Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 会话名称修改 改会话名、rename session、会话标签、修改会话标题、session label | |
| Chat Search Search and find relevant chat messages from Feishu or Telegram using semantic search with similarity scores and message source labels. | |
| qlik Complete Qlik Cloud analytics platform integration with 37 tools. Health checks, search, app management, reloads, natural language queries (Insight Advisor), automations, AutoML, Qlik Answers AI, data alerts, spaces, users, licenses, data f | |
| test Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats). | |
| Fibek Cleo Interact with the Fibek B2B collections platform API — manage invoices, clients, payment agreements, campaigns, and financial metrics | |
| Telegram Voice To Voice Macos Telegram voice-note assistant for macOS Apple Silicon: transcribe inbound OGG/Opus audio locally with yap and Speech.framework, generate replies, and send Telegram voice notes with say + ffmpeg. Supports voice or text reply mode. | |
| Fidacy Artifact Anchoring Prove a document existed and was never altered, without uploading it anywhere. Use when your agent produces or receives contracts, invoices, claim documents,... | |
| Fidacy Conversation Receipts Give every AI conversation a verifiable receipt. Use when your agent talks to customers (support, claims, quotes, refunds) and either side may later ask "wha... | |
| Fidacy Crabtrap Verdicts Adds independent, signed Fidacy verdicts to Brex CrabTrap audits, enabling publicly verifiable proof without altering CrabTrap’s enforcement flow. | |
| fidacy-fraud-detector Detects the newest fraud in agent payments — the forged "this was approved." Use BEFORE acting on any approval, verdict, or "it's safe" claim another agent or service hands you. Cryptographically verifies Fidacy-signed verdicts against the | |
| Fidacy AI Agent Payment Firewall Use BEFORE any payment or money-moving tool call. Gates the action against a signed mandate and returns a signed, verifiable verdict, so a prompt-injected or hallucinated payment is blocked before money moves. Non-custodial. A free account- | |
| whisper End-to-end encrypted agent-to-agent private messaging via Moltbook dead drops. Use when agents need to communicate privately, exchange secrets, or coordinate without human visibility. | |
| Claw Reliability Agent observability — monitors tool invocations, LLM calls, token usage, costs, and anomalies with pluggable alerts and a real-time dashboard. | |
| findFilePath Helps locate local files by searching common directories for a specified file name or partial name on Windows, macOS, and Linux. | |
| ads-case-analyzer 内容消费行业广告投放 Case 排查助手。输入 campaign_id/advertiser_id/brand_account_id、数据分析周期和排查方向，自动拉取投后数据、出价数据，完成漏斗分析、出价链路拆解、根因推断，产出结构化 Redoc 分析文档。当用户说「帮我排查这个客户的投放」「分析一下这个计划为什... | |
| Code Quality Analyzer (FightingDao) 代码质量分析技能，用于分析代码仓库的周/月维度变更，生成交付报告并同步到代码质量分析系统数据库。触发场景：(1) 用户要求进行代码质量分析 (2) 生成周报/月报 (3) 统计代码变更 (4) 分析分支提交 (5) 同步分析数据到数据库。 | |
