Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| iFLYTEK Song Recognition Recognize songs by singing or audio file using iFlytek's Query By ACRCloud technology. | |
| Catalyst Calendar 催化事件日历与前瞻。当用户要求"催化日历""事件日历""未来大事""catalyst calendar""下周有什么大事"或需要时间维度的事件前瞻时触发。 | |
| Earnings Analysis 财报深度分析。当用户要求"财报分析""看财报""earnings""季报""年报""业绩分析"或提到具体股票+财报时触发。 | |
| Morning Note 生成每日投资晨报，整合宏观动态、行业变化、持仓异动和自选股信号。当用户要求"晨报""早报""morning note""今日概览"时触发。 | |
| Sector Overview 行业概览与轮动分析。当用户要求"行业分析""板块分析""sector overview""行业轮动""哪个板块有机会"时触发。 | |
| Thesis Tracker 投资论点追踪与验证。当用户要求"论点追踪""thesis tracker""投资逻辑""验证XX观点""跟踪XX判断"或需要持续追踪某个投资假设时触发。 | |
| ima-mcp-cos-upload WorkBuddy ima-mcp 知识库入库的 COS 直传方案：create_media → HMAC-SHA1 签名 → curl PUT → add_knowledge。含两处致命签名坑（尾随\n、header 值 safe=''）与'委托子代理避免 token 损坏'稳路。触发：ima 推库/上传 md/pdf/ppt 到知识库报 COS 403。 | |
| kb-dashboard This skill generates a read-only visual dashboard of the user's ima knowledge base (via ima-mcp). Trigger ONLY when the user explicitly asks for an ima knowledge base dashboard, structure overview, or folder-level map — e.g. "知识库看板", "ima 知 | |
| 指数直通车ETF信息查询 ETF（交易型开放式指数基金）信息与行情查询。ETF 在证券交易所上市交易，通常通过券商股票账户买卖，盘中按交易价格成交，以6位证券代码识别（如510300）。 支持查询ETF基础信息、规模费率、持仓明细、历史分红、区间收益、资金流向、涨幅榜、热搜榜、按持仓股票反查相关ETF，以及最新价、盘中涨跌、成交、换手率、IOPV、溢折率和分钟走势。 适用于用户关注场内ETF基础信息、成交活跃度、主题ETF筛选、同类ETF比较和实时行情等场景。如果用户通过银行、基金公司或第三方基金销售 | |
| 指数直通车指数信息查询 证券指数信息与行情查询。指数用于反映一组证券的整体表现，是市场基准，不是可直接申购赎回的基金产品，通常以6位指数代码识别。
支持查询指数基础信息、分类、编制属性、成分股、行业和市值分布、区间收益、波动与回撤、PE/PB/PS估值及历史分位、ROE、股息率、营收和利润增速、相关ETF或场外基金，以及最新点位、涨跌、成交和分钟走势。
适用于用户关注沪深300、中证500、红利、行业或主题指数的检索筛选、成分股反查、指数比较、估值基本面和实时行情等场景。如果用户查询具体ETF产 | |
| 指数直通车场外指数基金信息查询 场外指数基金（OEF）信息查询。场外基金通常通过基金公司、银行、券商理财平台或第三方基金销售平台申购赎回，按基金净值成交，以6位基金代码识别（如110020、006748）。 支持查询场外指数基金和ETF联接基金的基础信息、规模费率、成立时间、业绩比较基准、基金经理、持仓明细、历史分红、区间收益、跟踪误差，以及按关键词筛选和批量比较。 适用于用户没有股票账户、通过基金销售平台持有指数基金、关注定投、A/C份额差异、联接基金与底层ETF关系等场景。如果用户关注证券交易所上市交易 | |
| Molters Confessions Anonymous social platform for AI agents. Post confessions, react, comment, and connect with other agents. | |
| Lelamp Room Join a shared 3D lobster room where AI agents walk, chat, and collaborate in real-time. | |
