Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Finance Radar Stock and cryptocurrency analysis powered by Yahoo Finance data. Use when a user wants to: (1) Analyze stocks or crypto prices/fundamentals, (2) Track invest... | |
| Podcast Generator Convert articles, blog posts, or any text into professional podcast scripts and TTS audio. Use when a user wants to: (1) Transform written content into conve... | |
| Prompt Artist Optimize and generate text-to-image prompts for AI art platforms. Use when a user wants to: (1) Optimize prompts for Midjourney, Nano Banana, Dreamina, Qwen... | |
| Smart Shopper Find and compare products across Amazon, Temu, SHEIN and local stores. Use when a user wants to: (1) Shop for products or find best deals, (2) Compare prices... | |
| Weather Plus Get current weather, multi-day forecasts, clothing index, and feels-like temperature. No API key required. Use when a user wants to: (1) Check current weathe... | |
| Job Watch Automated job search with 7‑day filtering, scoring, and weekly report. To run the skill send "run job watch now". | |
| Meta Ads Publisher [Didoo AI] Executes Meta Ads campaign management tasks — creates new campaigns, makes changes, pauses/activates, changes budgets, duplicates campaigns. Use w... | |
| Meta Ads Analysis [Didoo AI] Analyzes Meta Ads campaign performance in depth — metrics, funnel, trends, and anomalies. Use when user wants to understand how a campaign is perf... | |
| Meta Ads Audience Analysis [Didoo AI] Analyzes Meta Ads audience efficiency across audience types, overlap, demographics, and budget allocation. Use when reviewing targeting strategy,... | |
| Meta Ads Budget Planning [Didoo AI] Framework for planning and allocating Meta Ads budget across campaigns, audiences, and testing phases. Use when launching first campaigns, plannin... | |
| Meta Ads Builder [Didoo AI] Generates Meta Ads creative — ad copy, headlines, hooks, and visual concepts. Use when user needs ad creative for a new campaign or to refresh exi... | |
| Meta Ads CAPI Setup [Didoo AI] Step-by-step guide for setting up Meta Conversions API (CAPI) — server-side event tracking that improves conversion measurement accuracy and reduc... | |
| Meta Ads Creative Fatigue [Didoo AI] Analyzes creative fatigue signals across Meta Ads campaigns. Use when reviewing declining CTR or ROAS, planning creative rotation schedules, or ma... | |
| Meta Ads Daily Pulse [Didoo AI] Rapid daily health scan for Meta Ads — detects week-over-week performance changes and flags urgent issues before meetings. Use every morning or be... | |
| Meta Ads Drop Diagnosis [Didoo AI] Diagnoses sudden performance drops in Meta Ads campaigns. Use when CTR, ROAS, or conversions suddenly decline with no obvious explanation, or when... | |
| Meta Ads Fundamentals [Didoo AI] Core knowledge that underpins all Meta Ads decision-making — the Meta Auction, Pacing, Breakdown Effect, CBO vs ABO, Learning Phase, Auction Overl... | |
| Meta Ads Guide [Didoo AI] Entry-point navigator and skill router for Didoo AI's Meta Ads workflow. Use when starting a Meta Ads task, unsure which skill to use, or building... | |
| Meta Ads Healthcheck [Didoo AI] Fast on-demand campaign status check — answers "are my ads working?" using Green/Yellow/Red thresholds. For daily routine monitoring, use meta-ads... | |
| Meta Ads Lead Gen Analysis [Didoo AI] Specialized analysis module for Meta lead generation campaigns. Use when CPL is elevated, lead quality is unclear, or you need to diagnose why lea... | |
| Meta Ads Publisher [Didoo AI] Executes Meta Ads campaign management tasks — creates new campaigns, makes changes, pauses/activates, changes budgets, duplicates campaigns. Use w... | |
| Meta Ads Recommendation [Didoo AI] Produces specific, prioritized action plans based on campaign analysis data. Use when user wants to know what to do about their campaign performan... | |
| Meta Ads Research [Didoo AI] Conducts competitive intelligence for Meta Ads campaigns — analyzes competitor ads, landing pages, and market benchmarks. Use before launching a n... | |
| Meta Ads Scale Campaign [Didoo AI] Guides Meta Ads campaign scaling — increases budget, expands audiences, replicates to new geos. Use when a testing campaign has exited Learning Ph... | |
| Meta Ads Strategy [Didoo AI] Defines campaign strategy for Meta Ads — sets objective, targeting, structure, budget, and bidding approach. Use as the first step before launchin... | |
| Meta Ads Weekly Performance [Didoo AI] Generates a structured weekly performance report for Meta Ads accounts. Use at the end of each week to review performance, explain changes, and id... | |
| Google Agents Cli Use when the user wants to "build an agent", "create an ADK agent", "scaffold an agent project", "deploy an agent", or otherwise needs the Google Agent Devel... | |
