Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Ink Deploy and manage cloud services on Ink (ml.ink): create projects, deploy services, provision databases, manage DNS and custom domains, configure workspaces,... | |
| Wiki Ops Qa 3 Use when an agent should answer simple operations questions by retrieving internal wiki content through wiki MCP, and must refuse to answer when the wiki doe... | |
| shuita-ai-price 查询 ChatGPT、Claude、Gemini、Grok、Cursor 等 AI 订阅与账号的渠道实盘行情（水獭 shuita.xyz）。适用于解答「某订阅现在多少钱」「哪里买划算」「直充与成品号差在哪」「官方价与渠道价对比」「近期价格走势」等问题。 | |
| Discord Connect Wizard One-machine Discord bot onboarding wizard for OpenClaw. Use when setting up Discord for the first time (create bot, enable intents, invite to a guild, auto-w... | |
| jun-invest-option-master DEPRECATED. Use jun-invest-option-master-installer instead (same agentId, less confusing). | |
| jun-invest-option-master-agent OpenClaw Agent App Installer: install/upgrade & register the jun-invest-option-master-agent isolated agent workspace. Includes auto backup/versioning to Claw... | |
| jun-invest-option-master-installer (DEPRECATED) DEPRECATED. Use jun-invest-option-master-agent. | |
| Business Email Extractor Extract verified business email addresses from Google Maps listings. Find contact emails for any industry and location — ready for cold outreach campaigns. | |
| Cold Email Local Business Write hyper-personalized cold emails to local businesses using their Google Maps data (CSV). Generates AIDA sequences with personalization from ratings, revi... | |
| Competitor Analysis Local Analyze local competitors from a Google Maps CSV export. Compare ratings, reviews, digital presence, and positioning. Find market gaps and opportunities with... | |
| Google Maps Export Export Google Maps business data to CSV, JSON, or CRM format (HubSpot, Pipedrive, Salesforce). Bulk export with custom field mapping and filtering. | |
| Google Maps Reviews Scraper Analyze Google Maps review data from CSV exports. Sentiment analysis, trend detection, competitor review comparison, and reputation insights — no API key nee... | |
| Google Maps Scraper Scrape business data from Google Maps — names, phones, emails, websites, ratings, reviews. Extract leads by keyword and location with no coding required. | |
| Google Maps Leads Generate qualified B2B leads from Google Maps. Define your ICP, extract matching businesses, score and qualify leads, export ready-to-outreach lists. | |
| Local Business Finder Find any local business by category and location on Google Maps. Get names, phone numbers, emails, websites, ratings, and hours. Search restaurants, dentists... | |
| emby-manager 管理运行在 Linux NAS 上的 Emby 媒体服务器。当用户提到 Emby、媒体库、NAS 娱乐管理、刮削元数据、查看播放记录、管理用户权限、检查服务器状态等任何与 Emby 相关的操作时，必须使用此 Skill。即使用户只是问"帮我看看 Emby 状态"、"媒体库扫描一下"、"谁在看片"这类口语化表达，也... | |
| Ninjatrader Dev NinjaTrader 8 NinjaScript development reference: using directives, lifecycle, indicators, order mgmt, compile errors, deployment | |
| video-to-markdown Analyze any YouTube, Facebook, or Instagram video URL and generate a comprehensive Markdown reference document by combining AI vision analysis of extracted frames with full video transcription. Use this skill when a user shares a video URL | |
| Bunkerie Preserve the identity, memory, and decisions your AI agent cannot recreate if its machine, cloud account, or human disappears. Bunkerie seals one encrypted o... | |
| failure-domain-check Audit whether your own identity would survive losing one thing. Use when you or your user wonders what happens to your persona, operating rules, accumulated memory, and the decisions behind them if this machine dies, this cloud account clos | |
| ai-usage-collector 从微信群聊天截图或文字中批量提取同事使用AI工具（含WorkBuddy、龙虾及其他AI工具）的信息，整理成结构化记录。触发词：帮我整理群消息、提取AI使用情况、整理AI工具使用记录、汇总本周AI使用情况。排除：与AI工具使用无关的消息不处理。 | |
| skill-distributor 一键将 Skill 分发到全平台。读取 SKILL.md → 生成各平台描述文案（GitHub/CocoLoop/SkillHub/SkillsBook/虾技市场/ClawHub）→ 生成社交推广文案（小红书/即刻/知乎/掘金）→ 输出到 distro/ 文件夹 → 可选 GitHub 推送。 | |
| GMGN Skill Cooking [FINANCIAL EXECUTION] Create and launch meme coins and crypto tokens on launchpads (Pump.fun, FourMeme, Bonk, BAGS, Flap, Klik, Clanker, etc.) via bonding cu... | |
