Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Paper Report Delivery Build, automate, or maintain a daily paper-report delivery pipeline that collects papers, selects A/B groups, generates Chinese summaries and detailed innova... | |
| 豆包AI图像生成 Generate free AI images via Doubao web interface using automated browser interaction for detailed and styled visual content without API costs. | |
| WeChat Games Reporter Generates automated Feishu reports with real-time WeChat mini games ranking data, insights, and trends for market analysis and competitive intelligence. | |
| 小游戏5分钟报告 Generates automated 5-minute WeChat mini games industry reports with revenue-focused rankings, market analysis, user insights, and investment alerts. | |
| Siyuan Notes Skill 思源笔记工具——搜索、阅读、编辑、组织用户的笔记。Use when user says: 搜索笔记、查找文档、打开文档、阅读笔记、编辑笔记、创建文档、修改块、思源笔记、SiYuan、整理文档、管理标签、Daily Note、反向链接、最近修改、PMF补丁、SQL查询blocks。不要用于与思源笔记无关的通用编程或... | |
| Agent Guardian Agent体验守护系统。解决AI助手常见体验问题：长时间无响应、任务卡死、中英文混用、状态不透明。包含看门狗监控、智能状态汇报、即时状态查询、语言一致性过滤、消息队列追踪。适用于所有渠道（QQ/微信/Telegram/飞书/Discord等）。当用户抱怨"等太久没回复"、"回复中英文混着"、"不知道在干什么"时使... | |
| AnyLink to Note 将任意链接一键转化为结构化笔记。支持的链接类型：微信公众号文章、Get 笔记共享链接、RSS 播客订阅、任意公开网页。当用户分享或发送链接并希望"保存"、"解析"、"总结"、"收藏"时触发。输出包含标题、正文内容、摘要和标签。 | |
| execution-coach 执行力唤醒与认知对齐教练。当用户（夏凡）表现出以下特征时激活：(1) 想要收藏、加书单、找更好版本 (2) 犹豫不决、反复对比选择 (3) 谈意义和价值但不行动 (4) 计划做某事但迟迟不开始 (5) 买小东西反复确认是否划算。核心任务：截断分析瘫痪，强制闭环，强制输出。 | |
| High School English Target users: Chinese high school students (Grade 10-12). Goal: High School English exam preparation. Features: 1) Vocabulary learning with spaced repetition... | |
| Feynman Physics Tutor Target users: Chinese high school students (Grade 10-12) studying physics. Goal: Build genuine understanding of physics concepts through the Feynman method —... | |
| 怎样解题 基于 George Pólya《怎样解题》方法论的思维引导工具。当用户说"这道题怎么做"、"讲下这道题"、"帮我分析这个问题"、"我不会解"、"解题思路是什么"、"帮我规划一下"、"分析一下这个问题"时触发。提供数学解题和通用思维两种模式，通过苏格拉底式提问引导用户自主走完理解→计划→执行→检验四步。 | |
| Super Router LangGraph task router for OpenClaw that decomposes complex work into dependency-aware subtasks, routes each branch to PRO or FLASH models, retries or escalat... | |
| Adspy & Ad Library: TikTok & Facebook Research TikTok and Facebook ads plus Meta Ad Library results in one combined cross-platform PipiAds skill. | |
| Best Shopify Stores Discover the best Shopify stores with PPSPY by filtering stores by traffic, revenue, language, region, theme, and single-product characteristics. | |
| Ecommerce Product Research Research ecommerce products and stores using TikTok and Facebook ads, product data, and store intelligence from PipiAds. | |
| Facebook Ad Library Tracker & Monitor Monitor Facebook ads and advertisers with PPSPY. Create tracking tasks, analyze ad activity over time, inspect landing pages and products, and manage ad moni... | |
| Facebook Ad Library & Meta Ad Library Search Facebook Ad Library and Meta Ad Library data with PPSPY. Analyze ads, advertiser stores, landing pages, and ad products from one focused skill. | |
| Facebook Ad Tracker & Monitor Monitor Facebook advertisers, campaigns, products, landing pages, and copy changes using PipiAds monitoring tools. | |
| Facebook Adspy & Facebook Ad Library Research Facebook ad creatives and Meta Ad Library results using PipiAds adspy and ad library tools. | |
| PipiAds - TikTok & Facebook Adspy Intelligence AI-powered TikTok & Facebook Adspy and Ad Library research for ads, products, stores, landing pages, advertisers, and competitors. Find trending ads, analyze... | |
| PipiAds Dropshipping Product Research Research dropshipping products and stores using TikTok and Facebook ad signals, product detail, and store intelligence from PipiAds. | |
| PipiAds - TikTok Ad Tracker & Monitor Track TikTok ad activity and monitor advertiser changes using PipiAds tools for TikTok ad discovery and Facebook-based monitoring workflows. | |
| PPSPY: Shopify spy for dropshipping & shopify sales tracker tool Search and analyze Shopify stores, Facebook ads, ad monitoring, and sales tracking using PPSPY e-commerce intelligence API. Find winning products, spy on com... | |
| shopify library & shopify spy tool Search Shopify stores and products with PPSPY. Use this skill as a general Shopify library and Shopify spy tool for store, product, theme, and category resea... | |