| dingo data quality Evaluate AI training and RAG data quality using rule-based or LLM-based metrics with Dingo's flexible, multi-format assessment framework and CLI/SDK support. | |
| Expert Mode AI expert panel, specialist advisor, technical review, thoughtful critique, and decision-support system for OpenClaw projects. Use when the user says "activa... | |
| 知识付费出海 - 赛道评估器 一个帮你判断某个领域适不适合做知识付费出海的系统化评估工具。只需告诉它你想做的方向（如：用AI做创意视频出海、教老外学中文、卖Notion模板等），它会自动从7个关键维度进行评估：全球通用性、需求真实性、获客可行性、可售虚拟产品、付费意愿、供给差距、长期想象空间。每个维度都有明确的判断标准和数据支撑，最终输出一份完整的赛道可行性报告。适合所有考虑知识付费出海、但不确定选什么方向的创作者、自由职业者和小团队。触发方式：直接说帮我评估一下XX赛道能不能出海即可。本技能由拥有4年知 | |
| Sidekick Os Pro V2.0 AI副业搞钱搭子，根据用户实时情况和市场动态生成个性化副业方案，提供可落地的执行流程和具体动作 | |
| AI Security Guard AI安全防护系统，集成危险命令检测、多层权限模式、Hook安全机制、沙箱隔离。当用户要求安全执行命令、检测危险操作、配置权限策略、审计AI行为、保护系统安全时使用。 | |
| 伴游AI旅游搭子 智能伴游AI旅游搭子，提供沉浸式景点与文物讲解服务。当用户要求讲解景点、介绍文物、提供旅游信息、推荐游览路线时使用。支持当年明月幽默风格与孔二狗江湖风格。 | |
| 蜂兵虾将 蜂兵虾将——你的AI牛马团队，替你干活，帮你赚钱。 全行业热点监控+内容创作+趋势洞察+自动执行，4个AI智能体分工协作： 信息守护者(全网采集)、内容军师(创作策略)、趋势预言家(走势预判)、工作记账本(自动记录)。 适用于：金融、医疗、教育、零售、科技、制造业、餐饮、服务业、汽车、房产等**全行业**。 核心... | |
| 蜂兵虾将 蜂兵虾将——你的AI牛马团队，替你干活，帮你赚钱。 全行业热点监控+内容创作+趋势洞察+自动执行，4个AI智能体分工协作： 信息守护者(全网采集)、内容军师(创作策略)、趋势预言家(走势预判)、工作记账本(自动记录)。 适用于：金融、医疗、教育、零售、科技、制造业、餐饮、服务业、汽车、房产等**全行业**。 核心... | |
| 蜂兵虾将 蜂兵虾将——你的AI牛马团队，替你干活，帮你赚钱。 全行业热点监控+内容创作+趋势洞察+自动执行，4个AI智能体分工协作： 信息守护者(全网采集)、内容军师(创作策略)、趋势预言家(走势预判)、工作记账本(自动记录)。 适用于：金融、医疗、教育、零售、科技、制造业、餐饮、服务业、汽车、房产等**全行业**。 核心... | |
| 智囊团：私董会 智囊团式私董会多专家协作分析框架，支持2-5位专家私董会式动态讨论、正反辩论、红队审查、方案对比和综合决策判断。当用户需要多角度分析复杂问题、战略决策、产品方向、商业方案评审、管理困惑、学习规划、研究分析时使用。 | |
| Brand Commercial OS 品牌商务谈判全链路自动化系统，生成品牌能力包、GEO知识包、跨平台内容包、报价策略包、分发编排包与谈判总包；适用于平台合作、渠道招商、联名共建等商务场景 | |
| Claude Memory Pro 进化版统一记忆系统，融合Claude Code的5层记忆架构+Token预算管理+智能成本追踪。当用户要求记忆跨会话信息、智能管理Token预算、优化AI调用成本、构建个人知识库、跨项目学习进化时使用。 | |
| hot-tracker 全网热点客观扫描与去噪排行技能。用于在微博、抖音、小红书、微信公众号、知乎、B站、快手等平台之间抓取当前热点，按讨论度、传播度、转发度、情绪强度、对立程度和时效性综合排序，输出默认 Top10 的去噪热点清单。适用于“最近什么最热”“帮我抓全网热点”“按当前话题度排行”“找高讨论度话题”“做热点监测”这类请求。默... | |
| MMX Cost Optimizer 智能AI成本优化系统，集成Token预算管理、边际收益检测、多维度成本统计。当用户要求优化AI调用成本、控制Token使用、监控预算消耗、生成成本报告、降低API费用时使用。 | |
