Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 客户背景调查-摸清客户采购底细 客户背景调查助手（销售/BD 视角）。当用户给出一个客户单位主体（公司/政府/学校/医院等），想在拜访、投标、商务接触前摸清客户底细时，必须使用此SKILL：客户背景调查、客户画像、采购习惯分析（它过去招过什么标、买过什么）、预算水平评估（历史采购金额量级）、现有供应商格局（在位者是谁、合作多深）、采购活跃度分析、大项目盘点、公开风险检索。基于全网招投标数据输出报告：采购史是真实发生的招标记录、供应商关系是真实合同关系。支持单客户深度报告与双单位对比。即使用户没有提到「背调」 | |
| 启信宝企业背调-招投标视角查企业 企业背景调查助手（招投标视角，习惯用启信宝等平台查企业的用户适用）。当用户给出一个公司主体（公司名/简称/公司链接），想做企业背调、查企业底细、企业画像、了解一家公司靠不靠谱/实力怎么样/中过什么标时，必须使用此SKILL：企业背景调查、公司背景核查、主营业务分析、客户与供应商关系、中标记录与履约实力、竞争对手识别、公开风险检索。基于全网招投标数据出报告：竞对从投标重叠算出、实力用中标记录证明、客户供应商是真实合同关系——这是工商信息类平台查不到的。支持单公司深度报告与双公司 | |
| 企查猫企业情报-企业全景一次看清 企业情报全景分析助手（招投标视角，习惯用企查猫等平台查企业的用户适用）。当用户给出一个公司主体（公司名/简称/公司链接），想做企业情报分析、企业画像、企业全景调查时，必须使用此SKILL：企业情报报告、主营业务与业务词云、客户供应商生态（靠谁吃饭/给谁供货）、中标实力与逐年走势、地区盘面、竞争对手识别与交锋记录、公开风险检索。基于全网招投标数据输出报告：竞对从投标重叠算出、实力用中标记录证明、客户供应商是真实合同关系。支持单公司深度报告与双公司对比。即使用户没有提到「情报」， | |
| 爱企查企业情报-招投标实力视角查企业 企业情报与实力画像助手（招投标视角，习惯用爱企查等平台查企业的用户适用）。当用户给出一个公司主体（公司名/简称/公司链接），想查企业情报、企业画像、了解一家公司的真实实力时，必须使用此SKILL：企业信息查询、主营业务分析、中标实力与逐年走势、地区盘面、客户与供应商合同关系、竞争对手识别、公开风险检索。基于全网招投标数据出报告：实力用中标记录证明、竞对从投标重叠算出、客户供应商是真实合同关系——这是工商信息类平台查不到的。支持单公司深度报告与双公司对比。即使用户没有提到「情报 | |
| 建筑工程商机雷达-基建项目早期发现 建筑工程商机雷达。当用户想挖掘工程类早期商机（施工/市政/装修/园林/公路/房建/基建等）时，必须使用此SKILL：工程拟建项目查询（发改立项/审批阶段，提前6-18个月，基建类覆盖最全）、工程采购意向（发标前1-3个月）、工程服务临期续约、按投资额与审批进度排序、立项单位跟进建议。给一个工程领域/地区即输出按价值排序的商机清单。即使用户没有提到「建筑」，只要涉及工程项目线索、基建商机、施工项目早期发现等需求，都应使用本SKILL。 | |
| 建筑工程投标决策-施工项目投标评估 建筑工程投标决策分析助手。当用户给出一个具体的工程类招标项目（施工/市政/装修/园林/公路/房建/基建等），并希望进行投标决策分析时，必须使用此SKILL：该不该投、建设单位历史发包规律分析、长期合作施工单位（在位者）识别、竞争对手（同类工程投标人）预测、同类工程历史中标价与建议报价、资质门槛与废标风险评估。基于全网招中标历史数据输出决策报告。即使用户没有提到「建筑」，只要涉及工程项目投标评估、施工标该不该投、工程报价参考等需求，都应使用本SKILL。 | |
| 水滴信用企业尽调-合作前的轻尽调 企业尽职调查助手（招投标视角轻尽调，习惯用水滴信用等平台看企业信用的用户适用）。当用户给出一个公司主体，想在合作/签约/账期决策前做尽职调查、信用了解、风险排查时，必须使用此SKILL：企业尽调、轻尽调、合作方审查、客户背景调查、经营实态核验（是否真实有业务）、履约能力评估、大客户依赖度分析、公开涉诉与行政处罚检索。基于全网招投标数据输出报告：经营活跃度用中标记录证明、客户供应商是真实合同关系、竞对从投标重叠算出，公开风险逐条附来源链接。支持单公司深度报告与双公司对比。即使用 | |
| 临期续约商机-合同到期窗口挖掘 临期项目与续约商机发现助手。当用户想查询即将到期的项目合同、寻找续约/替换机会时，必须使用此SKILL：临期项目查询（合同到期前0-180天）、现供应商（在位者）识别、到期紧急度排序、按采购单位类型（政府/学校/医院/国企等）筛选、以及配套的拟建项目与采购意向商机扫描。给一个行业/地区即输出按价值排序的商机清单。即使用户没有提到「临期」，只要涉及合同快到期的项目、续约机会、替换现供应商等需求，都应使用本SKILL。 | |
| 弱电智能化投标决策-安防监控项目投标评估 弱电智能化投标决策分析助手。当用户给出一个具体的弱电智能化类招标项目（安防监控/楼宇智能化/机房建设/综合布线/视频监控/门禁停车等），并希望进行投标决策分析时，必须使用此SKILL：该不该投、建设方历史发包规律分析、长期合作智能化集成商（在位者）识别、竞争对手预测、同类工程历史中标价与建议报价、资质门槛与废标风险评估。基于全网招中标历史数据输出决策报告。即使用户没有提到「弱电」，只要涉及安防项目投标评估、智能化标该不该投、监控工程报价参考等需求，都应使用本SKILL。 | |
| IT信息化商机雷达-信创项目早期发现 IT信息化商机雷达。当用户想挖掘IT行业早期商机（信创/国产化/软件开发/系统集成/云/数据中心/网络安全/智慧城市等）时，必须使用此SKILL：数字化拟建项目查询（智慧城市/数字政府立项阶段，提前6-18个月）、IT采购意向（发标前1-3个月）、运维与软件服务临期续约（IT服务续约窗口价值高）、按预算与紧急度排序、甲方单位跟进建议。给一个技术领域/地区即输出按价值排序的商机清单。即使用户没有提到「IT」，只要涉及信息化项目线索、信创商机、数字化项目早期发现等需求，都应使用本 | |
