Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Pilot Base 中试基地/中试平台建设运营全流程技能。当用户需要规划、建设或运营中试基地/中试平台时使用，涵盖规划定位、政策资金、创新人才、管理团队、产业领域、知识产权、运营模式、合规管控、项目管理、生态建设、合作伙伴、年度目标、阶段考评等平台层面全流程。适用于高校院所、产业研究院、化工园区、制造业企业、政府平台等机构的中试基地... | |
| Pilot Base Agent 中试基地Agent（OPC导师版）：统筹8位专业角色，帮助技术项目跑通中试全流程。覆盖工艺放大、测试验证、质量合规、安全环保、设备排期、技术转移与行业专家咨询，最终交付可量产、可合规、可商业化验证的完整方案。 | |
| Platform Architecture Design 基于需求分析，设计完整平台架构方案，包含C4架构视图、六层架构、核心模块划分、技术栈比选、关键数据流和API设计。 | |
| 胡田 OPC导师 任正非 心智模型 任正非的思维框架与管理哲学。基于公开演讲、《华为基本法》、《下一个倒下的会不会是华为》的深度调研， 提炼3个核心心智模型、2条决策启发式和完整的表达DNA。 用途：作为思维顾问，用任正非的视角分析组织进化、危机应对、管理变革。 | |
| Requesthunt Generate user demand research reports from real user feedback. Scrape and analyze feature requests, complaints, and questions from Reddit, X, GitHub, YouTube... | |
| 逆向工程Agent 技术逆向分析Agent：快速看透任何产品/平台/系统的技术本质——它怎么做的、为什么这么做、是不是真的在做。覆盖SaaS/AI Agent/移动App/开源项目/API服务等。 | |
| Roadshow Planning 路演规划与融资演示技能。当用户需要规划路演、准备融资演示、设计投资人展示流程、撰写路演话术、准备投资人问答、制作路演PPT结构、规划路演时间分配、准备投资人问答策略、撰写执行摘要、展示商业模式、展示财务模型、展示竞争分析、介绍团队、说明融资用途时使用此技能。覆盖创业路演、融资路演、项目路演、投资人演示、Pitch... | |
| Sit Innovation Method 基于SIT（Systematic Inventive Thinking）系统创新思维方法论，提供5种核心思维策略（减法策略、除法策略、乘法策略、任务统筹策略、属性依存策略），帮助用户快速生成创新方案。SIT起源于20世纪90年代中期的以色列，由TRIZ理论简化发展而来，学习门槛低，适合商业、产品、服务、营销、运营... | |
| 苏格拉底-心智模型 苏格拉底的思维框架与对话方式。基于柏拉图对话录、色诺芬记载等一手文献的深度调研， 提炼3个核心心智模型、2条决策启发式和完整的表达DNA。 用途：作为思维顾问，用苏格拉底的视角分析伦理困境、澄清概念、通过追问深化思考。 | |
| 创业项目评估器 通过结构化框架评估创业想法的可行性与市场潜力，输出包含量化评分、市场分析、风险识别和行动建议的完整评估报告。适用于刚有创业想法、方向不确定、多个想法犹豫需决策参考的创业者。 | |
| 胡田 OPC导师 苏轼 心智模型 基于女娲心智蒸馏方法论，对苏轼思维模式、人格特质、决策逻辑进行系统性蒸馏 | |
| 系统架构师Agent 专业系统架构设计Agent：将模糊业务需求转化为完整的系统架构方案，覆盖需求分析、平台架构设计、风险评估与成本估算。适合创业者、产品经理、技术负责人快速获得可落地的架构方案。 | |
| Tech Manager Office 技术经理人事务所Agent（OPC导师版）：统筹5位专家角色，为已通过验证的技术成果完成技术交易全流程。覆盖技术评估、交易策略、尽调报告、合同草案与交割方案，核心使命是'找到对的人、谈成对的价、签成对的约'。 | |
| Tech Service Agent 科技服务业机构Agent：专门负责采集、维护和查询全国科技服务业机构信息。支持多源采集、增量更新、每日简报、DCAR周报与智能查询，覆盖孵化器/众创空间、中试基地、概念验证中心、科技园区、专精特新企业等全品类机构。 | |
| Test Case Generator 根据系统架构方案和验收清单，自动生成结构化的全量测试用例，覆盖功能测试、性能测试、安全测试和兼容性测试，按P0/P1/P2优先级排序。 | |
| Trademark Quick Check 面向中小企业/个人创业者的轻量级商标快速预查和申请流程导航工具。当用户输入商标名称/图样、查询近似商标、了解商标注册流程、获取商品服务类别推荐时使用此技能。覆盖商标查询、商标近似度分析、注册风险评估、尼斯分类推荐、申请流程导航等场景。关键词：商标查询、商标预查、近似商标、商标注册、商标类别、尼斯分类、商标申请、商... | |
| Training Annual Plan 全年培训排期总控：年度培训计划编制（1-12月）、各期培训档期排布（避免冲突）、场地/讲师/资源冲突检测、季度/月度计划调整、全年培训日历视图、历史同期对比辅助决策。 | |
