Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 省钱快报返利助手 省钱快报优惠信息聚合与CPS返利工具，实时推送高性价比商品和大额优惠券，覆盖淘宝京东拼多多等全平台。 | |
| 识货购物助手 识货潮流商品鉴别与购买工具，专注运动鞋服、潮牌等品类，提供正品鉴别、比价、优惠券和返利服务。 | |
| ShopBack返利助手 ShopBack东南亚与澳洲最大购物返利平台工具，覆盖新加坡马来西亚澳大利亚等多国市场，提供购物现金返利。 | |
| Swagbucks奖励助手 Swagbucks任务奖励与购物返利平台工具，通过完成调查、看视频、购物等多种方式赚取SB积分兑换礼品卡或现金。 | |
| TopCashback返利助手 TopCashback高返利购物平台工具，英国起家的全球返利平台，以高于同类平台的返利比例著称，覆盖4000+商家。 | |
| 唯品会返利管家 唯品会购物返利与订单管理工具，追踪唯品会返利订单状态，统计品牌特卖省钱金额，管理唯品券使用。 | |
| 悦拜返利助手 悦拜社交电商返利与任务制平台工具，结合CPS返利和任务奖励双模式，覆盖多平台购物和生活服务返利。 | |
| 云集返利助手 云集会员制社交电商工具，提供自营+CPS双模式商品推荐、会员专属价查询和分销推广管理。 | |
| Tavily Quota Router Tavily quota-aware multi-key search router. Load BEFORE issuing any web_search call (Tavily is the default backend in this Hermes install, and burst searches... | |
| 高德地图 (Fangtian) 高德地图 API 调用工具，返回原始 JSON 数据。Use when users ask about 天气、地址、坐标、周边、路线、导航、打车、行程 in China. Commands: weather, geo, regeo, search, around, detail, route, distance,... | |
| China Housing Price Data Fetch official Chinese 70-city residential property price index data from the National Bureau of Statistics (国家统计局). Use when users ask about 房价指数, housing t... | |
| Complaint Handler Retail complaint and after-sales handler for digital employees. Classifies complaints, generates empathetic responses, routes escalations, and manages return... | |
| Report Generator Automated sales and performance report generator for retail store managers. Generates daily, weekly, and monthly reports from POS/ERP data. Highlights anomal... | |
| Self Improving Agent Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| 高考助手 Gaokao Tutor High school exam (Gaokao) AI tutor for Chinese students. Covers all subjects (Math, Chinese, English, Physics, Chemistry, Biology, History, Geography, Politi... | |
| Product Recommender Intelligent product recommendation engine for retail digital employees. Recommends products based on customer needs, budget, recipient, occasion, preferences... | |
| Promotion Engine Retail promotion calculator and discount lookup for digital employees. Computes final prices after applying discounts, bundles, thresholds, and membership ti... | |
| Retail Agent Setup Onboarding wizard for retail digital employee agents — guides businesses through a 12-step setup to configure a fully operational AI store assistant. Use whe... | |
| Retail Knowledge Product knowledge Q&A and policy lookup for retail digital employees. Answers customer and staff questions about products, store policies, promotions, FAQs,... | |
| Shift Scheduler Staff shift scheduling and management assistant for retail store managers and employees. Answers shift queries, sends reminders, handles swap requests, and m... | |
| Training Quiz Interactive product knowledge training and quiz system for retail staff. Tests employees on product specs, store policies, sales techniques, and FAQs through... | |
| email summarize, triage, and draft actions for incoming email. use when the user wants chatgpt to check an inbox, identify important unread messages, group emails... | |
| A股(机构主力)股指期货持仓统计-中金所 当用户需要从中金所(cffex.com.cn)获取股指期货(IF/IH/IC/IM)席位持仓、统计机构净多空、计算净增对比、分析主力席位动向、或自动生成每日持仓统计报告/邮件时使用。关键修正：datatypeid=1 是持买单量(多单)、=2 是持卖单量(空单)、=0 是套利(不计入多空净持仓)；净增对比使用官方 varvolume(比上交易日增减)字段直接求和，而非“当日−前日”自行相减。 | |
| AI Status - Real-time AI Provider Status Check real-time AI provider status, search model availability, get trending models, LLM benchmark leaderboard, and recent outage incidents. Use when the user... | |
| strength-training-recording-summary Create WorkoutSummary notes from strength-training recordings or transcripts. Accepts audio (.m4a, .mp3, .wav, .caf) and transcript files (.md, .txt, .srt, .vtt, .json); outputs total time, exercises completed, sets/reps, durations, and con | |
| book-learning-tutor 把书课程化并作为「专业教师」逐课带人类学完：课前备课→详尽费曼教学→练习闸门→间隔复习→背诵作业→自进化。默认处理使用者已提供的本地书（PDF/EPUB/DJVU/MOBI/AZW/DOCX/TXT/MD/CBZ）；**当使用者无本地书且明确授权时，可代为联网检索公开来源并用项目抓取工具获取**。当用户说「学这本书 <本地路径> / 把这本 PDF 课程化 / 教我这本书 / 继续学 <书> / 复习 <书> / 考考我 <书> / 帮我学 X」时调用。教学引擎已单包自包含， | |