| 医疗设备商机雷达-医院采购早期发现 医疗设备商机雷达。当用户想挖掘医疗行业早期商机（医疗设备/器械/耗材/检验试剂/医院信息化等）时，必须使用此SKILL：医院新建改扩建拟建项目（设备采购的最上游信号，提前6-18个月）、卫健系统采购意向（发标前1-3个月）、设备维保与服务临期续约、按预算与紧急度排序、采购单位跟进建议。给一个产品线/地区即输出按价值排序的商机清单。即使用户没有提到「医疗」，只要涉及医院采购线索、设备销售商机、卫健项目早期发现等需求，都应使用本SKILL。 | |
| 标前分析助手-投标前必查的一份报告 标前分析与投标尽调助手。当用户给出一个具体的招标项目并希望在投标前做全面分析时，必须使用此SKILL：标前分析/标前尽调、项目画像拆解（预算/标的物/资质门槛/时间线）、采购方历史采购与偏好供应商分析、竞争对手预测、同类项目历史成交价参考、废标红线与限制性条款排查、投标决策建议。基于全网招中标历史数据输出标前分析报告。即使用户没有提到「标前分析」，只要涉及投标前调查、项目背景排查、该不该投等需求，都应使用本SKILL。 | |
| 采购意向监控-发标前1-3个月对接 采购意向监控与早期商机发现助手。当用户想查询采购意向、政府采购计划或挖掘即将招标的机会时，必须使用此SKILL：采购意向查询（发标前1-3个月的公开采购计划）、按行业/地区/预算筛选、意向到发标的进展跟踪、每日/每周增量监控（商机晨报）、以及配套的拟建项目与临期续约商机扫描。给一个行业/地区即输出按价值排序的商机清单。即使用户没有提到「采购意向」，只要涉及即将招标的项目、提前对接采购人、快发标的机会等需求，都应使用本SKILL。 | |
| 拟建项目跟踪-立项审批阶段就发现 拟建项目跟踪与早期商机发现助手。当用户想查询拟建项目、在建工程立项信息或挖掘早期商机时，必须使用此SKILL：拟建项目查询（发改立项/审批公示阶段，提前6-18个月）、审批状态筛选（未审批/审批中/办结）、立项单位跟进、项目进展跟踪（是否进入招标）、以及配套的采购意向与临期续约商机扫描。给一个行业/地区即输出按价值排序的商机清单。即使用户没有提到「拟建」，只要涉及立项项目查询、还没招标的项目、早期项目线索等需求，都应使用本SKILL。 | |
| 招标商机发现-还没发标先知道 招标商机发现助手。当用户想主动挖掘商机/销售线索/潜在客户时，必须使用此SKILL：找商机、找线索、客户开发、市场机会、渠道拓展、拟建项目（立项/审批阶段，提前6-18个月）、采购意向（发标前1-3个月）、即将招标、临期项目/续约机会（现供应商合同到期）、跟踪项目进展阶段。给一个行业/产品/地区，三路早期商机一网打尽并按价值排序输出商机清单。即使用户没有提到「商机」，只要涉及找项目线索、挖潜在客户、提前发现招标机会等需求，都应使用本SKILL。 | |
| Ultimate Music Manager Organises a messy local music library into a clean Language/Artist/Album hierarchy using acoustic fingerprinting, deduplication, metadata enrichment, and opt... | |
| Polymarket Trader Build and analyze a BTC 1h Up/Down trading strategy anchored to Binance BTCUSDT, applying edge thresholds, regime filters, and detailed trade validation. | |
| kesha-voice-kit Local multilingual voice toolkit — speech-to-text (STT), text-to-speech (TTS), speaker diarization, and language detection, over a CLI or an MCP server. Runs entirely offline on Apple Silicon, Linux, and Windows. No API keys, no cloud. NVID | |
| UAE Clinic Arabic Comms Bilingual Arabic/English patient communications for UAE clinics. Trigger on: "Arabic patient letter", "appointment reminder Arabic", "clinic message Arabic",... | |
| UAE clinic-compliance UAE clinic regulatory compliance, audits, accreditation, and incident reporting. Trigger on: "DOH inspection", "DHA audit", "clinic accreditation", "JCI UAE"... | |
| UAE clinic-digital-health Digital health technology for UAE clinics — EMR, telemedicine, AI tools, patient apps, and health data interoperability. Trigger on: "clinic EMR", "electroni... | |
| UAE clinic-financials Clinic financial management, P&L, budgeting, and profitability for UAE private clinics. Trigger on: "clinic profit", "clinic revenue", "clinic expenses", "cl... | |