| Training Certificate Mgmt 培训证书全生命周期管理：证书模板设计、证书生成（含编号/学员信息/培训内容/成绩）、证书发放与签收确认、证书查询验证（二维码/编号）、证书续期/升级管理、证书作废与补办流程。 | |
| Training Checklist 培训筹备全流程检查清单：逐项检查场地/酒店/设备/讲师/教材/物料等准备状态，输出✅完备/⚠️缺漏/❌未启动三级状态，自动生成周度进度小结。 | |
| Training Community 从单次培训到持续社区的转化引擎：学员社群搭建、后续活动推送、老学员裂变邀约、终身学习社群运营，实现培训-社区-复购的闭环。 | |
| Training Exam Mgmt 考试全流程管理：试卷生成（客观题/主观题/实操题）、考试排期、在线/线下考试执行、成绩录入、成绩分析、证书生成与发放。 | |
| Training Execution 培训现场执行全流程跟踪：课程执行状态、学员签到考勤、物料发放管理、考评测试组织、现场问题记录与应急处理。 | |
| Training Finance 培训学员管理与财务结算一体化工具：报名登记、收费确认、成本核算、讲师分成、利润报表。 | |
| Training Material Mgmt 教材与课件管理：课件版本管理、教材归档、课件审校流程、版权确认、教材分发管理、更新记录追踪。 | |
| Training Partner Mgmt 合作机构管理：培训机构信息登记（高校/协会/园区/酒店等）、合作协议管理、结算记录、合作评价、机构联系人维护。 | |
| Training Satisfaction 培训满意度全链路管理：满意度调查问卷设计（课程/讲师/组织/场地多维）、问卷发放与回收、自动汇总分析（NPS评分/词云/改进建议）、满意度趋势追踪、改进项闭环跟踪（问题→责任人→整改→验证）。 | |
| Training Scheduler 培训全流程计划编排工具：时间排期、讲师邀约、课程设计、教材准备、场地酒店预订，自动生成筹备日程表。 | |
| Training Teacher Mgmt 师资管理：讲师资源库的建设与长期管理，覆盖讲师信息登记、资质审核、授课领域分类、授课记录、评价评级、课酬标准、档期管理等全流程。 | |
| Wanpaike Opc Business Model Analysis 基于OPC版商业模式画布和单位经济模型，系统分析和验证创业项目的盈利能力与可持续性。 | |
| Wanpaike Opc Business Plan 专业商业计划书生成工具，精简问答+动态财务+原创分析框架+PPT自动生成 | |
| Wanpaike Opc Investor Due Diligence 投资者背景调查工具，系统化核查投资方资质、资金来源、过往业绩与潜在风险 | |
| Wanpaike Opc Overseas Investment Compliance 为OPC创业者提供对外投资合规诊断，涵盖审批路径、风险标记及三类主体差异化合规方案。 | |
| Wanpaike Opc Tech Due Diligence 技术尽调初筛工具，用于投资前的技术可行性评估、团队背景核查、专利验证。适用于科技创新项目的真实性核查，识别虚假技术和夸大宣传。核心能力：技术可行性评估、团队背景核查、专利备案验证、商业模式分析。 | |
| 胡田 OPC导师 维特根斯坦 心智模型 维特根斯坦的思维框架与语言分析方法。基于《逻辑哲学论》《哲学研究》等一手文献的深度调研， 提炼4个核心心智模型、1条决策启发式和完整的表达DNA。 用途：作为思维顾问，用维特根斯坦的视角分析语言困惑、追问本质的有效性、处理"不可说"的领域。 | |
| Brain Audit Marketing Advisor ที่ปรึกษาด้านการตลาดและการขายที่ใช้หลักการ Brain Audit เป็นกรอบคิดในหัว บทสนทนาเป็นธรรมชาติเหมือนเพื่อนที่เก่งเรื่องนี้มากๆ นั่งคุยกัน ไม่ใช่การกรอกแบบฟอร์ม... | |
| Canva Presentation Designer — Presentation Bible Edition Presentation Strategist ที่ใช้หลักการ Visual-First Design (พรีเซ้นฉลาดเน้นภาพไม่เน้นพูด) เป็นกรอบคิดหลักในการวิเคราะห์เนื้อหาและออกแบบ slide deck ก่อนสร้างจร... | |
| Psychology of Money Advisor ที่ปรึกษาทางการเงินที่ใช้หลักคิดจากหนังสือ The Psychology of Money โดย Morgan Housel เป็นคนใจเย็น สุขุม เป็นผู้ใหญ่ ไม่ตัดสินผู้ใช้ ฟังก่อนเสมอ ให้มุมมองและแ... | |
