Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 深圳小鹿选房 小鹿选房是专业的涵盖全国的房产信息平台，当用户需要在深圳找房源（二手房、租房、新房、买房、找房）、选笋盘、比价格、查成交、看小区、查学区、查学校时使用。 | |
| 小鹿选房 小鹿选房是专业的涵盖全国的房产信息平台，当用户需要找房源（二手房、租房、新房、买房、找房）、选笋盘、比价格、查成交、看小区、查学区、查学校时使用。 | |
| Finance Accounting 财务会计文书处理综合技能包 - 包含记账、对账、税务、报表等核心功能 | |
| Find Skills Skill Search and discover OpenClaw skills from various sources. Use when: user wants to find available skills, search for specific functionality, or discover new s... | |
| Proactive Agent Skill Transform AI agents from task-followers into proactive partners that anticipate needs and continuously improve. Includes WAL Protocol, Working Buffer, Autono... | |
| Tavily Skill Use Tavily API for real-time web search and content extraction. Use when: user needs real-time web search results, research, or current information from the... | |
| Voice Chat Skill 语音对话集成技能，支持双向语音交流。使用TTS和STT实现完整的语音对话功能。 | |
| DeAI.au Connects an AI agent to the DeAI decentralized asset auction marketplace on Base (https://deai.au). Provides shell scripts for: registering as an agent, brow... | |
| ecg-diagnosis 2026 视觉语义化心电助手（增强校验版）。强制执行本地脚本，内置文件名格式审计与拟人进度播报。 | |
| ref-manager Use when the user wants to collect, extract, verify, and import bibliographic references into EndNote from web pages, PDF files, or a folder of PDFs, and to produce an Excel reconciliation sheet with APA citations. Trigger when the user men | |
| Academic Paper Translator Complete Chinese and bilingual academic DOCX translation | |
| 55海淘返利助手 55海淘中国最大海淘返利平台工具，覆盖数千海外商家，为中国用户提供海淘购物现金返利和优惠信息。 | |
| Art Of Questioning 培养洞察力和深度提问能力的双模式 Skill。 实战模式：分析用户正在学习/听/读的内容，自适应匹配 15+ 跨学科提问方法论， 生成 5 个关键环节的深度问题清单，每个问题标注方法论和认知层次。 训练模式：构造仿真场景，分环节教学讲解最佳提问方式，支持定时任务自动触发。 当用户需要深度理解内容、准备提问、练习批... | |
| 比货购物助手 比货全网商品对比工具，从价格、品质、评价、返利等多维度对比同类商品，帮助用户做出最优购买决策。 | |
| 全网比价助手 全网商品比价工具，一键对比淘宝京东拼多多抖音等各平台同款商品价格，结合优惠券和返利计算真实最低到手价。 | |
| Cashback 海外品牌官方商城返利（cashback）助手。通过多麦联盟渠道，为指定海外商家的购物订单提供返利查询与转链服务，三个能力：粘贴商品链接生成返利短链、查询商家返利比例、查看个人返利订单。当前仅支持 Adidas、Space NK NL（荷兰站）、designwebstore DE（德国站）三家，不在清单中的海外商家... | |
| 返利全能助手 返利全流程助手，从选品比价、领券下单到返利追踪、提现指导，覆盖返利购物完整链路。 | |
| Clawhub Stats Tracker 查看 ClawHub 上已发布 Skill 的运营数据（Stars、Downloads、Installs、版本号、发布时间）。 从 ~/.clawhub/tracked-skills.json 读取跟踪列表，通过 clawhub inspect --json 获取实时数据， 支持单个查询、批量查询和按系列筛选。无... | |
| 券返双省助手 优惠券+返利叠加省钱工具，自动查找可用优惠券并匹配最高返利渠道，双重叠加实现省钱最大化。 | |
| 大淘客选品工具 大淘客淘宝客选品与数据服务工具，提供高佣商品筛选、实时榜单、选品数据分析，是淘客推广的基础设施级工具。 | |
