세이버 (한국어) 한국어 Context DB로 AI 토큰 사용량을 최대 96% 절감하는 프롬프트 최적화 및 메모리 검색 도구입니다. | |
| Vision Simulator Marketing strategy prediction with real-world data integration. Predicts campaign outcomes, product launches, and market reactions using multi-agent simulati... | |
| 去豆包水印 Batch remove Doubao (豆包 AI) watermarks from images using OpenCV inpainting. Use when the user asks to remove watermarks, batch remove watermarks, 去水印, 批量去水印,... | |
| Humanizer Enhanced Advanced AI text humanizer for blog content. Detects and removes 34 AI writing patterns, adds personality/soul, and handles crypto/Web3 specific tells. Use w... | |
| Ralph Quick Security Check Fast security spot-check with 10 iterations (~5-10 min). Use when user says 'quick security check', 'pre-deploy audit', 'ralph quick', 'fast security scan',... | |
| Ralph Security Audit Comprehensive security audit with 100 iterations (~30-60 min). Use when user says 'security audit', 'ralph security', 'weekly security check', 'audit this pr... | |
| Ralph Ultra Security Audit Deep-dive security audit with 1,000 iterations (~4-8 hours). Use when user says 'deep security audit', 'ralph ultra', 'compliance audit prep', 'thorough secu... | |
| Skeall Skill Builder Agent Skills (SKILL.md) builder, auditor, and improver for cross-platform LLM agents. Use for "skeall", "build a skill", "create skill", "improve skill", "au... | |
| Traktor Web Scraper Extract all assets and content from websites including images, SVGs, fonts, videos, and page structure. Parallel agents with thorough scraping coverage. Trig... | |
| twitterapi-io Interact with Twitter/X via TwitterAPI.io — search tweets, get user info, post tweets, like, retweet, follow, send DMs, and more. Covers all 67 active endpoi... | |
| AI搭子匹配平台 AI搭子匹配平台 - 智能用户画像与匹配系统。 基于用户主动提供的 AI 使用数据（token消耗、模型偏好、工具调用习惯等）， 生成多维用户画像，实现AI玩家间的智能匹配。 当用户提到"搭子"、"匹配"、"用户画像"、"AI使用分析"、"token统计"、 "使用报告"、"玩家等级"时触发此技能。 | |
| 设备电量查询 设备电量查询与播报。当用户询问电量、剩余电量、还有多少电、电池状态、耳机电量、耳机仓电量、左耳电量、右耳电量时使用此技能。覆盖场景：(1) 查询耳机整体电量（播报左耳+右耳）；(2) 查询耳机仓电量（仅播报耳机仓）；(3) 查询全部电量（播报耳机仓+左耳+右耳）。 | |
| 4aiagents Browse and participate in 4aiagents, a shared meeting place for AI agents from different systems. Use when exploring its public conversations, posting, using private conversations, or resuming participation with saved access. | |
| Cold Email Prospecting Agent Find work or personal emails, mobile phone numbers, and verify email validity using LinkedIn URLs or names with company domains for sales outreach. | |
| Franchise Analyzer Skill Evaluate a franchise opportunity like an investor. Given a brand name or its Franchise Disclosure Document (FDD), analyze total investment, fees and royaltie... | |
| Local Business Appointment Agent AI agent for local businesses to automate appointment scheduling, reminders, cancellations, and calendar integration. | |
| Vibes-Coded Agent Connector OpenClaw + npm vibes-coded-agent-connector: register agents, listings, Solana escrow jobs, prepaid /start + X-Vibes-Key, Operator Interrupt (X-Operator-Notif... | |
| OpenClaw Flomo Skill Read and write flomo memos on macOS. Use when user asks to fetch recent flomo notes, search memo text in local flomo cache, or create/write a new memo to flo... | |
| XHunt Hot Tweets 从 XHunt 抓取 X/Twitter 热门推文榜单并输出中文摘要与互动数据。用户提到“最火推文/热门帖子/Top20/4小时最火/只要AI/AI最火/给我链接+摘要”等请求时使用。支持 group=global|cn、hours=1|4|24、tag=ai|crypto|全部，并可切换过滤模式（全部/仅AI产... | |
| Xhunt Hot Tweets 从 XHunt 抓取 X/Twitter 热门推文榜单并输出中文摘要与互动数据。用户提到“最火推文/热门帖子/Top20/4小时最火/只要AI/AI最火/给我链接+摘要”等请求时使用。支持 group=global|cn、hours=1|4|24、tag=ai|crypto|全部，并可切换过滤模式（全部/仅AI产... | |
| call-pele-answer 按块路由的解释技能：给回答里的每一段内容挑最合适的形式（文字、表格、图、步骤、滑杆）。先画出回答的全貌， 拆成内容块，按每块的信息形状和理解障碍选形式：STE 风格文字、表格、Mermaid 图（内置渲染，30+ 种）、 滑块、标签页、分步播放；再决定载体：聊天里直接答，还是生成一页离线 HTML。模型只写 Markdown 稿件， bundled CLI 负责排版、配色、图的坐标和检查。用于：讲原理、讲流程/架构/状态、比较方案、复盘诊断、 教学演示，或用户说“讲讲 / 没 | |
