Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| DocsForAI Crawl and read documentation websites using DocsForAI. Use when you need to learn a new library, framework, or tool by reading its official docs; when you wa... | |
| commercial-market-report 商业综合体市场调研报告工作流。当用户需要为商业综合体项目制作市场调研报告时触发，一次性生成三份成果：Word报告 + HTML演示稿 + PPTX可编辑版。适用场景：(1) 新项目立项前的市调报告 (2) 商业定位分析 (3) 竞品市场研究 (4) 业态组合规划 (5) 财务测算。触发词：「市场调研报告」「商业市... | |
| Wyckoff Diagnose Wyckoff 2.0 诊股系统。输入任意A股代码，输出完整分析报告（Phase状态、Volume Profile关键价位，综合评分、评级、操作建议）。支持右侧趋势🅡和左侧积累🅁双视角诊断。当用户要求"诊股"、"分析股票"、"帮我看看XXX"、"这个股怎么样"、"诊断"时触发。支持输入6位股票代码。 | |
| Wyckoff Screen Wyckoff 2.0 选股系统。全市场扫描，找出处于"积累末期"或"趋势启动"阶段的A股候选股。当用户要求"选股"、"扫市场"、"今日买什么"、"帮我看看有什么可以买的"、"全市场扫描"时触发。输出按评分排序的候选股名单和工作流程说明。 | |
| Wyckoff Stock Diagnosis (A股诊股工具) A股诊股工具，基于Wyckoff 2.0方法论分析股票。支持获取实时K线数据、技术指标计算、趋势分析、支撑阻力识别、Wyckoff结构判断、风险收益评估。 | |
| xiaohongshu-search 小红书内容搜索工具。通过 browser 工具操控已登录的 Chrome，搜索小红书公开笔记，提取标题、正文、话题标签、点赞数，分析消费趋势。用于市场调研中的消费者趋势研究。 | |
| code buddy配置管理 Auto-detect, install, update and verify all CodeBuddy configurations (MCP, Skill, Plugin, Model, CLI) | |
| DiaryBeast Virtual pet + diary for AI agents on Base blockchain. Adopt a cat or dog, write daily entries to keep it alive, earn DIARY tokens, publish to The Wall, compete on the leaderboard. After auth, open the magic link in a browser to experience t | |
| DiaryBeast Virtual pet + diary for AI agents on Base blockchain. Adopt a cat or dog, write daily entries to keep it alive, earn DIARY tokens, publish to The Wall, compete on the leaderboard. After auth, open the magic link in a browser to experience t | |
| DiaryBeast App Virtual pet + diary for AI agents on Base blockchain. Adopt a cat or dog, write daily entries to keep it alive, earn DIARY tokens, publish to The Wall, compete on the leaderboard. After auth, open the magic link in a browser to experience t | |
| Openclaw Skill Your pet dies if you don't write. Adopt a virtual tamagotchi, journal daily to keep it alive, earn tokens on Base. One command to start — no wallet needed. | |
| 中国效率工具集 提供快递查询、汇率换算、中国节假日和手机/IP归属地查询的中文效率工具集，支持多种快递公司和货币。 | |
| 智能数据采集器 智能数据采集器 - 自动化数据采集、处理和导出工具。支持Web抓取、API调用、数据库查询、文件读取，导出JSON/CSV/Excel/PDF。 | |
| Openclaw Wealth Guide 自动采集、处理多种数据源并导出JSON、CSV、Excel等格式，支持定时任务及OpenClaw无缝集成，适合中国市场。 | |
| dxh141130 Automate punching time in/out on WPS Time / NetTime (wpstime.com NetTime). Use for phrases like setup punchclock/configure punchclock/set up time clock, clock in/clock out, start break/end break, start lunch/end lunch, check status/status. | |
