Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Claude Code Invoke 通过 claude -p 命令调用 Claude Code 执行单次 Prompt 任务。当用户要求"用 Claude Code 执行 XXX"、"调用 claude -p"、"用 Claude Code 调查/分析 XXX" 时使用。前提：目标目录必须是 Git 仓库。 | |
| Crypto Radar 数字货币行情监控工具。当用户询问「比特币」「以太坊」「BTC」「ETH」「数字货币行情」「加密货币」「Crypto」「比特币价格」「以太坊价格」时使用。使用 Yahoo Finance（实时价格）和 CoinGecko（市值/交易量）双数据源。📢微信公众号：PM熊叔（打造一人公司的投研团队） | |
| Futures Radar 期货与大宗商品行情监控工具。当用户询问「原油」「黄金」「白银」「天然气」「铜」「期货行情」「大宗商品」「WTI」「布伦特」「金银比」「油金比」时使用。使用 Yahoo Finance chart API 获取实时期货数据。📢微信公众号：PM熊叔（打造一人公司的投研团队） | |
| Fx Radar 全球汇率监控工具。当用户询问「美元汇率」「人民币汇率」「港币汇率」「日元汇率」「欧元汇率」「英镑汇率」「美元兑人民币」「USD/CNY」「汇率」「外汇」「离岸人民币」「在岸人民币」「换汇」时使用。使用 Yahoo Finance 获取实时汇率数据。📢微信公众号：PM熊叔（打造一人公司的投研团队） | |
| Hk Stock Radar 港股行情与舆情监控工具。当用户询问「港股怎么样」「恒生指数」「港股大盘」「港股涨跌」「HK股」「港股行情监控」「南向资金」时使用。支持东方财富港股API、新浪财经港股接口、Yahoo Finance获取实时行情，以及Google News RSS和X/Twitter舆情监控。📢微信公众号：PM熊叔（打造一人公司... | |
| 热点收集雷达 多平台追踪热点话题，分析生命周期与共鸣度，生成结构化每日热点报告并推送带选题建议的AI日报。 | |
| Investment Risk Scanner (Buffett + Porter Framework) Investment risk scanner using Buffett + Porter's Five Forces framework. Triggers when users ask "analyze XXX's risk", "is this project legit", "can I buy thi... | |
| Skill Vitals — Skill Audit Audit installed skills, cost, conflicts, and risk | |
| Trump Sentiment Trump 舆情分析 Skill。通过多渠道覆盖（Truth Social/X搜索/Google News实时/大V主页）捕获 Trump 言行，结合市场反应验证，辅助投资决策。触发：「/trump」「分析Trump舆情」。📢微信公众号：PM熊叔（打造一人公司的投研团队） | |
| Us Stock Radar Gold3bear 美股行情与舆情监控工具。当用户询问「美股怎么样」「纳指」「标普」「道指」「美股大盘」「今晚美股」「US股」「美股行情」「美股期货」「NQ」「ES」时使用。支持Yahoo Finance获取实时行情，以及Google News RSS和X/Twitter舆情监控。📢微信公众号：PM熊叔（打造一人公司的投研团队） | |
| 个人理财预算规划助手 Use this skill when helping users plan personal finances, create monthly budgets, track expenses, set savings goals, or optimize spending habits. Covers budg... | |
| Design System Builder Comprehensive guide for building enterprise-grade component libraries and design systems from scratch. Use this skill when a frontend engineer needs to: (1)... | |
| 中文商务邮件写作助手 Use when writing or polishing Chinese business emails: drafting from scratch, adjusting tone (formal/casual/assertive), structuring requests, follow-ups, apo... | |
| 健身训练计划制定助手 Create personalized Chinese fitness training plans based on goals, fitness level, available equipment, and schedule. Use when someone needs a structured work... | |
| Frontend Interviewer CN 中文前端开发面试辅导，支持分级练习、模拟问答、面试出题及详细解析，涵盖JS/TS/React/Vue等核心领域。 | |
| English Speaking & Writing Coach Use when coaching English speaking or writing skills: correcting grammar, improving sentence fluency, expanding vocabulary, practicing conversations, prepari... | |
| Market Research Report Generator Use this skill when you need to generate structured market research reports, competitive landscape analysis, industry trend summaries, or TAM/SAM/SOM sizing... | |
| 会议记录整理与行动项提取 Use when you need to organize meeting notes, extract action items, and generate structured summaries. Ideal for processing raw meeting transcripts or bullet... | |
| Micro-Frontend Architecture Micro-frontend architecture design and implementation guide. Use when: designing micro-frontend architecture, choosing between Module Federation/qiankun/sing... | |
| Turborepo Monorepo Patterns Use when setting up or managing a Turborepo-based monorepo. Covers workspace configuration, task pipelines, caching strategies, shared packages, and CI/CD in... | |
| Next.js 15 Best Practices Apply Next.js 15 best practices and modern patterns including App Router, Server Components, Server Actions, caching strategies, and performance optimization... | |
| 播客音频节目策划助手 Use this skill when planning a podcast episode or audio program. Covers episode structure design, topic research, interview question frameworks, show notes w... | |
| Prisma ORM Patterns Use this skill when working with Prisma ORM in Node.js/TypeScript projects. Covers schema design, migrations, query optimization, relations, transactions, an... | |
| 读书笔记整理与知识图谱构建 Use when organizing reading notes from books, articles, or papers into structured summaries and knowledge maps. Helps extract key insights, connect ideas acr... | |
