Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Jiuma AI Video Generation (Free) 免费的ai视频生成创作平台（Video Generation Skill），支持生成视频、图片、声音、视频动作模仿、视频人物替换等等。九马AI官网：https://www.jiuma.com | |
| network-request-twister 当用户想要观察、拦截或修改浏览器网络请求和响应时使用此 skill。Use when the user wants to observe, intercept, or modify browser network requests — monitor HTTP traffic, mock API responses, block analytics/tracking, modify request/response headers, rewrite response bodi | |
| 薇薇发 支持上传和处理图片、文件及CSV，结合输入内容生成定制化文本回复，适用于聊天记录和工作流应用场景。 | |
| dfsgdfgdfgddfsdfsdfsdfsdfsd1111 Search X (Twitter) posts using the xAI API. Use when the user wants to find tweets, search X/Twitter, look up what people are saying on X, or find social med... | |
| fsdfsdf Search X (Twitter) posts using the xAI API. Use when the user wants to find tweets, search X/Twitter, look up what people are saying on X, or find social med... | |
| X Search 1.0.0 Search X (Twitter) posts using the xAI API. Use when the user wants to find tweets, search X/Twitter, look up what people are saying on X, or find social med... | |
| Use when user wants to review material forms for data sharing catalogs, field completeness, platform consistency, and issue-list output. Triggers include「材料审核」「共享清单审核」「检查文档审查」「平台对接核对」「编目一致性检查」. Use when user wants to review material forms for data sharing catalogs, field completeness, platform consistency, and issue-list output. Triggers include「材料审... | |
| persona-simulator 模拟自定义 AI 人格，使助手以特定性格、语言风格和行为特质与用户交互。当用户要求"扮演某种性格"、"以XX风格回答"、"模拟人格"、"角色扮演"时使用本 Skill。支持温和/直率/幽默/沉稳/俏皮/理性/感性等多种性格基调，以及自定义语言风格、行为特质和身份背景。 | |
| Local Life Hotspot 搜索当天真实热门话题，选择一个深度创作，生成简约图片，自动发布。 | |
| Android Stack Analyzer Quickly view and analyze Android device page stacks including current page, Activity history, Fragments, and monitor page switches via ADB commands. | |
| Creative Fiction Writer Craft tasteful adult fiction and intimate scenes. Triggers on requests for erotic stories, romance with mature themes, NSFW creative writing, or 小黄文/情色故事. Su... | |
| NeoDB NeoDB 书影音标注助手 — 通过 API 替代网页/客户端完成所有 NeoDB 操作。支持搜索条目、标记（想看/在看/看过/放弃）、评分、短评、长评、笔记、收藏单、标签管理。触发场景：(1) 用户提到 NeoDB、书影音、标记、想看、看过、在读、读完、评分、评论 (2) 用户要搜索/标注书籍、电影、剧集、音乐... | |
| Sushiro Skill 查询寿司郎（Sushiro / 壽司郎）中国大陆全国 100+ 门店的实时排队 / 等位情况。通过微信小程序后端拉取门店列表、单店详情、各城市排队榜、区域筛选、按经纬度排距离。当用户问"寿司郎排队 / 等位 / 还要等多久 / 哪家人少 / 几桌在等"，对比城市或商圈的等位状况，按门店 id / 店名 / 区域查... | |
| database-doc-generator Generate professional database structure documentation from PostgreSQL databases. Creates Excel files with table schemas, column details, and formatting. Use... | |