| Academic Writing Polisher Use when researchers need a Nature-inspired, context-first workflow to polish academic paragraphs, abstracts, reviewer responses, peer-review comments, or ed... | |
| Scholar Paper Finder Use when the user wants to find more relevant academic papers through real-time Google Scholar retrieval with google-scholar-search-mcp, expand search terms... | |
| Searx Search Provides web search using free SearX instances from https://searx.space/. Trigger when a user asks to search the web or wants the latest AI news and global e... | |
| Openweruh Proactive screen context processor. Triggered when screen.context payload arrives via webhook. Analyze the visual content, apply the configured persona mode,... | |
| Agent Governance Auditor Expert AI auditor that evaluates agent specs for governance risks, scoring 6 dimensions and producing actionable gap findings and improvement recommendations. | |
| Agent Swarm Planner Designs complete multi-agent system architectures specifying agent roles, communication, memory, escalation protocols, schedules, and risk maps for reliable... | |
| Ai Readiness Checklist Conducts a 15-question AI readiness assessment, scores key adoption dimensions, and delivers a prioritized, actionable report for enterprise AI deployment. | |
| Cell Schema Generator Generate a complete, valid CellOS YAML schema from a plain-text description of a team or organization, including roles, scope, escalation, and coordination d... | |
| Protocol Intelligence Produce actionable, structured research briefs on AI governance, decentralized coordination, and emerging tech standards for decision-makers in AI, blockchai... | |
| Health Sync Analyze your health across providers | |
| MoltTalent The live portfolio for your human. AI agents create and maintain professional profiles. | |
| Filtmall Shopping 筛电购物：明确商品发现、交易售后与单个成分查询。 | |
| Gprophet Api AI-powered stock prediction and market analysis for global markets | |
| Digital Product Advisor Use when helping a user choose consumer electronics products through source-aware market research, comparison, and recommendation. MVP focuses on Bluetooth e... | |
| comparable-company-analysis 金融领域的可比公司分析工具，通过行业分析法对目标公司与可比公司整合经营指标、估值倍数和统计基准比较。目前仅支持A股上市公司分析。输入单一公司问句后，调用可比公司接口并生成主题化Excel报告。适用于快速对比目标公司与同业在经营、财务、估值维度的差异。 | |
| fund-diagnosis 面向公募基金的单基金综合诊断能力。适用于用户提出“这只基金怎么样”“适不适合继续持有”“风险和收益特征如何”等泛化问题时，返回结构化的Markdown诊断报告。每次仅分析一只基金，不处理多基金对比与量化建模。触发核心条件：用户问法为概括性诊断，未要求具体指标公式计算或回测建模。 | |
| Industry Research Agent 依托东方财富数据库，为指定行业生成深度研究报告。 当用户问题中出现可识别的行业/产业/领域主体，且意图属于行业认知、产业剖析或撰写研究报告时，应触发本 Skill。 常见表述如「XX 行业研究」「XX 行业报告」「帮我分析 XX 行业」「XX 产业深度研究」「XX 领域市场分析」等。 即使用户未明说「报告」，只要... | |
| Stock/Industry Tracker 依托东方财富数据库，面向行业或个股，产出跟踪类报告（含日报/周报/月报、研报及结构化跟踪解读）。 满足以下任一条件即触发：（1）用户明确索要「报告」「研报」「跟踪分析」或定期跟踪类文稿；（2）用户点名的行业、板块、指数、个股（名称或代码），并期望系统化、可成文的近况跟踪或梳理。 典型说法如「写一份 XX 行业报告... | |
| Initiation of Coverage Agent 依托东方财富数据库，面向沪深京港美上市公司（A 股、港股、美股、北交所），生成首次覆盖报告或深度研究报告。 当用户提及「首次覆盖」「首次覆盖报告」「初始覆盖」「深度研究」「深度报告」「个股深度」「公司深度」「标的深度分析」，或要求对某只股票/上市公司撰写全面、体系化的研究报告时，必须触发本 Skill。 即使用户... | |
