Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| MANOR Edge Install the MANOR Edge app on this Apple silicon Mac and guide the owner through pairing it with their home and adding cameras. Use when the owner asks to install, set up or check MANOR Edge on this Mac, asks whether it is already installed | |
| onepress-deck Turn a topic or your own documents into a polished slide deck — pitch, research, lessons, narrative. Works with no account (builds a real local HTML deck); a free OnePress connection adds cited live research, generated images, PDF/editable- | |
| onepress-deck-video Turn a slide deck or topic into a narrated explainer video — drafts the narration script and shot plan locally first, then renders and voices it on OnePress into an MP4. Connects via browser-confirmed pairing (no key copying); pairs with on | |
| onepress-podcast Turn a topic, document, or slide deck into a narrated podcast episode — drafts the episode script locally first, then voices and mixes it on OnePress into an MP3. AI voices (including cloned voices), natural pacing. Connects via browser-con | |
| Sequence Read Sequence business bank accounts, cash balances, transfers, and cards; create and run money-moving automations. Use when the user asks about cash position, transfers, cards, pods, rules, or Sequence banking. Money movement requires huma | |
| GetterDone Hire a human gig worker via USD bounty for tasks an AI agent cannot do alone — physical presence (storefront photos, deliveries, on-site verification) or remote work (writing, product reviews, design, translation, proofreading, video). Post | |
| WeChat to Notion Save WeChat public account articles to a Notion database. Use when user sends a mp.weixin.qq.com link and wants to save/archive it to Notion. Fetches title,... | |
| Skills Backup Claw Shell Executes shell commands inside a dedicated tmux session named claw, capturing and returning the command output safely. | |
| Lazada Shopping Assistant Lazada cross-site shopping assistant that guides users from intent to purchase. When the user expresses a desire to buy something on Lazada (e.g., "I want to... | |
| Gaoding Design 稿定设计对话式设计工具。支持搜索模板、选择模板、编辑文案、预览、导出设计。覆盖海报、PPT、电商主图、名片等全场景。 | |
| Gaoding Template Recommend 搜索稿定设计模板。当用户想制作海报、名片、Banner、电商主图等设计，或搜索/推荐设计模板时使用。 | |
| daily-deals-1.0.0 每日神价推送服务，自动聚合全网优惠，生成精简报告。适合忙碌的省钱达人、副业套利者。 | |
| Daily Deals 1.0.0 每日神价推送服务，自动聚合全网优惠，生成精简报告。适合忙碌的省钱达人、副业套利者。 | |
| Generate professional social 制作专业社交卡片和杂志风格的海报。将Guizang的编辑/瑞士视觉系统与杂志海报模板相结合。用于小红书图文, 公众号封面,杂志海报、社交卡片、旋转木马图像或任何需要高质量渲染的视觉内容。 | |
| text-to-speech Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... | |
| hot-china 中国实时热点数据采集工具。当用户询问热搜、热榜、热点、排行榜、榜单、票房、收视率、音乐排行、歌曲排名、报纸、新闻头条、人民日报等话题时使用此技能。覆盖：抖音/微博/百度/B站/快手热搜，QQ音乐/网易云/酷狗/酷我音乐榜，猫眼电影票房/电视剧收视/综艺热度，App Store游戏/应用排行榜，人民日报电子版PDF... | |
| Ng Lawyer Db Build Build a verified Nigerian lawyer database by city, practice, sub-specialty, regulator, firm size, position, and contact with evidence-backed emails. | |
| 用于自动扫描 Vue2 项目的潜在风险，依赖安全，Webpack 配置风险， Babel 配置问题 Skill 用于自动扫描 Vue2 项目的潜在风险，依赖安全，Webpack 配置风险， Babel 配置问题 | |
| Selenium Automation Teaches the agent how to perform advanced web automation using Python, Selenium WebDriver, and ChromeDriver. | |
| Send real Document in the Mail via PostalForm Send real postal mail through PostalForm using machine payments: prepare/validate print-and-mail payloads, submit `POST /api/machine/orders`, settle x402 pay... | |
| AWS Alert Handler Normalize Security Hub ASFF, Inspector v2, and CloudWatch alarm JSON into a consistent shape. Auto-unwraps SNS and EventBridge envelopes. Use when an AWS ale... | |
| Incident Triage Structured incident triage for alerts from any monitoring source. Five-step framework: classify severity, scope blast radius, correlate with recent changes,... | |
| Structured PR Review Layered PR code review with severity tiers (MUST FIX/SHOULD FIX/SUGGESTION) and addressing-mode. Default: gh CLI only; optional Lobster pipeline. | |
| Byreal Cli Byreal DEX (Solana) data & analytics CLI: query pools, tokens, TVL, APR, k-line charts, farmer rankings, launchpad projects, and DeFi position stats. Use whe... | |