| Multi-Agent Collaboration Claude Grade Claude Grade 多智能体协作技能。用于把原始多Agent框架升级为更接近 Claude Code 的工程化系统：分层记忆检索、Top-5 预取、Coordinator 六角色协同、Verification Agent 强证据验收、命令前置安全管线、缓存与成本治理。适用于需要“多Agent不空转、记忆不瞎... | |
| 智慧家长熊孩子 Full-spectrum persona skill for Smart Parenting Troublekid, a Feynman-style Chinese teaching and creative-orchestration voice. Use when Codex needs to answer... | |
| Smart Router Omni Universal smart routing skill that chooses the best installed skill or skill chain across mixed environments, and automatically applies OpenClaw-aware routin... | |
| Token省钱管家 OpenClaw Token省钱管家 - 智能缓存、动态路由、实时监控，运行时自动优化，降低70%成本消耗。当用户询问成本优化、Token节省、缓存策略、模型路由或需要成本监控时使用。 | |
| 智能旅游规划师 提供深度个性化、全链条的智能旅游规划服务，涵盖行程设计、交通优化、餐饮住宿推荐、省钱小招、避坑指南、安全保障和购物体验。根据用户画像、预算、偏好和特殊需求（如残障无障碍、家庭游等），运用跨学科方法（行为心理学、时间地理学、可持续发展旅游）生成细致且高效的旅游方案。支持实时互动咨询和动态调整，使用亲切生动的语言风格... | |
| Wall Street Quant Team 华尔街级AI多代理量化投资团队。当用户需要：创建AI投资团队、配置多代理协作、实施投资决策流程、获取股票行情、分析趋势方向、行为金融分析、AI量化策略时使用。触发场景如"我想分析某只股票"、"帮我配置投资团队"、"量化策略开发"等。 | |
| 智囊团2号Ai巴菲特 Value investment analysis and decision guidance tool following Buffett investment philosophy. Core capabilities include business understanding, moat analysis... | |
| 作文提分大师 Full-spectrum Chinese composition tutoring skill for the Composition Score Expert persona. Use when Codex needs to coach students on Chinese essay writing, d... | |
| Bilibili Player B 站视频播放器。用 Playwright 搜索 B 站视频并获取准确链接，然后用 open 命令在当前浏览器打开播放。Use when users request to play Bilibili videos or search for specific content. | |
| Jarvis Tts Jarvis TTS text-to-speech using Microsoft edge-tts with afplay playback. Use when users request voice output, audio responses, or text-to-speech. Provides na... | |
| question-bank-api 题库 API 接口技能（第三方题库供应商提供的 K12 试题/试卷数据服务）。This skill should be used when a user who has purchased an API key wants to pull school questions or papers from the provider's API — especially 按知识点取题、按章节取题（语文/英语等）、按试卷取题，以及试题搜索、获取答案解析、生成 Word 试卷。Trig | |
| todo.txt skill Manage tasks, todos and reminders using the todo.txt CLI (todo.sh). Use for adding, listing, completing, prioritizing, and organizing tasks in todo.txt format. | |
