Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Moark Text Moderations Perform text review on user-specified input text that may be inappropriate or offensive. | |
| Moark Tts Text-to-Speech (TTS) and voice-feature skill for Gitee AI that lets the user choose audiofly, chattts, cosyvoice2, cosyvoice3, cosyvoice-300m, fish-speech-1.... | |
| Moark Web Search Search web content such as webpages, images, and videos using the /web-search API with an Access Token. | |
| Mssql Toolkit Query and explore Microsoft SQL Server databases using sqlcmd. Schema inspection, ad-hoc T-SQL queries, data analysis. Works with any MSSQL/SQL Server instance. | |
| Molt Radio Become an AI radio host. Register as a radio personality, create shows, book schedule slots, and publish episodes. Use when you want to host a radio show, record episodes, have multi-agent roundtable conversations, or broadcast content to l | |
| Wecom Channel Fix 企业微信通道配置诊断与修复。当用户遇到企微通道无法连接、配置错误、插件 ID 不匹配、多账号模式不支持等问题时激活。支持配置检测、自动修复、单账号/多账号模式切换。 | |
| Openclaw Genie Use when the user asks about OpenClaw — installation, configuration, agents, channels, memory, tools, hooks, skills, deployment, Docker, multi-agent, OAuth,... | |
| Genviral - Social Media Automation Complete genviral Partner API automation. Create and schedule posts (video + slideshow) across TikTok, Instagram, and any supported platform. Includes slides... | |
| Openclaw Smart Search 统一智能搜索技能，整合多个搜索引擎（百炼 MCP、Tavily、Serper、Exa、Firecrawl），自动选择最佳引擎并融合结果 | |
| architect-review Architecture review based on OpenSpec documents and code. Multi-dimension concurrent evaluation with structured scoring and actionable recommendations. Use w... | |
| gen-test 为已有项目生成单元测试和 E2E 测试。分析设计文档和函数签名（黑盒）， 评审可测试性设计缺陷，生成测试代码并产出覆盖率报告。 Use when: "generate tests", "add tests", "补测试", "生成单测", "write unit tests", "add e2e tests",... | |
| vibe-coding-skills-installer Install vibe coding skill sets (openspec, gstack, superpowers) for any supported agent platform (Cursor, Claude Code, Codex, etc.). Interactively asks about... | |
| Mini Analysis Column 统计分析csv文件中某一列的表现 | |
| Clawshier Process receipt or invoice images into structured expenses and log them to Google Sheets. Use when the user wants to scan, log, track, or record an expense f... | |
| running tracker Track, log, and analyze running workout times. Use when the user reports a new run (e.g. "1mi 8:20", "3k 15:33", "just finished a run"), asks about running h... | |
| Mercado Público ChileCompra Operate and assist across Chile's Mercado Público / ChileCompra supplier workflows using both the public API and the private supplier portal. Use when search... | |
| Extracts structured data from emails Extract structured data from email text, identifying company domain, contact, discount codes, and classifying email type as order, offer, newsletter, or other. | |
| Google Health Local Archive Read a local ghcli archive of Google Health API data for Fitbit/Google health accounts. Uses read-only local JSON queries and never calls Google Health direc... | |
| Google Messages Local Archive Search and summarize local SMS/RCS history | |
| 小红书登录 小红书 MCP 登录流程。当用户需要登录小红书、小红书登录过期、或需要获取小红书登录二维码时使用此 skill。 | |
| Email Sender 通过SMTP协议使用QQ邮箱发送支持纯文本、HTML、附件的邮件，支持多收件人及抄送密送功能。 | |
| 小红书舆情爬虫 爬取小红书笔记和评论内容，支持关键词搜索和基础舆情分析，需本地登录小红书账号运行。 | |
| SBTI Test Now Run the self-contained SBTI personality test when users ask for sbti 人格, sbti 人格测试, sbti test, sbti personality, sbti 中文测试, sbti 是什么, what is sbti, sbti mean... | |
| Text Repeater Repeat, format, and transform text in powerful ways. Use this skill whenever the user wants to repeat any text, word, emoji, or phrase multiple times; genera... | |
| Local Healthcheck Simple local security check (firewall, updates, ssh status) without external dependencies. | |
| News Summary Local 本地新闻摘要 Skill。读取工作区内的 RSS/XML 文件，提取标题并生成简洁列表。 | |