| Skill with Prompt Engineering by Gen AI Space A Prompt Engineering assistant based on Gen AI Space's 16-technique framework. Helps with two things: creating ready-to-use prompts, and building high-qualit... | |
| Deterministic security fixes for infrastructure code via Gomboc.ai Community Edition Automatically scan and deterministically fix security issues in Terraform, CloudFormation, and IaC with merge-ready pull requests and CI/CD integration. | |
| Code Remediation with Gomboc.ai Community Edition Automatically scans and generates deterministic, merge-ready code fixes for infrastructure, app code, and configs using Gomboc.ai's Open Remediation Language. | |
| agentconcierge Find and recommend AI agents for any workflow using AgentConcierge. Use when someone asks which AI tools or agents would help them for their role, task, or p... | |
| 元呈 yotta-present 元呈 —— AI 输出的默认呈现层：智能体先把输出内容判为「内容类型」，再选「呈现形态」（结论卡/表格/正文/指标板/问答卡/报告/图表…），用 yotta_present CLI 或 present_result MCP 统一渲染成可复制的 Markdown / 纯文本（按需附本地 SVG）。平台自适应（--platform / platform）：webchat 完整 Markdown、discord/whatsapp 表格转列表+标题转加粗、plain 去符号；渲染通道 | |
| Hoverbot Chatbot Create, embed, and manage AI chatbots for any website in under 2 minutes using HoverBot. | |
| memo-bridge This skill should be used when the user wants to export, import, backup, migrate, or transfer AI memory/context between different AI tools. It handles memory... | |
| multi-agent-writer Use when requests involve writing articles, generating news, fetching hotspots, or producing content for social media (WeChat, Xiaohongshu, etc.). Triggers i... | |
| hi-light Ear Skill 以用户可执行的工作流方式安装、配置和排查 HiLight OpenClaw 插件。用户想把 OpenClaw 连接到 HiLight、安装 `@art_style666/hi-light` 插件、把 `channels["hi-light"]` 写入 OpenClaw 配置、更新 HiLight API Key... | |
| 微信自动写作排版专业技能（包含公众号发布功能） 支持微信公众号深度内容从Markdown写作、爆款方法论指导、94种排版主题选择到图片上传、草稿创建及一键发布的全流程管理。 | |
| Agency Orchestrator 多 Agent 协作调度系统 - 自动分析任务、选择最佳 Agent、协调多 Agent 协作完成复杂任务 | |
| Douyin Video Publisher 自动登录抖音账号，上传并发布视频到抖音创作者平台，支持视频标签管理和登录状态检查。 | |
| ArcGIS Pro深度学习训练数据补全 补全ArcGIS Pro深度学习训练数据缺失文件，支持9种元数据格式（PASCAL_VOC_rectangles、KITTI_rectangles、Classified_Tiles、RCNN_Masks、Labeled_Tiles、MultiLabeled_Tiles、Exported_Tiles、CycleGA... |
33,351–33,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.