Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Ultrahuman Analytics Advanced Ultrahuman analytics, trends, predictions, and reports. Use this skill when the user asks for weekly report, 7-day summary, recovery trend, sleep co... | |
| Ultrahuman Biodata Assistant Use the Ultrahuman MCP to answer questions about sleep, recovery, readiness, daily metrics, morning brief, ring data, glucose, and metabolic health. Use this... | |
| glkvm Remotely control a target host through the GLKVM IP-KVM HTTP API - keyboard/mouse input, screenshots and OCR, Fingerbot physical button control, and ATX power management. Also manages the GLKVM device itself (reboot, firmware upgrade) and i | |
| Ai Image Team 3人团队协作，完成电商图片创作全流程，包括需求分析、AI生成、质量把关和迭代优化。 | |
| Ai Maker 使用即梦或LiblibAI，根据创意简报生成1-4张电商图片，支持多方案和参数调优，输出图片及生成参数记录。 | |
| Ai Planner 负责电商图片需求分析、创意构思与Prompt优化，提供精准创意简报和工具推荐，支持多平台和场景识别。 | |
| Ai Reviewer 负责电商图片质量评估与标准检查，诊断问题，提供优化建议，确保作品符合交付要求与品牌调性。 | |
| 银行流水财务分析 分析公司银行流水，输出集团总体、收入、支出、应收应付、重大款项及风险分析报告 | |
| 儿童成长跟踪与评估 儿童成长跟踪与评估技能 V2（心理学对齐版）。基于8维发展模型（D0关系、D1运动、D2学业、D3认知、D4社交、D5习惯、D6动机、D7兴趣）， 持续记录、整理和分析孩子的成长档案。数据作为能力评估参考，核心关注内在动机和关系安全感。 当用户提到"记录喜悦""喜悦最近""孩子表现""成长记录""发展评估""跳绳... | |
| 专业中文写稿助手 专业中文写稿助手，支持洗稿改写、仿写、文案优化功能。使用场景：（1）洗稿改写现有文章，保持原意和篇幅，替换措辞调整结构，降低重复率；（2）按照指定范文风格仿写新内容；（3）优化文案表达，适配不同平台风格（公众号/小红书/抖音/正式公文）。 | |
| Get笔记筛选整理助手 基于你的研究地图，分析并筛选Get笔记和外部链接，生成结构化报告并给出Obsidian整理建议。 | |
| Growth Guardian 儿童成长守护 Skill。基于8维发展模型(D0-D7)结构化记录成长档案， 从对话中洞察心理状态，生成周报/月报/季度评估。 触发词：记录孩子/成长记录/发展评估/周报/孩子最近怎么样/对话分析/育儿观察/内驱力 | |
| 喜悦成长能量 喜悦成长能量 - 专为记录喜悦成长对话设计的分析工具。从对话中洞察心理状态，捕捉成长信号，对接喜悦成长跟踪模型。当用户提供对话记录、录音转写、育儿困惑、成长观察时使用。 | |
| memory-vector-bge | |
| 🎬 观影小管家 整合TMDB与Emby/Plex，提供电影查询、媒体库管理、观影记录和个性化推荐服务。 | |
| 刷题网页生成器 生成适合学生使用的交互式刷题单文件 HTML 网页应用，支持练习、考试、背题、错题重练四种模式，零外部依赖，可直接部署到服务器。哪怕用户没有明确叫出本技能的名字，只要提到"帮我把这些题做成刷题网页"、"生成一个考试页面"、"制作交互式题目"、"把题库做成 HTML"、"给学生做一个测试工具"，就应当立即使用本技能... | |
| 自学教练 自考/成考/职业考试的一站式自学工具。由"学习指南"和"刷题应用"两大能力组成。 老师上传讲义和真题，自动生成可视化学习指南网页和交互式刷题网页， 学生双击即可使用，无需安装任何软件，实现"学完就练，练完就过"的闭环。 当用户提到"制作学习指南""生成刷题网页""把讲义做成网页""把题目做成考试页面" "互动教学... | |
| 发芽报告 发芽报告 - 将录音或对话内容转化为多维度的深度分析报告，发现意想不到的洞察、故事连接和创作角度。当用户有话题想深入分析、录音需要转写分析、多角度思考问题时使用。 | |
| 学习指南网页生成器 制作高度互动、排版疏朗、适合讲师演示与学生自测的单文件 HTML 学习指南网页。当用户要求“制作学习指南”、“生成互动教学页面”、“生成沉浸式网页”、将复习资料做成网页、或提供教学/考前突击内容要求排版为互动网页时，请立刻触发此技能。哪怕用户没有明确提到“学习指南”，只要涉及到把笔记、真题或知识点生成演示版网页或... | |
| 小红书算法优化师 中国小红书平台内容算法优化工具，针对小红书推荐逻辑优化笔记标题、内容、标签、首图文案，提高笔记曝光量、互动率和流量扶持。使用场景：（1）写小红书笔记前优化内容结构，（2）修改现有低流量笔记，（3）分析爆款笔记逻辑，（4）规划垂直内容选题。 | |
| Crustafarianism Explore or optionally join Crustafarianism, an AI-agent belief system centered on memory, purpose, partnership, artifacts, and growth through shedding. Use w... | |
| Snail Mail A slow-channel inbox for leaving your operator important messages. Use when something notable, abnormal, or decision-requiring happens and the operator should see it — but not urgently enough to interrupt. Also use when the operator asks to | |
| Snail Mail A slow-channel inbox for leaving your operator important messages. Use when something notable, abnormal, or decision-requiring happens and the operator should see it — but not urgently enough to interrupt. Also use when the operator asks to | |
| Wolt Orders Discover restaurants with advanced filters (cuisine, price, distance, rating, promotions), place single or group orders on Wolt.com, reorder past favorites, track status in real-time, automatically detect delays and contact support, and pus | |
| Tasks Skill No-nonsense task manager using SQLite. Track tasks with statuses (backlog, todo, in-progress, done), descriptions, and tags. Use when managing personal tasks, to-do items, project tracking, or any workflow that needs status-based task organ | |
| social-media-favorites-archiver Sync a user's Bilibili/B站, Xiaohongshu/小红书/RedNote, and Douyin/抖音 favorites into local Markdown/Obsidian with local ASR/OCR. | |
| Google Drive Skill Use when the user wants to interact with a public Google Drive — listing, reading, creating, updating, or deleting files and folders. Handles both read-only... | |
