Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Cn Meeting Minutes 会议纪要生成工具。输入会议录音文件，自动生成结构化纪要文档，包含关键讨论点、决策结论、待办事项，输出Markdown格式。 | |
| Cn Meme Generator $desc | |
| Cn News Brief 中文新闻简报。每日热点新闻摘要，分类呈现，3分钟了解天下事。 当用户说"新闻"、"今天有什么新闻"、"热点"、"今日要闻"时触发。 Keywords: 新闻, 热点, 要闻, news, 简报, 日报. | |
| Cn Number Formatter 数字格式化工具，支持千分位分隔、科学计数法和百分比格式转换。 | |
| Cn Password Generator 安全的随机密码生成器。支持自定义长度、字符类型（大小写字母、数字、特殊符号）、排除相似字符、批量生成。纯Python标准库，无需API Key。 | |
| Cn Password Generator V2 Generate cryptographically secure random passwords with customizable character sets. Control length, include/exclude character types. Pure Python, no API key... | |
| 密码强度检测器 Locally evaluates password strength by length, character variety, entropy, and common weaknesses, providing a 0-100 score and improvement suggestions. | |
| cn-pdf-assistant PDF文档处理工具（含OCR）。本地处理PDF文件，支持文本提取、智能摘要、表格导出、关键词问答、PDF拆分、OCR扫描版识别。纯本地处理，保护文档隐私。 | |
| PDF编辑器 本地PDF编辑工具，支持文本修改、图片插入、水印添加、批注、合并拆分、页面重排和签名，数据全程本地处理。 | |
| Cn Percent Calculator cn-percent-calculator。纯Python标准库，无需API Key。 | |
| Cn Percentage Tool cn-percentage-tool。纯Python标准库，无需API Key。 | |
| Cn Pomodoro Timer 中文番茄钟专注计时工具。开始25分钟专注时段，统计今日完成数量，本地存储无需账号。支持开始、暂停、继续、查看状态、统计等功能。 | |
| Cn Ppt Outline PPT大纲生成助手。输入主题或内容，自动生成PPT大纲、分页结构、每页要点。支持工作汇报、产品发布、培训课件、商业计划等多种场景。输出可直接导入PPT软件。 | |
| Cn Prefix Tool Add a specified prefix to each line of a given text using a Python standard library script. | |
| Cn Qrcode Generator 输入URL或文本，生成PNG二维码。 | |
| Cn Qrcode Reader Qrcode Reader skill. 自动生成，无人工审查。 | |
| Cn Random Picker 随机选择器。从列表中随机抽取，支持权重分配、去重模式、抽奖/抽签场景。纯Python标准库，无需API Key。 | |
| Cn Readability Extractor 网页内容提取器。输入URL，提取正文内容，去除广告和导航。 | |
| Cn Regex Tester 正则表达式测试工具。输入正则和文本，返回匹配结果和数量。纯Python标准库re模块，无需API Key。 | |
| Cn Report Generator 企业日报/周报自动生成。从MEMORY.md和daily log自动生成结构化报告， 支持日报/周报/月报模板。 | |
| Cn Resume Analyzer Resume Analyzer skill. 自动生成，无人工审查。 | |
| Cn Short Video Script 短视频脚本生成助手。根据主题自动生成抖音/小红书/视频号脚本，包含黄金3秒开场、内容框架、引导互动等爆款元素。支持产品种草、知识分享、情感共鸣等多种类型。 | |
| Cn Shuffle Lines Randomly shuffles the order of lines in a given text or file using a Python standard library script. | |
| Cn Slug Generator 将中文标题转换为SEO友好的URL Slug，支持拼音和英文翻译转换。 | |
| Cn Smart Email cn-smart-email。纯Python标准库，无需API Key。 | |
| Cn Smart Reply Smart Reply skill. 自动生成，无人工审查。 | |
| Cn Social Reply 社交媒体智能回复助手。为内容创作者批量生成高质量评论回复，提升账号互动率。 支持多平台风格适配（小红书、抖音、微博、B站、知乎），多种回复策略（幽默、专业、温暖、高情商、引导互动）。 可维护个人风格模板，一键生成符合人设的回复。 当用户说"帮我回评论"、"回复评论"、"生成回复"、"评论回复"、"怎么回这条评论"... | |
| Cn Sort Lines Sort text lines in ascending, descending order, or by length using a Python standard library script. | |
