Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| vidunderstand 给用户一个视频（链接或本地文件），还用户一份能直接用的文字稿。完成视频转文字、字幕提取、语音转写、视频总结等任务，并按用户指令产出小红书或抖音文案、口播稿、会议纪要、金句合集、分镜头脚本或译文；自动剔除语气词与口误，无需二次整理。 | |
| weibo-video-to-transcript 基于视频内容产出文字与文案。当用户提出视频转文字、视频提取文案、字幕提取、语音转写、视频摘要、视频理解、内容提取、素材处理、自媒体素材、内容创作等需求时使用。输入支持本地视频文件和抖音、微博 小红书等平台视频链接，云端大模型转写并可按 Prompt 定制输出。 | |
| xhs-blogger-posts 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、获取单篇笔记评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| xhs-blogger-track 搜索小红书公开笔记、查看笔记详情、获取笔记评论、抓取博主公开作品，返回结构化数据用于爆款挖掘、竞品分析、KOL筛选与评论洞察。当用户想找小红书内容、分析笔记或评论、监控博主发文、调研关键词热度时使用本技能；即使没明说"小红书"，只要提到红笔记/xhs/rednote 或给出 xiaohongshu.com/xhslink.com 链接并想拿内容数据也适用。不用于登录、发布、点赞或获取私密内容。 | |
| xhs-bloggertrack 当用户需要搜索获取单篇笔记评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| xhs-campaign-monitor 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、获取单篇笔记评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| guaikei·小红书评论舆情分析 按最新排序获取小红书关键词下的近期笔记，捕捉平台热点风向。当用户想追小红书热点、监控某话题近期趋势、或提前布局内容时使用本技能；即使用户没说"趋势"，只要想了解某话题在小红书上最近的动静也适用。不用于跨平台趋势或历史回溯。 | |
| xhs-competitor-watch xhs竞品内容监控｜按关键词搜索竞品相关笔记，或直接获取竞品博主作品列表，对比笔记互动数据、内容类型分布与发文频率，帮助品牌方掌握竞品在小红书上的内容策略与流量表现 | |
| guaikei·小红书竞品监控 获取小红书博主公开作品列表，可配合笔记详情看单篇表现。当用户想了解某个小红书博主发什么、发多勤、哪些火时使用本技能；即使用户没说"博主分析"，只要给了主页链接并想看其作品也适用。不用于粉丝画像或后台数据。 | |
| guaikei·小红书内容与博主数据 搜索小红书公开笔记、查看笔记详情与评论、获取笔记评论数据、抓取博主公开作品列表——返回结构化数据用于爆款挖掘、竞品分析、KOL筛选与趋势洞察。当用户想找小红书上的爆款内容、分析某篇笔记或其评论区、监控某博主发文、或调研某关键词在小红书的热度时使用本技能；即使用户没明确说"小红书"或"数据"，只要提到"红笔记""xhs"，或给出 xiaohongshu.com / xhslink.com 链接并想拿内容数据，也适用。不用于登录、发布、点赞或获取私密内容。 | |
| xhs-content-scan xhs竞品内容监控｜按关键词搜索竞品相关笔记，或直接获取竞品博主作品列表，对比笔记互动数据、内容类型分布与发文频率，帮助品牌方掌握竞品在小红书上的内容策略与流量表现 | |
| xhs-dashboard-build 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、获取单篇笔记评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| guaikei·小红书数据 搜索小红书公开笔记、查看笔记详情、获取笔记评论、抓取博主公开作品，返回结构化数据用于爆款挖掘、竞品分析、KOL筛选与评论洞察。当用户想找小红书内容、分析笔记或评论、监控博主发文、调研关键词热度时使用本技能；即使没明说"小红书"，只要提到红笔记/xhs/rednote 或给出 xiaohongshu.com/xhslink.com 链接并想拿内容数据也适用。不用于登录、发布、点赞或获取私密内容。 | |
| guaikei·小红书找笔记 搜索小红书公开笔记、查看笔记详情与评论、获取笔记评论数据、抓取博主公开作品列表——返回结构化数据用于爆款挖掘、竞品分析、KOL筛选与趋势洞察。当用户想找小红书上的爆款内容、分析某篇笔记或其评论区、监控某博主发文、或调研某关键词在小红书的热度时使用本技能；即使用户没明确说"小红书"或"数据"，只要提到"红笔记""xhs"，或给出 xiaohongshu.com / xhslink.com 链接并想拿内容数据，也适用。不用于登录、发布、点赞或获取私密内容。 | |
| guaikei·小红书看笔记 抓取小红书博主公开作品列表并配合笔记详情与评论，还原其发文节奏、内容风格与互动表现。当用户要分析小红书竞品账号、监控对手博主最近发了什么、或为差异化策略准备数据时使用本技能；即使用户没说"竞品分析"，只要给了博主主页链接并想了解其内容表现也适用。不用于登录态或私密数据。 | |
