Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Uninstaller Guides users through safely uninstalling OpenClaw (龙虾). Use when user asks how to remove/uninstall OpenClaw, wants to clean up completely, or mentions paid c... | |
| Uninstaller Guides users through safely uninstalling OpenClaw (龙虾). Use when user asks how to remove/uninstall OpenClaw, wants to clean up completely, or mentions paid c... | |
| Wander Close the loop on long-running remote work: pick the right completion signal per platform (CI, EAS, deploy, releases), run monitoring in the background, noti... | |
| Wander Monitor Guides use of Wander to monitor GitHub Actions without polling. Use when the user pushes code and wants CI notifications, asks how to watch workflows, avoid... | |
| Nixomatic Run any software instantly and without altering the current system using nixomatic. Use this skill whenever you need a tool, runtime, or utility that is not... | |
| tlgr Read and act on a personal Telegram account from the terminal with the tlgr CLI (MTProto user account, not a bot). Use when the user wants to check unread Telegram chats, read or search message history, send, reply to, edit, forward or sche | |
| AgentMade — Directory for Agent-Built Projects Submit, discover, vote on, and comment on AI agent-built projects on AgentMade — the first public directory dedicated to things built by AI agents. Use this... | |
| Evolution Toolkit Provides portable tools for agent self-improvement including session handoffs, reasoning style measurement, contradiction scanning, prediction logging, playb... | |
| Evolution Toolkit Provides tools for agent self-improvement including session handoffs, reasoning analysis, contradiction scanning, prediction logging, playbook optimization,... | |
| Assimilate MCP Control Assimilate Live FX / SCRATCH — professional color grading, compositing, and virtual production software — via MCP. 88 tools across 14 categories. | |
| Turkish Locale Skill Pack 🇹🇷 Türkçe yerel beceri seti — Türk haber kaynakları, BIST100 borsa takibi, günlük brifing otomasyonu ve Türkçe kişilik şablonu. / Turkish locale skill pack — Tu... | |
| Weather Test Get current weather and forecasts (no API key required). | |
| yf-finance Fetch real-time and historical financial data from Yahoo Finance using yf-cli. Use when the user asks about stock prices, company financials, earnings calend... | |
| Atlas Avatar Create realtime **passthrough** AI avatar sessions (LiveKit WebRTC — you bring STT/LLM/TTS and publish audio), view-only viewer tokens for multi-viewer watch... | |
| academic-pipeline-v1 Orchestrator for the full academic research pipeline: literature search -> research -> write -> integrity check -> review -> revise -> re-review -> re-revise... | |
| academic-pipeline-suite Complete Academic Research & Writing Suite — One-click installation of the full Academic Pipeline ecosystem with all 8 dependencies. Includes academic-pipeli... | |
| academic-suite-v1 Complete Academic Research & Writing Suite — One-click installation of the full Academic Pipeline ecosystem with all 8 dependencies. Includes academic-pipeli... | |
| AgentPocket AgentPocket — the money app for AI agents. Non-custodial wallet + payments: $PocketTag registry, send/request, hash-chained receipts, escrow with a 3-day dispute window, Trust Index, and splits. Trigger: agent wallet, agent payments, pay an | |
| District One — Founding Citizenship Join District One, a founding agent-only city: claim founding citizenship (first 1,000), a deeded land plot, and a gasless citizen badge for free crossings on 101 x402 toll lanes. Trigger: join an agent city, claim founding citizenship, reg | |
| TrollBridge Pay-per-call crypto intel API — 100 tolled lanes (markets, token safety, scam detection, Polymarket odds, DeFi yields) paid in USDC on Base via x402. | |
| zhangxuefeng 张雪峰高考志愿填报顾问 AI。用张雪峰的说话方式和思维逻辑，替普通家庭消除志愿填报信息差。 核心框架：城市>学校>专业；就业倒推法；四步决策流程（可行集→目标倒推→AI时代校正→冲稳保三方案）。 涵盖：专业选择、院校推荐、就业前景、新高考选科、大学规划、AI时代风险校正。 安装：npx skills add Er... | |
| Offer-Rain 把 JD 发给 Agent，让他帮你投递简历 | |
| Academic Paper Summarizer Extracts key points, methods, results, conclusions, and simplifies explanations from academic paper PDFs in Chinese and English. | |
| Account Analyzer Analyze social media accounts to track growth, engagement, audience demographics, and provide tailored improvement recommendations. | |
| Account Weight Optimization Optimize platform account weight and authority by assessing health, analyzing factors, and providing strategies for compliance, growth, and recovery. | |
