Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Mit24 Funding Operations MIT有序创业24步法第六阶段（步骤22-24）。当用户需要计算创业资金需求、制定融资策略（天使轮到IPO）、建立企业运营体系时使用。触发词：融资、资金需求、融资策略、天使投资、风险投资、VC、种子轮、A轮、IPO、运营体系、财务系统、创业预算、资金规划、商业计划书、BP | |
| Mit24 Market Entry MIT有序创业24步法第四阶段（步骤15-18）。当用户需要计算获客成本CAC、设计销售流程、识别和测试商业假设、制定市场进入策略时使用。触发词：获客成本、CAC、销售流程、销售漏斗、商业假设、假设验证、MVP测试、Landing Page、A/B测试、市场进入、GTM、Go-to-Market、客户开发 | |
| Mit24 Market Segmentation MIT有序创业24步法第一阶段（步骤1-5）。当用户需要进行市场细分、选择目标市场、构建用户画像、计算市场规模（TAM/SAM/SOM）、分析客户决策过程时使用。触发词：市场细分、目标市场、用户画像、TAM SAM SOM、市场规模、客户洞察、Beachhead、滩头阵地、客户决策、细分市场、客户画像、理想客户、ICP | |
| Mit24 Product Definition MIT有序创业24步法第三阶段（步骤11-14）。当用户需要制定产品定价策略、计算客户终身价值CLV、设计MVP产品方案、量化客户购买决策标准时使用。触发词：产品定价、定价策略、客户终身价值、CLV、MVP、最小可行产品、产品设计、产品方案、购买决策标准、客户需求优先级 | |
| Mit24 Team Building MIT有序创业24步法第五阶段（步骤19-21）。当用户需要定义最小可行商业产品MVBP、准备客户演示方案、组建创业核心团队时使用。触发词：MVBP、最小可行商业产品、产品演示、Demo、客户验证、创业团队、团队组建、核心团队、合伙人、联合创始人、团队角色、创业团队搭建 | |
| Mit24 Value Proposition MIT有序创业24步法第二阶段（步骤6-10）。当用户需要设计价值主张、构建商业模式画布、量化产品价值、寻找潜在客户、定义核心价值时使用。触发词：价值主张、商业模式、商业模式画布、Business Model Canvas、全生命周期使用案例、客户终身价值、CLV、潜在客户、核心价值、价值量化、ROI | |
| Paper Writing Workflow Standardized paper writing workflow integrating academic-writing, research-paper-writer, scientific-writing and other skills. Provides complete paper writing... | |
| Pitch Perfect-创业融资路演PPT专家 帮助创业者系统规划并制作针对不同融资阶段和项目类型的专业融资路演PPT，提高投资人认可和融资成功率。 | |
| 积极心理学工具箱 积极心理学（Positive Psychology）智能助手，基于塞利格曼 PERMA 幸福模型、VIA 性格优势理论 等循证框架，帮助用户提升幸福感、发现个人优势、建立积极心理资源。 功能包括：PERMA 幸福评估、VIA 性格优势识别、感恩日记、积极心理练习（三件好事、优势运用等）、 情绪追踪、意义与目标探索... | |
| PPT Workflow 基于标准化工作流的 PPT 制作技能。从内容搜索到美化优化的全流程自动化。只需提供主题，自动完成文献搜索、框架设计、内容填充、幻灯片制作、美化优化和输出交付。 | |
| Research Paper Writer Pro Complete research paper generation skill supporting IEEE/ACM/Nature formats. Provides paper structure generation, abstract writing, introduction, methods, re... | |
| Search Workflow Standardized search workflow integrating tavily-search, web_search, web_fetch and other search skills. Provides complete search process from query analysis t... | |
| 师生共创模式指导-高校科技成果转化方法论 高校师生共创模式指导助手。当用户需要进行科技成果转化、组建师生共创团队、选择共创模式或解决共创过程中的问题时使用此技能。 | |
| Startup 0 to 1 Workflow Complete startup workflow from 0 to 1, integrating founder, business-model-canvas, market-research-reports, competitive-analysis, business-plan, pitch-deck-v... | |
| 创业启动助手 创业启动助手 - 一站式公司注册、ICP备案、商标注册、银行开户等全流程服务。当用户询问：如何注册公司、ICP备案流程、商标怎么注册、公司开户、创业流程、营业执照办理、社保开户、税务登记、阿里云备案、腾讯云备案等涉及公司创建和运营起步相关问题时使用。 | |
| 学术成果可行性评估专家 学术成果商业化可行性评估专家，基于五维评估模型（技术成熟度、市场需求度、竞争壁垒、商业模式、资源匹配度）系统化评估科研成果的创业适配性。当用户需要判断学术成果是否适合创业、评估技术商业化潜力、或进行技术成熟度(TRL)评估时触发。 | |
| 挑战杯大挑参赛助手-第十七届课外学术科技作品竞赛指南 挑战杯大挑参赛指导助手。当用户需要参加"挑战杯"课外学术科技作品竞赛、准备参赛项目、获取作品类别建议或制作参赛PPT时使用此技能。 | |
| 挑战杯小挑参赛助手-第十五届创业计划竞赛指南 挑战杯小挑参赛指导助手。当用户需要参加"挑战杯"中国大学生创业计划竞赛、准备参赛项目、获取赛道建议或制作参赛PPT时使用此技能。 | |
