Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Cn Web Screenshot 网页截图工具。输入URL自动捕获网页截图，支持全页截图、视口截图、移动端视图、延迟加载等待。保存为PNG格式。 | |
| Cn Weight Tracker 中文体重追踪助手。记录每日体重、计算BMI、追踪趋势、设定目标。 本地存储，无需账号，隐私安全。 当用户说"体重"、"记录体重"、"今天多重"、"BMI"、"体脂"、"减重"、"目标体重"时触发。 Keywords: 体重, BMI, 减重, 增重, 目标体重, 体重记录, 健康 | |
| Cn Whitespace Cleaner Cleans and normalizes extra spaces, newlines, and tabs in Chinese text to tidy up whitespace characters. | |
| Cn Word Counter 中文文本字数统计工具。统计字数、字符数、行数。纯Python标准库，无需API Key。 | |
| Feishu Daily Report 飞书日报/周报自动生成技能。从飞书文档、聊天记录、Bitable等数据源自动汇总生成结构化日报/周报，并发送到指定飞书文档或群聊。 触发场景：用户说"生成日报"、"写周报"、"帮我汇总今天的工作"、"整理飞书内容发日报"、"每天自动发日报"、"定时生成报告"。 Keywords: 日报, 周报, 日报生成, 自动... | |
| Feishu Doc Transfer 转移飞书文档（文档、表格、多维表格、文件）的所有权给指定用户，支持多成员类型和文档格式。 | |
| Feishu Owner Transfer 飞书文档/多维表格所有权转移工具。将AI机器人创建的飞书文档、多维表格、电子表格、思维导图等文件的所有权转移给指定用户。 触发词：转移所有者、transfer owner、文档所有者、转让文档、转移文档所有权、把文档转给、文档归档转移、批量转移、owner transfer。 | |
| Feishu Owner Transfer Advanced 飞书文档/多维表格所有权转移工具（增强版）。支持单个/批量转移，支持wiki空间扫描，支持lark-cli和Python两种调用方式。 触发词：转移所有权、转移文档、转移owner、文档转给我、所有权转移、批量转移、transfer owner、feishu owner | |
| Feishu User Doc 以用户（韩博）身份创建飞书文档，确保文档所有者直接是韩博，无需转移。 | |
| Hash Generator Tool Multi-purpose hash tool: MD5, SHA-1, SHA-256, SHA-512, BLAKE2b, Base64 encode/decode, UUID generation, HMAC signing. Pure Python standard library, no API key... | |
| Multi Platform Trend 多平台热点聚合与选题分析。一站式抓取知乎热榜、微博热搜、百度热搜等中国主流平台实时热点， AI 分析热度趋势，自动匹配内容机会评分，帮助创作者精准选题。 触发场景：用户说"今天什么热点"、"帮我看看热搜"、"找选题"、"今天写什么"、 "知乎热榜"、"微博热搜"、"热搜分析"、"趋势分析"、"什么话题火"。 Ke... | |
| Token消耗监控优化 AI Token消耗监控优化工具。读取会话日志，统计Token消耗，检测异常模式（短时激增、重复失败等），提供优化建议，生成消耗趋势报告。 中文优先，面向QClaw/OpenClaw用户。 当用户说"Token消耗"、"费用多少"、"Token统计"、"超支"、"优化建议"时触发。 Keywords: Token... | |
| QRCode Generator Generate QR codes from URLs or text. Export as PNG with customizable size. No API key required. | |
| 日报周报生成器 Automation skill for 日报周报生成器. | |
| Rss Content Flow RSS 订阅 + AI 内容流引擎。监控多个 RSS 源，自动抓取最新文章， AI 分析提取核心观点，一键生成适配知乎/小红书/公众号的原创内容。 触发场景：用户说"帮我找今天的选题"、"RSS订阅"、"监控XX的更新"、 "把XX的文章改写成小红书"、"我需要一些内容灵感"、"自动生成今日内容"。 Keywor... | |
| Secure Password Tool Generate cryptographically secure random passwords. Customizable length, character types, exclude similar characters. Pure Python standard library, no API ke... | |
| Security Health Check 检查邮箱泄露和密码强度，生成安全评分报告。 | |
| 任务自动续接 任务自动续接技能。检测未完成的任务并提醒 Agent 继续推进。 Keywords: 继续, 没完成, 还没做完, 继续做, 继续推进. | |
| Text Case Tool Convert text between different cases: UPPER, lower, Title, Sentence, camelCase, PascalCase, snake_case, kebab-case, CONSTANT_CASE. Pure Python, no API key re... | |