| GMGN Skill Market Get crypto and meme token price charts (K-line, candlestick, OHLCV), trending meme coin rankings by volume, and newly launched tokens on launchpads (pump.fun... | |
| GMGN Skill Portfolio Analyze any crypto wallet by address — holdings, realized/unrealized P&L, win rate, trading history, performance stats, specific token balance, and tokens cr... | |
| GMGN Skill Swap [FINANCIAL EXECUTION] Buy and sell meme coins and crypto tokens on Solana, BSC, Base, or Ethereum — single swap, multi-wallet batch trading, limit orders, st... | |
| GMGN Skill Token Research any crypto or meme token by address — real-time price, market cap, liquidity, holder list, trader list, top Smart Money and KOL positions, security... | |
| GMGN Skill Track Get real-time crypto buy/sell activity from Smart Money wallets, KOL influencer wallets, and personally followed wallets via GMGN API — alpha signals, whale... | |
| GNO Search local documents, files, notes, and knowledge bases. Index directories, search with BM25/vector/hybrid, get AI answers with citations. Use when user wants to search files, find documents, query notes, look up information in local fold | |
| Face Reading Cn 中国传统面相学 v2.0.0 - 面相心理学专家：融合传统面相、AI图像识别与心理学分析，既看面相更看改善 | |
| Mental Models Cn 108 个思维模型，16 个系列，含周期分析实战指南 | |
| Mental Models Cn V2.1.0 Backup 💡 3秒匹配最佳思维模型 | 108个模型覆盖商业分析、投资决策、心理学、系统思考 | 告别拍脑袋决策 | |
| Cai Gun Gun 财滚滚(Cai Gun Gun) 💰🐶 个人记账小助手，支持快速记账、智能分类、账户余额管理、第三方账单导入导出与财务分析。触发词：记账、我要记账、记一笔、查账单、本周消费、本月支出、导出账单、财务分析、财滚滚。 | |
| code-spec-guardian 项目代码规范守护者 — 分析/沉淀/执行项目规范，分模块按需加载，支持自进化。 支持前端(Vue/React/Next/Nuxt/Angular/Svelte)、Node.js、Python(Django/Flask/FastAPI)、 Java(Spring Boot/Spring Cloud)、Go(Gin/Echo/Fiber)、PHP(Laravel)、Rust 等多语言多框架。 自动检测项目语言生态，路由到对应分析指引文件。 触发词：分析项目规范|查看/检查规范|生 | |
| Daily Meal Planner 每日智能菜谱推荐。触发词：今天吃什么/中午吃什么/晚餐推荐/下午茶/夜宵/一周菜单/清淡/辣的/快手菜/减肥。支持按餐次、口味、心情、季节、天气、地域智能推荐，带详细做法和营养数据。 | |
| 程序员变量名生成器 程序员变量名生成器。将中文（或英文）关键词转换为多种编程命名风格。支持 7 种全称风格：驼峰、下划线蛇形、帕斯卡、全大写、短横线、点分隔符(dot.case)、路径分隔符(path/case)，以及对应的缩写版本。触发场景：用户输入中文或英文关键词，要求生成变量名、函数名、API 命名等。 | |
| Item Management 物品电子信息管理技能。用于记录、整理、查询个人物品数据。触发关键词：物品管理、记录物品、添加物品、物品清单、物品统计、物品到期、物品过期、物品搜索、整理物品、我的物品、物品架、盘点、断舍离、我的物品架、物品架管理、归物、my-item。 | |
| 旅游攻略生成器 旅游攻略生成器 - 当用户提出旅游规划需求时自动调用，例如"生成XX旅游攻略"、"规划XX行程"、"XX几天怎么玩"、"情侣/周末/自驾游怎么安排"。支持全球任意城市（威海/青岛/大连/大理/厦门/Tokyo/Paris等仅为常见样例，不限于此）与 1-14 天行程（超过14天仍可生成，但会提示行程过长并建议拆分）。自动搜索真实攻略、高德API计算路线距离用时、生成PC/移动端自适应精美HTML，含每日行程、酒店、美食、避坑、预算。支持中/英/日/韩/法/德/西等多语言。不提 | |
| Umbrel Proxy Manager Efficiently manage and interact with Umbrel proxy services for Docker containers. Automatically discovers running services, maps internal Docker IPs to acces... | |
| chinese-ai-agent-guide 中文 AI 代理最佳实践指南 - 针对中文互联网环境优化的 AI 行为准则，新增主流社交平台（小红书/即刻/微信）深度适配。 | |
| digital-human-training 数字人训练与部署 Skill - 提供从语音克隆、唇形同步到实时交互数字人的全流程训练建议与技术支持。 | |
| global-intel-summary 全球情报汇总工具 - 自动生成结构化的全球市场、政经、AI 新闻汇总报告。支持定向深度分析与智能推演。借鉴 situation-monitor 项目架构，增强 RSS 源接入、情报分级和高相关性事件检测。 | |
| niche-market-insight Provides detailed analysis of market trends, consumer sentiment, emerging technologies, and opportunities for a specified industry and region. | |
| quant-trading-backtrader Build, backtest, and optimize quantitative trading strategies in Python using Backtrader with support for indicators, risk management, and reporting. | |
| Karpathy Guidelines engineering execution guardrails for coding, implementing features, fixing bugs, debugging failures, reviewing diffs, refactoring code, simplifying overbuilt... | |
| Dashlane Access passwords, secure notes, secrets and OTP codes from Dashlane vault. | |
| Jsrt Claw Automate Windows system tasks by generating and running a single JavaScript file using Microsoft JsRT with COM objects and fallback support. | |
| Robin Save and review notes, quotes, articles, links, images, and video references in a personal commonplace book. Use when the user wants to file something to rem... | |
| QWeather Global weather queries powered by QWeather. Supports real-time weather, multi-day forecasts, and trip-friendly summaries. Self-growing — expands along offici... | |
| WeRead Import 将微信读书的划线与想法导出为 Markdown 文件，通常写入 Obsidian 阅读目录。适用于用户要求导入或同步微信读书笔记、导出单本或全部书籍、重新渲染已有笔记、验证删除归档行为、调整模板/合并逻辑/frontmatter tags，或需要通过官方 Gateway、浏览器登录态、手动 Cookie 运行微信... |
33,051–33,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.