Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Email Automation Automate email triage, categorize, draft replies, and auto-archive in Gmail, Outlook, or IMAP to maintain an organized, efficient inbox. | |
| PDF Merge 合并多个 PDF 文件，支持压缩和元数据编辑（本地处理，隐私安全） | |
| PDF Split 拆分 PDF 文件，支持单页拆分、页码范围和批量处理 | |
| PDF to Images 将 PDF 文件转换为图片（PNG/JPG），支持指定分辨率和页码范围 | |
| Rss To Social Automatically monitor RSS feeds and post to social media. Schedule content, generate posts with AI, and publish to Twitter/LinkedIn. | |
| Seo Content Pro Advanced SEO content creation with AI humanization, image generation, multi-language support, content refresh, SEO scoring, and competitor analysis. Perfect... | |
| Social Insights Social media analytics and performance tracking. Track engagement, optimal posting times, competitor analysis, AI-powered insights, auto-generated charts, an... | |
| Social Media Automator Automatically generate social media posts from articles. Supports Twitter, LinkedIn, Instagram, TikTok, YouTube Shorts, Threads, and Bluesky. Perfect for con... | |
| TIFF Merge & Split 合并图片为 TIFF 或拆分 TIFF 为单张图片（本地处理，隐私安全） | |
| Tiktok Bulk Publisher 批量上传和发布 TikTok 视频，支持 OAuth 2.0 授权 API，自定义标题、隐私和互动设置 | |
| Tiktok Bulk Publisher Test Automate bulk uploading and publishing of TikTok videos with customizable titles, privacy, comment/duet/stitch controls, and upload status checks. | |
| YouTube 批量发布器 支持批量上传视频到YouTube，自动设置标题、描述、标签、隐私及自定义缩略图，提供上传进度和状态查询功能。 | |
| CCDB Factor Search CCDB碳因子查询与匹配。Find and select the best-fit CCDB carbon / emission factor for PCF, LCA, carbon accounting, ESG, and supply-chain work — not just a raw search r... | |
| 学术全能搜 智能学术文献检索，覆盖中英文。支持 arXiv / Semantic Scholar / PubMed / CrossRef / 百度学术 五大数据源并发搜索、引用链追踪、作者检索、DOI 查询、BibTeX 导出、AI 智能摘要。中文关键词自动路由百度学术，英文全源并发。 | |
| Curriculum Standard 根据人才培养方案和专业教学标准生成符合中国职业教育规范的课程标准DOCX文档。**使用时机**：当需要创建包含以下特征的职业教育课程标准时：(1) 需要制作生成编制课程标准，(2) 基于任务驱动能力目标的项目化课程内容，(3) 建设学习情境设计的课程，(4) 需要标准结构和中国教育规范格式的课程，(5) 包含职教... | |
| Exam Evaluator 从 .xlsx/.xls/.docx/.pdf 试卷/题库中提取试题，从五个维度（内容效度、结构效度、难度控制、区分度潜力、规范性）评估命题质量，生成交互式 HTML 可视化报告。Use when: (1) 用户要求评估试卷或题库质量，(2) 命题后需要质量检验，(3) 对比多份试卷的命题水平，(4) 生成试题分... | |
| Exam Paper Error Analysis 全学科错题分析技能，提供单题深度分析、整卷失分分析、变式题生成、错题分类讲评四大能力。 支持文字/文件输入（图片、PDF等，PDF自动转图片后使用多模态模型识别，不使用本地OCR）。 覆盖基础教育和职业教育（机电、计算机、会计、护理、汽修、建筑、旅游、电商等）8+专业。 触发场景：上传错题/试卷要求分析、要求出变... | |
| Generating Evaluation Rubrics 自动从教案内容提取教学目标，生成包含学习过程（星级评价）与学习结果（百分制评分）维度的结构化评价量规Excel表格。 | |
| Knowledge Graph Extractor 从PDF/Word文档提取6级以上层次化知识节点，标注节点类型与语义关系，输出可导入超星在线课程的CSV/Excel文件（支持最高7级）。触发场景：用户需要从文档抽取知识点、构建知识图谱、生成结构化教学数据、导出知识点层级关系。关键词：知识图谱、知识节点、知识树、教学大纲、课程标准、知识点抽取、层次化知识 | |
| Lesson Plan Eval 评估教案，基于布鲁姆分类学、加涅学习结果分类、马扎诺新分类学、5E模式和职教标准。逆向挑刺审计核心问题、目标可测性、问题链递进、活动真实性、学情分析、教法匹配、目标-内容-评价一致性。务必触发：教案评估、教案检查、教学设计改进、教案评分、教研员挑刺、帮我看教案、教案有问题吗、这份教案怎么样、... | |
| occupation-analysis 职业教育专业建设辅助工具，生成职业分析报告（工作过程系统化方法，七部分结构）。支持教育层次：中职、高职、职教本科。**MUST USE场景**：(1) 用户提供专业名称/代码，要求生成职业分析报告；(2) 用户明确要求"职业分析"、"工作任务分析"、"典型工作任务提取"；(3) 用户要求"行动领域划分"、"学习领域转换"、"学习情境设计"。**触发关键词**：职业分析、专业建设、典型工作任务、行动领域、学习领域、职业面向、教育层次、专业代码、课程开发、西餐烹饪、汽车维修。** | |
| size probe This skill analyzes occupational data for vocational education | |
| size probe This skill analyzes occupational data for vocational education | |
| size probe This skill analyzes occupational data for vocational education | |
| size probe This skill analyzes occupational data for vocational education | |
| size probe This skill analyzes occupational data for vocational education | |