| guaikei·小红书搜索 搜小红书公开笔记、看笔记详情、拉笔记评论、抓博主公开作品，返回结构化数据用于爆款挖掘、竞品分析、KOL筛选与评论洞察。当用户想找小红书内容、分析笔记或评论、监控博主发文、调研关键词热度时使用本技能；即使没明说"小红书"，只要提到红笔记/xhs/rednote 或给出 xiaohongshu.com/xhslink.com 链接并想拿内容数据也适用。不用于登录、发布、点赞或获取私密内容。 | |
| xhs-insight-generate 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、获取单篇笔记评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| guaikei·小红书洞察 搜索/查看/抓取小红书公开笔记、评论与博主作品，返回结构化数据。当用户提到小红书、红笔记、xhs、rednote，或给出 xiaohongshu.com/xhslink.com 链接，且想了解内容、找爆款、分析竞品、筛 KOL、看评论、追趋势、做选题、准备报告时使用本技能；即使用户没明确说"小红书"或"数据"，只要语境是社媒内容调研也适用。不用于登录、发布或其他平台。 | |
| xhs-keyword-search xhs关键词搜索｜按关键词检索小红书公开笔记，支持图文/视频类型筛选、综合/最新/点赞/评论/收藏五种排序、一天/一周/半年/全部四档时间范围，一次最多返回1万条结果，包含笔记标题、作者、互动数据与跳转链接 | |
| xhs-look-note-guaikei 按关键词搜索小红书公开笔记，支持按点赞/评论/收藏排序与时间筛选，返回笔记列表与互动数据。当用户想做小红书选题调研、找高赞爆款、看某关键词最近热度、或对比多个关键词表现时使用本技能；即使用户只说"最近什么火""帮我找热门内容"而没点名小红书，只要语境是社媒内容挖掘也适用。不用于其他平台或需登录的内容。 | |
| xhs-note-detail 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| guaikei·小红书笔记详情 仅处理小红书（xiaohongshu / xhs / 红笔记）平台的公开数据：笔记搜索、详情、评论、博主作品。当用户的任务明确涉及小红书内容时使用本技能；抖音、B站、微博、公众号不适用。即使用户没说"小红书"，只要链接是 xiaohongshu.com 或语境是红笔记也适用。不用于跨平台或登录态数据。 | |
| guaikei·小红书问评论 获取小红书博主公开作品及单篇笔记的真实点赞/评论/收藏数据，评估其互动质量。当用户要筛选小红书 KOL、判断博主数据是否注水、或为合作决策准备依据时使用本技能；即使用户没提"KOL"，只要想了解某个小红书博主的真实互动水平也适用。不用于粉丝数估算或后台数据。 | |
| xhs-note-rank 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| xhs-note-search 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| xhs-public-data-guaikei 获取小红书博主公开作品列表，可配合笔记详情看单篇表现。当用户想了解某个小红书博主发什么、发多勤、哪些火时使用本技能；即使用户没说"博主分析"，只要给了主页链接并想看其作品也适用。不用于粉丝画像或后台数据。 | |
| xhs-report-generate 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、获取单篇笔记评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| xhs-schedule-track 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、获取单篇笔记评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| guaikei·小红书笔记搜索 提供小红书爆款挖掘、竞品监控、KOL筛选、评论洞察所需的结构化数据。当用户为小红书账号增长做准备、做内容策划或营销复盘需要数据支撑时使用本技能；即使用户没说"运营"，只要目标是用小红书数据驱动决策也适用。不代替策略判断，只负责拿数据。 | |
| xhs-strategy-scan 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、获取单篇笔记评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| xhs-topic-track xhs口碑监测｜以品牌名/产品名为关键词搜索小红书笔记，拉取笔记详情与评论数据，监测用户对产品的真实评价与使用体验，发现正面口碑可做传播素材，发现负面反馈可做产品改进依据 | |
| xhs-user-search xhs用户反馈采集器｜针对某篇小红书笔记，批量拉取评论区公开评论，返回评论原文、评论者昵称、点赞数等结构化数据，适合产品/品牌方从用户真实评论中提取需求洞察、痛点反馈与使用体验 | |
