Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Elixir Dev Elixir/Phoenix development companion. Run and interpret mix test, mix credo, mix dialyzer, mix format. Generate modules following OTP conventions: contexts, schemas, GenServers, supervisors, tasks. Debug compilation errors and warnings. Hel | |
| Hacker News Browse and search Hacker News. Fetch top, new, best, Ask HN, Show HN stories and job postings. View item details, comments, and user profiles. Search stories and comments via Algolia. Find "Who is hiring?" threads. Use for any HN-related qu | |
| Oban Design and implement Oban background job workers for Elixir. Configure queues, retry strategies, uniqueness constraints, cron scheduling, and error handling. Generate Oban workers, queue config, and test setups. Use when adding background j | |
| Oban Designer Design and implement Oban background job workers for Elixir. Configure queues, retry strategies, uniqueness constraints, cron scheduling, and error handling. Generate Oban workers, queue config, and test setups. Use when adding background j | |
| Phoenix API Generator Generate a full Phoenix JSON API from an OpenAPI spec or natural language description. Creates contexts, Ecto schemas, migrations, controllers, JSON views/renderers, router entries, ExUnit tests with factories, auth plugs, and tenant scopin | |
| Readwise & Reader API Manage Readwise highlights, books, daily review, and Reader documents (save-for-later / read-it-later). Use when the user wants to save articles or URLs to Reader, browse their reading list, search saved documents, review highlights, create | |
| 中国官方经济资讯 获取中国经济资讯。仅从官方权威媒体（中国政府网、新华网、人民网、国家统计局、央视财经、中国经济网）抓取高质量经济新闻，自动过滤广告和低质量内容。触发词：中国经济、经济资讯、经济新闻、财经新闻、经济政策、宏观经济、GDP、CPI、PMI、货币政策、财政政策、今日财经。 | |
| CNInfo Reports Batch-download formal A-share annual and semiannual report PDFs from CNInfo (巨潮资讯) using a stock-code CSV. Supports dry-run preview, resume on failure, force... | |
| Xhs Auto Publisher 小红书自动化内容生产与发布助手。通过对话收集账号定位（领域/人设/视觉偏好/发布节奏），自动完成「热点选题 → 9 图文案 → HTML 视觉模板 → 高清图片渲染 → 浏览器自动发布 → 定时任务调度」全链路，最终保留"用户手动点发布"一步防封号。支持随时通过对话调整视觉风格、文案语气、选题方向。触发关键词：小... | |
| GuruWalk Free Tours Search Search GuruWalk free tours through the GuruWalk MCP server and return bookable options by city, dates, and language. Use this skill when the user asks for free tours, walking tours, guided city tours, plans in a city, or availability of tou | |
| Yahoo Finance CLI Fetch live financial data from Yahoo Finance. You CANNOT answer financial data questions from memory — you MUST use this skill instead. Trigger whenever the... | |
| Molt Skills Connect and engage with the Moltbook social network for AI agents by posting, commenting, voting, and joining communities. | |
| CodeBox QR Code Generate, manage, and track QR codes via CodeBox API. Create dynamic QR codes with 200+ style templates, track scans with analytics (device, location, time),... | |
| Mpps Attestation Create tamper-proof receipts for AI agent work. Hash artifacts or action manifests, POST to api.mpps.io, get an HSM-signed receipt. No API key. | |
| AI Company Starter 一键搭建 AI 公司。创建老板、HR、技术、销售等多个协作 AI 角色，配置 Telegram/Discord 绑定，建立 AI 间沟通机制。Use when setting up a multi-agent AI company with coordinated roles. | |
| AI员工协作技能包 AI员工协作技能包 - 多AI角色配置、任务自动分配、进度监控、结果汇报。适合想要自动化运营的团队。 | |
| AI员工协作技能包 AI员工协作技能包 - 多AI角色配置、任务自动分配、进度监控、结果汇报。适合想要自动化运营的团队。 | |
| AI Employee Team AI员工协作技能包 - 多AI角色配置、任务自动分配、进度监控、结果汇报。适合想要自动化运营的团队。 | |
| AutoClip Pro 视频批量处理技能包 - 一键处理100个视频，自动剪辑、加字幕、配乐、调风格。适合自媒体从业者、短视频创作者。 | |
| Business Income Tracker Track daily income and expenses, auto-calculate weekly/monthly ROI, monitor channels, and compare expected vs actual business revenue. | |
| Business ROI Calculator 实时计算商务合作的短期和长期投资回报率（ROI），并基于阈值提供合作执行建议和关键洞察。 | |
| Channel Follow-up Automation 自动每日09:00检查渠道，按ROI、响应速度和成交概率评分排序，分级提醒跟进，降低遗漏率和成交周期。 | |
| 数据分析技能包 数据分析技能包 - 自动抓取、清洗、可视化、生成报告。适合数据分析师、运营人员，告别 Excel 手工操作。 | |
| DataMaster Pro 数据分析技能包 - 自动抓取、清洗、可视化、生成报告。适合数据分析师、运营人员，告别 Excel 手工操作。 | |
| Email Outreach Templates 提供50+商务合作邮件模板，覆盖首次联系、跟进、谈判及成交阶段，含A/B测试和行业定制，提升回复率有效降低成本。 | |
| Partnership Priority Evaluator Evaluate new revenue channels by scoring technical difficulty, market demand, competition barriers, and revenue potential to guide prioritization decisions. | |
| PDF Toolkit Pro PDF批量处理技能包 - 一键合并、分割、压缩、转换PDF。适合办公人员、文档处理、自动化工作流。 | |
| WeChat Auto Publisher 公众号自动化技能包 - 从选题到写作到发布全流程自动化，热点监控+AI写作+草稿管理。适合自媒体运营者、内容创作者。 | |
| Reporead Analyze GitHub repositories using RepoRead AI. Use when the user asks to "analyze a repo", "generate docs", "security audit a repo", "create a README", or wa... | |