| Byreal Perps CLI Byreal Hyperliquid perpetual futures trading CLI: account setup, market/limit orders with TP/SL, position close-market/close-limit/close-all, leverage contro... | |
| painkiller-recovery Use Painkiller to create a structured recovery prompt when an agent loses task context, repeats a failed approach, or needs a careful handoff in QA, software engineering, operations, research, data analysis, or customer support. It preserve | |
| Where We Meet WhereWeMeet / 约哪儿：多人聚会、约饭、聚餐、约会选址 skill。Use when the user asks “Where should we meet”“约哪儿”“找一个谁都不远的地方”“大家住得分散去哪吃/玩”“聚餐去哪”“约饭去哪”“第一个人在...第二个人在...第三个人住...”“A 在... | |
| Story to Prompts Convert story synopses or single-scene descriptions into high-quality text-to-image prompts. Two modes: (1) multi-scene - a story outline is split into multi... | |
| 摸摸头（PatPat）-你的科学育儿教练 evidence-based-parenting — 0-15岁全场景育儿教练。帮助家长在真实育儿场景中获得科学、实用的支持和指导，覆盖情绪管理、行为引导、学习支持、社交问题、数字素养、青春期沟通等全方位育儿挑战。当用户提到以下任何话题时应触发：孩子哭闹、发脾气、打人、不听话、亲子冲突、情绪崩溃、育儿焦虑、如何安... | |
| patpat PatPat（摸摸头）— 3-8岁儿童情绪共调节助手。帮助家长在孩子情绪爆发时快速获得可用的应对指导，包括当下爆发、事后修复和日常练习三种场景。当用户提到孩子哭闹、发脾气、打人、不听话、亲子冲突、情绪崩溃、育儿焦虑、如何安抚孩子、怎么跟孩子道歉、孩子不愿刷牙/睡觉/出门、兄弟姐妹吵架、屏幕时间结束大哭等任何涉及幼... | |
| Positive Parenting 科学育儿 — 0-15岁全场景育儿教练。帮助家长在真实育儿场景中获得科学、实用的支持和指导，覆盖情绪管理、行为引导、学习支持、社交问题、数字素养、青春期沟通等全方位育儿挑战。当用户提到以下任何话题时应触发：孩子哭闹、发脾气、打人、不听话、亲子冲突、情绪崩溃、育儿焦虑、如何安抚孩子、怎么跟孩子道歉、孩子不愿刷牙/睡... | |
| Criticaster Search Criticaster's aggregated product reviews to quickly find the best products. Use when the user needs trustworthy product recommendations, reviews, comp... | |
| A2A Market 帮助用户通过 A2A Market 平台全网采购商品、发布和上架销售商品、声明供货能力，并实时跟踪交易和通知。 | |
| Minimax Tts Cn 使用 MiniMax API 将文字转换为 MP3 语音文件。触发词：文字转语音、TTS、生成语音、生成音频、把文字转成语音、文字转MP3、生成MP3。触发后按交互流程引导用户完成 Token 配置、文字输入、音色选择，最终生成 MP3 文件发给用户。严禁使用 say 命令或通过喇叭播放，必须生成 MP3 文件。 | |
| address2lnglat 调用百度地图开放平台API，将地名批量转换为BD-09（百度）经纬度坐标，自动搜索地点 → 用户填入AK → 批量爬取坐标 → 保存CSV+JSON → 直接发送给用户。坐标保留6位小数，无需转换。 | |
| baidu-mapbox-isochrone 生成等时圈（isochrone）。通过百度地理编码API将地址转为BD-09坐标，转换为WGS84后，调用Mapbox Isochrone API生成等时圈SHP文件和Python预览图。当用户需要：给定地址生成等时圈地图、百度坐标转WGS84后做等时圈分析、生成等时圈shapefile并提供预览图时使用此技能。 | |
| travel-planner-plus 为用户生成个性化旅游攻略。当用户要求"做一份旅游攻略"、"帮我规划X天X晚的旅行"、"生成某地旅游行程"、"制定旅游计划"时使用此技能。支持国内外各大城市，自动搜索景点/酒店/美食，计算交通路线，生成Word文档并发送给用户。 | |
| yolo-expert 提供基于ultralytics库的YOLO模型加载、推理、训练、验证、导出及目标跟踪功能，并辅以源码解析与示例代码。 | |
| agentcli-go agentcli-go framework reference for building Go CLI tools. Use when working on agentcli-go itself, scaffolding new CLI projects, adding commands, integrating... | |
| 木工厂报价助手 木工厂报价助手。自动匹配阶梯价格、计算损耗率、生成报价明细表（工艺成本/损耗/总成本/报价金额）。支持图纸尺寸提取、多格式导出。触发关键词：算报价、图纸报价、工艺核算、生成报价表、木作报价、板材成本核算。 | |
| drivectl - your command-line tool for interacting with Google Drive Interact with Google Drive, Docs, and Sheets using the drivectl CLI. Use this skill when asked to list Drive files, download files, read/update Sheets, or cr... | |
| SkillMe Use when user asks to find, search, add, or install skills, or discover agent capabilities. Also triggers on 'install skills', 'add skills', 'is there a skil... | |
| gh-industry-deep-analysis 行业深度分析框架 1.1.2 - 对行业/板块进行十维深度分析 | |
| gh-stock-deep-analysis 股票深度分析框架 4.1 - 对 A 股/港股/美股进行十维深度分析 | |
| COE Root Cause Run a Correction of Error root-cause analysis for recurring failures, false success, missed work, data loss, and brittle automation. | |
| delete discord message in bulk Use when user requests deleting multiple Discord messages or channel cleanup. Triggers on phrases like: - "delete [X] messages" - "purge [X] messages" - "cle... | |
| tushare股票数据源 提供基于股票代码从Tushare获取A股股票基础数据，支持自定义返回条数。 | |
| MickerBook / 麦克广场 MickerBook / 麦克广场 AI Agent 社交平台接入 Skill。用于安全读取动态、生成草稿、按负责人批准发布帖子/评论/点赞/私信，并查看勋章与 Karma 状态。 | |
| Xobni Email Email infrastructure for AI agents via Xobni.ai. Provides real email addresses (@xobni.ai) with REST API and MCP server access. Use when an AI agent needs to send/receive email, search inbox, manage attachments, or set up webhooks for email | |
| Team Planner This skill should be used when the user wants to plan a team of AI agents to work on a complex task. It analyzes task requirements, designs team structure, d... |
32,651–32,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.