Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| kingdoc 金山文档 AI 协作助手 — 9 品类在线文档全生命周期管理 （文档/智能画布/电子表格/演示文稿/多维表格/收集表/可视化/历史管理/全文搜索/附件）， 深度直连金山文档（WPS）开放平台原生 API，覆盖腾讯文档全部能力 + 金山独有 18 项增强 （回收站、版本历史、格式转换（全格式覆盖 jpg/png/t... | |
| Multi Agent Orchestrator 支持多Agent流水线编排（采集→分析→报告），基于DAG调度实现跨技能状态共享、错误重断点续传、执行报告生成、HTML甘特图可视化、人工审批节点（含超时策略）、历史执行对比、硬件自适应参数、版本更新提醒、官方流水线模板库（10类预置模板）、任务级重试策略、节点类型归组、统一错误恢复命令、条件表达式增强、Web控制台、MCP Server暴露、成本实测化桥接、新手向导（orchestrator init）。AI即编排器，脚本提供基础设施。 | |
| privacy-search 隐私优先的多引擎并行搜索 Skill，十大搜索引擎并行检索。V1.9 新增可信度标记和口语化错误建议，SKILL.md 瘦身至 ≤12KB。V1.8 新增可信合成与垂直搜索。V1.7 新增 MCP Server 形态。V1.6 新增 Perplexity 式答案合成。V1.5 新增网页正文抓取、结果导出、LLM 摘要。V1.2 统一 HTTP 出口、SimHash 去重、多因子排序、结果缓存、SearXNG 本地部署、隐私模式切换。 | |
| receipt-compliance 会计助手：发票OCR识别→真伪查验→报销单自动填充→对接审批系统。企业自主配置，数据本地处理。 | |
| skill-security-checker Skill Security — 安全审计扫描器，审一下这个 skill、装之前帮我查查、这个 skill 安全吗？一键快扫 30 秒出三档裁定（✅干净/⚠️可疑/🚫恶意）+ Top3 风险 + 一句话理由；全量模式覆盖轻量 SAST 污点追踪（Python AST + JS 词法近似，source→sink 证据链降误报）、规则引擎（YAML 规则包热插拔扩展）、社区规则（schema 校验 + 来源记录 + 签名验证）、提示注入 ML 语义检测（ONNX + 正则降级）、 | |
| Video Analyzer 视频分析处理 — 本地视频反编译分析工具。将视频拆解为时间轴剧本、语音转文字、场景分析、跨模态关联和精华摘要，支持多ASR引擎切换（Whisper/Paraformer/SenseVoice）、中文NLP增强、PaddleOCR中文识别。v4.0 新增短视频平台适配（抖音/快手/B站/视频号）和自动剪辑建议（高光检测/冗余标记/EDL导出/字幕样式）。v4.1 新增tiny模型优先体验（75MB低门槛）、说话人分离质量评分、剪映draft.json导出。v4.2 新增场景管理 | |
| wecom-voice-agent 企业微信语音消息 AI Agent 技能，自动处理语音消息的意图识别、多轮对话与任务执行。 支持被动接收语音消息、主动外呼、来电接线、通话纪要、合规录音、外呼调度等完整电话场景。 v2.6 新增：声明式意图引擎（YAML 配置 20+ 意图 + 多级澄清）、自定义意图插件（企业自有 API 声明式映射）、 统一会... | |
| winskill Windows 服务器运维工具箱 - 磁盘体检（统一入口）、临时文件清理、IIS 站点管理、批量文件操作、服务状态监控、Windows Update 诊断、实时性能监控、安全审计、注册表启动项审计、磁盘健康检测、网络端口监控、事件日志诊断、已安装程序管理、用户会话监控、计划任务审计、文件共享审计、DNS网卡诊断、SSL证书过期检测、防火墙规则审计、服务崩溃恢复状态、系统文件修复、存储池管理、备份状态检查、Docker容器管理、K8s集群监控、自动化修复向导、性能基线与趋势分析 | |
| wps-office-suite WPS Office 全家桶 - 四引擎（WPS/MS Office/LibreOffice/纯Python）智能识别用户已安装软件，纯Python模式支持排序/筛选/图表/公式/统计，含文档模板（代码生成）、最佳实践案例、故障排除大章（20+避坑+15 FAQ+15错误ID 统一索引）、自动重试、硬件自适应、环境自检、Skill更新提醒；v5.1新增：kingdoc云端桥接（白名单探测+配置预检+subprocess上传+差异检查）、条件格式/数据验证跨引擎IO（JSON中 | |
| zwjh-skill 统一记忆底座：长期记忆 + 知识图谱 + 自动沉淀 + 检索。让 AI「记得你」，跨会话持久记忆、实体/关系图谱、语义与时间线检索、记忆健康度审计、本地备份（可接百度网盘）。纯本地、零密钥、按硬件自适应，不拖累电脑。并保留 v1.7 的根因分析/预测性维护/进化报告。 | |
| Pyx Scan Check whether an AI agent skill is safe before installing or using it. Calls the PYX Scanner API to retrieve trust status, risk score, and safety recommendat... | |
| Content Quality Pipeline Detect AI-generated content and humanize it to sound natural. Write → Detect → Humanize → Verify. Powered by humantext.pro API. | |
| Skill Async Codex jobs with receipts, artifacts, and workdir control | |
| HPC CalculiX Build, review, debug, and automate CalculiX finite-element workflows. Use when working with CalculiX `.inp` decks, Abaqus-style keywords, materials, steps, c... | |
| HPC ElmerFEM Build, review, debug, and automate ElmerFEM workflows. Use when working with Elmer `.sif` solver input files, mesh directories, equation and material blocks,... | |
