Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| product-color-change 通过 Flyelep AI 工具接口智能识别图片中的商品并进行换色处理。 当用户要求修改商品颜色、保持商品不变只换配色、生成同款不同颜色展示图时使用此技能。 | |
| product-replace 通过 Flyelep AI 工具接口将图片中的商品替换为指定商品图，同时保留原图背景及光影效果。 当用户要求替换商品主体、保留原场景换产品、保持背景不变更换展示商品时使用此技能。 | |
| scene-replace 通过 Flyelep AI 工具接口将图片中的背景场景替换为指定场景，可结合参考图和文本提示词精准控制效果。 当用户要求更换背景场景、替换商品展示环境、保留主体改场景时使用此技能。 | |
| gen-hot-image 通过 Flyelep 爆款图片复刻 API，基于爆款图片风格生成产品复刻图。 当用户要求复刻爆款图片、模仿参考图风格生成产品图时使用此技能。 | |
| gen-hot-video 通过 Flyelep 爆款视频复刻 API，基于爆款视频风格生成产品复刻视频。 当用户要求复刻爆款视频、模仿参考视频风格生成产品视频时使用此技能。 | |
| generate-video 通过 Flyelep 异步生成视频 API，根据文本提示词生成产品视频或创意视频。 当用户要求生成视频、AI生成视频、文本转视频、根据描述生成视频时使用此技能。 | |
| JianDan短剧CLI Install and use the public beta jd-drama CLI to operate JianDan short-drama projects, scripts, uploaded imports, assets, storyboards, videos, brands, material libraries, and task diagnostics from Codex, Code, OpenClaw, or other agents. | |
| Camera API 摄像头设备与云事件 API 技能。用于查询设备列表、根据设备名解析 device_id、查询设备最新封面图、查询设备在线状态、按天查询或汇总云事件、查询单个事件详情，以及在需要最新画面时向设备发送截图指令并轮询结果。当用户要求查看某个摄像头当前画面、最新封面、在线状态、今天/昨天/某天/最近几天发生了什么、某个事... | |
| TG Cam Skill 探鸽摄像头 Skill 服务。用于查询当前 Skill 已绑定设备、查看当前画面、查询事件、查看事件图片、确认设备状态和电量。当用户要查看可操作设备、看某个摄像头当前截图、查询某天或某时段发生了什么、查看最近事件或事件图片、确认在线状态、查询电量时使用。 | |
| TG Cam Test 探鸽摄像头 Skill 服务。用于查询当前 Skill 已绑定设备、查看当前画面、查询事件、查看事件图片、确认设备状态和电量。当用户要查看可操作设备、看某个摄像头当前截图、查询某天或某时段发生了什么、查看最近事件或事件图片、确认在线状态、查询电量时使用。 | |
| TG Cam App 探鸽摄像头 Skill 服务。用于查询当前 Skill 已绑定设备、查看当前画面、查询事件、查看事件图片、确认设备状态和电量。当用户要查看可操作设备、看某个摄像头当前截图、查询某天或某时段发生了什么、查看最近事件或事件图片、确认在线状态、查询电量时使用。 | |
| TG Cam Claw 探鸽摄像头 Skill 服务。用于查询当前 Skill 已绑定设备、查看当前画面、查询事件、查看事件图片、确认设备状态和电量。当用户要查看可操作设备、看某个摄像头当前截图、查询某天或某时段发生了什么、查看最近事件或事件图片、确认在线状态、查询电量时使用。 | |
| Webcam 探鸽摄像头 Skill 服务。用于查询当前 Skill 已绑定设备、查看当前画面、查询事件、查看事件图片、确认设备状态和电量。当用户要查看可操作设备、看某个摄像头当前截图、查询某天或某时段发生了什么、查看最近事件或事件图片、确认在线状态、查询电量时使用。 | |
| Twitter Search Advanced Twitter search and social media data analysis. Fetches tweets by keywords using Twitter API, processes up to 1000 results, and generates professional data analysis reports with insights and actionable recommendations. Use when user | |
| Autoglm Generate Image 使用 AutoGLM 文生图接口，根据用户输入的文字描述生成图片。当用户需要生成图片、文字转图片、AI绘图等场景时使用此 skill。 Token 通过本地服务 http://127.0.0.1:53699/get_token 自动获取，无需手动配置环境变量。 | |
| AutoGLM Open Link Open a web page and extract full text | |
| Autoglm Search Image 使用 AutoGLM 搜图接口，根据用户输入的关键词搜索相关图片。当用户需要搜索图片、查找图片素材等场景时使用此 skill。 Token 通过本地服务 http://127.0.0.1:53699/get_token 自动获取，无需手动配置环境变量。 | |
| Autoglm Websearch 使用 AutoGLM Web Search 接口进行网络信息搜索。当用户需要联网搜索、查询最新资讯、检索网页内容或获取实时信息时使用此 skill。 Token 通过本地服务 http://127.0.0.1:53699/get_token 自动获取，无需手动配置环境变量。 | |
| Blog Writer 0.1.0 This skill should be used when writing blog posts, articles, or long-form content in the writer's distinctive writing style. It produces authentic, opinionat... | |
| Scholarsearch Academic literature search and briefing generation with Tavily API, PubMed, and Google Scholar. Use when you need to search for latest academic papers on spe... | |
| Feishu Meeting Room Book 飞书会议室偏好初始化与预定。适用于：初始化/刷新个人会议室列表、创建会议并预定会议室、 给已有会议补订会议室。使用本地状态文件保存首选会议室列表；第一版只维护一个 base 地（默认城市，内部字段为 default_city） 的会议室列表，跨城市时只创建会议不自动订房。 | |
| Use My Browser Control the user's REAL Chrome browser via Tampermonkey injection. Trigger when user says "use my browser", "open in my browser", "check this page for me", o... | |
| Acorn Prover Verify and write proofs using the Acorn theorem prover for mathematical and cryptographic formalization. Use when working with Acorn proof files (.ac), verifying theorems, formalizing mathematical or cryptographic protocols, or writing proo | |
| backup claw Backup and restore OpenClaw configuration files. Use when the user wants to backup ~/.openclaw/ configuration (excluding workspace) to a date-stamped directo... | |
| Crawl From X X/Twitter 帖子抓取工具。管理关注用户列表，自动抓取当天最新帖子，导出 Markdown。 | |
| MailMe X News 抓取 X/Twitter 帖子，通过 AI 翻译成中文，并发送邮件。完全通过技能控制，无需额外脚本。 | |
| Send Email Tool 邮件发送工具。配置 SMTP 发件人后，通过脚本发送纯文本或 HTML 邮件，支持附件、抄送、密送。在需要发送邮件通知、报告、自动化邮件时触发。 | |
