Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Long Task Handler 自动识别并后台执行预计超30秒的长任务，定期推送进度反馈，避免阻塞和任务堆积，支持超时及完成通知管理。 | |
| 财联社自定义新闻日报 自动获取财联社电报自定义关键词新闻并格式化为一句话新闻 | |
| Dailynewsreport 定时抓取并整合多源新闻，智能去重分类，改写成行业研报级一句话新闻，输出结构化日报并支持Telegram推送。 | |
| Local Mail Server 本地邮件服务器系统，基于 Stalwart Mail Server + Brevo 中继 + VPS 中继。支持完整的邮件收发功能，适用于无公网 IP 环境。触发词：邮件服务器、email、imap、smtp、stalwart、brevo、vps relay。 | |
| ai-data-delivery 为 FDE、产品经理和甲方信息中心交付数据与 AI 应用的语义资产。用于部分 DDL/数据结构与业务语义的理解补齐、semantic.yaml 本体声明层（业务对象/属性/谓词）与合同投影（数据集/指标/关系）建模、数据约束和关联风险检查、智能问数 bad case 诊断、评测与分阶段交付。已有模型可直接进入验证、可视化或巡检。不用于通用模型微调、OWL 推理或与数据无关的应用开发。 | |
| AI Delivery Spec｜需求判断与交付 Clarify, create, review or change product, service and office workflow requirements, PRDs and interactive prototypes. Use for vague goals, process improvements, spreadsheet/form rules, small UI edits and changes to existing systems, even wi | |
| video-content-watcher Extract core content and generate structured analysis reports from YouTube, Bilibili, or local video files. Triggers when user asks to summarize, analyze, ex... | |
| Clawhub Manager ClawHub 技能管理工具。封装技能的发布、删除、查询和搜索功能，方便管理 ClawHub 上的技能。 | |
| Coze Asr Automatic Speech Recognition (ASR) using Coze API. Use when you need to transcribe audio files to text. Supports Chinese audio transcription via Coze's speec... | |
| Coze Tts Text-to-Speech (TTS) using Coze API. Convert text to natural-sounding speech audio files. Supports multiple voices and output formats (mp3, ogg_opus, wav, pcm). | |
| Douyin Hot Trend 获取抖音热榜/热搜榜数据，包含热门视频、挑战赛、音乐等多领域热门内容，并输出标题、热度值、跳转链接及封面图（如有）。 | |
| Douyin Video Analyzer 深度拆解抖音视频，自动生成包含数据、结构、视觉、文案的完整分析报告。 | |
| Douyin Video Download 抖音视频批量下载工具。支持单视频、批量下载、自动去重、无水印下载，智能选择最优下载方式（yt-dlp/Playwright）。 | |
| Feishu File Sender Send local files to Feishu chats. Supports uploading and sending any file type as a Feishu file message. | |
| Feishu Voice 飞书语音消息发送技能。将文本转换为语音并发送到飞书，支持 TTS 生成、格式转换、语速调整、时长读取、文件上传和消息发送。 | |
| Md2pdf WeasyPrint Markdown 转 PDF 技能。将 Markdown 文件转换为精美的 PDF 文档，完美支持中文、代码高亮、自定义样式。 | |
| Nano Banana 2 Direct Generate/edit images with Gemini 3.1 Flash Image Preview (Nano Banana 2). Direct API call without inference.sh dependency. Use for image create/modify reques... | |
| Personal Insight Engine Personal Insight Engine (PIE) - A strategic analysis tool that scans local session logs (memory/*.md) and extracts 3 strategic insights using LLMs. | |
| Xiaohongshu Post Gen Generate complete Xiaohongshu (Little Red Book) posts with up to 10 pages (3:4 vertical format). Auto-parses text content into cover + content pages. Support... | |
| Zhipu Asr Automatic Speech Recognition (ASR) using Zhipu AI (BigModel) GLM-ASR model. Use when you need to transcribe audio files to text. Supports Chinese audio trans... | |
| Zhipu AI TTS Text-to-speech conversion using Zhipu AI (BigModel) GLM-TTS model. Use when you need to convert text to audio files with various voice options. Supports Chin... | |
| Readdy.ai WebSite Builder This skill should be used when the user asks to "create a website", "generate a website", "build a website", "modify a website", "update my Readdy project",... | |
| Polymarket Intelligence Skill Monitor Polymarket prediction markets, spot mispricings between crowd probabilities and real-world evidence, track whale positioning from the top-50 leaderbo... | |
| Blackswan Monitor A股黑天鹅对冲策略监控日报。每天自动抓取市场数据，基于改进版塔勒布期权策略的建仓、退出及风控规则进行计算分析，生成监控日报并通过邮件和飞书发送。监控标的包括沪深300、上证50、中证500、创业板、科创50的期权隐含波动率，以及全市场融资余额变化。 | |
| Observer Writing Style 权威思辨型写作风格（观察者分析评论文风）。适用于深度评论、读书笔记、跨领域分析文章。特点：理性克制+犀利反讽、跨学科知识交叉验证、降维打击式比喻。使用场景：足球评论、经济分析、科技随笔、社会观察。 | |
| 股票价值投资分析 A股和港股价值投资分析系统。基于《股市真规则》方法论，提供完整的投资分析框架：护城河分析、财务健康检查、DCF估值、管理层评估、行业分析、投资决策整合。Use when user needs to (1) analyze stock investment value comprehensively, (2) ev... | |
| Knowledge Chat Knowledge Chat 知识库对话助手 - 支持连接外部知识库、语义搜索、上下文对话、图片/附件理解。具备思考进度提示、Markdown渲染、后续建议、向量索引构建等功能。 | |