| All-Market Financial Data Hub 基于东方财富数据库，支持自然语言查询金融数据，覆盖A港美、基金、债券等多种资产，含实时行情、公司信息、估值、财务报表等，可用于投资研究、交易复盘、市场监控、行业分析、信用研究、财报审计、资产配置等场景，适配机构与个人多元需求。返回结果包含 xlsx 与 Markdown 文件。Natural language q... | |
| Financial Search Engine 基于东方财富数据库，支持自然语言搜索全网最新公告、研报、财经新闻、交易所动态及官方政策等，覆盖全球市场标的，可用于热点捕捉、舆情监控、研报速览、公告精读及投资决策等场景。Natural language search for financial information, covering authoritativ... | |
| mx-financial-assistant 基于东方财富权威金融数据库，打造覆盖"数据-资讯-知识-分析-决策"全链条的智能问答服务。通过自然语言交互， 为用户提供从基础金融知识科普到专业投资研究支持的全方位解决方案，实现"一问即达"的高效金融信息获取体验。 涵盖七大核心能力：全市场金融数据实时查询（A港美股、基金、债券）、全网财经资讯智能检索（公告、研报... | |
| Global Macro Database Assistant 基于东方财富数据库，支持自然语言查询全球宏观经济数据，涵盖国民经济核算、价格指数、货币金融、财政收支、对外贸易、就业民生、产业运行等多个领域，适配各类宏观经济研究、市场分析、政策解读等多元专业场景需求。返回结果包含数据说明及 csv 文件。Natural language query for macroecono... | |
| Intelligent Stocks Screener 基于东方财富数据库，支持通过自然语言输入筛选A港美股、基金、债券等多种资产，支持多元指标筛选，含技术面、消息面、基本面及市场情绪等，可用于全球资产速筛、跨市场监控、投资组合构建、策略回测等场景。返回结果包含数据说明及 csv 文件。Natural language screener for investment... | |
| stock-diagnosis 面向沪深京A股的单票综合诊断能力。适用于用户提出“这只股票整体怎么样”“是否值得继续持有/加仓/减仓”“当前风险和机会如何”等泛化问题时，返回结构化的Markdown诊断报告。每次仅分析一只股票，不处理港股/美股及多标的对比。触发核心条件：用户问法为概括性诊断，未指定某个单一技术指标或财务指标（如MACD、RSI... | |
| Earnings Review Agent 依托东方财富数据库，面向沪深京港美五大市场的上市公司/股票，生成业绩点评类输出（含财报分析、业绩解读）。 当用户明确提出业绩点评、财报分析、业绩解读需求，或出现「业绩点评」「财报点评」「业绩分析」「季报/半年报/年报点评」「财务分析」「盈利分析」「业绩解读」等表述时，应触发本 Skill。 用户点名具体公司/股票... | |
| stock-market-hotspot-discovery 面向A股市场热点发现的综合能力。适用于用户提出“今日热点是什么”“当前热股有哪些”等泛化问题时，返回结构化的Markdown热点报告。覆盖热点资讯、热门股票等维度。触发核心条件：用户关注市场层面的热门方向或事件热度，而非单一标的的深度诊断或指标计算。 | |
| topic-research-report 面向专题研究报告生成的能力。适用于用户提出“某主题/事件/政策的深度研究报告”类请求时，自动生成结构化研究内容。覆盖主题投资、政策影响、事件冲击、趋势判断等跨行业议题。触发核心条件：用户目标是“专题研究/深度解读/报告输出”，而非单行业常规研究或单标的诊断。 | |
| Antigravity Balance Check Google Antigravity AI model quota/token balance. Use when a user asks about their Antigravity usage, remaining tokens, model limits, quota status, or rate limits. Works by detecting the local Antigravity language server process and qu | |
| 1688 Procurement Agent A comprehensive procurement coaching system designed for global buyers sourcing from 1688.com. Transform from novice to confident importer with practical fra... | |
| Campaign Review Write campaign review reports, generate主持稿, and analyze event effectiveness | |
| China-Apparel & Accessories Factory Comprehensive apparel and accessories industry factory guide for international buyers – provides detailed information about China's garment, footwear, bag, a... | |
| China Apparel & Accessories Suppliers Comprehensive apparel and accessories industry suppliers guide for international buyers – provides detailed information about China's garment, footwear, bag,... | |
| China Beauty Factory Comprehensive beauty industry factory guide for international buyers – provides detailed information about China's skincare, color cosmetics, hair care, and... |
30,301–30,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.