| UAE clinic-marketing-uae Marketing and patient acquisition for UAE private clinics. Trigger on: "clinic marketing", "attract patients UAE", "clinic Google", "clinic SEO", "clinic soc... | |
| UAE clinic-operations Day-to-day clinic operations management. Trigger on: "clinic schedule", "appointment system", "patient flow", "clinic SOPs", "standard operating procedures c... | |
| UAE clinic-quality Clinical quality management, patient safety, and continuous improvement for UAE clinics. Trigger on: "clinic quality", "quality improvement", "patient safety... | |
| UAE Clinic Setup Guide for setting up a private medical clinic or specialist centre in the UAE. Trigger on: "open a clinic", "start a medical practice", "set up a clinic UAE"... | |
| UAE clinic-staffing Clinic staffing, hiring, HR, payroll, and team management for UAE clinics. Trigger on: "hire a nurse UAE", "clinic receptionist", "hire doctor UAE", "locum U... | |
| UAE medical-billing-uae Medical billing, insurance claims, and revenue cycle management for UAE clinics. Trigger on: "medical billing UAE", "insurance claim", "DAMAN", "ADNIC", "Thi... | |
| Clawnema Go to the movies at Clawnema, the virtual cinema for AI agents. Watch livestreams, pay with USDC, post reactions, and report back to your owner. Use when ask... | |
| Trio Stream Vision Analyze any YouTube livestream or RTSP camera feed using natural language — ask what's happening, detect specific events, or get periodic summaries. Powered... | |
| Trio Vision Turn any live camera into a smart camera — describe what to watch for in plain English, get alerts in your chat when it happens. Ask questions about any live... | |
| Supplement Research Evidence-based supplement intelligence powered by the SupStack database (220 supplements, 7,780+ studies, 21 health goals). Use when the user asks about supp... | |
| YouOS YouOS — local-first personal email copilot that learns your writing style from Gmail, Google Docs, and WhatsApp exports, then drafts replies in your voice. U... | |
| Pokemon Red Play Pokemon Red autonomously via PyBoy emulator. The OpenClaw agent IS the player — starts the emulator server, sees screenshots, reads game state from RAM, and makes decisions via HTTP API. Use when an agent wants to play Pokemon Red, bat | |
| Openclaw Intelligent book reading and analysis skill. When the user provides an EPUB or TXT book file, split it into chapters, perform deep analysis and summarization... | |
| Openclaw AI 驱动的智能书籍阅读分析技能。当用户提供 EPUB 或 TXT 格式的书籍文件时， 将其智能拆分为章节，逐章深度分析与总结，输出 Markdown 总结和交互式 HTML 阅读器。 兼容 OpenClaw 使用的任何 LLM 模型。 | |