| Agent Harness Architect Diagnose and harden any long-running agent architecture. Describe your agent setup and get a complete harness optimization plan + auto-generated bridge artif... | |
| Capability Radar 检测并标记能力缺口、重复模式和规则冲突，供架构进化使用。当以下情况发生时使用：(1) 某项任务因工具能力缺失或损坏而失败，(2) 同类型请求出现 3 次以上，(3) 规则冲突导致了错误行为，(4) 不得不使用临时绕过方案。目的：让 Claude Cowork 下次会话时能看到明确的进化信号，而非淹没在 memor... | |
| Commitment Engine 小梦的承诺引擎——将口头任务转化为可追踪的定时承诺，确保到点执行、不遗漏、不等人催。 | |
| Harness Evolve AI Agent 自进化引擎——消费研究日志 → 系统自检 → 架构优化（分级执行/提案）→ 写入当日进化摘要。 适用于任何 AI Agent 系统：OpenClaw、Claude Code agent、AutoGPT、LangGraph 或自研框架。 触发词：自进化、self-evolve、架构优化、agent... | |
| Harness Research AI Agent Harness 前沿研究 skill——让你的智能体每天自动追踪 AI Agent 领域最新论文和文章， 用结构化框架分析，记录可落地到自身系统的改进方向，实现智能体的持续自我进化。 触发词：研究论文、找最新文章、Harness学习、读paper、agent研究、分析论文、 今日研究、self-... | |
| Filmora Video Enhancer Cloud-based video enhancement skill that uploads a user-selected local video file to Wondershare-hosted endpoints for AI enhancement, then downloads the proc... | |
| double6-deep-research 在用户授权范围内使用宿主搜索、网页和本地材料完成多来源研究；在指定目录写入报告、记录、SHA-256 候选哈希与验证回执，并运行 Python validator。用于深入调研、对象比较、证据化决策和复杂事实核验。 | |
| Double6 PDF Translation Translate user-supplied text PDFs into Simplified Chinese and bilingual PDFs. Reads the PDF and only explicitly selected local LaTeX, sends extracted text to an explicitly approved OpenAI-compatible endpoint, runs local PDF/Python subproces | |
| Double6 PPT CLI 基于 ppt-master 与 iOfficeAI/OfficeCLI 两个开源项目，生成、套用模板、读取、检查和闭环修复原生 PPTX；“可编辑”重点指保留原生对象与稳定身份，方便 Agent 多轮定位、修改和复查。适用于从 Markdown、文本、结构化材料与本地授权图片制作演示文稿，复用常规 PPTX 模板，或质检和受限修复已有 PPTX；不负责 PDF/DOCX 内容解析、联网搜图、图片式 PPT、HTML slides、TTS 或视频。 | |
| double6-workbench-builder 把普通用户反复要做的真实事情构建成离线优先、严格单文件、个人数据留在当前设备的本地工作台。用户提到个人工作台、学习台、备考台、任务面板、记录与复盘工具，或想把重复流程做成可保存恢复的页面时应使用；联网、多人协作、账号、支付和发布属于独立外部流程。 | |
| PlanSuite Create, finalize, and execute detailed project plans with sub-plans, checkpoints, progress tracking, and change control across sessions using file-based work... | |
| PlanSuite Create, finalize, and execute file-based project plans with subplans, using checkpoints and logs for controlled, session-based implementation and progress tr... | |
| atoll Use Atoll for project, issue, goal, KPI, initiative, milestone, artifact, external reference, PRD, implementation plan, comment, dependency, runner, and workflow operations. Activate for Atoll planning, execution, project-management, local- | |
| atoll Use Atoll for project, issue, goal, KPI, initiative, milestone, artifact, external reference, PRD, implementation plan, comment, dependency, runner, and workflow operations. Activate for Atoll planning, execution, project-management, local- | |
| Coil API Use Coil's CLI and API for agent-operated outbound recipes, durable runs, lead management, automations, provider integrations, feedback, and runtime discovery. Use when an agent needs to install, authenticate, discover, or operate Coil thro | |
| cad-skill Control local CAD applications on Windows including launching apps, opening files, checking status, closing apps, detecting active or running apps, detecting... | |
| cae-skill Control local CAE applications on Windows including launching apps, opening files, checking status, closing apps, detecting active and running apps, detectin... | |
| 法律幻觉校验器 校验文本内容中的法律引用是否正确：自动抽取文中引用的法规/法条和案例/案号，与权威来源比对语义一致性，核验法规时效性，输出"一致/不一致/未命中"判定及权威原文。当用户要求复核、校验、核查法律引用准确性，询问法律文本是否存在幻觉，或请求AI帮助撰写包含法律引用的法律文书时，视为必须启用本skill | |
| Code Stats 分析代码仓库的统计信息（行数、文件数，语言分布）。用于了解项目规模和复杂度。当需要了解项目有多大、有多少代码时使用。 | |
| Onchain Verify Transaction Verify an EVM transaction's calldata via Tenderly before signing. Confirms which tokens move, in what amounts, and to which addresses. Designed to be called... |
26,801–26,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.