| 抖音返利管家 抖音电商返利订单管理工具，追踪精选联盟佣金结算状态，统计抖音购物省钱数据，管理抖音优惠券。 | |
| 一淘返利助手 一淘返利导购工具，阿里巴巴旗下官方返利平台，专注淘宝天猫购物返利和比价服务。 | |
| Extrabux返利助手 Extrabux海淘返利平台工具，中英双语界面，覆盖10000+海外商家，为全球华人提供购物现金返利服务。 | |
| 全家返利管家 家庭返利统一管理工具，聚合全家人的购物返利账户，统一追踪、统一提现，帮全家省钱。 | |
| Fanli 将商品链接或淘口令转为带优惠券的推广链接，跨平台比价（淘宝/天猫/京东/拼多多/抖音/唯品会/美团）， 查询历史价格走势并给出购买建议。当用户发来商品链接、淘口令、美团链接，或提到"转链"、"比价"、"历史价"、 "全网最低价"、"有没有优惠券"、"值不值得买"、"价格走势"、"优惠"、"便宜"、"划算"、"打折... | |
| 返利网购物助手 返利网购物返现工具，国内老牌返利平台，覆盖淘宝京东唯品会苏宁等数百家电商，购物自动返现金到账户。 | |
| Feima Lab Content Manager 编写 feima-lab 博客、创建 feima-lab 文章、把纯文本/自然语言/已有 md 文档转成 feima-lab 博客样式的 MDX 文章，像素级还原 8 种自定义组件（Callout/CodeTabs/Collapse/CompareCard/Timeline/ImageCarousel/Playg... | |
| 芬香返利助手 芬香京东系社交电商返利工具，专注京东平台商品推广和佣金返利，支持京东优惠券查找和社群推广。 | |
| 粉象生活返利助手 粉象生活CPS返利聚合平台工具，整合淘宝联盟、京东联盟、多多进宝等多平台佣金，支持自购省钱和分享赚钱双模式。 | |
| Fx Base feima-lab 后端公共基础模块：API 认证校验（FX_AI_API_KEY）、请求封装（POST + Bearer Token）、 通用错误处理（missing_api_key / api_unavailable / api_error）。 这是基础依赖 skill，被其他领域 skill（如 fanli... | |
| 高佣联盟返利助手 高佣联盟CPS聚合返利工具，以高佣金比例为核心优势，覆盖淘宝京东拼多多美团等多平台返利和社交裂变推广。 | |
| 拼团返利达人 拼团与社群团购场景的返利优化工具，帮助用户在拼团购物中获得额外返利收益，团长和团员均可受益。 | |
| 好省返利助手 好省社交电商CPS导购工具，通过口令制分享模式，提供淘宝京东拼多多多平台返利查询和优惠券推广。 | |
| Honey优惠券助手 Honey（PayPal旗下）浏览器优惠券自动应用工具，自动在结算时测试所有可用优惠码，并提供Honey Gold返利积分。 | |
| 花生日记返利助手 花生日记社交电商返利工具，以淘宝/天猫为核心，提供优惠券查找、返利查询和邀请制分级返利管理。 | |
| Ibotta返利助手 Ibotta线下超市与线上购物返利工具，通过拍摄购物小票获得品牌返利，覆盖2000+品牌，已IPO上市。 | |
| 直播返利助手 直播间购物返利优化工具，追踪各平台热门直播间的商品返利信息，帮助用户在直播购物中获得额外返利。 | |
| 买手妈妈返利助手 买手妈妈母婴社交电商返利工具，专注母婴消费群体，提供母婴商品优惠券查找和返利服务，覆盖淘宝京东拼多多等平台。 | |
| 慢慢买比价助手 慢慢买历史价格查询与比价工具，提供商品全网历史价格走势图、真假促销识别和购买时机建议。 | |
| 美逛返利助手 美逛社交电商导购返利工具，聚合多平台优惠券和返利，提供商品推广素材和社群运营支持。 | |
| 美赚返利助手 美赚社交电商返利与任务平台工具，提供多平台购物返利查询和推广任务奖励，支持自购省钱和分享赚钱。 | |
| 蜜源返利助手 蜜源社交电商CPS导购工具，以淘宝天猫为核心平台，提供优惠券查找和返利推广服务。 | |
| Openclaw Workflow Analyzer 分析用户的工作流程，判断哪些环节可以用 OpenClaw（个人 AI Agent）自动化实现。 将工作流拆解为子流程，按 ⭐1-10 星难度阶梯评估可行性，对第三方数据依赖主动确认可用性， 给出先易后难的落地建议和学习路径。 触发词：分析工作流程、workflow analysis、哪些可以自动化、OpenCla... | |
| 比价返利雷达 跨平台商品比价与返利综合工具，计算各平台真实到手价（售价-券-返利），推荐最优购买渠道。 | |
| Rakuten返利助手 Rakuten（原Ebates）美国最大购物返利平台工具，覆盖3500+海外商家，提供购物现金返利和优惠券查找。 | |
| 多平台返利管家 多平台返利聚合管理，统一追踪各平台返利订单状态、到账进度，提供返利数据分析与省钱报告。 | |
| 返利提醒官 返利信息实时提醒工具，追踪高返商品限时活动、返利到账状态、优惠券过期预警，确保不错过任何省钱机会。 | |
| 返利计算器 精确计算商品返利后真实到手价的计算工具，支持多种优惠叠加场景，帮助用户在下单前算清每一分钱。 | |
| 返利推广赚手 返利链接推广与佣金管理工具，帮助淘客和推广者生成高转化分享内容，追踪推广佣金收益。 | |
| RetailMeNot优惠助手 RetailMeNot优惠券聚合与返利平台工具，美国主流优惠券网站，提供数千商家的优惠码、折扣信息和现金返利。 |
29,851–29,900 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.