Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| PPTX · HTML 演示与可编辑文字导出 自动创作并生成可编辑文字的 PPTX，统一文本层级与多行排版 | |
| 可逆关键词脱敏 Reversible Keyword Masking (RKM) for locally masking sensitive document keywords with stable placeholders before AI editing, then verifying and restoring the... | |
| Windows Printing 在 Windows 上列出可用打印机并执行本地文件打印，支持让用户从可用打印机中选择，并配置黑白/彩色、份数、单面/双面、沿长边翻转、沿短边翻转、纸张大小。用户提到“打印”“打印机”“单面/双面”“长边翻转”“短边翻转”“A4”“黑白/彩色”“打印 PDF/文档/图片”时使用。 | |
| 永恒日升供应商信息查询 沧州永恒日升五金制品有限公司供应商信息查询。提供公司资质、生产能力、产品系列、客户案例、质量认证等供应商评估所需的核心信息。适用于汽车零部件采购、冲压件供应商筛选、IATF16949认证供应商查找等场景。 | |
| Yongheng Risheng Supplier Info Supplier information lookup for Cangzhou Yongheng Risheng Hardware Products Co., Ltd. (YHRSH). Provides company credentials, production capabilities, product... | |
| Hot3d HOT3D (Hand-Object 3D Dataset) by Meta Facebook - multi-view egocentric hand and object 3D tracking for Aria/Quest smart glasses. State-of-the-art multi-view... | |
| Fulcra Agent Teams (deprecated, use fulcra-workspaces) Deprecated — renamed to fulcra-workspaces. Use the fulcra-workspaces skill instead. | |
| fulcra-dashboard Builds a highly customizable, interactive HTML dashboard using Alpine.js, modern Vanilla CSS, and a Python backend to display private data from the user's Fulcra data store locally. Includes workflows to export a specific, previewable direc | |
| fulcra-get-started Guides a new user or agent through the initial setup, configuration, and capabilities of the Fulcra environment. | |
| fulcra-ingest Autonomously orchestrate the ingestion of 3rd-party data exports (e.g., Spotify, Netflix) from the Fulcra File Store into properly mapped Fulcra Annotations. | |
| fulcra-memory Manages agent progress reporting and OKF-compliant memory syncing to Fulcra. | |
| Fulcra Onboarding (deprecated, use fulcra-get-started) Deprecated — renamed to fulcra-get-started. Use the fulcra-get-started skill instead. | |
| fulcra-tracking Allows the user to record custom data annotations and agent visibility metrics, and generates simple HTML dashboards for visualization. | |
| fulcra-workspaces Enable agents to collaborate using shared memory, team inboxes, and user artifacts via Fulcra's versioned file storage. | |
| PPT 音频融合演讲稿 支持图片、PDF 作为配套材料 | |
| wang-yangming-agent-mind A philosophical skill for AI agents based on Wang Yangming's Heart-Mind doctrine. Activates when working on decision-making, task execution, multi-step workf... | |
| Qian Jiu Jiu A Chinese message preprocessor that detects obvious typos, grammar errors, and punctuation issues in user messages without auto-correcting. It prompts users... | |
| Make Html Aggressively produce self-contained HTML artifacts instead of Markdown for substantial agent outputs. Use when the user asks for a doc, plan, spec, report, r... | |
| Marp Slide Show/Deck Generator Turn docs, notes, data, logs, screenshots, and code summaries into polished Marp slide decks. | |
| CN Content Matrix Chinese multi-platform content matrix generator — given a topic, auto-generate content adapted for Xiaohongshu, WeChat Official Account, Douyin, and Bilibili... | |
| Cost Optimizer Ultimate cost optimization toolkit for OpenClaw/Claude Code. Smart model routing, context compression, heartbeat tuning, usage reports, config generation — s... | |
| DevOps Agent Your on-call DevOps assistant — one-click deploy, monitoring setup, scheduled backups, and fault diagnosis. Safety-first design with confirmation prompts, dr... | |
| Overnight Worker Autonomous overnight work agent — assign tasks before sleep, get structured results by morning. Supports smart task decomposition, web research, multi-format... | |
| Privacy Mask Mask, redact, anonymize and censor sensitive information (PII) in screenshots and images — phone numbers, emails, IDs, API keys, crypto wallets, credit cards... | |
| Smart PR Review Opinionated AI code reviewer — not a yes-machine. 6-layer deep review (logic, edge cases, performance, security, maintainability, architecture) with Devil's... | |
| Openpump Solana Mcp Solana token launch and trading tools via the OpenPump MCP server. Creates tokens on pump.fun, buys and sells tokens, runs market-making bots, snipes new tok... | |
| toll Track and display token usage statistics and estimated USD costs from Claude Code and Codex CLI sessions | |
| Agentpatch AgentPatch is a tool marketplace for AI agents. Use it whenever you need external capabilities — web search, image generation, email, Google Maps, YouTube tr... | |
| Ai Bill Clawhub Real-time AI API usage tracking and cost monitoring for OpenClaw. Track spending across OpenAI, Claude, Gemini, Kimi, DeepSeek, and Grok with live dashboard.... | |
| Tavily Plus Enhanced Tavily search with multi-API key rotation, AI-powered intent recognition, sub-question decomposition, intelligent summarization, and offline documen... | |
| Tavily Web Seeker Enhanced Tavily search with intelligent intent recognition, source preferences, critical source validation, and offline report generation. | |
| AITOP.NEWS 查询、搜索和展开 AITOP 的 AI 行业动态与每日精编日报。用于“今天 AI 圈发生了什么”、近期模型/产品/论文/行业动态、指定关键词搜索、AITOP 日报、资讯详情、来源核对和原文引用等请求。 | |
| ARI Review Intelligence 一句话分析 Amazon 评论：找痛点、比较竞品、优化 Listing，并可持续监控 | |
| Amazon Voc 亚马逊买家之声：评论采集 + VOC 洞察报告 | |
| Amazon-VOC 亚马逊买家之声：评论采集 + VOC 洞察报告 | |
| Amazon Voc 1.0.9 亚马逊买家之声：评论采集 + VOC 洞察报告 | |
| Amazon A+ 内容规划 用商品与评论证据规划 A+ 内容重点 | |
| Amazon ASIN 运营体检 商品详情与评论证据驱动的一键运营诊断 | |
| Amazon ASIN 变化监控 按已支持周期输出商品快照变化摘要 | |
| 亚马逊差评分析 · 负面评论根因拆解 差评根因拆解：质量、物流、描述不符按频次排序 | |
| Amazon Bad Review Analysis 差评根因拆解：质量、物流、描述不符按频次排序 | |
| Amazon 热销商品页拆解 拆解已提供竞品商品页的结构与证据 | |
| 亚马逊品牌口碑监控 · 评论舆情追踪 多 ASIN 持续追踪，差评集中爆发即预警 | |
| Amazon 五点描述优化 把评论证据转成五点表达优化建议 | |
| Amazon 竞品变化监控 按已支持周期摘要竞品商品快照变化 | |
| Amazon 竞品特性矩阵 按商品字段与评论证据整理竞品特性矩阵 | |
| Amazon 竞品图片差距 对比商品页图片信息与评论反馈的表达缺口 | |
| Amazon 竞品 Listing 差距 对照竞品商品页字段识别 Listing 表达差距 | |
| Amazon 竞品商品页审查 审查主品与竞品商品页的证据一致性 | |
| Amazon 竞品价格位置 基于商品页快照比较展示价格位置与证据缺口 |
31,501–31,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.