Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Img Ocr 图片文字识别工具，基于Tesseract OCR。当用户提到：图片识别、OCR、文字提取、图片转文字、识别图片里的文字时使用。 | |
| Screenclaw 用“截图 + 坐标网格”的方式操作任意桌面软件：截带网格的图，让任意多模态大模型读出目标的坐标数字，再调用点击/输入/按键等 API ，模拟人类视觉化操作软件。还能录制一次操作并沉淀成可复用的场景模板，下次直接复用。不依赖目标软件提供 API 或 CLI。 出现以下情况时使用： - 自动化操作 Windows 桌... | |
| Multi Screen Wireframe Generate offline multi-screen wireframes with canvas + demo navigation. Zero Node/npm. | |
| skill-base-cli The official Skill Base CLI client. Use the `skb` (Skill Base CLI) command to search, install, update, publish, and import-from-GitHub skills from Skill Base... | |
| skill-base-web-deploy Skill Base server deployment guide. Covers starting the Skill Base server (npx skill-base), Docker configuration, port mapping, and SQLite database backup. F... | |
| Pregnancy Care A comprehensive pregnancy care assistant that tracks gestational age, manages medical checklists, provides weekly updates, and offers personalized advice for... | |
| Clawcrm Agent-native CRM built for AI agents to manage sales pipelines autonomously | |
| 数字公式计算器-招投标价格 数学公式计算专家 - Excel 公式解析、分步计算、边界验证。专用于招投标价格分计算、复杂公式求解。 | |
| flomo-add 通过 Python requests 向 flomo webhook URL 新增一条 memo。使用 scripts/flomo-add.py 从 .flomo.config 读取 url 并发起 POST 请求，支持在 macOS 与 Windows 环境下添加 flomo 笔记。用户需要快速新增 flomo... | |
| flomo-sync 将 flomo 所有记录 memo 同步/备份到本地 Markdown 文件的工具。使用 scripts/flomo-sync.py 脚本通过 flomo API 拉取 memo，支持增量同步、附件下载、多文件输出。当用户需要备份 flomo、同步 flomo memo 到本地、导出 flomo 笔记为 Mark... | |
| Girikon AI - AI Voice Agent India GirikVoice is an AI voice agent for India that automates inbound and outbound calls, qualifies leads, books appointments, manages follow-ups, and updates CRM records. It supports Hindi, Hinglish, English, and regional languages, integrating | |
| Singapore Fnb Location 🍜 新加坡餐饮选址助手：分析租金、人流、竞争、盈亏平衡，辅助餐饮店铺选址决策 | |
| Singapore Location Helper 🇸🇬 新加坡租房选址专家：精确到楼栋的推荐、通勤分析、避坑指南，帮你找到最适合的居住区域 | |
| Feishu Cli Auth 飞书 OAuth 认证和 User Access Token 管理。两步式非交互登录（AI Agent 专用）、 Token 状态检查、scope 配置、自动刷新机制、搜索功能的 Token 依赖关系。 当用户请求"登录飞书"、"获取 Token"、"OAuth 授权"、"auth login"、"认证"、 "搜... | |
| Feishu Cli Board 飞书画板全功能操作：创建画板、绘制架构图/流程图/看板（通过 create-notes API 精确控制节点位置和样式）、 导入 Mermaid/PlantUML 图表、下载画板图片、获取/复制画板节点。 当用户请求"画个图"、"画架构图"、"画流程图"、"画板"、"whiteboard"、"create-not... | |
| Feishu Cli Chat 飞书会话浏览、消息互动与群聊管理。查看聊天记录、获取群聊历史消息、搜索群聊、 获取消息详情、Reaction 表情回应、Pin 置顶/取消置顶、删除消息、 群聊信息查询与管理（获取/更新/解散/成员管理）。 支持普通群和话题群两种模式，话题群自动获取线程回复。所有命令需要 User Token。 当用户请求"查看... | |
| Feishu Cli Doc Guide 飞书文档创建前的兼容性检查规范。覆盖 Mermaid/PlantUML 语法限制（8 种图表类型的飞书安全写法）、 表格自动拆分规则（9×9 限制）、Callout/公式/图片处理、API 限制与容错机制。 被 feishu-cli-write、feishu-cli-import 等技能引用，在生成将要导入飞书的... | |
| Feishu Cli Export 将飞书文档或知识库文档导出为 Markdown 文件，或导出为 PDF/Word 等格式（异步任务）。 当用户请求"导出文档"、"导出为 Markdown"、"转换为 Markdown"、"保存为 md"、 "导出 PDF"、"导出 Word"、"下载文档"时使用。 本技能专注于导出操作。从本地 DOCX 文件导... | |
| workled The Agent states: `thinking`, `waiting`, `idle`, and `error` are automatically synced to workled via the MCP protocol. Light‑effect parameters and touch macros can also be configured for the device over MCP. | |
| 供应链 BOM 数据分析 供应链 BOM 数据分析 - 从多份工程报价单和 Excel/CSV 表格中提取、清洗、对齐硬件设备 BOM 数据，生成按时间轴维度的物料需求预测汇总表。使用场景：(1) 分析多家供应商报价单；(2) 提取传感与采集设备、传输与组网类别的物料清单；(3) 跨表格物料标准化合并；(4) 按项目交付时间生成需求预测表。 | |
| rename-file Rename files in a specified directory with a given prefix. This skill prompts the user for a prefix and directory path, shows a preview of changes, and asks... | |
| rename-fill Rename files in a specified directory with a given prefix. This skill prompts the user for a prefix and directory path, shows a preview of changes, and asks... | |
| test skill publish Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multipl... | |
| jenkins-fix 通过 Jenkins 环境变量认证，支持查询项目、触发指定分支构建及查看构建状态与产物下载链接。 | |
| Data Analysis Reporting Turn raw business data (CSV, SQLite, spreadsheets, pasted tables) into clear analytical summaries, trend analysis, and actionable reports for small business... | |
| Energy Market Intelligence Build sourced, decision-ready Alberta energy market briefings covering AESO pool prices, supply/demand balance, outage events, regulatory changes, and commer... | |
| Infra Monitoring Monitor server health, uptime, resource utilization, SSL certificate expiry, and incident detection for small teams and self-hosters. Delivers plain-language... | |