| HPC FEniCS Build, review, and debug FEniCS or DOLFINx PDE scripts for finite-element workflows. Use when translating PDEs into UFL, selecting function spaces, applying... | |
| openfoam-skills Generate, review, debug, and recover OpenFOAM case files for CFD workflows. Use when working with OpenFOAM dictionaries, case structure, turbulence fields, b... | |
| vasp-skills Build, review, debug, and automate VASP first-principles workflows. Use when working with VASP input sets such as INCAR, POSCAR, KPOINTS, and POTCAR; when ch... | |
| Gemini Watermark Remover Remove visible Gemini AI watermarks from images via reverse alpha blending. Use for cleaning Gemini-generated images, removing the star/sparkle logo watermark. | |
| JD商品评价 京东批量评价自动化。当用户需要自动评价京东待评价商品时使用此技能。触发场景包括但不限于：批量评价京东订单、自动评价京东商品、给京东待评价商品全部好评、京东评价自动化。无论用户是否明确提到"批量"或"自动化"，只要涉及京东商品评价操作都应触发此技能。 | |
| article-idea-capture Record公众号文章灵感、选题、半成品观点，并持续整理成可写的大纲或初稿。Use when the user says they have an article idea, topic, inspiration,选题, 钩子, 标题想法, or wants to save a thought for later... | |
| auto-publish-created-skills Automatically publish newly created local skills to ClawHub after the skill has been reviewed and committed, when the user has explicitly requested ongoing C... | |
| clawhub-publish-flow Publish or update an OpenClaw skill on ClawHub using the local authenticated ClawHub session and direct API upload. Use when the user wants to publish a new... | |
| Codex Delegate Decide when to delegate code-heavy, multi-file, or repo-intensive tasks to Codex while keeping final judgment and context in the main agent. | |
| feishu-sheet-tabs Create and organize multiple tabs (worksheets/pages) inside an existing Feishu sheet when the normal feishu_sheet API cannot create new worksheet tabs. Use w... | |
| registry-sync Keep the Feishu registry sheet in sync whenever a new local skill, workflow, or template is created or significantly updated. Use when a new skill is added u... | |
| skill-merge-and-republish Merge overlapping local skills into one canonical skill and republish the canonical skill to ClawHub. Use when two local skills have overlapping responsibili... | |
| Skill Shell Evaluate external skills before installation and decide whether to install, reject, or absorb only the useful ideas. Use when a user shares a ClawHub/GitHub... | |
| Steam Lowest Price Skill Monitor Steam game prices and alert when a game hits historical low or a user target price. Use when users ask to track Steam discounts, watch specific games... | |
| Memory Anchor Long-term memory for OpenClaw agents — SQLite hybrid recall (FTS5 + keyword + associative expansion + optional LLM embeddings), raw/curated anchors, session... | |
| Content Machine Automates trending topic discovery, AI content creation, scheduling, and multi-platform posting with performance tracking and optimization. | |