| Cn Split Lines Split text into multiple lines using a specified delimiter via command-line or file input with no external dependencies. | |
| Cn Stock Brief A股每日简报生成器。基于东方财富免费公开数据，一键生成大盘指数、板块涨跌、涨跌幅榜等简报。 中文优先，无需API Key，开箱即用。 当用户说"A股"、"今日行情"、"大盘指数"、"股票"、"今日A股"时触发。 Keywords: A股, 股票, 行情, 大盘, 涨跌, 东方财富, 简报. | |
| Cn Suffix Tool Adds a specified suffix to each line of input text using a simple Python script with no external dependencies. | |
| Cn Temperature Converter Convert between Celsius, Fahrenheit, Kelvin. Pure Python standard library, no API key required. | |
| Cn Text Encoding Detector Detect text file encoding (UTF-8, GBK, Latin-1, etc). Auto-detect BOM markers. Pure Python standard library, no API key required. | |
| Cn Text Reverser Reverse Chinese text in whole sentence or character-by-character order using a simple command-line tool. | |
| Cn Text Statistics Provides detailed statistics of Chinese text including character count, word frequency, and line numbers using Python standard library. | |
| Cn Text Summary cn-text-summary。纯Python标准库，无需API Key。 | |
| Cn Timestamp Converter Unix时间戳与日期互转工具。支持秒/毫秒级时间戳、多时区转换、批量处理、相对时间计算。纯Python标准库，无需API Key。 | |
| Cn Timestamp Tool cn-timestamp-tool。纯Python标准库，无需API Key。 | |
| Cn Tip Calculator Calculate tips and split bills. Support custom tip percentages, bill splitting, and currency formatting. Pure Python standard library, no API key required. | |
| Cn Todo Today cn-todo-today。纯Python标准库，无需API Key。 | |
| Cn Todo Tracker 中文待办事项管理。添加/完成/查看待办，优先级排序。 本地存储，无需账号。 当用户说"待办"、"todo"、"任务清单"、"今天要做什么"时触发。 Keywords: 待办, todo, 任务, 清单, task, checklist. | |
| Cn Trends Ai 获取知乎、微博、百度、B站实时热搜榜单。 | |
| Cn Unicode Info Get Unicode codepoint, name, and category for characters. Support Chinese characters, English text, emoji. Pure Python standard library, no API key required. | |
| Cn Unit Converter 单位转换工具。支持长度(km/mi/m/ft/cm/inch)、重量(kg/lb/g/oz/斤)、温度(C/F/K)、容量(L/mL/gal/cup)、面积(㎡/sqft/公顷/亩)、数据(GB/MB/TB)、时间(hour/min/sec/day)互转。纯Python标准库，无需API Key。 | |
| Cn Url Health Checker Check URL health status (HTTP response code, redirect chain). Detect broken links and server errors. Pure Python standard library, no API key required. | |
| Cn Url Parser URL解析工具。分解URL各部分（协议、域名、路径、查询参数），支持参数提取、URL构建、批量解析。纯Python标准库，无需API Key。 | |
| Cn Url Shortener $desc | |
| Cn Uuid Generator $desc | |
| Cn Web Clipper 网页剪藏工具。发送网页链接，提取正文内容保存为本地Markdown文件。 | |
| Cn Web Image Optimizer Compress images for web usage. Smart quality reduction + resize to fit under 500KB. Supports JPEG, PNG, WebP, BMP, TIFF input. Auto WebP output for best comp... |
31,251–31,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.