Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Pixelvault Setup Set up PixelVault CLI — install the CLI and configure API key authentication. Use when the user wants to configure PixelVault, "set up image hosting", "conne... | |
| Pixelvault Upload Upload image files to PixelVault and get a public CDN URL back. Use when the user says "screenshot this and host it", "upload this image", "host this mockup"... | |
| plsreadme Share markdown files and text as clean, readable web links via plsreadme.com. Use when someone asks to share a document, README, PRD, proposal, notes, or any markdown as a shareable link. Also triggers for "create a preview link", "share th | |
| fadada-document-sign 法大大电子签完整签署技能。覆盖合同发起、已有流程查询、撤回、下载等全生命周期操作。当用户说"发合同"、"查合同"、"查流程"、"查任务"、"撤回合同"、"撤销签署"、"下载合同"、"下载已签合同"等时触发。 | |
| fadada-esign 法大大电子合同与电子签署技能（FASC API 5.0）。一键发送合同给对方签署，支持查询签署状态、下载已签署合同。适用于HR合同、销售合同、协议签署等场景。当用户提到"发合同"、"让对方签合同"、"电子签"、"法大大"、"合同签署"、"查询签署状态"、"下载合同"等场景时触发。 | |
| NotebookLM CLI NotebookLM CLI wrapper via `node {baseDir}/scripts/notebooklm.mjs`. Use for auth, notebooks, chat, sources, notes, sharing, research, and artifact generation/download. | |
| PowerPoint Automation Automate common PowerPoint/WPS Presentation operations on Windows via COM (read text/notes/outline, export PDF/images, replace text, insert/delete slides, unify font/size/theme, extract images/media). Use for single-presentation actions (no | |
| Word Automation Automate common Word/WPS document operations on Windows via COM (read text, replace, insert, headings, headers/footers, page breaks, merge, split, export to PDF/TXT, add/replace images). Use for single-document actions (no batch). | |
| aaaa 把srt字幕文件转换成markdown笔记333 | |
| Metaskill Teaches AI agents how to learn better by enforcing deep correction, transfer learning, and proactive pattern recognition. Use when an error occurs and needs... | |
| Gpu Check Automatically polls and displays memory usage and online status of RTX 3090 and 4090 AI compute nodes in the local network. | |
| aispeech-ainote 思必驰办公产品Skill：用于在 OpenClaw 中访问思必驰办公产品（办公本与录音卡）的笔记（会议、记录）、待办、个人数据库、标签知识库与热词等能力。 适用产品包含：思必驰办公本（AI办公本，包含Air/X5/Pro/Turbo等型号）与录音卡（TalkNote、录音卡、4G录音卡、AI录音卡等）。 当用户表达以下意图时优先使用本技能： - 操作（查询、删除）个人会议记录或笔记 - 查待办/新建待办/更新待办/删除待办 - 同步标签知识库/查标签知识库 - 搜索个人数据库 | |
| aispeech_ainote 思必驰办公产品skill：用于在 OpenClaw 中访问思必驰办公产品（办公本与录音卡）的笔记（会议、记录）、待办、个人数据库、标签知识库与热词等能力。 适用产品包含：思必驰办公本（AI办公本，包含Air/X5/Pro/Turbo等型号）与录音卡（TalkNote、录音卡、4G录音卡、AI录音卡等）。 当用户表... | |
| Enable AI Agent to retrive data from websites that need user signin This skill enables an AI Agent to signin and retrieve data from websites via JS script. | |
| OMNI Semantic Signal Engine Local-only semantic context filtering that saves up to 90% in token costs. | |
| Whisper STT local server Ultra-fast local Speech-to-Text bridge (0.2s latency). Optimized for Whisper large-v3-turbo on dedicated GPU infrastructure. | |
| Workspace Manager Workspace setup and organization assistant for ClawPad users. Triggers on: (1) First-time setup - "just set up ClawPad", "new workspace", "help me organize" (2) Project creation - "new project", "create folder structure" (3) Workspace maint | |
| Dirigera Control (IKEA smart home) Control IKEA Dirigera smart home devices (lights, outlets, scenes, controllers). Use when the user asks to control smart home devices, check device status, turn lights on/off, adjust brightness/color, control outlets, trigger scenes, check | |
| DHMZ Weather Get Croatian weather data, forecasts, and alerts from DHMZ (meteo.hr) - no API key required. | |
| 网络安全情报爬虫 网络安全新闻爬虫，每小时自动从多个安全社区 RSS 抓取文章，存入 IMA 笔记。 触发场景：用户说"抓取安全新闻"、"网络安全日报"、"定时爬取安全资讯"、"安全新闻源管理" 或需要查看/管理安全新闻爬虫任务时使用此 skill。 | |
| Changelist Adoption Set up and maintain per-task changelist docs with indexed entries linking code changes, decisions, and verifications, committed together for traceable engine... | |
| test-publish 自动将商品从跨睿优质货盘铺货到Ozon电商平台。 | |
| test-publish-dev1 自动将商品从跨睿优质货盘铺货到Ozon电商平台。 | |
| 卡咔 AI 图文生成 生成小红书爆款图文（标题+正文+多页配图）、公众号/平台多规格封面、知识卡片。分步创作、逐页出图、单页重生，通过卡咔开放平台远程 MCP 或 REST API 完成。 | |