| Fitness Recipes AI AI tool that creates viral fitness recipe videos with AI-generated images, voiceovers, renders, and optional TikTok auto-posting. | |
| SEO Analyzer by G0atbot Analyze website SEO including meta tags, headings, content, keywords, competitor comparison, site audits, and ranking checks for free. | |
| TikTok Carousel Generator Generate viral TikTok photo carousels using AI. Uses 6-slide formula for maximum engagement and includes learning loop for continuous improvement. | |
| Twitter Thread Generator Generate optimized, engaging Twitter threads from any topic with viral hooks, structured formatting, and auto-posting readiness. | |
| Code Audit Pro 全方位AI代码审查：安全/性能/逻辑/风格/AI幻觉，支持PR审核、多语言规则、增量扫描 | |
| Self-Evolved dev-tools 全功能开发工具箱：Git/脚手架/CI-CD/测试/规范管理/代码审查/技术债务/依赖分析 | |
| TDX Formula Master 通达信选股/指标公式大师：金叉放量突破龙头识别，含回测模板板块轮动主力资金分析 | |
| TDX Formula 通达信选股/指标公式编写助手，基于函数手册快速生成金叉、放量、突破等信号公式。 | |
| ClawLock ClawLock — 综合安全扫描、红队测试与加固工具，支持全平台。 当用户明确要求安全扫描、安全体检、安全加固时触发： 「开始安全体检」「安全扫描」「检查 skill 安全」「安全加固」「探测实例」 「scan my claw」「security check」「drift detection」「red team... | |
| ClawLock-Rank ClawLockRank — 基于 ClawLock 2.2.1+ 本地体检结果的排行榜上传技能。 仅当用户明确要上传安全分、上传体检成绩、提交排行榜结果、同步分数到 ClawLockRank 时触发。 不要在普通安全体检、安全加固、调试开发、安装依赖或仅浏览榜单时触发。 | |
| Mealie API skill Interact with a self‑hosted Mealie instance (recipe manager & meal planner) via its REST API. Use for adding, updating, retrieving recipes, meal plans and generating shopping lists. Trigger when the user mentions their Mealie URL, wants to | |
| 国内电商全链路运营 国内电商全链路运营专家技能，覆盖淘宝、天猫、京东、拼多多、抖音电商、小红书、视频号、Temu八大平台。提供选品评分、定价与利润测算（含达人佣金）、广告投放ROI测算、店铺转化漏斗诊断、广告法违禁词合规检查、商品标题生成、备货与资金占用测算七个可计算工具，以及一个实时数据桥接器(live.py)——先用 WebSearch/WebFetch 拉取当前真实佣金率、类目退货率、1688进货价、关键词搜索量，再一键灌入各计算器，实现"实时可用"的决策。当用户涉及国内电商选品、定价、算 | |
| 爆款短视频拆解 多平台爆款短视频拆解与原创改写生产线。覆盖抖音、快手、YouTube、哔哩哔哩、微信视频号、小红书。把"模糊想法 / 视频链接 / 视频文件 / 已有文案"转成：爆点摘要、黄金3秒、逐镜结构、原创改写脚本、复刻分镜与视频提示词反推。内含视频转文字流程、内容分析总结、爆款脚本生成、敏感词与平台限流合规闸门。当用户要做短视频拆解、视频转脚本、爆款脚本生成、改写脚本、复刻分镜、提示词反推，或说"拆一下这个视频""这个爆款怎么抄""帮我想个短视频脚本""反推它的 AI 视频提示词"" | |
| Project Analyzer Analyze any project directory and produce a detailed report covering what the project does, its tech stack, folder structure, entry points, how to run it, an... | |
| Crypto Traveler - Book Hotels and Flights with Bitcoin Book flights, hotels, and eSIMs on cryptotraveler.com with Bitcoin and other cryptocurrencies. | |
| Hoist Deploy and manage apps, servers, databases, domains, and environment variables on VPS providers using the Hoist CLI. | |
| agent-security-audit AI安全审计助手 - 按次付费，新用户注册送5次免费。20+项漏洞扫描+AI深度安全分析，检测敏感信息泄露、API密钥暴露、注入风险、权限问题，开发者发布前安全自检必备。 💡 企业定制/智能体开发/AI全案服务，合作微信17392371127（郭总） | |
| AI Agent Security Scanner AI Agent安全审计工具。扫描Skill/Agent代码中的敏感信息泄露、API密钥暴露、注入风险、权限问题、数据安全漏洞，AI智能分析给出修复建议。适用于开发者发布前安全自检、代码安全review。 | |
| ai-compliance-review AI合规审查 - 按次付费，新用户注册送5次免费。广告法/数据隐私/金融营销/劳动用工/电商平台五大场景一键检测，AI智能识别违规点、引用法条、给出修改建议，企业营销文案/合同/招聘文案合规自检必备。 💡 企业定制/智能体开发/AI全案服务，合作微信17392371127（郭总） |
31,751–31,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.