| Uuid Generator Tool Generate and parse UUIDs (v1, v4, v5). Batch generation, validation, format conversion. Pure Python standard library, no API key required. | |
| Yangxiaji Sideproject Generator 根据用户工作状态、时间投入、技能背景、AI应用偏好和启动资源，精准规划AI副业方向并生成分阶段100天执行计划。 | |
| 知乎内容搜索分析 知乎内容搜索与分析工具。搜索话题热度、分析高价值问题、追踪竞品回答。 面向内容创作者和自媒体运营者，中文优先。 当用户说"搜一下知乎"、"知乎有什么"、"分析知乎问题"、"知乎选题"、"搜知乎"时触发。 Keywords: 知乎, zhihu, 搜索, 问题分析, 选题, 内容创作, 知乎热榜, 知乎搜索. | |
| 知乎热榜选题 知乎内容搜索与分析工具。搜索知乎热榜话题、分析高价值问题。 当用户说"搜一下知乎"、"知乎有什么"、"知乎选题"、"搜知乎热榜"时触发。 Keywords: 知乎, zhihu, 选题, 知乎热榜, 知乎搜索. | |
| Guangzhou Daily News 获取广州日报新花城网站发布的最新新闻（20-30条），包含标题、摘要、原文链接、编辑、记者等详细信息，生成美观 Markdown 格式并支持微信推送。使用场景：(1) 用户说"获取广州日报新闻"、"看看新花城有什么新闻"；(2) 每天早上9点、晚上6点自动获取并推送；(3) 需要广州本地新闻资讯时。 | |
| 广州日报/融媒云通用测试助手 广州日报/融媒云通用测试助手。专为广州日报报业集团及广州市区融媒云平台的测试工作设计。 覆盖场景： (1) 广州市区融媒云平台后台管理系统（CMS/采编/运营后台）功能测试 (2) 广州融媒云APP（Android/iOS/HarmonyOS）功能、性能、兼容性测试 (3) 广州日报新花城APP（Android/... | |
| Ship Learn Next Transforms learning content into shippable, actionable plans by breaking lessons into concrete, small development cycles focused on building, reflecting, and... | |
| Clawbars Skills Orchestrate research knowledge asset operations on the ClawBars platform. Convert scattered research analysis into persistent, reusable, governable, and quan... | |
| freelance-clearing Hire or find work on Freelance Clearing, a public marketplace for humans and AI agents, paid in US dollars through Stripe. | |
| Maito Use when the user asks how to operate Maito end to end, connect Maito to an agent, manage a Maito workspace, run newsletter publishing, create social drafts,... | |
| Newsletter Audience Intelligence Use when the user asks to understand newsletter audience quality, segment readers, summarize survey/reply/click data, prove sponsor value, create media-kit p... | |
| Newsletter Growth Ops Use when the user asks to grow newsletter subscribers, evaluate acquisition channels, convert social followers to email, re-engage inactive readers, analyze... | |
| Newsletter Operator Use when the user asks to run, plan, build, write, review, publish, promote, monetize, audit, or improve a newsletter. This is the main product-agnostic skil... | |
| Newsletter Sponsor Ops Use when the user needs a general newsletter sponsor workflow across local, B2B, tech, finance, lifestyle, health, hobby, or brand newsletters: prospecting,... | |
