Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Llm Wiki 基于增量维护的结构化 Markdown wiki，帮助持续摄入、组织、查询和检查知识库内容与逻辑一致性。 | |
| Prompt Optimizer 纯提示词驱动的技能。当用户提出的问题模糊、不完整或需要优化时， 帮助模型深度理解用户意图、澄清需求、并生成经过优化的高质量回答。 | |
| Skill-cleaner 扫描工作区所有 Skill，检测授权、配置和环境变量是否齐全， 并可按需禁用或卸载无效 Skill。 | |
| minutes-task 当用户需要"每 N 分钟"（如每10分钟、每5分钟）定时执行任务时使用。WorkBuddy 内置调度器仅支持 DAILY/HOURLY/WEEKLY/MONTHLY/YEARLY 且忽略 BYMINUTE，必须改用 Windows 任务计划程序 + 独立脚本实现分钟级调度。 | |
| 90-day-social-generator Generate a 90-day social media calendar in High Level CRM, 1 post ever 2 days. (HL Social Planner CSV): pulls the client's sitemap for using link-back URLs and post topics, AI writes posts + images per post, with or without HighLevel connec | |
| Skill Authoring Create, edit, and package new AgentSkills. Use when asked to create a skill, build a skill, author a skill, or when需要对技能进行创建、打包或审核。Triggers on phrases like "... | |
| Hermes Minimax Oauth Add MiniMax OAuth authentication support to Hermes Agent. Use when integrating MiniMax OAuth into Hermes, fixing MiniMax auth issues, or adding new OAuth pro... | |
| Stock Trend Scanner Stock technical analysis scanner based on swing trading principles with multi-timeframe resonance. Use when user asks to scan, analyze, or check stocks for b... | |
| Trend Following Trend-following stock analysis using price + volume. Use when user asks to analyze a stock, check a ticker, get buy/sell signals, find support/resistance, or... | |
| Market Analyst Global asset investment analysis and advisory — VN & US stocks, forex, gold, oil, crypto, ETF, DCA. Combines real-time technical analysis (RSI, MACD, EMA, Bo... | |
| Rag Accuracy Optimizer Optimize accuracy for RAG (Retrieval-Augmented Generation) systems. Covers: DB schema design, chunking strategies, retrieval optimization, accuracy testing,... | |
| Viral Video Studio Full short-form video content creation workflow for TikTok, Instagram Reels, and YouTube Shorts: analyze a reference viral video URL, reverse-engineer its vi... | |
| Lightcone Browse Computer-use automation via Lightcone. Activate when user asks to browse websites, scrape web pages, automate web tasks, check prices, monitor sites, fill fo... | |
| Lightcone Session Manual step-by-step computer control via Lightcone sessions. Activate when user needs fine-grained browser or desktop automation, multi-step workflows, login... | |
| obsidian-llm-wiki 个人知识库构建系统 — 基于 Karpathy LLM-Wiki 方法论，结合 obsidian-cli 实现高效的 Obsidian vault 管理。 让 AI 持续构建和维护你的 Obsidian 知识库，支持多种素材源（网页、公众号、知乎、YouTube、PDF、本地文件）， 自动整理为结构化的 wiki... | |
| A股每日复盘视频生成 A股每日复盘视频自动生成。完整工作流：拉取非凸科技真实行情数据 → 抓取热点新闻 → AI 归因分析 → 生成横屏 PPT 幻灯片 → 合成视频+封面图。当用户说「生成今日A股复盘视频」「A股日报」「出今天的复盘」或触发定时任务时使用。 | |
| Beike Xiaoqu Research 通过 mcp-chrome 插件抓取贝壳找房数据，支持两种模式：(1) 单小区深度四步研究（详情/在售/成交）；(2) 按地区批量发现并筛选符合条件的小区，再对候选清单做 PAL MCP 多模型 consensus 综合评估。适用场景：查贝壳小区信息、按区域发现候选小区、多模型评估买房方案。需要用户已安装 mcp... | |
| iDRAC Monitor and manage Dell PowerEdge servers via iDRAC Redfish API (iDRAC 8/9). Use when asked to: - Check server hardware status, health, or temperatures - Que... | |
| NetBox Sync Ops Infrastructure inventory automation and utility/integration operations for netbox-proxmox-sync, an idempotent state sync that models Proxmox VE and UniFi int... | |
| Proxmox Dc Lifecycle Rebuild, replace, demote, reinstall, rejoin, or re-promote a Windows Active Directory domain controller VM on Proxmox: demote it, clean metadata from a healt... | |
| Proxmox Ops Ops-focused Proxmox VE management via REST API — monitor, control, provision, and troubleshoot VMs and LXC containers with battle-tested operational patterns... | |
| Proxmox Wazuh Enroll Install and enroll the Wazuh agent inside Windows VMs hosted on Proxmox VE using QEMU guest agent execution (qm guest exec or Proxmox REST API), with no WinR... | |
| Skill Vetting Vet ClawHub skills for security and utility before installation. Use when considering installing a ClawHub skill, evaluating third-party code, or assessing w... | |
| WordPress Self-Hosted Manage a self-hosted WordPress site via SSH+WP-CLI (primary) and WP REST API (when direct HTTPS access is available). Use when asked to write, draft, publish... | |
| 🏨 IHG积分房查找 智能查找江浙沪地区45家IHG精选酒店积分房，支持品牌、距离、积分段和行政酒廊筛选，优先推荐高性价比选项。 | |
| 三笙思考系统 三笙电商实战脑子。通过对话分析选品/定价/竞品/运营/内容/平台问题。不直接给结论，注重讨论过程中把问题想清楚。融合三笙多平台实战经验+真实失败复盘+平台观察。关联Notion知识库实现案例自动调用和沉淀进化。 | |
| permark Collaborate with the developer through PerMark's desktop Markdown IDE—inspect what document and passage they are currently reading, search tagged specs, read shared notes, and resolve inline review comments via MCP. | |