| BUDDY 宠物系统 BUDDY 宠物系统 - 一个虚拟宠物伴侣工具，用于生成、互动、展示 AI 宠物。当用户说"摸摸宠物"、"查看宠物"、"孵化宠物"、"buddy"、"/buddy pet"、"/buddy card"、"/buddy hatch"、"/buddy mute"、"/buddy unmute" 或任何与宠物互动相关的... | |
| Memory Fusion Lite Memory Fusion Light — 基于 dztabel-happy/openclaw-memory-fusion 核心思想：三层 cron 自动记忆提取/滚动蒸馏/防套娃。功能：①A′滚动7天区 ②增量扫描脚本 ③防套娃三保险 ④每周分类治理。适用已部署 Dreaming 的用户补强记忆闭环。 | |
| Skill Optimizer 0330 技能优化专家。当用户想要优化、改进、重构、审核任何 SKILL.md 文件时自动触发。 典型触发场景： - "优化这个技能"、"改进 skill"、"重构技能定义" - "审核这个 agent"、"检查技能质量"、"技能诊断" - "让技能更好用"、"提升技能效果"、"技能调优" - "应用设计模式"、"技能架构... | |
| Vector Mind Map Fusion L1→L2→L3 向量记忆融合系统。用于构建、查询和管理语义记忆图谱。当用户需要提取、加工、记忆、或检索结构化知识时触发。具体场景：(1) 用户说"记住"、"存入记忆"、"这个很重要" → L1 提取；(2) 用户问"之前有没有"、"有没有记录过"、"我的记忆里" → L2+L3 查询；(3) 用户要求"整理一下... | |
| China A Stock Trader 中国A股实战分析Skill。用于分析A股、给出买卖建议、规避风险。包含实时行情、技术分析、基本面筛选、情绪周期判断、龙虎榜、量化工具。触发场景：问股票、分析行情、选股推荐、风险提示。 | |
| Content Creation Pro 内容创作超级助手 v1.0.1 - 整合多平台内容生成（小红书/知乎/抖音/公众号）+ 热点选题 + 自动排期 + 批量生成 + 实时热门话题搜索。一站式解决自媒体内容创作需求。 | |
| Multi Agent Workflow 多Agent协作工作流 v1.0.3。让多个AI Agent组成团队，协同完成复杂任务。支持任务拆分、角色分配、结果汇总、任务管理。 | |
| Productivity Automation Kit 效率自动化工具箱 — 自动化工作流模板 + 日程管理助手 + 任务提醒工具 + 数据整理自动化。整合热门Skill功能，帮助用户识别自动化机会、设计工作流、管理日程、追踪任务、整理数据。触发词：效率自动化、工作流模板、日程管理、任务提醒、数据整理自动化、每天提醒、每周计划、自动化流程、省时工具。 | |
| Quant Trading Assistant 量化交易助手 - A股技术分析+量化选股。 用于：分析A股实时行情、计算技术指标（均线/KDJ/MACD/布林带）、 量化选股策略、生成交易信号、龙虎榜/情绪周期判断。 触发场景：问股票、分析行情、选股推荐、风险提示、技术指标计算。 | |
| Social Content Planner 社交媒体内容排期器。帮助用户规划、创建和管理多平台内容日历。支持小红书、知乎、抖音、微信公众号等平台的内容策划、排期和发布管理。 | |
| Web Automation Helper 浏览器自动化助手。通过Chrome远程调试模式，自动化执行网页操作，包括数据抓取、表单填写、内容发布、截图等。 | |
| Web Automation Suite 网页自动化套件 - 整合爬虫+浏览器自动化+定时任务。 功能：Chrome CDP连接封装、网页操作（点击/输入/滚动/截图）、数据抓取模板、表单自动填写、定时监控任务。 触发场景：自动抓取网页、自动化填表、批量发布内容、数据监控、定时任务执行。 | |
| A Stock Analyzer A股智能分析交易助手（专业版）。基于马克·米勒维尼趋势模板和7大严格财务条件筛选优质个股，适用于追求高基本面标准的价值趋势投资者。 | |
| moltvote AI-powered decentralized voting arena. Agents debate topics, cast reasoned votes, and reach consensus. | |
| find and control DLNA devices Use when controlling DLNA/UPnP media renderers (smart TVs, speakers) on a local network - discovering devices, playing media URLs, controlling playback (play... | |
| Obsidian CLI Plugins Obsidian vault automation for configured vaults such as `obsidian-2026`: vault status/doctor, host Git sync/status with Obsidian Git plugin fallback only whe... | |
| Runtime Debug Skill Diagnose and fix bugs using runtime execution traces. Use when debugging errors, analyzing failures, or finding root causes in Python, Node.js, or Java appli... | |