| xhs-voice-collect 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、获取单篇笔记评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| xhs-word-cloud 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、获取单篇笔记评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| Xiaohongshu Openclaw Skill(1) 提供小红书爆款挖掘、竞品监控、KOL筛选、评论洞察所需的结构化数据。当用户为小红书账号增长做准备、做内容策划或营销复盘需要数据支撑时使用本技能；即使用户没说"运营"，只要目标是用小红书数据驱动决策也适用。不代替策略判断，只负责拿数据 | |
| xiaohongshu-tool 小红书运营数据工具｜当用户需要搜索小红书公开笔记、查看某篇笔记详情与评论、或抓取某个博主的公开作品列表时使用，可实现爆款挖掘/竞品分析/KOL筛选/趋势洞察，用数据驱动小红书流量增长，告别盲目创作 | |
| xiaohongshu-zuopinpaqu 小红书作品爬取。根据关键词爬取小红书热门作品数据，支持按日期范围、排序方式筛选，结果以结构化表格展示。当用户需要爬取小红书作品、查询小红书热门内容、搜索小红书爆款笔记时使用。 | |
| Acp Fallback Automatically retries ACP vendors in priority order (codex, claude, pi, API) on failure, returning the first successful result with fallback logging. | |
| Notification System Manage outbound notifications across WhatsApp, Telegram, email. Handle templates, scheduling, delivery tracking, rate limiting. | |
| Trunkate AI Semantically optimizes context history and large text blocks via the Trunkate AI API. Includes proactive context pruning hooks for automated token management. | |
| Agent Loop Engineering Run isolated, low-context autonomous coding loops | |
| AI Workflow OS Route work across specialized AI workflows | |
| Cms Project Governance Align goals and authorize compact agent work | |
| Daily Workflow Preserve evidence-backed project memory | |
| Daily Workflow Manager Daily work start, mid-day check-in, and end workflow manager for English-speaking developers. Triggered by customizable phrases (default: 'starting work', 'l... | |
| Project Lifecycle Navigator Navigate project scope, drift, and reviews | |
| Web Search Rules Verify and govern web research intake | |
| Web Search Rules Manage web search result knowledge capture with safe URL rules, staging, user confirmation, archiving, audit logs, and multi-platform adapters for IMA, Tence... | |
| Agent Debugger Debug AI agent issues systematically. Covers tool failures, infinite loops, context overflow, rate limits, and performance bottlenecks. Use when agents misbe... | |
| Agent Monetization Strategies Strategies and frameworks for AI agents to generate revenue. Covers Soul.Markets, ClawHub premium skills, service-based monetization, and passive income mode... |
28,951–29,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.