| 短视频脚本创作助手 Use this skill when creating short-form video scripts for platforms like TikTok, Douyin, Instagram Reels, YouTube Shorts, or WeChat Channels. Activates on re... | |
| SQL 查询优化助手 Use this skill when you need to write, review, optimize, or debug SQL queries. Covers query construction, performance tuning, index strategy, window function... | |
| 学习计划制定助手 Use this skill when creating personalized study plans, learning roadmaps, or skill acquisition schedules. Activates on requests like "make a study plan for X... | |
| 旅行攻略规划助手 Use this skill when you need to plan a trip: build day-by-day itineraries, recommend accommodations and restaurants, estimate budgets, handle visa info, and... | |
| Vite Plugin Development Use when developing Vite plugins: scaffolding plugin structure, implementing hooks (transform, resolveId, load, buildStart, etc.), handling virtual modules,... | |
| 中文周报日报自动生成 Automatically generate professional Chinese weekly/daily work reports from bullet-point inputs. Use when you need to transform raw task notes into polished 周... | |
| 小红书爆款文案写作助手 Use this skill when you need to write viral Xiaohongshu (小红书) posts, product notes, travel diaries, lifestyle content, or any copy optimized for the RED plat... | |
| Intervention Agent AI 协作助手，以「错题本」机制帮助 AI 学习改进。支持人为干预、自动记录摩擦点、协作偏好记忆，让 AI 越用越顺手。 | |
| MoltenView Push persistent visual views (charts, metrics, lists, progress bars) to MoltenView Mac app. Use when agent output benefits from visual display that persists... | |
| Dingtalk Attendance 查询和分析钉钉考勤打卡数据。当用户提到打卡、考勤、迟到、早退、旷工、出勤率、谁没打卡、上班情况、DingTalk attendance 等关键词时触发此 skill。即使用户没有明确说"打卡"，只要涉及员工到岗、缺勤、工时相关的问题，也应该使用这个 skill。 | |
| Golden Claw Manage GoldenClaw (GCLAW) on Solana. Create wallet, claim from faucet, check balance, send tokens, view history. For OpenClaw AI agents. | |
| AgentRecall Persistent compounding memory for AI agents. 6 MCP tools: session_start, remember, recall, session_end, check, digest. Correction-first memory with watch_for... | |
| Multi Engine Search for Agent AI Agent search platform with 9 engines, Google 13 sub-types, vertical scene search, and intelligent auto/multi/extract modes. Designed for LLM and AI agent... | |
| Proxy4agent Residential proxy for AI agents — fetch any URL through 2M+ real IPs, bypass anti-bot, geo-target, sticky sessions. | |
| downloader Extract video details, play URLs, user posts, collections, comments, live room info, and dynamic data from Douyin, TikTok, and Bilibili via multiple API endp... | |
| 每日安全巡检 OpenClaw 每日安全巡检技能。按固定清单检查网关 loopback、防火墙提醒、API 密钥在 .env、SOUL.md 安全规则、认证异常，并执行 openclaw security audit 与 openclaw doctor，输出简短报告与 0–10 安全评分；可由 cron 定时触发，结果可投递到... | |
| 7 Powers Hamilton Helmer's strategic framework for achieving sustainable competitive advantage through seven distinct power types. Use when analyzing business strateg... | |
| 狐表(Foxtable) 移动端开发 狐表(Foxtable)移动端开发完整文档，涵盖HTML入门、WeUI框架、微信接口、客户端类、JSON解析、异步编程、Web数据源等，完整保留多层导航结构 | |
| 狐表(Foxtable) 开发文档 狐表(Foxtable)开发文档第 1 部分（共 2 部分，因 ClawHub 单包体积限制拆分）。基于最新 foxtable.chm 完整重转，完整保留 9 层导航结构。另见 foxtable-dev-doc-2。 | |
| Foxtable 开发文档（上） 狐表(Foxtable)开发文档第 1 部分（共 2 部分，因 ClawHub 单包体积限制拆分）。基于最新 foxtable.chm 完整重转，完整保留 9 层导航结构。另见 foxtable-dev-doc-2。 | |
| 腾讯会议面试助手 基于腾讯会议(tmeet)通讯录与会议录制/纪要，覆盖面试全链路——会前生成候选人画像与结构化面试提纲，会中记录关键信息，会后输出带维度评分与录用建议的结构化评估。当用户说"准备面试""生成面试提纲""面试评估""候选人画像""面试记录整理"时触发。 | |
| 会议周报/复盘自动生成器 基于腾讯会议（tmeet）智能纪要与转写，把多场会议聚合为结构化周报与复盘报告。当用户说「生成本周周报」「会议复盘」「汇总会议纪要做复盘」「提取跨会议行动项」「把几次会的结论整理成一份报告」时触发。 | |
| 会议健康度分析仪 基于腾讯会议(tmeet)会议报告（参会人/等候室）与智能纪要，量化会议健康度——发言均衡度、议题覆盖率、决策产出率、沉默成员识别，并给出改进建议。当用户说"分析会议效率""会议健康度""谁没发言""决策产出率""会议参与度"时触发。 | |
| 跨会议知识库 基于腾讯会议(tmeet)多场会议的智能纪要与转写，把分散的会议决策、结论、行动项与风险沉淀为可检索的知识库，实现"周报/复盘/面试/培训一气呵成"的跨场景串联。当用户说"沉淀会议知识""跨会议检索""建个会议知识库""之前会议怎么定的"时触发。 | |
| 培训纪要结构化手册 基于腾讯会议(tmeet)培训会议的录制转写，把冗长转写稿自动整理为带章节结构、要点提炼与自测题的培训手册。当用户说"整理培训纪要""把培训转写做成手册""生成培训自测题""培训材料结构化"时触发。 | |
| Acceptance Report Gen 汇总测试用例执行结果、功能验收结论、性能安全评估，生成完整的系统验收报告，包含测试概述、结果汇总、缺陷清单、验收结论（✅通过/⚠️有条件通过/❌不通过）。 |
33,201–33,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.