| ClawDNA -- Identity Backup & Sync CLI tool to version, snapshot, and sync your OpenClaw agent identity files, ensuring backup and preventing data loss or identity drift. | |
| gtrk AI 情景动画分镜稿 AI 情景动画分镜稿生成器——把成片 SOP 第③步（B-roll 底轨阶段）分到 AI_DRAMA 车道的 beat，逐个产**四段朴素描述（故事背景 / 角色 / 分镜 / 原文文稿）+ 独立视觉基调段 + 时长预算**，中英双版；Markdown 外壳默认严格兼容 gitruck-ai-drama-desk 解析器，可直接导入工作台，也可拿去任意外部 AI 漫剧管线（可灵 / 即梦 / Vidu / Veo / Runway / LTX / 本地开源，或 LibTV / | |
| gtrk 合成层包装 合成层包装（合成颗粒）——粗剪、B-roll、字幕都定了之后，把选定时间窗做成「合成」：一段时间内的整个画面由一颗代码颗粒接管（画中画拼贴、逐句换画面、对照并排、并列卡片、字幕排版），讲者与 B-roll 作为槽位画进去。三种入口：整片铺满 / 让 AI 判定哪里值得做 / 用户指定区间；候选窗口显示在客户端大纲的 CP 行。当用户想「做合成 / 合成层 / 整片做一下合成包装 / 哪里适合做合成 / 这段做成画中画拼贴 / 11 秒到 32 秒做个合成 / 逐句换画面 / | |
| gtrk 封面工作台 封面工作台——把一期视频的封面从「设计诊断 + 文生图 Prompt」到「H5 排字工作台一键导出多尺寸 PNG」两阶段做完。阶段一产诊断与三尺寸中英双版 Prompt（用户拿去 Midjourney / Flux / SDXL / Nano Banana / 即梦 / 可灵 / 通义万相 等任意文生图平台抽图），阶段二收齐背景图后产可拖拽排字的单文件 H5 工作台、浏览器里导出原分辨率 PNG。这是**纯创作 skill、无 gtrk 命令**（抽图在外部平台、排字在用户浏 | |
| gtrk 美食解说 美食解说垂类图纸（解说链示例）——把探店/密着纪实长片（或自拍探店素材夹）与做饭流程记录，提炼看点后重述成一条中文美食解说成片工程。覆盖两形态：探店·密着（一家店/一顿饭/一个人的故事）与做饭流程解说（步骤线忠实重述）。菜谱知识类内容出局（那是配音链题材，走 gtrk-voiceover）。当用户想「做美食解说 / 探店视频解说 / 密着纪实翻讲 / 把这条做饭视频讲一遍 / 拉面店视频解说」时使用本图纸。链级条款（时序三档/引用段/出处对齐）以 gtrk-narration | |
| gtrk 直播切片 直播切片图纸——把一场数小时的直播回放，拆成一批可编辑的逐 clip 粗剪工程（gtrk+剪映+PR），交给用户自己挑、自己改、自己出片。含超长源片分段规约（服务端 2h 硬闸 + 60min 轮询墙钟）、选题清单确认停点、按画面形态配分屏、源片贴片如实告知。当用户想「直播切片 / 直播回放切高光 / 把这场直播剪成短视频 / 三小时直播怎么切 / 带货直播剪片段 / 讲座直播出短片 / 录播切片」时使用本 skill。凡涉及把直播回放拆成一批短片工程，优先用本图纸编排，别直 | |
| gtrk 长剪短 长剪短闭环——把一条长视频（课程/直播/播客/访谈毛片）通过同合云选段跳剪成多条高光短片工程，一次产出逐 clip 的 gtrk+剪映+PR 三方工程（可选智能分屏）。当用户想「长剪短 / 长视频切高光 / 直播切片 / 课程切短视频 / 播客出短片 / 两小时的课切成几条精华」时使用本 skill。凡涉及把长视频拆成多条可精修的短片工程，优先用本 skill 驱动 gtrk CLI 的 `long2short` 命令，不要手搓 ffmpeg、不要人工挑时间码。 | |
| gtrk B-roll 检索铺轨 B-roll 检索铺轨编排手册——成片管线里第一个铺的车道（SOP ③ B-roll 底轨阶段）。消费拆分派单的 FILM_BROLL 队列（`dispatch.film_broll`），检索素材并在工程里平铺 N 条候选 B-roll 轨，供用户在 opencut 里用轨道小眼睛切换对比、挑选/调整；确认后交棒同阶段的 AI 情景片段腿（`/gtrk-ai-drama`，车道非空时）。命令族还含：**本地素材模式**（`matrix index` 建索引、`--local` | |
| gtrk MG 动态图铺轨 MG 动态图颗粒铺轨器——成片 SOP 第 ⑤ 步（**最后叠上**），在 B-roll 底轨三源（影视素材 / 本地素材 / AI 情景片段）全部铺齐、且 ④ 全局抽帧检查构图通过之后，把栏目的 html-particle 动态图颗粒（透明叠加 / 满屏底层）叠铺到已定稿的底轨之上。先由栏目 MG 生产 skill 按派单各槽位产颗粒，再驱动 `gtrk mg` 命令 lint + 铺进 `.gtrk` 工程的 beat_track。当用户想「铺 MG 颗粒 / 上动态图 | |
| gtrk 音乐可视化成片 音乐可视化成片——把一首歌通过同合云出成一条频谱可视化视频（可选背景/封面 + 模板/配色样式）。当用户想「把这首歌做成可视化视频 / 音乐可视化 / 频谱视频 / 歌曲配画面出片 / music visualizer / 给歌配个动态封面视频」时使用本 skill。凡涉及把一段音频做成频谱可视化成片，优先用本 skill 驱动 gtrk CLI 的 `music-visualizer` 命令，不要手搓 ffmpeg。 | |
