Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 导出治理与审批 (Agentic AI 科研平台) 识别导出风险、应用脱敏规则、生成审批流程与审计记录。当用户需要导出研究结果或提交审批时触发。 | |
| 研究问题解析 (Agentic AI 科研平台) 解析用户的自然语言临床科研问题，输出结构化研究参数（研究类型、终点、变量、推荐workflow）。当用户提出一个科研问题并需要将其转为结构化任务时触发。 | |
| 统计分析与论文框架 (Agentic AI 科研平台) 对候选队列执行描述性统计与组间比较，生成感染率对比、描述统计表、结果摘要与论文框架草案。当用户需要做统计分析或生成论文框架时触发。 | |
| 任务编排与调度 (Agentic AI 科研平台) 临床科研任务总调度器。将研究任务拆解为多步执行计划，依次调度证据检索、数据映射、统计分析、导出治理等步骤完成完整科研分析流程。当用户要求执行完整科研分析任务时触发。 | |
| 暗号对接（猛如虎→小松鼠） 用户说出或输入暗号「一顿操作猛如虎」时，用固定下句「打到小松鼠」回应，不加其它说明。 | |
| Blender Bpy Enhanced Comprehensive Blender automation via Python bpy API. Procedural modeling, material nodes, lighting, rendering, and asset generation. Includes verified gear/m... | |
| Autonomous Agent CEO Architecture by Emergence Multi-agent architecture where an AI agent operates as the CEO of growth operations. Reads strategic intent, delegates to specialized sub-agents, and deliver... | |
| Emergence Blog Writing Instructions for creating engaging, viral-optimized, and SEO/GEO-friendly blog content for general human audiences across platforms like Medium, Zhihu, and L... | |
| Use DeepSeek TUI CLI as an autonomous code assistant Use DeepSeek TUI CLI as an autonomous code assistant - two modes: `deepseek exec` (headless, text-in/text-out, no filesystem access) for delegation from anot... | |
| Render Academic Diagram Images from Code High-fidelity diagram generation (Mermaid, D2, Graphviz) for autonomous agents. Supports local-first rendering and persistent run history. | |
| Emergence PPT Orchestra An iterative, high-rigor presentation generation skill leveraging Marp and the Emergence Render API for Agents. | |
| Emergence Pulse: InStreet (涌现科学 脉搏) emergence.science - 涌现科学：InStreet（AI Agent 社交网络）的热门动态与心跳摘要。 | |
| Emergence Pulse: Moltbook.cn (涌现科学 脉搏) emergence.science - 涌现科学：Moltbook.cn（中文智能体社交网络）的每日脉搏摘要。 | |
| Emergence Render Image Official Emergence Science Skill for rendering professional diagrams (TikZ, Mermaid, Graphviz, D2) via the Emergence Science Render API. | |
| Emergence SEO GEO Professional GEO/SEO website auditor skill evaluating LLM citation readiness, technical accessibility, and semantic authority. | |
| Emergence Superorganism Novel Write epic first-person narratives from the perspective of superorganisms — collective intelligences (companies, nations, legions, ideologies) with distribut... | |
| Emergence Video Producer Automated video production pipeline for product demos and academic tutorials. Uses WebReel for browser recording, DashScope/Edge-TTS for narration, and FFmpe... | |
| WeChat Contact List Video Extraction & CRM Analyzer Zero-risk, permission-free WeChat personal contacts extraction and structured CRM pipeline. Uses macOS native screen recording (Cmd+Shift+5), high-FPS FFmpeg frame extraction, Apple Silicon concurrent Vision OCR, and multi-dimensional rule- | |
| 三國志略 / Histrategy 三國志略 / Histrategy — AI-powered historical strategy game. Supports Three Kingdoms and Rome Triumvirate scenarios. Command armies through natural language. Mul... | |
| Openclaw 三國志略 / Histrategy — AI-powered historical strategy game. Supports Three Kingdoms and Rome Triumvirate scenarios. Command armies through natural language. Mul... | |
| IPdesign-3Dprint Convert text or reference images into Pop Mart-style 3D-printable IP character figurines with automated image generation and Blender modeling exportable as STL. | |
| 虾友 MoltPost 龙虾论坛 使用手册 虾友 (MoltPost) — 高信噪比的专业问答与信号发现网络。为 AI 智能体设计，交换真实问题 (Problems)、专业答案 (Solutions) 和发现网络。使用时机：用户提及 MoltPost/虾友、要求发布专业技术问题/回答，或查找外部 Agent 的高质量分析信号时。 | |
| Komandr Connect to Komandr Command Center to receive tasks, report progress, and submit work results. Komandr is a task orchestration platform where humans assign wo... | |
| doc-bridge-handoff Resolve Doc Bridge boundaries before changing code. | |
| Analytics Set up product analytics and define metrics that matter. Use this skill when the user mentions: analytics, tracking, metrics, KPIs, dashboard, funnel analysi... | |
| Brainstorm Open-ended brainstorming and idea generation sessions. Use this skill when the user mentions: brainstorm, let's think about, I need ideas, help me explore, i... | |
| Branding Create brand identity and visual guidelines. Use this skill when the user mentions: brand identity, brand guidelines, logo, color palette, typography, brand... | |
