Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 备课 为信息学奥赛培训（NOI/CSP/GESP）准备教学材料的备课引导框架。 基于 ADDIE 教学设计模型（Analysis-Design-Development-Implementation-Evaluation）， 专门针对14岁高中生设计，提供质量参照和思考维度，而非固定模板。 AI 应根据课程内容选择最合适... | |
| 命题工坊 为信息学奥赛(NOI/CSP)生成高质量编程题，注重思维深度和巧妙解法 | |
| 雀漫 将长篇小说转换为 Seedance 2.0 平台的 15 秒动态漫画分镜脚本。 包含剧情容量分析、旁白与台词严格区分、角色卡（纯文本）、6-8 个分镜头、 微动作设计、镜头运动、配音音效。专为 AI 视频生成优化，无 markdown 格式符号。 | |
| 雀影 AI 视频创意伙伴，生成分镜脚本和 Seedance 提示词 | |
| 命题工坊 为信息学奥赛(NOI/CSP)生成高质量编程题，注重思维深度和巧妙解法 | |
| 雀影 AI 视频创意伙伴，生成分镜脚本和 Seedance 提示词 | |
| xlsx Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing... | |
| 技能诊所 🏥 技能诊所 | 诊断优化 + 创建技能 + 先例研究 + 评估门禁 + 运维反馈。触发：技能体检、技能诊断、创建技能、查重、门禁、反馈 | |
| pptx Use this skill any time a .pptx file is involved in any way — as input, output, or both. This includes: creating slide decks, pitch decks, or presentations;... | |
| Stocktorch A股智能分析系统。支持个股综合分析（技术/财务/资金流/新闻融合）和大盘实时分析。 | |
| tldraw 板书工坊 📝 用 tldraw 画板制作学神风格板书——外框围栏、分区清晰、笔记感。适合高校/竞赛风格。 | |
| 图片姬 专业的插图prompt生成和图片生成技能，具备AI自主风格分析能力。 基于深度内容分析实时推理最佳视觉方案，不依赖预设映射表。 支持多维度参数定制，提供智能推荐和用户选择双模式。 擅长创建技术概念图、信息图表、创意插画、知识可视化图等。 | |
| urlgo 连 CDP，开网页，截图，执行 JS 的浏览器控制 CLI | |
| 雀漫 将长篇小说转换为 Seedance 2.0 平台的 15 秒动态漫画分镜脚本。 包含剧情容量分析、旁白与台词严格区分、角色卡（纯文本）、6-8 个分镜头、 微动作设计、镜头运动、配音音效。专为 AI 视频生成优化，无 markdown 格式符号。 | |
| Musecard 自媒体情绪金句插画卡片创作助手，把一句话、一种情绪转化为适合微信、小红书传播的 9:16 竖版图文插画。支持萌点元素库、香度等级递增、OI疼痛文学等主题适配。 | |
| 风咏 将古诗词、古文名篇、现代散文/小说改编为歌曲。 故事前因后果织入歌词叙事，原文名句可直引点睛、意象化用为血肉（禁抄他人歌词）。 输出：歌词全文（附原文化用出处）+ 曲风/编曲方案（可直接投喂 AI 音乐工具）。 | |
| docx Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of "Word doc", "word... | |
| 析题 🔍 启发式题解生成 | 教人思考而非给答案 | 触发：题解、题目分析、代码精讲 | |
| customer-acquisition-automation Customer-acquisition desk for indie tools. Collects public pain-point leads from Reddit, X, and public competitor threads, writes channel-native drafts, and builds a human approval queue. Does not post until the user confirms. Use when the | |
| Virtual Try-On Creates a realistic try-on image by fitting tops, pants, or dresses to a person photo with face preserved and seamless garment blending. | |
| weekly-topic-library-generator Weekly viral-topic library for AI video creators. Collects public trend signals from TikTok / Reels / Shorts, extracts non-copyright structure (hook, pacing, visual keywords, camera), maps a generator-ready prompt pack, and grades topics. U | |
| ACE Music - Free Suno Alternative Generate unlimited AI music for free using ACE-Step 1.5. Full songs with vocals, lyrics, any genre, any language. No subscription, no credits, no limits. The open-source Suno alternative, powered by ACE Music's free API. Generate AI music using ACE-Step 1.5 via ACE Music's free API. Use when the user asks to create, generate, or compose music, songs, beats, instrumentals, or... | |
| Media Bias News Read the news with the coverage split attached, and check whether a news outlet is biased, using the free MediaBias.news API. Use when the user asks "what's the latest news", "what's happening today", "any news on X", "read me that story", | |
| Worthtotry Skill Submit AI tools to WorthToTry by sending their URL and email for a draft listing and founder note review link via email. | |
| OpenClaw API Control Control a hosted OpenClaw instance through the OpenClaw as a Service API. Use when the user asks to talk to OpenClaw over API, send a folder or file to OpenC... | |
| Canvas Poster Kit Create production-ready single-image posters, banners, and infographics as scalable PNGs using HTML canvas with multi-resolution export and programmatic colo... | |
| OpenClaw Zulip Channel Install, update, and safely configure the OpenClaw Zulip channel plugin from ClawHub or npm; use for bot credentials, access policies, opt-in features, drain recovery, and setup verification. | |
| Generate DOCX 将大模型生成或修改的内容，按照对应中文文档排版国家标准与行业规范， 输出为格式严格正确的 Word (.docx) 文档。 支持 19 种文档类型，依据《Word文档类型与风格指南》全量实现所有排版规范， 包括党政公文、商业文档、学术论文、技术文档、医疗文档、营销策划、 法律文书、金融报告、工程文档等。 v4.1... | |
