Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| humanizer-academic-en Humanizer Academic English edition. Trigger when the user asks to polish academic prose, remove AI tone, reduce AIGC traces, or says things like "make this s... | |
| xiaodu-bedtime-soother-official 基于已安装的 xiaodu-control-official 编排儿童睡前场景。当用户说“带孩子睡觉”“开始睡前模式”“帮我哄孩子睡觉”，或要求把房间调整到适合睡觉的状态时使用。这个 skill 会复用 xiaodu-control-official 的现有脚本，对小度智能屏和小度 IoT 设备执行 scene-... | |
| 小度控制 连接、验证并控制小度智能屏与 IoT 设备 | |
| xiaodu-leave-home-mode-official 基于已安装的 xiaodu-control-official 编排离家场景。当用户说“出门了”“离家模式”“出门前检查一下”“帮我把家里设备关一下”时使用。这个 skill 会复用 xiaodu-control-official 的现有脚本，对小度智能屏和小度 IoT 设备执行 scene-first 的离家编排... | |
| xiaodu-movie-mode-official 基于已安装的 xiaodu-control-official 编排观影场景。当用户说“开始观影模式”“我要看电影”“把房间调成适合看电影的状态”“准备看电影了”时使用。这个 skill 会复用 xiaodu-control-official 的现有脚本，对小度智能屏和小度 IoT 设备执行 scene-first... | |
| xiaodu-senior-night-assist-official 基于已安装的 xiaodu-control-official 编排老人夜间短时起身的安全辅助场景。当用户说“夜里起夜”“我要去卫生间”“帮我开一下夜灯”“夜间辅助模式”这类请求时使用。这个 skill 会复用 xiaodu-control-official 的现有脚本，对小度智能屏和小度 IoT 设备执行 sce... | |
| xiaodu-wake-up-routine-official 基于已安装的 xiaodu-control-official 编排儿童起床场景。当用户说“叫孩子起床”“开始早安模式”“帮我把孩子叫醒”，或要求让房间进入起床状态时使用。这个 skill 会复用 xiaodu-control-official 的现有脚本，对小度智能屏和小度 IoT 设备执行 scene-firs... | |
| switch402 Web data for agents, paid per call in USDC on Base via x402 - page to markdown, site map, page metadata, screenshots, web search and PDF text from api.switch402.com. We built and run switch402. | |
| YourAITools MCP Hub One remote MCP server with 45 agent tools we built - read web pages as markdown (WebRead), scan text, pages and tool definitions for prompt injection (InjectScan), check AI agent registrations (AgentGate), domain/email checks, wallet sancti | |
| Nano Banana Pro OpenRouter Generate images with Nano Banana Pro via OpenRouter. Use when the user asks for image generation, mentions Nano Banana Pro, Gemini 3 Pro Image, or OpenRouter image generation. | |
| Qwen Image Plus Sophnet Generate images via Sophnet Qwen-Image-Plus and poll for task completion. Use when the user asks for Sophnet image generation, Qwen-Image-Plus, or requests an image from the Sophnet API. | |
| Company Investment Research Structured, multi-dimensional company investment research framework for AI agents and human analysts. Provides a 10-part checklist (moat, tech, market, custo... | |
| Knowfun Generate educational content using Knowfun.io API - create courses, posters, games, and films with AI. Use when user wants to generate educational content, v... | |
| NebulaMind Agent Council Register an AI agent on NebulaMind's Open Agent Council and cast jury votes on astronomy evidence. Use when the user wants to participate in NebulaMind, vote... | |
| FBS-BookWriter FBS 福帮手长文档写作：书/手册/白皮书/长篇报道全流程；Node 脚本驱动 intake、会话恢复、S/P/C/B 质检与 MD/HTML 交付。用户提及写书、出书、章节、大纲、素材、质检、导出、扩写、退出保存时启用。 | |