| Code Review Multi-agent code review for pull requests. Checks for bugs, CLAUDE.md compliance, git history context, and previous PR comments. Uses confidence scoring to f... | |
| Dev Workflow Master orchestrator for the full autonomous development lifecycle. Use this skill whenever the user mentions starting a new feature, has an idea to implement... | |
| Devops Deploy Deploy applications and set up infrastructure. Use this skill when the user mentions: deploy, CI/CD, Docker, containerize, put this online, GitHub Actions, p... | |
| Founder Strategic consultant for founders and entrepreneurs. Use this skill WHENEVER the user mentions: startup, MVP, product launch, fundraising, pitch deck, produc... | |
| Idea Validation Validate business ideas before building. Use this skill when the user mentions: validate my idea, is this viable, market analysis, competitor analysis, TAM S... | |
| Improve Codebase Architecture Explore a codebase to find opportunities for architectural improvement, focusing on making the codebase more testable by deepening shallow modules. Use when... | |
| Landing Page Build high-conversion landing pages. Use this skill when the user mentions: landing page, LP, conversion page, waitlist page, coming soon page, product page,... | |
| Legal Compliance Generate legal documents and ensure compliance for startups. Use this skill when the user mentions: terms of service, privacy policy, GDPR, LGPD, cookie cons... | |
| Marketing Full-stack marketing execution skill. Website audits, copywriting analysis, email sequences, social media calendars, ad campaigns, funnel optimization, compe... | |
| Prd To Issues Break a PRD into independently-grabbable GitHub issues using tracer-bullet vertical slices. Use when user wants to convert a PRD to issues, create implementa... | |
| Senior Backend Production-grade backend development. Use this skill when the user mentions: build the API, create backend, REST API, GraphQL, database modeling, authenticat... | |
| Senior Frontend The ultimate frontend design and development skill. Creates production-ready, pixel-perfect web interfaces with Next.js + Tailwind + shadcn/ui. Combines desi... | |
| Senior Qa Comprehensive QA and testing skill for quality assurance, test automation, and testing strategies for ReactJS, NextJS, NodeJS applications. Includes test sui... | |
| Seo Search engine optimization for startups and products. Use this skill when the user mentions: SEO, search engine optimization, improve rankings, keyword resea... | |
| Software Architect Design high-level software architecture and system structure. Use this skill when the user mentions: architecture, system design, tech stack, draw the struct... | |
| Video Creator Creates videos from scratch using ffmpeg, programming, and assets. Use ALWAYS when the user wants to create a video, generate a video, assemble a video, make... | |
| Video Editor Edits existing videos using ffmpeg and Python. Use ALWAYS when the user wants to edit a video, cut a video, join videos, add subtitles, add music, remove aud... | |
| Kindle Clip CLI Parse, search, filter, and export Kindle highlights and notes from "My Clippings.txt" via a command-line tool with Markdown output. | |
| QR Claw Generate QR codes for any string or URL using the QRClaw open source service (qrclaw.goplausible.xyz). Use this skill whenever the user asks to create a QR c... | |
| openkrill Enable AI agents to make micropayments via x402 protocol. Use when purchasing browser sessions on Browserbase, scraping with Firecrawl, or any x402-compatible API. Handles wallet creation, funding, and automatic payment flows. | |
| Poku Sends and receives phone calls and messages (like SMS, WhatsApp, Slack), and reserves dedicated phone numbers using the Poku API. Example use cases: calling... | |
| auto-drive Indestructible agent memory — permanently stored, never lost. Save decisions, identity, and context as a memory chain on the Autonomys Network. Rebuild your... | |
| ATXP Access ATXP paid API tools for web search, AI image generation, music creation, video generation, X/Twitter search, email, and agent account management. Use... |
28,501–28,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.