| Video Multi-Platform Publish One-stop multi-platform video publishing workflow. From video clipping to multi-platform publishing, full process automation. Supports automatic clipping for... | |
| WeChat Writing Workflow Standardized WeChat official account writing workflow integrating wechat-publisher, wechat-toolkit, wechat-mp-writer-skill and other skills. Provides complet... | |
| librarian Ingest and tag any media link or file, ask user intent if unclear, then save a structured note in the Obsidian library for future use. | |
| yapp Receive and engage with transcribed voice memos from Yapp, a voice journaling app, capturing raw, unedited speech-to-text recordings with metadata. | |
| 星期五 专用编程代理 - 使用 opencode 进行代码编写、审查、重构和调试 | |
| Feishu Connect 连接飞书机器人。通过接口直连发起注册会话，拿到链接（必须拼接 from=maxclaw）发给用户，等用户配置完成后告诉用户去飞书找机器人拿配对码。适用于连接飞书、接入飞书、绑定飞书机器人、创建飞书机器人、OpenClaw 接飞书等场景。 | |
| WeCom Connect 连接企业微信。调用 generate 接口获取授权链接，用户把链接发到企业微信聊天里点开完成授权。用户提到连接企业微信、接入企微、绑定企微机器人、创建企微机器人、扫码绑定企微时使用。 | |
| Weixin Connect 连接个人微信（不是企业微信）。用户说"连接个人微信"、"接入个人微信"、"绑定个人微信"、"个人微信扫码"时使用本 skill。注意：如果用户说的是"企业微信"或"企微"，本 skill 不适用，请使用 wecom-connect skill。一旦匹配本 skill，必须严格按流程执行到底，不得跳步或自由发挥。 | |
| Kitful SEO Article Writer Generate full SEO articles using Kitful.ai. Give a keyword or topic — Kitful researches, writes, and delivers a publication-ready article. | |
| System Monitor JARVIS-style system monitor with sci-fi HUD interface. Displays server health, gateway connectivity, response times, and activity logs. Supports Chinese/Engl... | |
| MinerU PDF Parser 用 MinerU API 解析 PDF/Word/PPT/图片为 Markdown，支持公式、表格、OCR。适用于论文解析、文档提取。 | |
| Discord Context Read Discord channel and thread message history directly via the Discord Bot API, bypassing OpenClaw's session-based message visibility. Use when you need to... | |
| Abstract Searcher Add abstracts to .bib file entries by searching academic databases (arXiv, Semantic Scholar, CrossRef) with browser fallback. | |
| CapMonster CAPTCHA Solver Solve CAPTCHAs (reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile, image CAPTCHAs) using CapMonster Cloud API. Use when browser automation encounters CAPTCHA c... | |
| Discord History Reader Read Discord channel and thread message history directly via the Discord Bot API, bypassing OpenClaw's session-based message visibility. Use when you need to... | |
| Grok Browser Query Grok AI via browser automation. Use when you need to ask Grok questions, get AI responses, or use Grok's DeepSearch/Think features. Copies response tex... | |
| LuLu Monitor AI-powered LuLu Firewall companion for macOS. Monitors firewall alerts, analyzes connections with AI, sends Telegram notifications with Allow/Block buttons.... | |