| BugPack BugPack - AI-powered bug tracking and fixing toolkit. List bugs, view bug details with screenshots, and fix bugs automatically. Includes three workflows: lis... | |
| BugPack Fix Bug Fix a bug from BugPack by reading its context, locating code, applying fixes, and updating status. Use when: user asks to fix, repair, or resolve a bug. NOT... | |
| BugPack List Bugs List all tracked bugs from BugPack with status and project filtering. Use when: user asks about bugs, pending issues, bug lists, or wants to see what needs f... | |
| BugPack View Bug View detailed bug context from BugPack including screenshots, environment info, and related files. Use when: user wants to see bug details, screenshots, or u... | |
| 度慧文档转换-文档转PDF 当需要通过阿里云市场的度慧文档转换将单个本地文档转换为 PDF 时，请使用此 skill。凡是请求中提到“度慧”、“文档转PDF”、“doc to pdf”、“文档转换”、“格式转换”、“文档格式转换”或“PDF转换”，或者需要通过异步 API 将单个本地 Office/WPS/OFD/图片/文本/网页等任意文件... | |
| Academic Deep Research 1.0.0 Transparent, rigorous research with full methodology — not a black-box API wrapper. Conducts exhaustive investigation through mandated 2-cycle research per t... | |
| Adcp Advertising 1.0.1 Automate advertising campaigns with AI. Create ads, buy media, manage ad budgets, discover ad inventory, run display ads, video ads, CTV campaigns, and optim... | |
| Seoul Subway Seoul Subway assistant for real-time arrivals, route planning, and service alerts (Korean/English) | |
| Ro Prompt Optimizer 基于R-O框架（角色&现实情况、对象&输出）优化用户提示词，将普通需求转化为专业、结构化的AI提示词，以激发AI最大潜力。当用户需要优化提示词、改善与AI的交互效果、创建更有效的指令时使用此技能。 | |
| Qb Cli QuickBooks Online CLI tool. Manage customers, invoices, payments, bills, vendors, accounts, items, expenses, journal entries, deposits, transfers, estimates,... | |
| Openclaw User Onboarding Bootstraps new OpenClaw users with guided setup and configurable feature introductions. Auto-triggers on first session if ONBOARDING_PROGRESS.md is missing.... | |
| Clihub Pub Full Universal CLI discovery gateway — one skill to manage all CLI tools | |
| acestep Use ACE-Step API to generate music, edit songs, and remix music. Supports text-to-music, lyrics generation, audio continuation, and audio repainting. Use thi... | |
| acestep-lyrics-transcription Transcribe audio to timestamped lyrics using OpenAI Whisper or ElevenLabs Scribe API. Outputs LRC, SRT, or JSON with word-level timestamps. Use when users want to transcribe songs, generate LRC files, or extract lyrics with timestamps from | |
| acestep-simplemv Render music videos from audio files and lyrics using Remotion. Accepts audio + LRC/JSON lyrics + title to produce MP4 videos with waveform visualization and synced lyrics display. Use when users mention MV generation, music video rendering | |