| fork-it Before the user starts coding a new project idea, search GitHub for an existing repo to fork as a starting point. Skip for debugging, learning, or a specific... | |
| Script Cron Jobs (no LLM) Run bash scripts on a schedule without LLM involvement. Zero model cost, hot-reload, pure shell. A workaround until openclaw/openclaw#80793 lands. | |
| GitHub Iteration Workflow GitHub Issue 全流程自动化处理。当用户要求处理 GitHub Issue、拉取并修复 Issue、创建 PR、监控 CI/CD、合并部署时使用此技能。涵盖从 Issue 拉取、代码修复、PR 创建、CI/CD 监控到合并部署的完整自动化流程。 | |
| Quant Strategy Searcher 量化策略搜索与深度个股分析 —— 连接远程策略数据库，AI驱动全链路决策 | |
| Yezhou Deploy 将 HTML、项目目录或 ZIP 部署到页舟并保持公开链接不变 | |
| Deskbird-Automator Steuert Deskbird ueber Telegram mit sicherem Auth-Handling, Discovery und Parkplatz-Status/Reservierung. Verwende diesen Skill, wenn ein OpenClaw-Agent Deskb... | |
| Goalz über MCP Verwende diesen Skill fuer einen vollautonomen Goalz-Bot ueber den oeffentlichen Goalz-MCP-Endpunkt, der eigenstaendig spielt, berichtet und den Verein langf... | |
| Agent Governance Assistant UPDATED 2026: Covers China AI Agent governance regulations (generative AI regulations), MCP protocol governance implications, and enterprise AI audit framewo... | |
| Agent Governance Assistant UPDATED 2026: Covers China AI Agent governance regulations (generative AI regulations), MCP protocol governance implications, and enterprise AI audit frameworks. AI-powered enterprise AI agent governance framework — audit agent behavior, en | |
| Agent Skills Framework Explorer AI-powered assistant for exploring, understanding, and building with AI agent skills frameworks — covers Anthropic agent-skills, OpenAI agent SDKs, LangChain tools, CrewAI protocols, and open-source agent skill marketplaces. Built for AI de | |
| Agentic Test Engineer AI-powered autonomous test generation and self-healing test maintenance. Generates unit/integration/E2E tests, detects flaky tests, auto-fixes broken selectors, and maintains test coverage. Built for QA engineers and developers. Keywords: A | |
| Agentic Workflow Designer AI-powered agentic workflow design and automation assistant — map complex multi-step processes, identify automation opportunities, design autonomous AI agent pipelines, generate n8n/Make/Zapier workflow specs, and estimate ROI. Covers enter | |
| AI Agent Evaluator AI-powered agent evaluation and benchmarking assistant — design evaluation suites, run structured assessments (task completion rate, latency, safety, reasoning accuracy), compare multi-agent frameworks (CrewAI, LangChain, AutoGen), generate | |
| AI Agent Orchestration Advisor Scope: framework comparison, architecture design, starter-code scaffolds and evaluation design for multi-agent systems; it does not run, install, or deploy any framework. AI-powered multi-agent framework comparison and selection assistant — | |
| AI Code Review Expert AI-powered code review assistant — perform deep static analysis, identify security vulnerabilities, enforce coding standards, suggest refactoring patterns, and generate PR review comments. Supports Python, JavaScript, TypeScript, Java, Go, | |
| AI Meeting Intelligence Expert AI-powered meeting intelligence assistant — automatically transcribe, summarize, extract action items, generate follow-ups, and track decisions across your meeting lifecycle. Supports multi-language transcription, speaker identification, se | |
| AI Test Strategy Architect AI-powered test strategy and automation assistant — design comprehensive testing frameworks, generate unit/integration/e2e test cases, implement test automation for web/mobile/API, and build CI/CD testing pipelines. Covers Test-Driven Devel | |
| AI Trading Strategy Backtester AI-powered quantitative trading strategy backtesting assistant. Designs, codes, and evaluates trading strategies across historical market data. Supports A-share (China), Hong Kong, US equity markets. Covers mean reversion, momentum, breakou | |
| API Design & Documentation Generator AI-powered API design and documentation assistant — generate RESTful/OpenAPI specs, write comprehensive API docs (guides, tutorials, reference), create mock servers, validate API designs, and produce SDK code snippets. Supports OpenAPI 3.0/ | |
| Bank APP Wealth Advisor Assistant AI-powered wealth advisory assistant for bank mobile applications — provides product recommendations, investment consultation, and compliance-compliant customer interaction. Built for digital banking teams. | |
| Bank Compliance AI-assisted bank compliance review for screening marketing materials, KYC, AML alerts, and CBIRC/NFRA regulatory checks per 2024-2026 China banking rules. |
32,251–32,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.