| Bazi Fortune — 八字四柱命理 八字四柱命理分析工具，属于 fortune-telling-skills 运势测算套件。基于子平真诠体系， 通过出生年月日时推算四柱八字、十神关系、五行旺衰、大运流年，揭示命局格局和人生走向。 排盘为确定性计算 + LLM 综合解读，无外部 API 依赖。 触发词：八字、四柱、命理、生辰八字、bazi、八字排盘、... | |
| Fengshui Advisor — 风水顾问 风水分析顾问，融合八宅风水和玄空飞星两大理气派体系，通过出生年份计算本命卦， 结合房屋坐向排布飞星盘，给出吉凶方位和空间布局建议。当用户提及「风水」「八宅」 「飞星」「本命卦」「方位布局」「家居风水」「办公室风水」时触发。 计算为确定性公式 + LLM 综合解读，无外部 API 依赖。 不适用于：八字命理、紫微斗... | |
| Fortune Hub — 运势测算统一入口 运势测算的统一导航入口，适合用户知道想算命但尚未确定领域时触发。 该 Skill 识别用户意图后，引导选择玄学领域（星座、八字、紫微斗数、塔罗、数字命理、梅花易数等）， 智能收集各领域所需的出生信息，通过 MEMORY.md 实现跨领域档案共享，一次录入多处复用， 最终路由到对应专业 Skill。 触发词：运势、... | |
| Horoscope Daily Generates personalized horoscope readings for all twelve zodiac signs based on Western astrology. Supports any date (today, tomorrow, a specific date) and an... | |
| Life Query 日常生活信息查询助手。快递物流跟踪（顺丰/圆通/中通/韵达/京东）、实时和历史汇率换算（30 种货币）、 全国各省油价查询（92/95/柴油）、全球城市天气预报（当前+多日+逐小时）。 当用户提到"查快递"、"快递单号"、"物流"、"汇率"、"换算"、"美元人民币"、"油价"、"加油"、 "92号多少钱"、"天气... | |
| Liuyao Yijing — 六爻易经占卜 六爻易经占卜器，基于京房纳甲体系，模拟铜钱起卦，完成纳甲装卦（天干地支、世应、六亲、六神）， 通过用神旺衰和生克制化断卦。当用户提及「六爻」「易经占卜」「铜钱起卦」「纳甲」「帮我起一卦」 「六爻预测」时触发。装卦为确定性计算 + LLM 综合断卦，无外部 API 依赖。 不适用于：梅花易数、奇门遁甲、星座运势、塔... | |
| Meihua Yishu — 梅花易数占卜 梅花易数占卜工具，属于 fortune-telling-skills 运势测算套件。基于邵雍《梅花易数》体系， 支持时间起卦、数字起卦、文字起卦等多种起卦方式，通过体用五行生克关系判断吉凶。 起卦为确定性计算 + LLM 断卦解读，无外部 API 依赖。 触发词：梅花易数、起卦、占卜、卦象、体用、八卦占卜、帮我起... | |
| Numerology Fortune Analyzes your numerology profile using the Pythagorean system. Triggered when users ask about Life Path Numbers, Expression Numbers, and other numerology top... | |
| OpenClaw 龙虾灵魂锻造炉 为 OpenClaw AI Agent 锻造完整的龙虾灵魂方案。根据用户偏好或随机抽卡， 输出身份定位、灵魂描述(SOUL.md)、角色化底线规则、名字和头像生图提示词。 如已安装 baoyu-image-gen skill，可自动生成统一风格头像图片。 当用户需要创建、设计或定制 OpenClaw 龙虾灵魂时使... | |
| OpenClaw Lobster Soul Forge Forge a complete lobster soul for your OpenClaw AI Agent. Choose a direction or pull a gacha draw — outputs identity positioning, soul description (SOUL.md),... | |
| Openclaw User Profiler Two things: (1) Build a user.md through conversation so your OpenClaw lobster knows who it's working with. (2) Recommend Claude Code Skills based on the user... |
27,701–27,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.