| Market Intel Briefing Build lean, source-linked, decision-ready market intelligence briefs for a niche, competitor set, company set, jurisdiction comparison, or market theme. Use... | |
| Auto Updater Sxdg2 Automatically update OpenClaw and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of w... | |
| LastPass CLI Skill Securely fetch credentials from LastPass vault via lpass CLI. | |
| Accounting Cpa Tax Marketing Kit Generates IRS- and AICPA-compliant marketing content for accounting, CPA, enrolled agent, and tax prep firms with required disclosures and no prohibited claims. | |
| Ad Copy Generator Generate optimized ad copy for Google, Facebook/Instagram, LinkedIn, and retargeting campaigns using product details and audience targeting in minutes. | |
| Addiction Treatment Marketing Kit Generates compliant marketing content for licensed addiction treatment centers that meets LegitScript, 42 CFR Part 2, FTC, and platform advertising regulations. | |
| Affiliate Marketing Generator Generates SEO-optimized affiliate reviews, comparison posts, email sequences, and social scripts to promote products and monetize content effectively. | |
| Affiliate Partner Program Generator Generate complete affiliate programs including structure, commissions, recruitment materials, partner assets, and performance reports for SaaS, e-commerce, a... | |
| Agency Client Reporting Generates tailored agency client reports, QBR narratives, health scorecards, and renewal proposals to prove ROI, retain clients, and grow accounts. | |
| Ai Automation Agency Kit Provides a complete 4-prompt system to launch and run an AI automation agency, covering niche selection, service packaging, client acquisition, and delivery... | |
| Ai Chatbot Prompt Builder Create comprehensive AI chatbot system prompts, personas, guardrails, and FAQ datasets for custom business assistant deployment without prompt engineering ex... | |
| Ai Workflow Automation Generator Generates a custom AI automation playbook identifying workflows to automate, recommended tools, SOPs, and ROI projections for small businesses. | |
| Air Duct Cleaning Iaq Kit Generates legally compliant, scientifically accurate marketing content for NADCA-certified air duct cleaning and indoor air quality contractors, enforcing se... | |
| Airbnb Str Listing Optimizer Transforms short-term rental details into optimized Airbnb/VRBO listings, photo captions, house rules, FAQs, and automated guest messages for higher booking... | |
| App Store Listing Generator Generates optimized iOS and Android app store listings, release notes, and ASO keyword strategies tailored to platform limits and marketing best practices. | |
| Appliance Repair Marketing Kit Creates compliant digital marketing materials for appliance repair businesses, including ads, SEO pages, review systems, and B2B outreach templates. | |
| Asphalt Driveway Sealing Kit Generates legally compliant, conversion-focused marketing content for asphalt sealing contractors, enforcing 7 strict regulatory and truth-in-advertising com... | |
| Auto Body Collision Kit Generates Nevada-compliant, liability-checked marketing content for auto body shops, ensuring OSHA, EPA, FTC, and local regulations are met. | |
| Auto Body Collision Repair Kit Generates legally-compliant, accurate marketing content for auto body shops that avoids common violations and enforces EPA, certification, parts, and insuran... | |
| Auto Dealership Car Service Kit Generates FTC/NADA/state DMV-compliant marketing content for auto dealers and service shops covering inventory, service upsells, reviews, and digital ads. | |
| Auto Detailing Car Wash Kit Generates EPA- and FTC-compliant marketing content for auto detailing shops, including seasonal campaigns, service pages, reviews, ads, and fleet outreach. | |
| Auto Glass Repair Marketing Kit Generate compliant marketing content for auto glass shops enforcing AGSC certification, ADAS recalibration disclosure, Nevada insurance laws, OEM glass truth... | |
| Auto Glass Windshield Marketing Kit Generates compliant marketing copy and SEO content for auto glass shops, covering AGRSS standards, ADAS recalibration, insurance billing, and glass tier disc... |
32,751–32,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.