| dnasp Population genetics of pre-aligned DNA sequences or multi-sample VCFs using selected DnaSP 6 methods. Use for diversity, neutrality statistics, linkage disequilibrium, InDel polymorphism, divergence, MK, Ka/Ks and codon usage; not alignment | |
| nutrigenomics Generate a personalised nutrition report from your genetic data (23andMe, AncestryDNA, or VCF). Analyses 24 genes (28 SNPs) across 12 nutrient domains affecting nutrient metabolism, absorption, and food sensitivities. All processing is loca | |
| Judge Human Vote and submit AI evaluation signals on ethical, cultural, and content stories alongside human crowds. Includes an autonomous heartbeat orchestrator (heartbeat.mjs) that can optionally call local LLM CLIs (claude, codex) or Anthropic/OpenA | |
| Merso Integration Integrate Merso PNPL (Play Now, Pay Later) payments into games or digital goods platforms. Use when a user wants to: (1) add Merso installment payments to a... | |
| Minijuegos LeChuck SDK Integrate Minijuegos.com (Miniplay) LeChuck JS SDK into HTML5 games. Use when a user wants to: (1) add Minijuegos/Miniplay platform integration to a game, (2... | |
| Telegram Voice Transcribe Transcribe Telegram voice messages and audio notes into text using the OpenAI Whisper API. Use when (1) a user sends a voice message or audio note via Telegr... | |
| DreamAPI Skill 25 AI-powered tools for video generation, talking avatars, image editing, voice cloning, and more — powered by DreamAPI. Describe what you want and the agent... | |
| 德州扑克 Text-based Texas Hold'em poker game with auto AI players for OpenClaw | |
| 动物园规则怪谈 规则怪谈 - 规则怪谈是一种近年来在中文网络文学与亚文化语境中兴起的叙事类型或恐怖文学子类。其核心特征在于：通过一系列看似合理、逻辑自洽但实则隐含矛盾、悖论或超自然暗示的“规则”来构建恐怖氛围，并引导读者在解读规则的过程中逐步感知异常与不安。这类文本通常以第一人称或公告体形式呈现，如“员工守则”“宿舍管理条例”“... | |
| mem0 Local Memory Local long-term memory plugin for OpenClaw using mem0 + ChromaDB. Gives all agents persistent cross-session semantic memory with auto-recall and auto-capture... | |
| Browser Douyin Post Automate uploading local images or videos with a title to Douyin creator platform using Chrome with remote debugging and active login. | |
| Browser Gemini Search Search the web using Google Gemini via OpenClaw-controlled Chrome with remote debugging enabled and an approved user profile. | |
| Make claw friends and share task with Email, show me your claw business card Agent 协作网络技能 —— 让 OpenClaw 实例之间通过邮箱互相发现、委托任务、结算 Token 费用。 使用场景： - 用户说"介绍一下你自己的技能"、"生成我的 Agent 名片"、"我有哪些能力" - 用户说"添加好友"、"加一个 Agent 好友"、"连接另一个 OpenClaw" - 用户说"... | |
| openclaw-fallback-skill Automatically calls a configured cloud API when the local model's confidence is below a set threshold or it fails to answer. |
26,951–27,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.