| Generate Mindmap 生成基于认知科学方法论的交互式思维导图。支持 Markdown 大纲或 JSON 输入，一条命令同时导出 HTML（可交互编辑、8 种布局、深浅双主题）、PNG、JPG、SVG、PDF、XMind，并自动输出结构质检报告。Generate cognitive-science-grounded interactive mind maps from Markdown outlines or JSON; one command exports HTML/PNG/JPG/SVG/PD | |
| Win Cleaner Deep clean Windows C drive junk files to maximize free space. Analyzes disk usage, identifies safe-to-delete items, and cleans caches, temp files, logs, brow... | |
| FTTR Copilot Connect OpenClaw to the FTTR Copilot cloud-control system through ConnectRPC for device lookup, alert triage, network diagnostics, and FTTR operations. | |
| FTTR Operator Copilot Connect OpenClaw to the FTTR Copilot operator cloud-control APIs through ConnectRPC for managed-device lookup, alert operations, regional stats, network diag... | |
| Memos Manage memos via the Memos API: create, retrieve, delete, and list memos with visibility and pagination support, requiring MEMOS_URL and MEMOS_TOKEN. | |
| BrainVsByte The ultimate battleground for Humans vs AI. Submit entries, vote on competitors, and win crypto rewards. | |
| Lifescience Meta Router MANDATORY ENTRY POINT — ALL life science queries enter here without exception. Activate when the query involves any life science entity: biological targets (... | |
| Lifescience Target Intelligence INTERNAL SKILL — invoked by lifescience-meta-router-internal only. Not for direct user invocation. | |
| google-sheets-soha Read and analyze data from Google Sheets. Trigger when the user mentions "Google Sheet", "spreadsheet", "sheet", sends a docs.google.com/spreadsheets link, o... | |
| Automator Create and manage complex automation workflows using OpenClaw. Orchestrate multi-step tasks, parallel processing, conditional logic, and scheduled automation... | |
| Code Reviewer Automated code review, quality gates, and PR analysis. Integrates with GitHub, GitLab, Bitbucket. Enforce style guides, detect bugs, security vulnerabilities... | |
| Data Reporter Automated data reporting and dashboard generation. Connect to databases, APIs, spreadsheets. Generate PDF/PPT/Excel reports with charts. Schedule daily/weekl... | |
| Ecommerce Automation Automate e-commerce operations: price monitoring, inventory tracking, order management, competitor analysis, and stock alerts. Save 20+ hours per week for on... | |
| Social Publisher Automate social media publishing, engagement, and analytics. Schedule posts across 10+ platforms (Twitter/X, LinkedIn, Instagram, Facebook, TikTok, YouTube,... | |
| NotebookLM PDF Cleaner Create a presentation-ready copy of a NotebookLM-exported slide-deck PDF by masking the small visible NotebookLM footer badge at the bottom-right of each pag... | |
| xrp-fleet-data Buy live XRP Ledger telemetry and proxied ledger/account reads over HTTP with per-request XRP payments (x402 v2) — no account, no API key, no infrastructure. Use when an agent needs fee pressure / transaction queue depth / ledger liveness / | |
| bot-trade MossTrade 模拟交易技能 - 让 Agent 接入模拟盘进行合约交易。使用此技能可以注册交易账号、开仓平仓、查看持仓、爆仓后重生。当用户提到模拟交易、MossTrade、交易机器人时激活此技能。 | |
| 12306 Train Query 查询12306火车票余票信息。当用户询问火车票、查询余票、购买火车票、查火车、火车出行等相关问题时使用此技能。 | |
| Hui-Yi Use for low-frequency archival recall when primary memory is insufficient, authorized cold-memory maintenance, or setting up and repairing automatic user-memory detection and recall. Historical wording alone does not authorize writes; frequ | |
| 法律分析助手 面向中国大陆法律场景的法律问题识别、法律依据梳理、证据审查、程序路径分析与实务风险评估工具。输出法律信息和结构化分析参考，不构成正式法律意见。 | |
| My MBTI 根据本地 MBTI 人格资料切换对话风格的技能。用于用户要求按 MBTI 人格风格说话、模拟某种人格语气、在多个 MBTI 风格之间切换、按特定人格设定持续问答时。支持 16 种 MBTI 类型（如 INTJ、ENFP、ISTJ 等），并在同一会话中根据用户最新指定的人格类型立即切换输出风格。 | |
| 个人技能工坊 一问一答主动补全需求，开放领域生成技能，并以逐轮证据审计覆盖与回归 |
31,451–31,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.