Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Ops Skills Pack Provides production-ready autonomous agent operations with cost optimization, task autonomy, persistent memory, security, and scheduled execution workflows. | |
| pdf-to-epub-ocr 将扫描版PDF电子书通过OCR识别转换为结构化精排的EPUB格式。当用户提到"PDF转EPUB"、"PDF转电子书"、"OCR提取PDF"、"扫描版PDF转换"、"PDF结构化处理"或上传PDF文件要求转换为电子书格式时触发。不适用于纯文本PDF（可直接提取文字的PDF不需要OCR）、图片格式转换或PDF编辑功能。 | |
| 古诗词新民谣改编 古诗词改编现代新民谣音乐创作——将古典诗词改编成成名曲水平的完整新民谣歌词、详细曲风与演唱描述，适用于单曲或整张专辑企划。当用户提到"把诗/词改成歌""诗词改编""古诗词新民谣""古风歌词""为诗歌写歌词""古风新编""音乐专辑企划""曲风建议""AI音乐歌词prompt"等意图时触发。不适用于：古诗词纯文学赏析或翻译、现代都市流行（非古风）歌词创作、诗歌朗诵稿。 | |
| 3D虚拟仿真实训系统生成器 3D虚拟仿真实训系统制作技能。当用户需要为职业教育/职业培训制作 3D 虚拟仿真实训页面（单文件 HTML）时使用。触发场景：内燃机/无人机/新能源汽车/民航机务/安检/客舱乘务/空港管理等设备或岗位的"3D 结构拆解、原理仿真、实操培训、考核系统"。产出对标已验证的 9 个高逼真样本（特斯拉 Model Y、四冲程内燃机、A320/B747 客舱、大疆无人机、民航安检/机务/空港）。 | |
| 交互式教学网页生成器 根据教案、教材或课件生成交互式教学HTML网页 | |
| Textbook Virtual Simulator 教材虚拟仿真系统生成器，支持多种教材格式（文本/PDF/JSON）转换为交互式教育仿真 Web 应用。 能够生成3D场景、交互式组件、数据分析功能，适用于教育实验、操作培训、知识图谱等多种仿真类型。 当用户提出以下意图时触发：创建教材仿真、生成虚拟实验、构建教学模拟、制作教育3D场景、 教材可视化、交互式教学应用... | |
| Vic Publish 可视化交互课件制作技能。当用户需要为课堂教学制作可视化、可交互的课件（HTML 单文件）时使用。触发场景：把教材知识点（如血液循环、四羊方尊、晨昏线、二分二至等）做成 SVG 演示 + 可交互的网页课件、知识卡和教师说明。适用学科：生物、历史、地理、物理、化学、数学等一切含结构、流程、现象的知识点。 | |
| 职业教育课材一体化开发 职业教育课材一体化开发专家 - 基于岗位能力图谱和AI赋能的课材一体化设计、开发与优化工具 | |
| Vocational Ed Policy Scraper 自动抓取教育部、人社部及各省教育厅官网的职业教育政策文件和课题申报信息。支持按关键词筛选和定期汇总。 | |
| 职业教育教学能力大赛备赛指导 职业教育教学能力大赛备赛指导专家（增强版）。提供从团队组建、选题设计、课程重构、教案编写、实施报告撰写到决赛答辩的全流程专业指导，含大量获奖范例与模板。 | |
| Vocational Ed Policy Scraper 自动抓取教育部、人社部及各省教育厅官网的职业教育政策文件和课题申报信息。支持按关键词筛选和定期汇总。 | |
| Parallel Task Executor 多任务并行执行管理器。接收多条指令并同步执行，支持优先级调度、任务依赖、结果收集和进度跟踪。适用于需要并发处理多个独立任务的场景。 | |
| Recursive Self Improvement 递归自我改进系统，能够自动检测错误并修复，或持续优化和重构。包含修复模式和优化模式，支持并发执行、自动化测试、性能监控、智能调度、自适应学习、错误预测和异常恢复。用于需要持续自我优化的系统。 | |
| Baserow Work with Baserow tables/rows over the REST API for reads, inserts, and updates. Use when user asks to view or modify Baserow CRM/pipeline data. | |
| Feishu Doc Read, create, update, and append content in Feishu (飞书) documents with appropriate user permissions. | |
| Feishu Drive Manage Feishu cloud storage by listing, creating, moving, and deleting files and folders with your Feishu account. | |
| Feishu Perm Manage Feishu document, file, folder, or wiki permissions by setting access levels, sharing, or revoking user or group permissions. | |
| Feishu Wiki Manage Feishu Wiki knowledge bases by listing spaces, viewing, creating, moving, and renaming wiki pages with appropriate permissions. | |
| huawei-cloud-ascend-op-mfu-calculator Calculate MFU (Machine FLOP Utilization) for operators like matmul/GEMM/FlashAttention on Ascend NPU, providing clear formulas and derivation process Use this skill when the user wants to: (1) calculate MFU for matrix operations, (2) analyz | |
| huawei-cloud-asm-fuzzy-list Query the list of Huawei Cloud ASM (Application Service Mesh) meshes belonging to the current tenant / project and fuzzy-match them by mesh name. Returns the mesh name (metadata.name), mesh id (metadata.uid), status phase and creation times | |
| huawei-cloud-dws-sql-check Comprehensive SQL statement checking for DWS, supporting two check modes: 1. Syntax Check - Keyword validation, statement structure verification, clause completeness, DWS syntax compatibility based on gram.y grammar definitions 2. Specifica | |
| Repo Security Auditor Audit GitHub repositories for security vulnerabilities, malicious code patterns, and suspicious behavior. Clone repos, analyze code for backdoors, data exfil... | |
| YouTube Intelligence Extractor Extract structured intelligence from YouTube video transcripts for productivity, AI prompting, platform engineering, and creative workflows. Use this skill w... | |
| Otterai Cli Use when the user mentions Otter, Otter.ai, or wants to find, search, download, export, or manage meeting notes, transcripts, recordings, or audio from calls... | |
| Pro Zh Summary 专业级中文长文本摘要工具。当用户要求“总结”、“摘要”、“提炼要点”、“缩写”或处理超长中文文本时，必须调用此工具进行自动分段与压缩。 | |
| Text to Image Render text into an image and return a temporary local image file path, with optional data URI. Use when Clawhub or Codex needs to convert plain text, styled... | |
| Knowhere Use the Knowhere OpenClaw plugin to ingest local files or URLs, search stored documents, inspect parsed results, check jobs, and clean up stored document state. | |