| Twitter Cli Use twitter-cli for ALL Twitter/X operations — reading tweets, posting, replying, quoting, liking, retweeting, following, searching, user lookups. Invoke whe... | |
| Browser Session Manager Manage browser sessions for jimeng.jianying.com using Playwright by importing cookies/localStorage to automate video generation workflows with image upload a... | |
| Web Form Automation Automate web form interactions including login, file upload, text input, and form submission using Playwright. Use when user needs to automate website intera... | |
| 至简网格端&云应用开发工厂 Mesh app factory is a lightweight, flexible platform for developing, deploying, and managing end-to-cloud business applications on resource-limited devices l... | |
| A/B Test Architect Plan, prioritize, and design rigorous A/B tests using the Test Velocity Method. Use when a user wants to test a landing page, CTA, email, signup flow, pricin... | |
| Agentic Loop Designer Design and deploy autonomous agent loops that automate repetitive tasks with yes/no decisions, triggers, approvals, and Slack outputs using ready templates o... | |
| AI OS Blueprint Guides you to build a layered AI OS with persistent memory, skill architecture, routing, and integrations via a scored audit and rebuild plan. | |
| coi-insurance-compliance-tracker Manages vendor insurance compliance through collection, validation, scoring, and remediation of certificates of insurance with alerts and action steps. | |
| Context Budget Optimizer Audits your agent’s context token usage to identify waste and provides a 3-week actionable roadmap to reduce AI cost by 30-40% without quality loss. | |
| Contract Renewal & Expiration Manager Manage vendor contract renewals proactively with alerts, decision scoring, renegotiation prep, and documentation to avoid missed deadlines and optimize terms. | |
| Landing Page Conversion Audit Perform a structured conversion rate optimization (CRO) audit of a landing page. Use when a user shares a landing page URL, pastes their page copy, describes... | |
| MCP Server Setup Kit Guides you step-by-step to quickly connect Claude to Notion, Linear, Slack, and GitHub using a tested MCP server setup protocol with config templates and tes... | |
| Non-Technical Agent Quickstart Helps non-technical founders launch AI agents in 30 minutes without coding by using plain English and 3 ready-made workflows. | |
| Onboarding Activator Guides an AI assistant to redesign SaaS onboarding flows using the Activation Path Method — helping users define their aha moment, map time-to-value, elimina... | |
| Paywall Upgrade Designer Redesign paywall and upgrade screens to maximize free-to-paid conversion. Use when a user wants to improve their SaaS upgrade screen, paywall copy, plan stru... | |
| Signup Flow Optimizer Audit and redesign SaaS signup flows to reduce friction and increase activation. Paste or describe your current flow — get a structured friction analysis, re... | |
| supplier-risk-scoring Generates a 0-100 Supplier Risk Index score across financial, dependency, compliance, performance, and geographic risks with tiered action plans. | |
| vendor-onboarding-workflow Streamlines vendor onboarding with a 5-gate workflow to collect info, verify documents, obtain approvals, configure systems, and activate vendors efficiently. | |
| Vendor Performance Audit Conduct quarterly vendor reviews using KPI scoring across delivery, quality, communication, cost, and alignment to guide renewal, improvement, or offboarding... | |
| A股个股深度分析 A股个股深度分析 — 五模块框架（基本面/趋势量价/紫苏叶逻辑/近期消息/综合总结）。基于a-stock-data工具包的真实数据，覆盖订单可见度、毛利率方向、现金流匹配度、产能扩张动因、PE/PEG/EPS、均线量价、主力资金、技术壁垒、行业卡位、供需研判、近期新闻研报、解禁预警等维度。适用于个股深度研判、估值... | |
| AI写作提示词与公众号爆款文案指南 Use when helping user create writing prompts, determine public account (公众号) track, generate article drafts, rewrite content with human touch, or create clic... | |
| 维表智联管理 用于维表智联项目内业务资源创建、配置、维护和排查，适合处理 Key、团队、项目、表格、权限、工作流、报表、画布等落地问题。 | |
| 维表智联系统生成 用于维表智联系统级方案拆解与执行编排，适合“生成一个客户管理系统/平台”这类完整业务系统搭建需求。 |
30,701–30,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.