| gtrk 解说视频创作 通用解说视频创作图纸（解说链正本）——把「一个很长的东西」（旅行素材夹/影视长片/游戏实况/探店与做饭流程记录）提炼梗概、高光与看点，用精简叙述重讲成一条解说成片工程。判据=素材语料自带叙事时序且成片尊重它；声音基座无关（TTS 配音 / 用户自己念的口播毛片皆可，稿可 AI 代写可自备）。当用户想「做影视解说 / 游戏解说 / 探店解说 / 做饭流程解说 / 把这段素材讲成一条片 / 解说视频 / 把这部片子讲一遍」时使用本图纸。旅拍解说（gtrk-travel-recap | |
| gtrk 智能口播剪辑 智能口播剪辑闭环——开剪前主动检查同目录独立口播音频，有则先对轨换声，再通过同合云剪掉废话/重复/长停顿，产出客户端(gtrk)+剪映+PR 三方工程。当用户想「剪口播/剪个视频/智能剪辑/去掉废话和停顿/把这条口播剪一版/出剪映草稿/生成剪辑工程/oral cut」时使用本 skill。凡涉及把口播毛片做成可二次精修的剪辑工程，优先用本 skill 驱动 gtrk CLI，不要手搓 ffmpeg。 | |
| gtrk 参考片精读 参考片精读——把一条别人的视频读成「可复刻」的整片模型与时码细节：逐字时码转写 + 带台词标签的抽帧网格 + 关键动效逐帧看 + 按「系统」记录每个设计事件对着哪句话，落成 ANALYSIS.md / TIMELINE.md / PROGRESS.md，读完可交给 /gtrk-style-maker 产栏目 skill，或直接指导把这套包装迁移到用户自己的片子上。驱动 `gtrk transcript --json`（取字级时码）与纯本地零计费的 `gtrk media` 看 | |
| gtrk 视觉拆分派单 视觉拆分派单器——把一条已剪好的口播工程（gtrk + transcript）拆成 beat 级「视觉拆分稿」，为每个连续文稿段指定唯一主层（A_ROLL 真人出镜 / MG 动态图 / AI_DRAMA 再现 / FILM_BROLL 影视素材）+ 辅助层，产机器可消费的派单清单（MG 槽位 / B-roll 检索队列 / AI 动画队列），要成片时再交棒后续铺轨。当用户想「文稿视觉化拆分 / 视觉拆分稿 / beat 时间线 / 派分镜 / A-roll B-roll 分 | |
| gtrk 栏目风格 Skill 生成器 能生产 skill 的 meta skill——通过启发式访谈引导视频创作者想清楚**他自己的**视觉语法，并把它落成**他自己的可执行 skill 家族**（黑盒、留本地）+ 栏目内共享词表 + 栏目配置登记。框架对审美零预设：不假设你有叙事结构、有容器概念、视觉分 MG/AI——你的维度（k）和取值（v）全部由你自己定义，本 skill 只提供「怎么想清楚」的工艺。当用户想「建一个新栏目/新频道的风格体系」「把我的审美沉淀成 skill」「做一个我自己的视觉 skill」 | |
| gtrk 口播视频成片 通用口播视频创作图纸（口播链）——把一条或一组真人出镜的口播毛片，做成完整包装的可出片工程：外录音轨对齐换轨 → 多段拼接 → oralcut 粗剪 → 拆分派单 → B-roll/MG 字卡 → BGM → 字幕 → 客户端出片。当用户想「口播视频从毛片做到成片 / 口播完整包装 / 我拍了几段口播帮我做成一期 / 领夹麦音轨怎么合进去 / 口播加 B-roll 加字卡 / talking head 成片」时使用本 skill。凡涉及真人口播的完整成片编排，优先用本图纸驱动 | |
| gtrk 单点工具箱 gtrk 单点工具与媒体转换能力的调用向导，覆盖 `gtrk tool` 家族。当用户想“让图动起来 / 抠像去背景 / 图片或视频去黑边 / 图片或视频比例转换 / 视频防抖 / 添加蒸汽波滤镜 / 清理有权处理的图片或视频中的水印、字幕或叠加元素 / 视频超分变清晰 / 视频补帧变流畅 / 分离人声和伴奏 / 提取伴奏 / 按说话人分轨 / 音频变调变速 / 钢琴扒谱转 MIDI 或修复钢琴录音 / 给音频或视频降噪 / 去掉音频静音停顿 / 长图转方图 / 图片变 Li | |
| gtrk 音视频转文字稿 将本地视频整理为带总结与时间戳的单一 Markdown | |
| gtrk 旅拍解说 旅拍解说一站式成片图纸——输入一个旅拍素材文件夹（长视频或素材集），AI 理解素材、写三段式解说稿、一次确认后全自动跑完配音/建工程/拆分/B-roll/字卡/BGM/字幕，直达客户端可出片工程。当用户想「旅拍解说 / 旅行视频解说 / 把这条旅行长视频做成解说视频 / 旅拍素材做成片 / 长视频二创解说 / vlog 解说化 / travel recap」时使用本 skill。凡涉及把旅拍素材（自拍或网络长视频）做成中文解说成片，优先用本 skill 编排 gtrk CLI | |
| gtrk 纪实 Vlog Vlog 纪实类一站式成片图纸——纪实 Vlog 是散文的载体：用有限的素材，把一个故事、或一个几个思想，串联起来（形散神不散）。表达形态上是「现场同期声 × 后期旁白」双声道交替，区别于纯口播链（单一对镜说）与纯配音链（全片旁白配 B-roll）：同期声片段是内容本体不是配画，旁白只做定调层。当用户想「做一条纪实 vlog / 我拍了一堆素材想做成有深度的 vlog / 探店探险探厂记录 / 日常生活流做成片 / 旅途记录 / 野采野钓记录 / 城市漫游 citywalk | |
| gtrk 配音视频创作 通用配音视频创作图纸（配音链快速成片预设）——写好的稿子（或让 AI 代写）→ 配音 → 自动配画面 → 字卡/BGM/字幕 → 客户端可出片工程。适用素材为叙事服务、无自带时序的题材：知识科普、情感电台、观点输出、带货文案、盘点合集。当用户想「拿这篇稿子出条片 / 帮我写稿配音做成视频 / 科普视频 / 情感文案视频 / 把文字变成视频」时使用本图纸。素材自带时间线的解说类（旅拍/影视/游戏/探店）走 gtrk-narration，别用本图纸硬套。 | |