| Ziptax Sales Tax Look up U.S. sales tax rates using the ZipTax API. Use when the user asks about sales tax rates, tax calculations for a U.S. address/ZIP code/coordinates, freight or service taxability, jurisdiction-level tax breakdowns, use tax vs sales ta | |
| Skill Route tool requests through Clawvisor for credential vaulting, task-scoped authorization, and human approval flows. Use for Gmail, Calendar, Drive, Contacts,... | |
| Submit Check Find students who haven't submitted artifacts by matching filenames against a class manifest. | |
| Backup Rotator Smart backup rotation and retention manager. Create backups, enforce flexible retention policies (grandfather-father-son), verify integrity, and clean up old... | |
| SSL Certificate Checker SSL/TLS certificate expiry checker and domain health monitor. Check certificate expiration, issuer details, SAN entries, and chain validity for one or multip... | |
| CSV Data Processor Process, filter, merge, clean, convert, and analyze CSV or delimited data files, supporting CSV, TSV, JSON, and SQL formats with customizable options. | |
| D365 F&O Developer Comprehensive D365 Finance & Operations development assistant covering X++, customizations, integrations, data entities, DMF, security, and deployment. Use w... | |
| Docker Cleanup Toolkit Docker resource cleanup, pruning, and disk usage analysis toolkit. Inspect containers, images, volumes, networks, and build cache usage. Prune stopped contai... | |
| Docker Ops Docker container lifecycle management, health checks, log analysis, cleanup, compose orchestration, and troubleshooting. Use when Codex needs to manage Docke... | |
| Code Reviewer Automated code review for pull requests and code snippets. Analyzes code quality, security vulnerabilities, performance issues, and best practices across Pyt... | |
| Docker Helper Manage Docker containers, images, volumes, networks, and Docker Compose projects. Use when the user wants to: (1) List/start/stop/restart Docker containers,... | |
| Git Workflow Assistant Expert-level Git workflow guidance covering branching strategies, commit conventions, merge/rebase workflows, conflict resolution, and CI/CD integration. Use... | |
| Tech News Daily Fetch, summarize and curate the latest tech news from major sources (Hacker News, TechCrunch, The Verge, Ars Technica, GitHub Trending). Use when the user wa... | |
| Price Monitor Monitor competitor product prices across Shopee, Lazada, Amazon, and others with automated tracking, alerts, and detailed comparison reports. | |
| SEO Audit Analyze and improve website content for search engines. Guides users through checklist-based reviews of title tags, meta descriptions, headers, content quali... | |
| Social Publisher Generate, schedule, and repurpose platform-optimized social media posts with consistent brand voice and content calendars for Twitter, LinkedIn, Instagram, F... | |
| GitHub PR Manager GitHub Pull Request lifecycle management — create, review, merge, changelog generation, CI checks, conflict resolution, and draft management via gh CLI. Use... | |
| Commit Message Generator Generate conventional, descriptive commit messages from git diffs. Analyzes staged changes or branch diffs and produces well-formatted commit messages follow... | |
| Git Standup Summary Generate concise daily/weekly standup summaries from git commit history. Analyzes recent commits, groups them by type (features, fixes, refactors, chores), a... | |
| GTS Ecommerce Price Monitor Monitor competitor product prices on Shopee, Lazada, Amazon, and others with automated tracking, alerts, reports, and trend analysis for smarter pricing. | |
| JSON Processor JSON query, validate, diff, transform, format, flatten, and stats toolkit with a jq-like interface. Uses Python stdlib only — no external dependencies. Use w... | |
| Network Toolbox Perform network diagnostics including ping, DNS lookup, HTTP header inspection, port scanning, traceroute, WHOIS, SSL info, public IP, and latency measurement. | |
| Python Automation Full-stack Python automation toolkit for file processing, data extraction, PDF manipulation, Excel/workbook automation, web scraping, and system tasks. Use w... |
29,251–29,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.