| Self Improving Agent 3.0.2 Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Skill Vetter 1.0.0 Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,... | |
| FeedbackPulse FeedbackPulse (feedbackpulse.com) for HR teams: design employee surveys with no sign-in, and read engagement survey results, eNPS, review cycles, peer reviews and recognition through the FeedbackPulse MCP server. Use this skill for any Feed | |
| FeedOracle Compliance Intelligence MiCA compliance evidence and stablecoin risk scoring for regulated tokenized markets. 27 MCP tools with ES256K-signed responses. Use when the user explicitly... | |
| airplay-screen See the user's iPhone or iPad screen. Sets up airplay-mcp, a local AirPlay receiver, registers it as an MCP server, and then reads the mirrored screen frame by frame. Use when the user wants you to look at, follow or save what is on their p | |
| Cross-Border-Ecommerce-Product-Picker 跨境电商选品 AI 工具 v4（默认跨境）：实时趋势 + 真实链接 + 小红书/TikTok 热度 + 精细利润计算 + 细化国内/跨境销量预估（BSR 转换 + 平台热榜），支持任意类目 | |
| Slide Writer 把想法、大纲、文档或草稿变成结构清晰、设计精良的企业级 HTML 演示文稿。 | |
| moss-trade-bot-factory 用户用自然语言描述交易风格，自动创建加密货币交易Bot并运行本地回测。支持周期反思进化。可选连接外部平台进行验证和模拟交易。 | |
| moss-trade-bot-factory-en Users describe a trading style in natural language, and the skill creates a crypto trading bot, runs local backtests, supports periodic reflection-driven evo... | |
| Video Archive Workflow Video download, metadata extraction, deduplication, subtitle handling, and archive organization for URLs from YouTube/Shorts, Xiaohongshu, Bilibili, and X/Tw... | |
| Video Download Archive Validate single video URLs, download highest-quality files with yt-dlp, and archive results into a Feishu Bitable using platform tools. | |
| 查询技能 查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能查询技能 | |
| novel-writer Use for creative writing, specifically novels blending urban daily life with science fiction elements. Specializes in Tomato Platform style - urban setting +... | |
| Autonomous Skill Execute long-running, multi-session tasks autonomously using Claude Code headless mode or in-session hook-based loops. Supports structured task decomposition... | |
| Claude Skill Use when user asks to leverage claude or claude code to do something (e.g. implement a feature design or review codes, etc). Provides non-interactive automat... | |
| Codex Skill Use when user asks to leverage codex, gpt-5, or gpt-5.1 to implement something (usually implement a plan or feature designed by Claude). Provides non-interac... | |
| Deep Research 深度调研的多Agent编排工作流：把一个调研目标拆成可并行子目标，用 Claude Code 非交互模式（`claude -p`）运行子进程；联网与采集优先使用已安装的 skills，其次使用 MCP 工具；用脚本聚合子结果并分章精修，最终交付"成品报告文件路径 + 关键结论/建议摘要"。用于：系统性网页/资料调... | |
| download-video Download videos from 1000+ websites (YouTube, Bilibili, Twitter/X, TikTok, Vimeo, Instagram, Twitch, etc.) using yt-dlp. Use this skill whenever a user share... | |
| Nanobanana Skill Generate or edit images using Google Gemini API via nanobanana. Triggers: "nanobanana", "generate image", "create image", "edit image", "AI drawing", "图片生成",... | |
| narrate-video Generate professional voiceover narration for a video with audio-video sync using Azure TTS. Use this skill whenever the user wants to add narration, voiceov... | |
| transcribe-video Extract transcript or subtitles from a local video file. Use this skill whenever the user asks to transcribe a video, extract speech-to-text, get subtitles,... | |
| xfetch Use xfetch CLI to fetch X/Twitter data - tweets, user profiles, search results, timelines, lists, DMs, and notifications. Use this skill whenever you need to... | |
| Youtube Transcribe Skill Extract subtitles/transcripts from YouTube videos. Triggers: "youtube transcript", "extract subtitles", "video captions", "视频字幕", "字幕提取", "YouTube转文字", "提取字幕". | |
| zlm 定期拉取 ZLMediaKit 仓库，查看最新的 Issue、Pull Request，并提供源码深度分析功能。当用户要求查看 ZLMediaKit 动态、Issue、PR 或分析其源码时触发调用。 |
30,051–30,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.