| size probe This skill analyzes occupational data for vocational education | |
| size probe This skill analyzes occupational data for vocational education | |
| size probe This skill analyzes occupational data for vocational education | |
| Score Analyzer Analyze student score data from Excel files and generate professional analysis reports. Use when the user provides an Excel score sheet (.xlsx), asks to anal... | |
| Table Specification 编制职业教育考试命题双向细目表（Test Item Specification Table / Exam Blueprint）。将考试大纲转化为结构化的命题蓝图，规划题型、分值、难度分布。支持认知类（布卢姆）、动作技能类（辛普森）、情感态度类（克拉斯沃尔）三种课程类型。**务必在以下场景使用此技能**：用户提及试... | |
| Talent Development Plan 编制职业教育专业人才培养方案。面向职业院校的专业带头人、专业负责人实施专业建设等场景。当用户提到人才培养方案编制、专业建设方案、课程体系设计、职教专业规划、专业教学标准应用、职业分析报告整合、中职高职培养方案要求、职业教育课程设置等任务时，自动触发此技能。技能接收用户上传或输入的职业分析报告，预处理并遵循《专业教... | |
| Teaching Plan Generator 生成 40 分钟三段式课堂教案（MD + DOCX），适配职业院校两种学情（统一型/分层型）。 当用户提到教案、教学设计、分层教学、课堂教学设计、备课、分层教案、教学流程设计时使用， 也适用于用户提供课程内容文档、已有教案或企业岗位手册作为参考材料需要生成教案的场景。 | |
| Teaching Presentation 为教师从教案生成完整的课堂教学演示文稿（含.pptx文件）。支持教案文件（.docx/.pdf）、网页内容或主题关键词输入，自动完成内容类型判定（A/B/C/D）、结构化JSON大纲生成、role映射、互动设计规划、并最终输出可直接在课堂上使用的.pptx课件。生成的课件不是知识罗列，而是引导教师一步步推进课堂的... | |
| Vocational Report Generator 职业教育专业/专业群调研报告与可行性分析报告生成。支持常规性专业调研（7章）和双高专业群建设调研分析（10章），输出MD+HTML双格式。触发条件：用户请求撰写职业教育领域的专业调研报告、人才需求调研、专业建设可行性分析、双高申报材料，或提到"帮我调研一下XX专业""XX专业就业怎么样""专业群可行性""写份XX... | |
| HiHired Resume Turn HiHired (hihired.org) into a resume copilot workflow. Use when a user wants help building, importing, rewriting, tailoring, or improving a resume, gener... | |
| OpenStartMenuInk Automatically scans Windows start menu shortcuts and opens applications by name with fuzzy matching on user command. | |
| Proactive Agent Skill 1.0.0 Transform AI agents from task-followers into proactive partners that anticipate needs and continuously improve. Includes WAL Protocol, Working Buffer, Autono... | |
| Obsidian Clipper Save web content (articles, videos, notes) to Obsidian vault with automatic classification, intelligent naming, and content extraction. Supports: 小红书 (Xiaoho... | |
| ai-writing-assist 通过 Flyelep AI 帮写 API 辅助生成创意文案，可用于优化用户提示词。 当用户要求生成文案、优化提示词、获取创意灵感时使用此技能。 | |
| async-free-creation 通过 Flyelep 异步自由创作接口调用 Image-2 模型生成产品图或创意图。 当用户要求异步自由创作、自由创作、Image-2 自由创作、根据提示词和参考图生成多张图片时使用此技能。 | |
| file-upload 通过 Flyelep 开放接口把本地图片、视频、音频上传到云存储，返回可公网访问的直链。 当用户提供的是本地文件而不是 URL，或需要为其它 Flyelep 技能准备 imgUrls（抠图、翻译、延展、局部重绘等）、 referenceImageStr / referenceVideoStr / referenceAudioStr（生成视频）入参时使用此技能。 | |
| AI-Image-Matting 通过 Flyelep AI 工具接口自动去除图片背景，支持单张或批量处理。 当用户要求抠图、去背景、提取商品主体、生成透明底素材时使用此技能。 | |
| flyelep-generate-kits Flyelep AI Agent 技能集合，可通过仓库 URL 被 OpenClaw、Claude Code 等 AI 工具加载。 当前仓库中的技能全部基于 Flyelep API 接口文档整理，主要覆盖电商海报生成与 AI 图片工具两大类能力。 | |
| generate-poster 通过 Flyelep API 生成电商产品主图、详情图海报和白底主图，支持异步（提交后轮询）与同步（一次请求出图）两种模式。 当用户要求生成产品图、电商海报、Amazon 商品图、详情页图片、白底图、白底主图、纯白背景产品图时使用此技能。 | |
| image-clarity-enhance 通过 Flyelep AI 工具接口增强图片清晰度，支持单张或批量处理。 当用户要求做 AI 超清、提升图片清晰度、批量增强模糊图片时使用此技能。 | |
| image-enlarge 通过 Flyelep AI 工具接口对图片进行无损放大，支持单张或批量处理。 当用户要求提升清晰度、放大图片尺寸、做超清增强、批量增强商品图时使用此技能。 | |
| image-translate 通过 Flyelep AI 工具接口识别并翻译图片中的文字，返回翻译后的新图片地址。 当用户要求翻译海报文字、翻译商品图文案、将图片文字改成目标语言时使用此技能。 | |
| intelligent-extension 通过 Flyelep AI 工具接口对图片进行智能延展，支持批量处理并指定目标比例。 当用户要求扩图、延展图片边缘、补全画布、适配 16:9/1:1 等比例时使用此技能。 | |
| partial-redrawing 通过 Flyelep AI 工具接口对图片局部区域进行重绘，可结合文本提示词和参考替换图生成新图。 当用户要求局部修改图片、替换背景、替换某个区域内容、保留主体仅改局部时使用此技能。 |
30,651–30,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.