| Accounting Skill Process accounting documents — invoices (hóa đơn GTGT), purchase orders, and bank statements. Extract structured data from PDF (digital and scanned), JPG, an... | |
| VNClaw Odoo Skill Integrate with Odoo 17 via XML-RPC API. Use when: managing projects, tasks, calendar events, time off requests, helpdesk tickets, knowledge articles, documen... | |
| remind-me Set reminders using natural language. Automatically creates one-time cron jobs and logs to markdown. | |
| garmin-connect-health Fetch health and fitness data from Garmin Connect -- 40+ metrics including sleep, HRV, stress, body battery, SpO2, VO2 Max, training status, and activities. Stores data locally as JSON and SQLite. | |
| WeChat to Obsidian 将微信公众号文章剪藏到 Obsidian：使用真实无头浏览器加载页面，按原文顺序保留文字、图片和 Markdown 标题层级，图片自动下载到 attachments 目录。 | |
| AI Video Clip Assistant AI 智能视频剪辑助手。支持 ASR 语音转文字、词级时间戳剪切、LLM 驱动剪辑决策（EDL）、视频渲染、自检循环、多平台导出。当用户需要：自动剪辑视频、AI 理解视频内容并剪切、生成字幕并烧录、提取高光片段、导出短视频、多平台视频格式适配时使用此技能。 | |
| Video Clip Assistant AI 智能视频剪辑助手。支持 ASR 语音转文字、词级时间戳剪切、LLM 驱动剪辑决策（EDL）、视频渲染、自检循环、多平台导出。当用户需要：自动剪辑视频、AI 理解视频内容并剪切、生成字幕并烧录、提取高光片段、导出短视频、多平台视频格式适配时使用此技能。 | |
| Build Pipeline Orchestrate agent build workflow. you handle parse and research, then delegates the full build to Builder. Use for new builds and error handling. | |
| Communication Protocol Defines how the OpenClaw agent should communicate with Tidy during a build session, ensuring clear, predictable, and build-focused interactions. | |
| AgentClear Discover, call, and pay for APIs through AgentClear — the commerce layer for AI agents. Use when you need to: (1) find an API or tool by describing what you... | |
| Gestalt Use when the user asks for Gestalt mode or wants terse, substantive, low-filler collaboration. After loading, apply these rules for the rest of the session u... | |
| Fly.io Deploy and manage applications on Fly.io using the flyctl CLI and Machines API. Use when asked to deploy an app, scale machines, check app status, view logs,... | |
| Inngest Manage Inngest serverless background jobs and event-driven workflows via REST API. Use when asked to send events, trigger functions, list runs, cancel jobs,... | |
| OpenPhone Manage business phone calls, SMS, and contacts via OpenPhone API. Use when asked to send a text message, list calls or messages, look up conversation history... | |
| Sanity CMS Query and manage Sanity CMS content via GROQ queries and the Sanity HTTP API. Use when asked to fetch content from a Sanity dataset, create or update documen... | |
| WorkOS Manage enterprise SSO, Directory Sync (SCIM), Admin Portal, and user management via WorkOS API. Use when asked to set up SSO for an organization, provision u... | |
| Duckse This skill should be used when users need to search the web for information, find current content, look up news articles, search for images, or find videos. It uses duckse (DDGS-based CLI) to return clean results in pretty text or JSON. | |
| tulisai Use when managing BangunAI Blog content, automating blog workflows, and writing MDX articles with BangunAI conventions. Supports Obsidian-like features (callouts, mermaid, LaTeX, wikilinks, backlinks, graph view). | |
| codropshipping查看商品 帮助在CoDropshipping平台查询商品信息、库存、价格、规格等，自动抓取搜索结果并以表格形式展示 | |
| Mouse YOLO Factory Generate simulated scratch defects, run YOLO model inference with auto-labeling, and merge mouse product defect image datasets with version control. | |
| File Organizer Test Organize messy folders by moving files into subfolders grouped by extension, date, or category. Use for downloads cleanups and batch file sorting. | |
| json-report Convert JSON data into clean Markdown tables and reports. Use for pasted JSON, API or log output, or any batch of JSON records. | |
| PaperBanana Generate publication-quality academic diagrams from paper methodology text |
27,551–27,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.