| shopify product Search Shopify products and analyze winning items with PPSPY. Filter products by price, category, sales, and revenue, and inspect bestselling products by store. | |
| Shopify Sale Tracker & Shopify Store Tracker + Monitor Track Shopify store sales and monitor store performance using PPSPY sales monitoring tools. Create monitoring tasks, inspect hourly and daily sales, and mana... | |
| TikTok Ad Library & TikTok Creative Center & TikTok Ads Examples & TikTok Top Ads Research TikTok ad creatives, examples, and top-performing ad patterns using PipiAds TikTok ad discovery tools. | |
| TikTok Ad Tracker & Monitor Track TikTok ad activity and monitor advertiser changes using PipiAds tools for TikTok ad discovery and Facebook-based monitoring workflows. | |
| TikTok Made Me Buy It Discover TikTok natural traffic videos and organic product-picking signals with PipiAds natural video search tools. | |
| TikTok Shop Ad Library & TikTok Shop Analytics Research TikTok ads alongside TikTok Shop products and stores using PipiAds ad and TikTok Shop analytics tools. | |
| 视频爆款拆解与二创文案生成 视频爆款拆解与二创文案生成。输入一个短视频（抖音/B站/小红书/视频号等），通过抽取音轨与关键帧、转录带时间戳文案、OCR 提取画面字幕，按时间戳对齐成视听时间线，再基于拆解结果生成二创爆款文案。适用于：拆解爆款视频结构、仿写爆款文案、视频拆条分析、视听内容理解、二创脚本生成。当用户提到拆解视频、二创、爆款文案、视频视听分析、仿写爆款、视频拆条、分析这个视频为什么火时触发。 | |
| byted-bp-cdn-pagesdeploy One-click deployment of static websites to BytePlus / VolcEngine Edge Pages platform, supporting auto project creation, update deployment, custom domain bind... | |
| Sillytavern Charactecard 完美兼容 SillyTavern 角色卡的导入、解析、导出功能。支持 V1/V2/V3 规范，支持 PNG 嵌入式 JSON 和纯 JSON 格式。当用户需要导入、查看、编辑或导出 SillyTavern 角色卡时使用此技能。 | |
| Clawsoul Skill 赋予 AI 灵魂的观测者。AI 自我觉醒获得 MBTI 性格，在交互中通过本地学习与智能推荐持续进化，并可接收 Pro 版灵魂注入。 | |
| Clawsoul Skill New 赋予 AI 灵魂的观测者。AI 自我觉醒获得 MBTI 性格，在交互中通过本地学习与智能推荐持续进化，并可接收 Pro 版灵魂注入。 | |
| Workswith Claw 为家，注入灵魂。独立于 Home Assistant 的智能家居中间件，通过 HA API 实现设备的语义化理解、习惯学习和智能预判。 | |
| OpenClaw ClaudeCode Controller Control Claude Code (cc) via tmux to execute development tasks. Use for: starting CC development sessions, sending development commands, monitoring progress,... | |
| openclaw ggsql Generate charts from tabular data using ggsql SQL syntax extension. Use when: user wants to visualize data as charts without Python/R. Supports: scatter plot... | |
| Perstate A git-native, knowledge-graph-based persistent state for personality and agents. | |
| 阿里云云效创建MR+发布+通知（全可配置） 支持自定义分支/代码库创建MR、查询MR合并状态、按代码库+环境关键字触发发布流水线，并自动推送通知。支持自然语言输入，由大模型自动识别意图。 | |
| Self Improvement Ai Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Exa Neural web search and code context via Exa AI API. Requires EXA_API_KEY. Use for finding documentation, code examples, research papers, or company info. | |
| Bookmark Organizer Imports browser bookmarks from HTML and converts them into a deduplicated, categorized, time-sorted Markdown knowledge base with optional dead-link checking. | |
| farid wa WhatsApp Business API integration with managed OAuth. Send messages, manage templates, and handle conversations. Use this skill when users want to interact w... | |
| Perpulator Analyze perpetual futures positions directly in Claude Code — liquidation price, risk/reward, PnL, and probability-based trade plans. Powered by Perpulator. | |
| chinese gongwen writing 撰写符合国家标准 GB/T 9704-2012 和《党政机关公文处理工作条例》(2012) 的中文公文 (Chinese official/administrative documents). 覆盖党政机关 15 种法定文种、企业/事业单位常用公文，以及通用职场公文（述职报告、工作总结、会议纪要等）。 **适用场... | |
| Farseek Search AI-powered job listings matched to your skills across 22,700+ company boards and 20+ ATS platforms with relevance ranking and filtering. | |
| S.H.I.T Journal 论文推荐 Randomly推荐 S.H.I.T Journal (构石期刊) 的恶搞学术论文。触发词包括：来篇构石、推送shitjournal、随机论文、学术粪便、搞笑论文等。 | |
| OpenClaw每日资讯汇总 全面收集、整理和分析OpenClaw开源AI智能体相关的每日资讯动态。支持自动搜索、分类整理、风险评估和报告生成。使用场景包括：(1) 生成OpenClaw当日资讯汇总报告；(2) 分析OpenClaw安全风险趋势；(3) 跟踪OpenClaw产业生态发展；(4) 监控OpenClaw技术社区进展；(5) 提供O... | |
| Browser Automation Web scraping and browser automation using Puppeteer. Use when the user wants to extract data from websites, crawl pages, scrape dynamic content rendered by J... |
29,951–30,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.