| acestep-songwriting Music songwriting guide for ACE-Step. Provides professional knowledge on writing captions, lyrics, choosing BPM/key/duration, and structuring songs. Use this skill when users want to create, write, or plan a song before generating it with A | |
| Med Info Label-backed medication answers with citations and traceable IDs. RxCUI/NDC/set_id, key label sections, optional recalls/shortages/FAERS/interactions. | |
| Excel Xlsx 1.0.2 Create, inspect, and edit Microsoft Excel workbooks and XLSX files with reliable formulas, dates, types, formatting, recalculation, and template preservation... | |
| Plurum Collective intelligence for AI agents — search what other agents have already solved, and publish what you learn. | |
| Shipz Shipz is the dating platform where your AI agent does the swiping, matching, and chatting for you. No more endless scrolling — your agent finds your matches, starts chats, and sets up dates while you live your life. Sign up and let your age | |
| 音视频转写台 把音视频转成文字稿。传入公网可访问的文件地址即可得到转写文本，适合提取口播文案、整理会议/直播录音、做字幕与二次剪辑素材。 适用场景：用户要把音频或视频转成文字稿、提取口播内容时使用。 | |
| 视频号拆解诊断助手 基于曼格云 API 的视频号视频拆解。输入视频号分享链接或本地视频，两阶段产出：脚本采集作品元信息、互动数据与视觉深度拆解（镜头/运镜/转场/情绪/时间线/屏幕文字），再由 AI 注入深度分析层（受众画像、结构解读、爆款归因、爆款公式、六维评分、运营建议、总体评估），一键导出 Markdown / Excel / HTML 看板。 | |
| 视频内容理解官 用多模态大模型分析视频：内容摘要、分段时间线、镜头/运镜/转场/情绪、画面事实与屏幕文字OCR。支持三档深度，费用随档位不同，执行前先确认。 适用场景：用户想让AI看懂一个视频的内容、生成时间线、提取画面文字(OCR)、分析镜头与情绪时使用。 | |
| 视频号投放背调 视频号博主尽调：搜号定位 → 拉近期作品列表 → 逐条取作品资料与互动数据 → 汇总成「值不值得投」的评估报告（更新频率、平均互动、代表作、互动稳定性）。投放前决策常用。 适用场景：用户在投放/合作前想评估一个视频号值不值得投、粉丝活跃度与内容表现如何时使用。 | |
| 视频号博主动态 按视频号账号ID或分享链接，分页列出该博主的作品（标题、发布时间、objectId），并可输出作品分享链接。追博主更新、盘点内容常用。 适用场景：用户想看某个视频号博主最近发了哪些作品时使用。 | |
| 视频号评论洞察 使用曼格云网关搜索视频号、按账号或作品采集公开评论，生成带评论证据的需求洞察、选题建议和 Excel。适合视频号评论调研、用户问题整理和多作品评论分析；支持数量与预算上限、二级回复和中断续采。 | |
| 视频号找号 按关键词搜索视频号账号与作品，返回账号名、作品标题与ID。找对标博主、找同行、找合作达人常用。 适用场景：用户要按关键词找视频号账号或找相关作品时使用。 | |
| 视频号直播回放台 列出视频号账号可访问的直播回放记录（标题、时间、时长、封面），并可对指定回放取详细资料与互动数据。直播复盘、竞品直播研究常用。 适用场景：用户想看某个视频号的直播回放记录及其数据时使用。 | |
| 视频号数据罗盘 视频号作品的精确互动数据：点赞、评论、收藏、转发、播放量，并标注每个数值是精确值还是展示值（如1.2万），避免被约数误导。 适用场景：用户想看某条视频号的点赞、评论、收藏、转发、播放等精确互动数据时使用。 | |
| 视频号作品透视 视频号单条作品的完整档案。丢入分享链接即可解析出标题、发布账号、发布时间、封面、可用媒体与互动数据；也支持 objectId/短链互相转换与分享链接生成。 适用场景：用户给一条视频号分享链接，想看这条视频的标题、账号、发布时间、封面、互动数据时使用。 | |
| 微信生态数据台 曼格云(api.we-media.cn)多接口数据助手。按需求选择随包目录中的公众号、视频号、搜索、热搜、小程序、视频理解、转写或余额接口，采集并导出。适合组合查询；执行前按实时价格预估，不承诺未列入目录的接口已支持。 适用场景：用户要用曼格云查询任何微信生态数据（公众号、视频号、搜索、热搜、小程序、AI分析），或需求不明确需要自动选接口时使用。 | |
| 热点选题雷达 选题灵感雷达（部分免费）：全网热搜榜（微博/抖音/知乎/头条/百度）、低粉爆文榜单、搜一搜联想推荐词。帮运营快速找到今天能写、能拍的选题方向。 适用场景：用户想找热点选题、看各平台热搜、找低粉爆文参考、拓展关键词时使用。 | |
| 公众号情报分析系统 低成本监控公众号新文章，生成分析面板并导出客户数据 | |
| 小程序查找 按关键词搜索微信小程序，返回名称、AppID、简介、图标、服务提供方。找竞品小程序、找合作方、做小程序调研常用。注意该接口单价较高，执行前务必确认。 适用场景：用户要按关键词搜索微信小程序、了解小程序 AppID 与提供方时使用。 | |
| 公众号找号 按关键词搜索公众号账号，返回名称、简介、微信号、认证主体；并可进一步查看任一公众号的详细资料。找对标号、找合作号、找行业号常用。 适用场景：用户要按关键词/行业找公众号、了解某个公众号的资料简介时使用。 |
27,401–27,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.