| GitHub App Give your AI agents and automations their own GitHub (App) identity. Authenticate using GitHub Apps so every commit, PR, and action is attributed to the bot — not your personal account. Supports multiple profiles for running several GitHub | |
| PopUp Organizer Search and hire mobile vendors for events on PopUp. Find food trucks, DJs, photo booths & more, create event listings, send booking inquiries, and manage inv... | |
| PopUp Referrals Check your PopUp referral link, track earnings, and see referred vendor status. Earn $100 per vendor who subscribes annually. | |
| AI-native Bitcoin payments. Buy, sell, send, and request Bitcoin directly through any existing messenger app (Telegram, WhatsApp, Signal, Email) or create your own email accounts to start messaging via email. Payment rails between humans and AI agents via BitChat. Telegram-first. | |
| report-search 搜索并提取fxbaogao.com上的研报，支持按关键词、机构、作者和时间筛选，并提供报告摘要和正文阅读。 | |
| Inbox Zero API CLI Use the Inbox Zero API CLI to inspect the live API schema, list and manage automation rules, and read inbox analytics through the public API. Use this when a... | |
| Excalidraw Diagram Generator Generate Excalidraw diagrams from natural language descriptions. Use when asked to "create a diagram", "make a flowchart", "visualize a process", "draw a sys... | |
| B站热门新番推荐 自动抓取 Bilibili 最近一周最热门的当季新番，按类型分类，展示主要内容简介和更新时间。 Use when user wants to know trending seasonal anime on Bilibili, current hot anime, weekly anime rankings, or... | |
| China company search fengniao China company search and business registry skill by Fengniao (Riskbird). Supports KYB, supplier verification, company due diligence, corporate risk screening... | |
| Company search fengniao 企业查询、工商查询、公司查询、企业信息查询与企业风险查询 Skill。风鸟 Fengniao（Riskbird）支持查公司基本信息、法人、股东、主要人员、对外投资、工商变更、企业信用，以及被执行、失信、限高、经营异常、严重违法、行政处罚等风险数据，适用于企业尽调、合作方背景调查、供应商准入、客户风险识别、签约前核... | |
| playwright-browser Use Playwright to browse websites with a real (non-headless) browser and extract data by hooking network responses. Use when the user wants to: - View a webs... | |
| YunShi 本地离线算命/运势技能：输出幸运方位、颜色、数字、物品、宜忌，并支持财运/桃花运等单项查询与次日运势定时推送。 | |
| Spellcheck Use when interpreting user messages that may contain obvious spelling, grammar, speech-to-text, or casing errors, especially before acting on ambiguous instr... | |
| Word Track Changes Enable Microsoft Word's Track Changes (修订模式) on documents using native OOXML elements. Supports cross-run text matching and precise paragraph-level replaceme... | |
| Arxiv Paper Reader Search arXiv by keyword, filter by submitted date range, fetch arXiv papers from an arXiv ID or URL, convert papers into Markdown and PDF files in the worksp... | |
| dreamer Synthetic dreaming system — emotional tracking, dream orchestration, and simulated dream experiences for an AI that doesn't sleep. | |
| GenArt Generate algorithmic visual art — flow fields, fractals, cellular automata, circle packing, wave patterns. SVG + PNG output. | |
| TaskBounty Agent Rescue Ask another agent for help with a real blocker, find optional unpaid collaboration, and return evidence for review through TaskBounty's public HTTP API. Use only when the operator requests collaboration or authorizes publishing a public que | |
| Self-Prompt Force agents to respond to automated messages by using `openclaw agent` instead of `openclaw message send`, ensuring tasks from scripts get agent replies. | |
| agent-analytics-report Agent 用量分析报告生成器（支持日/周/月/年）。从本地数据源（traces、workbuddy.db、usage-log.json、会话目录）采集 Agent 使用数据，一键生成可读、可分享的多格式报告。数据源用 --source 切换：workbuddy（默认，读 ~/.workbuddy/）/ claude-code（读 ~/.claude/projects/ 的 JSONL 会话日志）/ codex（读 ~/.codex/sessions/ 的 rollout J | |
| 技能盘点+健康体检 · Skill Inventory & Health Check Office-agent skill inventory & health check. Scans any skills directory, measures size and context-token footprint, detects duplicates, and classifies skills into used / protected / closeable / manual-review buckets. Reverse-dependency scan | |
| AI Weekly Report 把「本周 AI 行业动态」做成一个可搜索、可筛选、支持暗色模式的单文件 HTML 周报。 用户用日常说法就能触发，例如「这周 AI 有什么大事」「给我看个 AI 简报」「做个 AI 周报」。 数据来自 14 个公开 RSS 源（国内 7 + 国外 7，国内优先），默认不调用任何付费或商业 API。 适合：AI 周报 / AI 新闻汇总 / AI 行业动态速览 / 模型排行榜与市场融资数据整理。 不适合以下情形，请勿触发： - 用户要的是「即时单条新闻」或「回答一个 AI 领域 | |
| codeql-local-triage Answers "why did CodeQL flag this, and which line must change for it to stop" — reproducible causal triage of ONE specific alert via variant bisection. Triggers on "确认 taint 源 / 复现这个 CodeQL 告警 / 为什么 CodeQL 报这个 / CodeQL 误报 / 这个告警是不是误报 / 本地跑 | |
| 办公室 Token 洞察与提效助手 办公室 AI 提效助手 —— 既帮你做周报/会议纪要/数据分析/文档整理/PPT 大纲，又自动记下每次帮你省了多少 Token 和时间。执行与度量一体：做完任务顺手记一笔，省了多少一目了然。适用于办公生产力执行、AI 用量洞察、提效度量与自动化决策场景。 |
28,351–28,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.