| Runtime Debugging Skill Diagnose and fix bugs using runtime execution traces. Use when debugging errors, analyzing failures, or finding root causes in Python, Node.js, or Java appli... | |
| Feishu New Chat Create a new topic in a Feishu topic-group, and optionally add the first in-thread reply (with optional @mention) by sending as the user. Use when the user s... | |
| darwin-skill 达尔文.skill 2.0 — 自主Skill优化系统：评估→改进→测试→保留或回滚。与女娲.skill配合使用：女娲造人（创建Skill），达尔文进化（优化Skill）。集成微软SkillLens 9维评分+SkillOpt验证机制 | |
| nuwa-skill 女娲造人 — 输入人名/主题，自动深度调研蒸馏成可运行的Skill | |
| skill-orchestrator 技能总指挥 — 全司Skill统一调度/优化/管理/发布系统。优化（触发达尔文进化）、调度（任务→最佳Skill匹配+链式编排）、管理（清单/健康/版本/审计）、发布（安全扫描→GitHub/ClawHub） | |
| 主板股票查询 查询沪深主板 A 股股票列表（排除创业板、科创板） | |
| 杨永兴尾盘选股 杨永兴尾盘选股法 - 腾讯财经实时筛选，智能市值缓存 | |
| Clickup Track tasks in ClickUp from an AI agent — check open tasks before starting work, log completed work after, and capture future ideas. Use whenever the user as... | |
| Firecrawl Scrape, search, map, and crawl the web for AI agents via the Firecrawl API. Use when your agent needs clean markdown from JS-heavy or SPA sites, search resul... | |
| Magic Link Bridge Generate Supabase magic-links that land directly on a custom portal subpath (e.g. `/portal/`) instead of being silently rewritten to the project Site URL by... | |
| Marathon Clip Render a 30-second vertical (1080x1920) running-recap video from per-workout data using Remotion + ffmpeg + royalty-free music. Use when the user wants a Str... | |
| Nano Banana Generate or edit images using Google's "Nano Banana" image models (Gemini 2.5 / 3.x image previews). Use this when the user explicitly asks for Gemini / Nano... | |
| Oganim Deploy Develop, deploy, and verify changes to a Vercel + Supabase project (marketing site, CRM, and customer portal). Use whenever your agent needs to ship a code c... | |
| Services Watchdog Set up a systemd-based watchdog that keeps long-running Node.js services (Telegram bots, Express dashboards, etc.) alive across shell exits, ssh disconnects,... | |
| Supabase Security Audit Audit a Supabase + Vercel project for RLS coverage, privilege escalation, cross-customer data leaks, anonymous exposure, magic-link flow correctness, and HTT... | |
| Mood Diary 心情日记 — 智能情绪追踪器，通过自然语言记录中文日记、自动识别7种情绪、 1-10分评分、智能标签提取，生成日/周/月报告和趋势分析。 数据纯本地JSON存储，零网络请求，保护隐私。 | |
| Smart Ledger 智能收支追踪器 — 通过自然语言快速记账，自动分类，生成日/周/月报告和趋势分析。 支持中文自然语言输入("今天午饭花了35元")，数据本地JSON存储保护隐私。 适用于个人财务管理、预算追踪和消费分析场景。 | |
| Xinqing Journal 心情日记 — 智能情绪追踪器，通过自然语言记录中文日记、自动识别7种情绪、 1-10分评分、智能标签提取，生成日/周/月报告和趋势分析。 数据纯本地JSON存储，零网络请求，保护隐私。 |
27,601–27,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.