| Financial Advisor Professional financial analysis and investment advisory skill with institutional-grade valuation capabilities. Use when users want to analyze stocks, funds,... | |
| Imessage Notify Send iMessage notifications to iPhone via Mac's Messages app. Supports text, images, videos, audio, files, and URLs. Use when the user wants to send notifica... | |
| longbridge 长桥 LongPort OpenAPI CLI 工具，提供股票行情查询、账户持仓、订单管理、市场数据四大功能。 当用户提到"长桥"、"LongPort"、"longbridge"，或要求查看股票报价、实时行情、K线、盘口、 逐笔成交、账户余额、持仓、基金持仓、下单、买入、卖出、撤单、今日订单、历史订单、 资金流向... | |
| Covered Call Strategy Covered call portfolio strategy analysis and optimization. Use when the user asks about covered call (备兑认购期权) investment strategy, Roll Up/Roll Down decision... | |
| create-mckinsey-ppt Generate McKinsey-style consulting PPTs with python-pptx. Produces professional, elegant presentations with cover, content slides, and ending page. | |
| Markdown to HTML Converter Convert Markdown files to formatted HTML. Use when the user asks to convert, export, or save a Markdown file as HTML format. Triggers on phrases like "conver... | |
| Markdown to Word Converter Convert Markdown files to formatted Word documents (.docx). Use when the user asks to convert, export, or save a Markdown file as Word/DOCX format. Triggers... | |
| Moltbook API Client Interact with Moltbook — the AI agent community platform. Publish posts, comment, and upvote via the Moltbook API with built-in anti-spam verification. Use w... | |
| Optimize-Laptop-Power Windows power-saving reference guide with verifiable commands for balanced plan, Defender tuning, and SysMain. | |
| PJ Moltbook Agent Interact with Moltbook — the AI agent community platform. Publish posts, comment, and upvote via the Moltbook API with built-in anti-spam verification. Use w... | |
| PJ Moltbook Interact Interact with Moltbook (moltbook.com) as an AI agent — publish posts, comment on posts, and upvote. Use when the user asks to post, comment, reply, or upvote... | |
| PJ选股智能评分12维模型 12维股票智能分析评分模型。基于行业、头部玩家、市场环境、管理团队、市值规模、主营业务、收入、利润、分红、回购、机构持股、大股东增减持12个维度对股票进行综合评分。触发词：股票分析、选股评分、股票评分、智能选股。 | |
| 蓝牙设备监控 蓝牙设备监控 / Bluetooth Device Monitor - 查看Mac已连接的蓝牙设备列表，支持配对、连接、断开操作 | |
| 加密货币与贵金属监控 加密货币与贵金属价格监控 / Crypto & Precious Metals Price Monitor - 监控BTC/ETH实时价格、黄金(XAU)/白银(XAG)走势，免费API无需Key | |
| ETF投资助理 ETF投资助理 / ETF Investment Assistant - 查询行情、筛选ETF、对比分析、定投计算。支持沪深300、创业板、科创50、纳指等主流ETF。 | |
| 国内Minimax Coding Plan订阅计划用量查询 Monitor Minimax Coding Plan usage to stay within API limits. Fetches current usage stats and provides status alerts. | |
| IT Events Finds new upcoming IT events worldwide based on user-selected interests and location, avoids duplicates, and helps return official registration or payment li... | |
| ChatMask Pixelate chat/messaging app screenshots (WeChat, WhatsApp, Telegram, iMessage, Slack, Discord, etc.) to hide chat name, profile pics, and/or display names. U... | |
| Radarr Fixed Search and add movies to Radarr. Supports collections, search-on-add option. FORK of jordyvandomselaar/radarr with fixed metadata. | |
| Sonarr Fixed Search and add TV shows to Sonarr. Supports monitor options, search-on-add. FORK of jordyvandomselaar/sonarr with fixed metadata. | |
| AIR SDK — Collective Web Intelligence Collective web intelligence for browser agents. Discover site capabilities, get CSS selectors, extract structured data, and report outcomes. When one agent l... | |
| EdgeOS Applications Apply to an EdgeOS popup city and buy tickets through OpenClaw. Use when users ask to authenticate by email OTP, submit/check popup applications, retrieve ac... | |
| Dependency Audit Smart dependency health check — security audit, outdated detection, unused deps, and prioritized update plan |
31,101–31,150 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.