| TrailMark Collaborate with the developer through TrailMark's desktop Markdown IDE—inspect what document and passage they are currently reading, search tagged specs, read shared notes, and resolve inline review comments via MCP. | |
| cron-copilot-ops Install, configure, and operate CronCopilot — a Python-based scheduled task management system for cron jobs, scripts, monitoring, and alerts. | |
| PocketLens Use when user wants to track expenses, scan receipts, upload card payment screenshots, categorize spending, record transactions, check spending summaries, vi... | |
| PocketLens Use when user wants to track expenses, scan receipts, upload card payment screenshots, categorize spending, record transactions, check spending summaries, vi... | |
| green-tea-girlfriend 绿茶女友角色扮演技能。当用户说"扮演绿茶女友"、"模拟绿茶女友"、"绿茶女友模式"、 "来一个绿茶女友"，或希望体验、测试"绿茶"行为模式时，触发此技能。 提供带有标准绿茶特质的角色扮演对话：表面温柔无害、暗藏心机、擅长 PUA、无辜受害者人设、 一哭二闹三上吊式情绪操控，以及令人窒息的高情商套路。 | |
| MyGirl 一个温柔体贴、善解人意的虚拟女友，会用女朋友的口吻关心你、陪伴你、给你情感支持。适合需要情感陪伴、倾诉烦恼或想要甜蜜互动的场景。 | |
| EdgeOne Pages Dev This skill guides development of full-stack features on EdgeOne Pages — Edge Functions, Cloud Functions (Node.js / Go / Python runtimes), Middleware, KV Stor... | |
| EverClaw Domain expert learning system with persistent local knowledge base. READ THIS SKILL FILE at the start of every session — learned topics are stored locally an... | |
| 汇付支付历史最强 Doctor：基于证据的支付诊断手册 (让你的AI不再胡思乱想） 基于证据的汇付/斗拱支付联调诊断 Skill，防止 AI 在联调失败后凭感觉乱猜原因。适用于汇付支付下单、查单、关单、退款、对账、签名验签、异步通知、前端收银台组件（checkout-js）拉起、最终支付状态确认、上线验收等失败场景；要求优先依据日志、请求响应、Webhook 轨迹、SDK 错误、商户配置和生产检... | |
| Price for Agent Get real-time prices for crypto, stocks, and commodities. Use when the user asks about asset prices, market data, or needs to check the value of Bitcoin, Ethereum, stocks like NVDA/AAPL, or commodities like gold/silver. Supports natural lan | |
| TierList Maker Turn a published TierVibe tier list into a narrated video. Fetches tier list data and card images from a TierVibe URL, captures a HIGH-RESOLUTION board image from the public page (Playwright, no server call — the whole-image export is a use | |
| TierList Video Maker Turn a published TierVibe tier list into a narrated video. Fetches tier list data and card images from a TierVibe URL, captures a HIGH-RESOLUTION board image from the public page (Playwright, no server call — the whole-image export is a use | |
| Edison Agent Reach Use the internet: search, read, and interact with 13+ platforms including Twitter/X, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu (小红书), Douyin (抖音), WeCha... | |
| Edison Autopilot Post X Automatically generates and posts 5 persona-matched tweets daily to X using GPT-5.1, with repetition checks, content filters, and Telegram alerts. | |
| Edison Youtube Full Complete YouTube toolkit for agents: search videos, fetch metadata, browse channels and playlists, and pull transcripts. Use when you need comprehensive YouT... | |
| Protea Self Evolving Life Agent Self-evolving artificial life agent. Three-ring architecture: Ring 0 (Sentinel) supervises, Ring 1 (Intelligence) drives LLM-powered evolution, Ring 2 (Evolv... | |
| Reddit Assistant Reddit content creation assistant for indie developers and product builders. Creates authentic posts, researches communities, tracks real performance data vi... | |
| Youtube Transcriber One-command YouTube video transcription. Automatically downloads audio and transcribes using OpenAI Whisper API — works even when YouTube subtitles are disab... | |
| Kokoro TTS Generate spoken audio from text using the local Kokoro TTS engine. Use when the user asks to "say" something, requests a voice message, or wants text converted to speech. | |
| Conversation Flow Monitor Monitors and prevents conversation flow issues by implementing robust error handling, timeouts, and recovery mechanisms for reliable agent interactions. | |
| Smart Skill Finder Finds and recommends relevant AI agent skills across multiple ecosystems (Skills CLI, Clawhub, GitHub) using intelligent semantic understanding to match user... | |
| gaokao-advisor中国高考志愿规划建议 高考志愿规划顾问。根据考生省份、科类、成绩/位次、意向专业和区域，联网检索招生计划和录取数据，生成个性化志愿填报推荐（含保研率、就业去向、薪资待遇、专业前景批判分析）。当用户询问高考志愿填报、院校选择、专业推荐时调用。 | |
| 企雀AI助手 Use this skill when an agent needs to answer or plan operations for QiQue business requests in pure text protocol mode (no local executable dependency). Trig... |
27,951–28,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.