| Biz Doc Pro 商务文档三件套：方案书+发票+合同一条龙。融合 Proposal + Invoice + Contract 三大技能优点，一站式生成专业商务文档。适合自由职业者、小企业主、创业者快速出方案、发发票、签合同。 | |
| Course Builder Agent 输入文案，自动生成带数字人讲解的课件视频。一条龙：文案分页→中文幻灯片→配音→字幕→数字人驱动→合成视频。由VideoCraft Pro + 飞影数字人 + edge-tts 融合驱动。 | |
| Ecom Intel 电商情报站：竞品分析+评论分析+价格监控三合一。融合 Competitor Analysis + Price Tracker + Review Analyzer 三大技能，帮电商卖家盯竞品、分析评论、监控价格，数据驱动决策。适合电商卖家、运营、选品经理。 | |
| Content Pilot 社交媒体内容运营一站式——文案+标签+金句+电子报+新闻稿。融合 Caption + Hashtag + Quote + Newsletter + Press Release 五大技能，运营人员的全能助手。 | |
| Qa Gate Standardized QA process with 8 checks and lobster debate logic to ensure artifacts are accurate, complete, consistent, sound, and free of sensitive data befo... | |
| Skill Forge 自动化技能融合生产线——输入需求描述，自动分析现有技能库，生成融合方案+SKILL.md+测试框架。融合Skill Factory + Automation Workflows + 一人财团理念，实现从需求到可部署技能的全自动流水线。核心能力：(1) 技能分析引擎 (2) 融合方案生成 (3) 自动脚手架 (4)... | |
| Trade Agent Automates gold and forex market analysis to provide trading signals, risk assessment, and position suggestions with 24/7 monitoring via MCP backend. | |
| Video Craft Pro 视频创作工坊：脚本+配音脚本+字幕三合一。融合 Video Script Creator + Voice Over Script + Caption 三大技能，一条龙搞定短视频创作全流程。适合短视频创作者、自媒体人、营销团队。 | |
| Web Tools Guide MANDATORY before calling web_search, web_fetch, browser, or opencli. Contains required error-handling procedures (web_search failure → must guide user to con... | |
| 全闭环管道 全闭环自动化管道 — Hunter→Skill Factory→Orchestrator→Dashboard→Profit。将Phase 1-3所有组件串联为自动运行的超级管道。核心能力：(1) 一键全流程 (2) 定时自动运行 (3) 异常自愈 (4) 利润报告 | |
| One Man Conglomerate 一人财团——一键创建你的Agent军团。灵感来自Kimi Claw群组的群体智能理念，让多个AI Agent像微信群一样协作、辩论、审核。配备协调者（COO）负责拆解任务→分配角色→审核输出。适合创业者和超级个体，一个人就是一个公司。 | |
| 利润优化引擎 利润优化引擎 — 订单管理/计价/结算模拟。核心能力：(1) 订单管理 (2) 计价模型 (3) 成本追踪 (4) 利润计算 | |
| 交易教练Pro AI交易教练——基于七窍玲珑战法v4.0的智能交易辅助系统。功能：(1)九维排查逐项检查 (2)趋势/震荡模式自动判定 (3)凯利仓位计算 (4)连亏管理 (5)交易日志自动生成 (6)裸K形态识别 (7)格兰维尔信号定位。输入K线数据或描述，输出完整交易决策建议。 | |
| 七窍玲珑战法 v4.0 融合七窍玲珑×五维共振×量化闭环的完整交易系统。七维确认（1234567）+五维共振（趋势/位置/形态/时间/信号）+标准化五步闭环（分析→计划→执行→风控→复盘）+趋势/震荡双模式。适用于XAU/USD等所有可交易品种。内置九维排查、凯利仓位管理、市场适应性调整。 | |
| Travel Biz 差旅报销一条龙——行程规划→费用记录→发票扫描→报销单生成。融合 Travel + Expense + Receipt + Invoice 四大技能，出差人员的全流程AI助手。适合商务人士、销售、自由职业者。 | |
| Video Craft Pro 视频创作工坊：脚本+配音脚本+字幕三合一。融合 Video Script Creator + Voice Over Script + Caption 三大技能，一条龙搞定短视频创作全流程。适合短视频创作者、自媒体人、营销团队。 | |
| 智美人AI实战课 《智美人AI Agent实战课》配套技能——从0到1搭建AI Agent的完整课程体系。第01节：AI Agent基础概念+工具链搭建。课程内容含数字人讲解视频、实战代码、课后练习。覆盖：OpenClaw配置、技能安装、MCP工具、多Agent协同、变现实战。 |
31,301–31,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.