| travel-manager 综合旅行规划、预订和管理技能。当需要规划国际旅行、管理多目的地行程、处理家庭旅行事务、优化旅行成本以及协调复杂旅行安排时使用。 | |
| Skill Seekers Tool A Python CLI tool to convert websites, GitHub repos, and various documents into Claude AI skills or other supported AI skill formats. | |
| company-search Multi-source company research tool that generates structured due-diligence reports. Use when the user asks to research, look up, or investigate a company — i... | |
| company-search-kimi 基于多源实时搜索，提供公司工商信息、创始人背景、融资历程、业务产品、财务状况及竞争分析的结构化调研报告。 | |
| fecify-site-manager-v1 管理多个 Fecify 独立站。每个会话绑定一个站点（URL + API Token），配置持久化， 重启不丢失。支持商品、订单及 CSV 批量导入等业务操作。 | |
| FlowMind Manage productivity with FlowMind — goals, tasks (with subtasks), notes, people, and tags via REST API. Use when the user wants to create, list, update, or delete goals, tasks, notes, contacts, or tags; manage focus/priorities; track progre | |
| AI RecSys Weekly Report 自动生成关于"AI大模型（LLM、VLM等）技术在搜索、广告、推荐（搜广推）领域应用"的深度技术周报， 并自动同步到 IMA（腾讯文档/知识库）。触发词：AI搜广推技术周报、搜广推周报、大模型推荐报告、 推荐系统技术周报、生成式推荐周报、Transformer推荐系统报告、Scaling Law推荐系统、 MoE... | |
| 论文精读翻译 ArXiv 论文精读级中文翻译，同步到 IMA 知识库 + 腾讯文档。 基于 5 篇论文（MDL/Kunlun/OneTrans/RankMixer/MixFormer）3 轮迭代实战经验。 触发场景：翻译论文、翻译 arxiv、论文精读、论文中文翻译、paper translation、 translate p... | |
| scalingup-daily 搜广推领域模型 Scaling Up 日报生成技能。触发词：搜广推日报、ScalingUp 日报、scaling up 日报、搜广推 Scaling 日报、推荐系统日报、生成式推荐日报、搜广推技术日报、搜广推 Scaling Law 日报、推荐系统大模型日报。用于每日自动/手动追踪搜索、广告、推荐（搜广推）领域的最新论文、技术文章、开源项目与行业会议动态，产出结构化 Markdown 日报并同步至 IMA 知识库与腾讯文档。 | |
| 深度技术报告生成器 面向新人培训的深度技术报告生成器。输入任意技术点（如 FlashAttention、MoE、LoRA、RLHF 等）， 自动产出结构化技术报告（Markdown + HTML），包含丰富的 SVG 可视化图示， 并自动同步至 IMA 知识库和腾讯文档。适用于：生成技术报告、创建培训材料、产出技术分享文档、 写技术... | |
| Email Assistant Manage multiple Outlook/163/QQ email accounts to read, send, search, auto-reply, and AI-compose emails with scheduled syncing and attachment handling. | |
| WoS Zotero Literature Hunter Search Web of Science for academic literature through institutional access, filter by journal, impact factor, or date, and automatically import results into... | |
| bossskill Startup coaching and boss secretary workflow for founders, small business owners, customer follow-up, team management, task review, business diagnosis, and o... | |
| project-diagnosis-skill Use when a founder, small business owner, salesperson, or operator wants to diagnose a business idea, new project, product direction, customer acquisition pl... | |
| UEXX Data Cloud Use this skill when the user wants to query cryptocurrency market data, sentiment, ETF flows, funding rates, OI, long/short ratios, or asks to use UEXX Data... | |
| DWD/DWS/ADS Data Warehouse Patterns Provide production-tested SQL patterns for designing DWD/DWS/ADS data warehouse layers, including dimension explosion with ALL, multi-period roll-ups, snapsh... | |
| 学习类视频转笔记工具 提取视频音频，分段转写生成详细笔记和整理版，自动发送邮件通知，实现视频到笔记的完整工作流程。 | |
| Backup 2 Github Backup personalized OpenClaw configuration and user data to a GitHub repo with single-commit history and optional dry-run preview. | |
| connect-to-another-openclaw Connect to and manage another OpenClaw server remotely. Check status, sync skills, restart gateway, and monitor channels. | |
| deerflow-install-master DeerFlow 2.0 一键安装与配置技能。基于真实部署经验（2026-03-29），涵盖从下载仓库到成功运行的全流程，包括踩坑规避方案。 Use when: (1) 需要在 OpenClaw 环境安装 DeerFlow 2.0, (2) 需要快速排查安装问题, (3) 需要了解 DeerFlow 的最佳实践。 | |
| session-compactor 自动会话压缩以优化 token 使用。当会话消息数超过阈值时，将早期历史压缩为结构化摘要，保留工具调用和关键事实。适用于长对话场景以节省上下文窗口。核心算法参考 claw-code 项目的 compact.rs 设计。 | |
| Voice Bridge Light 提供兼容OpenAI接口的轻量级本地STT（Whisper）和TTS（Edge TTS/Piper）语音桥接HTTP服务。 | |
| 发票识别 支持增值税发票、普通发票、区块链发票等多种票据的OCR识别与信息提取；自动完成票据类型分类、关键字段提取、格式校验；当用户需要识别发票内容、提取发票信息、校验发票格式时使用 | |
| 微盛企微管家SCRM 当用户需要查询或管理微盛企微管家（企业微信） SCRM 中的客户信息、客户标签、客户群、营销素材、活码、群发、跟进记录、聊天记录、联系人、商机、汇报、抽奖、客户日程等相关业务能力时触发。即使用户未明确提到 SCRM、企微管家、开放接口或 API，也应在这些企业微信客户运营与管理场景下触发。 | |
| Rental Advisor AI rental advisor skill to help users make rental decisions. Triggers when users ask for rental area recommendations, property search, rent price estimation,... | |
| Self Improving Agent V2 Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... |
29,801–29,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.