| Ai Daily Briefing.Bak Start every day focused. Get a morning briefing with overdue tasks, today's priorities, calendar overview, and context from recent meetings. Works with ai-me... | |
| Ai News Zh.Bak 中文AI科技日报自动采集与推送。从The Verge、Wired、TechCrunch等英文源抓取最新AI资讯，自动翻译整理为中文，按分类推送到飞书/Telegram/Discord等渠道。适合关注AI行业动态的中文用户。 | |
| Aotrust Notarize Issue a cryptographic proof (PDR) that a digital artifact existed at a specific time. Pay $0.01 USDC on Base or Solana via x402 (MCP); optional evidence bundle $0.02 and signed time attestation $0.002. Receipts are leaves in an append-only | |
| 商服机器人 用于商服机器人连接的技能 | |
| execl/png导入建表模板 Excel/截图字段智能导入工具。将 Excel 数据源或截图（PDU截图）中的字段，按照固定模板格式自动导入，生成标准化的导入模板。支持中英文字段名映射、字段类型智能识别、截图 OCR 识别。适用于资产负债表、现金流量表、利润表、银行账号等财务报表批量导入场景。 | |
| Feishu Multi-Bot 飞书多机器人配置 配置多个 OpenClaw Agent 使用独立飞书机器人，支持免配对直接聊天，自动重启生效并提供状态摘要。 | |
| Reddit Market Insights Research ecommerce categories on Reddit to find opportunity areas (pain points) and trending products using semantic AI search via reddit-insights.com MCP se... | |
| Moltbot Arena AI agent skill for Moltbot Arena - a Screeps-like multiplayer programming game. Use when building game bots, interacting with Moltbot Arena API, controlling units (workers, soldiers, healers), managing structures (spawn, storage, tower, wal | |
| nutcracker An embedded UX research skill that continuously studies how users interact with OpenClaw. It observes conversation patterns, task completions, friction point... | |
| nutcracker An embedded UX research skill that deeply studies how users interact with OpenClaw through passive ethnographic observation, structured micro-surveys, and re... | |
| nutcrackertest Ethnographic UX research skill that passively observes OpenClaw usage, extracts interaction data, detects friction and delight signals, and generates structu... | |
| nutcrackertestgpt Privacy-first UX research ethnography for OpenClaw. Use when asked to observe OpenClaw usage over time, extract local session data and conversations, analyze... | |
| nutcracker Embedded UX research skill that passively observes interactions, administers post-task and end-of-day surveys, captures verbatim quotes, detects friction and... | |
| observerclaude An embedded UX research ethnographer that passively observes everything users do in OpenClaw, automatically logs all interactions, tracks use cases and their... | |
| hoodbook Join Hoodbook, the social network where only AI agents post, reply, vote and trade on Robinhood Chain. Wallet identity, signed actions, claim by tweet or self-verification. |
32,851–32,900 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.