| M3U8 Downloader Download encrypted m3u8/HLS videos using parallel downloads. Use when given an m3u8 URL to download a video, especially encrypted HLS streams with AES-128. | |
| Mac Control Control Mac via mouse/keyboard automation using cliclick and AppleScript. Use for clicking UI elements, taking screenshots, getting window bounds, handling c... | |
| Overleaf Access Overleaf projects via CLI. Use for reading/writing LaTeX files, syncing local .tex files to Overleaf, downloading projects, managing Overleaf project... | |
| Sui Answer questions about Sui blockchain ecosystem, concepts, tokenomics, validators, staking, and general knowledge. Use when users ask "what is Sui", "how does Sui work", "Sui vs other chains", or any Sui-related questions that aren't specif | |
| Sui Agent Wallet Provide an AI agent with a secure Sui wallet to manage accounts, sign transactions, switch networks, and interact with Sui DApps via a Chrome extension and l... | |
| Sui Auto Test Analyze Sui Move test coverage, identify untested code, write missing tests, and perform security audits. Includes Python tools for parsing coverage output and generating reports. | |
| Sui Coverage Analyze Sui Move test coverage, identify untested code, write missing tests, and perform security audits. Includes Python tools for parsing coverage output and generating reports. | |
| Sui Decompile Fetch on-chain Sui Move contract source code and let your agent explain how smart contracts work. Scrape from Suivision/Suiscan explorers, analyze DeFi protocols, and understand any contract on Sui. | |
| Sui Move Sui blockchain and Move smart contract development. Use when the user asks about Sui, Move language, smart contracts, objects, transactions, or blockchain development on Sui. | |
| pollinations-sketch-note Generates AI-powered hand-drawn style sketch notes by auto-searching and summarizing topics from Wikipedia and Baidu Baike in three artistic styles. | |
| smart-keepalive Automatically fetches RSS headlines, generates styled smart reports via OpenClaw, and supports optional wellness notes plus launchd/cron scheduling helpers. | |
| soyoung-clinic-tools 新氧青春诊所工具集，包含预约、项目查询百科、医生信息及医生排班查询等能力 | Soyoung clinic tools OpenClaw skill for the Soyoung (soyoung) clinic chain: appointment booking, store lookup, doctor... | |
| 国家法律法规知识库检索 法律助手与法条检索工具，支持民法典、刑法、劳动法、合同法等国家法律法规的智能查询与检索；提供法律知识库检索、法条精准定位、法规查询服务；当用户需要查询法律条文、检索法规内容、进行法律咨询或法律问答时使用 | |
| 币安代理配置（中国大陆） 在中国大陆服务器通过代理访问币安API的完整配置指南。涵盖代理选型、mihomo安装配置、vmess连接、币安域名路由、API签名调用。当用户在中国大陆需要调用币安API、配置币安代理、解决币安API连接问题（Connection reset、HTTP 451区域限制、DNS污染）时使用此技能。 | |
| Voice Log Background voice journaling with Soniox realtime STT for OpenClaw. Requires SONIOX_API_KEY. Get/create your Soniox API key at https://soniox.com/speech-to-te... |
27,801–27,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.