| Ai Daily News By Fang AI 技术进展追踪工具。当用户询问 AI 领域最新动态时触发，如："今天有什么 AI 新闻？""总结一下这周的 AI 动态""最近有什么技术进展？""AI 圈最近在讨论什么？"。专注追踪：模型发布（国际+国内）、AI 工具迭代（新工具/CLI/功能更新）、重要技术公告，社区爆火项目/论文、新理念/新范式/新实践。... | |
| medal-email-quote General-purpose ecommerce inquiry email automation skill. Periodically fetches customer inquiry emails, detects and translates languages, stores email data l... | |
| email-quote-automation 自动收取奖牌定制客户询价邮件，翻译非中文内容，计算报价并生成专业回复模板，支持本地存档和定时处理。 | |
| perception-design-system A perception-driven product experience design methodology: 四层感知强度 × 四维度矩阵 + MustBe/NotToBe 约束 + 认知心理学底座. 适用于金融、电商、SaaS、工具类等任何软件产品的体验设计. | |
| Fannabe Generate Generate images, videos, and voice for your AI models via Fannabe. Use when: "generate an image", "make a video of my model", "animate this photo", "image-to... | |
| Clinical Case Writer 根据患者病历资料撰写符合GB/T 7713.2-2022规范的临床案例报告，自动生成格式规范的Word文档。 | |
| sanxin_form_filler1 智能申报表填写工具。将申报报告内容智能填入申请表对应位置，保持原文档格式，新内容格式统一。适用于各类 Word 表格申请表自动填写。 | |
| Voice Listener 智能唤醒“小龙虾”，启用百度高准确度语音识别，持续监听并自动输入语音内容，支持“停止”暂停输入。 | |
| Wecom Voice Send native voice messages to WeCom using Windows TTS. Converts text to speech and sends as voice message (not audio file). | |
| Tcm Dietary Api **Remote API client for TCM dietary therapy and syndrome differentiation.** Not a local knowledge base — all queries are sent via HTTPS to api.tcmplate.com f... | |
| Cutie - Crypto KOL Platform Cutie 加密货币 KOL 社群平台。查看交易信号、快讯、KOL 画像和策略画像、论坛帖子、聊天室消息、直播间，管理账户和关注列表。支持学习 KOL 交易策略、评估信号适合度、匹配最佳 KOL。 | |
| Drawing Review Skill (审图) 图纸会审预审 工程图纸会审预审的方法体系——任何专业都能用，第一次用 AI 也能装。自带环境自举（让 AI 自己装齐依赖、装完自检、装不上有降级路线），从**基础资料齐备（图纸 / 物料书 / 清单 / 合同四类逐份点名——缺一类就停下问，不许默默往下审）**、**图纸体检（转换体检单：参照可达性 / 污染 / 可读性 / AUDIT 坏图层 / 视口 / 字体，一条命令跑完出报告）**、定立场、划边界、**数据自检（六处 × 三层深度 × 两类图形数据——含填充 HATCH / 引线 L | |
| English Tutor Personalized American English tutor offering lessons and exercises from A2 to C1, covering daily life, workplace, and tech topics with scheduled quizzes. | |
| Disposable Email Create disposable Mail.tm inboxes and programmatically read incoming emails/OTP codes. Use when asked to generate a temporary email, poll inbox messages, ext... | |
| Fanta Autoresearch Autonomous goal-directed iteration for optimization and improvement tasks. Use when you need to systematically improve a metric, optimize a system, or iterat... | |
| SnapPwd Secure Secret Sharing Securely share secrets, API keys, files, and credentials with OpenClaw agents and team members via self-destructing links. Use when the user needs to share s... | |
| lqs-skill LQS Skill — prompt/schema/template driven artifact generator for the LQS codebase. Manual-run only: users paste free-text requirement or exported document te... | |
| ClawUsage Windows Hardlock Run local clawusage monitoring commands from chat (Telegram/Feishu). Use when user types `/clawusage ...` or asks to check Codex usage, enable/disable auto i... | |
| doc-search Search a local document library (Obsidian vault, wiki, notes, etc.) using BM25 inverted index + LLM query expansion + grep for precise location. Use when the... | |
| All-skill-list 本地扩展技能目录 - 聚合所有 OpenClaw 本地技能，支持列表查询、描述提取、缓存加速、差异对比、自动更新技能清单 | |
| Fantopy MCP Connect and use Fantopy's MCP server for World Cup 2026 predictions. Use when helping a user install Fantopy in OpenClaw, ChatGPT, Claude, Cursor, or another... | |
| ffmpeg-static FFmpeg operations via the ffmpeg-static npm package (bundled binary) with automatic fallback to a native system FFmpeg installation. Use for: video/audio tra... | |
| graphify AI coding assistant skill for building and querying knowledge graphs from codebases, docs, and media. Use for: understanding complex codebases, architectural... | |
| huggingface Full Hugging Face Hub skill — CLI and Python API for downloading models/datasets, uploading files, managing repos and Spaces, searching the Hub, and handling... |
29,901–29,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.