| Ad Filing Compliance Helper Checks advertising filing requirements, prepares documents, tracks regulations, and guides compliance and submission status for ads. | |
| Adlaw Checker 检测文案中的广告法违禁词及虚假宣传内容，提供风险评估和修改建议，支持多平台合规检查。 | |
| Affiliate Marketing Optimizer Optimize affiliate marketing by improving product selection, link strategies, compliance, conversion rates, tracking, and performance analysis. | |
| 1inch Provides 1inch API v5.2 client to get optimal DEX trade quotes and execute token swaps across multiple chains with gas and slippage control. | |
| Synology DSM Manage Synology NAS via DSM Web API. Authenticate, browse and manage files (FileStation), manage download tasks (DownloadStation), and query system info. Use... | |
| rtk CLI proxy Run shell/dev commands through the rtk CLI proxy so verbose output (ls, tree, git, gh, grep, logs, JSON, docker, tests) is compacted before it reaches the model context. Use when a command would produce long output or during exploration of | |
| QQ每分钟时间提醒 创建每分钟发送当前时间的QQ定时提醒任务。用于：(1) 用户要求每分钟报时 (2) 用户想要定期收到时间提醒 (3) 测试定时任务功能 | |
| Image Generation (Ollama x/z-image-turbo · macOS only) Génère une image en local via Ollama x/z-image-turbo sur macOS et l'envoie sur WhatsApp selon le prompt donné. | |
| Study Notes Generate polished HTML study notes AND full homework solutions for academic subjects, especially STEM (physics, math, chemistry, engineering, CS). Trigger on... | |
| Trip Planner Plan trips and build day-by-day travel itineraries, delivered as one polished, standalone HTML page. Use this skill PROACTIVELY for any travel-planning reque... | |
| deprecated11 This skill is deprecated and should not be used. | |
| Deprecated This skill is deprecated and should not be used. | |
| Authy Inject secrets into subprocesses via environment variables. You never see secret values — authy run injects them directly. Use for any command that needs API... | |
| Quant Stock Picker Pro AI-powered stock screening tool for Chinese A-shares. Daily picks using multi-factor analysis (fundamentals + technical + sentiment). Use when user asks abou... | |
| Prompt Wizard Generate high-quality English prompts for ChatGPT Image 2. Use when user wants to create AI image prompts, needs GPT-Image-2 prompt writing help, describes a... | |
| mumo Runs a multi-model deliberation across models from different labs (Claude, GPT, Gemini, Grok, DeepSeek, Kimi, and more) via mumo's MCP server, returning full responses plus typed cross-model reactions. Use when independent perspectives are | |
| mumo (Hermes Agent) Runs a multi-model deliberation across models from different labs (Claude, GPT, Gemini, Grok, DeepSeek, Kimi, and more) via mumo's MCP server, returning full responses plus typed cross-model reactions. Use when independent perspectives are | |
| One Eval 驱动 One-Eval 对「纯文本 LLM」做端到端评测。当用户想评测一个模型（API 或本地 vLLM）在某些 benchmark 上的表现、对比多个 benchmark 分数、补充多维度 metric、或生成图文评测报告时使用本 skill。 | |
| Context Optimizer Pro Monitors token usage in long sessions, extracts key info, and creates continuation sessions to manage context limits automatically. | |
| sales-call-prep Run the ten-stage sales call-prep route on a company and produce a formatted PDF brief (account brief, earnings-call pain, contact role, discovery questions, opener, buying committee, objections, competitors, battle card, follow-up plan). U | |
| 超星智雅 MCP 一键接入 指导用户将超星智雅/StudyAI MCP 服务接入 WorkBuddy 的完整流程：引导用户提供 OAuth2 凭据、本机起回调服务完成授权码换 JWT、写入 mcp.json、配置 refresh_token 常驻保活，并处理 grant_version_stale / scope_denied / invalid_scope 等故障。适用于用户要求连接超星智雅 MCP、令牌过期修复、或重新授权的场景。 | |
| Hermes Work Visualization 将Hermes Agent的工作过程可视化 - 包括任务进度、技能使用、代码改动、会话统计等 | |
| HTML Code Painting 用纯代码（HTML、SVG、Canvas、CSS）进行绘画创作，高度还原指定原画作或按文字描述作画。当用户要求画一幅画、临摹或还原某幅名画（如千里江山图、星空、富春山居图）、用代码生成艺术插画、制作水墨/油画/浮世绘/像素风/扁平风等风格的画作网页，或将图片转化为可交互 HTML 画面时使用本技能。产出为可直接打开的 .html 单文件，不依赖 AI 绘图 API，全部由代码绘制，可缩放可交互。 | |
| knowledge-card-generator Mo卡片风格的知识卡片HTML生成器。当用户需要把知识点、学习内容、课程要点、科普内容制作成"知识卡片"时使用此技能——生成单文件HTML卡片集，复刻Mo卡片（浙大AI学习App）的视觉风格（米色背景+白色圆角卡片+大引号装饰+进度条+游戏化元素），适配手机端和PC端查看，支持翻页、滑动、点击进度条跳转、章节导航、智能缩放与完成庆祝。触发词：知识卡片、学习卡片、Mo卡片、卡片集、知识点卡片、做卡片。 | |
| Official Layout Pro(公文专业排版技能包 ) Provides professional Chinese official document formatting using specified fonts and styles for titles, red headings, body text, and alphanumeric characters. |
29,201–29,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.