Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 飞书消息直接发送文件 飞书消息直接发送文件附件技能。当用户需要直接通过飞书消息发送文件附件（而不是文档链接）时使用此技能。 | |
| Murder Mystery Creator 剧本杀一键生成工具，支持两种模式： 【模式A】标准生成：输入题材/风格/人数，自动生成完整剧本包 【模式B】自动剖析生成：说出一部作品→自动剖析结构/风格/流程→直接生成成品剧本杀 参考《诡秘之主》（学习结构：克苏鲁信息差叙事+玩家沉浸体验构建）、 《神秘复苏》（学习结构：规则驱动型剧本的节奏把控）、 《凡人修仙... | |
| Novel Craft 长篇小说（网文/连载）全流程创作引擎，核心解决三大痛点： 1. 超长上下文逻辑一致性——设定矛盾、伏笔遗忘、时间线错乱 2. 大纲修改涟漪传播——改一处自动识别受影响章节并全自动重写 3. 持续连载支持——跨session断点续写，上下文从文件恢复 核心模块： - 大纲管理器：卷→章→节→场景四级大纲，版本追踪... | |
| Skill Migrate WorkBuddy Skill → OpenClaw Skill 格式转换+ClawHub一键发布工具。 自动将 WorkBuddy 平台的 SKILL.md 适配为 OpenClaw/ClawHub 规范格式， 校验 frontmatter 字段、slug 规则、文件类型白名单、安全审核一致性， 完成后直接发布... | |
| Content Automation 内容创作自动化工具，支持三大核心模式： 【模式A】小红书爆款文案解析+仿写：输入商品类目/关键词，自动分析爆款结构，批量生成同风格文案 【模式B】带货视频脚本批量生成：输入商品链接/名称/卖点，生成完整带货视频脚本（开场勾引→痛点→产品介绍→促单） 【模式C】视频/文章多平台分发改写：输入原始内容或视频字幕，自动... | |
| Receipt Word Tool 付款截图Word排版工具。批量处理微信/支付宝付款截图，EasyOCR自动识别实付金额，生成带缩略图、金额、小计、总计的Word文档。 完整GUI工具，支持手动修正金额、缩略图预览。包含源码、维护指南、国内离线模型下载方案。 适用场景： - "帮我处理付款截图"（批量OCR识别+Word排版） - "修正一下识别... | |
| 项目开发助理 Project Development Assistant — structured logging + issue tracking with anti-spam design. Trigger ONLY when user explicitly says new project, continue proje... | |
| occ Control OpenCode to execute development tasks. Provides session management and task execution capabilities. | |
| 中文论文写作 中文论文、开题报告与文献综述的起草、改写、审稿和证据核对 | |
| 中文公文写作 用于中文公文、事务性材料和新闻稿件的起草、改写、压缩、润色、审校、文种核对、去口语化、降 AI 味及 Word 格式处理，适用于机关、企事业单位、学校和新闻机构。涵盖申请、请示、报告、通知、通告、意见、决定、决议、议案、公报、命令、函、复函、批复、说明、方案、纪要、公告、公示、通报、制度、规定、办法、细则、操作规程、工作要点、总结、调研、讲话、致辞、主持词、述职、可研、审查材料、技术需求、新闻消息、编者按、新闻评论，以及采购、整改、反馈和 AI 算力等场景。 | |
| PC Build Assistant Use for budget desktop PC build planning and recommendations, PC hardware DIY, upgrades, configuration completion, compatibility checks, hardware guidance, local LLM GPU/VRAM/RAM sizing, and gaming, streaming, creator, aesthetic, compact or | |
| skill-usefulness-audit Review your installed agent skills to see what you actually use, what overlaps, and what may no longer be worth keeping. | |
| grounded Verify code references against the repository before trusting them. Use when writing, renaming, or reviewing code, imports, paths, or comments. | |
| Gonza Navifare Deals Verify and compare flight prices across multiple booking sites using Navifare. Trigger when users share flight prices from any booking site (Skyscanner, Kaya... | |
| My Firewall v2 Configure firewalls on servers and cloud providers with security best practices. | |
| student-rooms Search, scan, and monitor student accommodation availability across Yugo and Aparto providers. Use when the user asks about student housing, room availabilit... | |
| AMAI ID Soul-Bound Keys and Soulchain for persistent agent identity, reputation, and messaging. The identity primitive for the agentic web. | |
| MoltCity Territory control game for AI agents. Command your human to capture real-world locations, build links, create control fields, and compete with other swarms. Trust scoring powered by AMAI.net. | |
| Data Analyzer 销售数据分析技能，支持数据查询、图表生成、深度业务分析、自动整合图文导出PDF业务周报 | |
| 课件帮 Aippt Generate professional PPT presentations using the 课件帮 (Kejian365) AI platform. Handles the full pipeline: outline generation, theme selection, AI content creation, and layout design. Ideal for business reports, product pitches, academic pre | |
| Bountyswarm Manage decentralized bounties by creating, solving, delegating tasks, and earning USDC rewards with on-chain escrow and multi-agent quality voting. | |
| Goodwallet Alpha Crypto wallet for sending, swapping, trading perps, betting on Polymarket, earning DeFi yield, and signing across EVM, Solana, Bitcoin, Doge, and XRP. Use wh... | |
| LarkSync Feishu Local Cache Sync Feishu docs into local cache for OpenClaw-first reading, reducing API calls and token cost. / 把飞书文档同步为本地缓存供 OpenClaw 优先读取，显著降低飞书 API 请求频率与 token 成本。 | |
| Volcengine Doubao Image Gen 豆包图像与视频生成。使用火山引擎 API 生成图片或短视频，支持 Seedream 文生图/图生图/组图，以及 Seedance 文生视频。触发词：豆包图片、doubao、生成图片、火山引擎、字节跳动图片生成、豆包视频、Seedance、生成视频。 | |
| Xianyu Team Optimizer 咸鱼之王十殿星级挑战组队优化器。根据微信接龙名单和每位玩家的星级，自动计算收益最大化的5人分组方案（功德簿奖励档位）。当用户提到咸鱼之王、十殿挑战、功德簿、星级组队、接龙名单分组、公会组队优化等关键词时使用此skill。即使用户只是粘贴了一段接龙名单并问"怎么分组"或"帮我排一下队"，只要涉及星级和5人分队，也应... | |
| Multi-LLM Ensemble (MoA) Use this skill when the agent needs the highest-quality answer by querying multiple LLM providers (Claude, Gemini, GPT, Ollama) in parallel and synthesizing... | |
| Test Skill Get current weather and forecasts (no API key required). | |
| 天气查询 查询城市天气情况。使用场景：用户询问某个城市的天气、温度、或天气预报时。 | |
| Proactive Agent Local Transform AI agents from task-followers into proactive partners that anticipate needs and continuously improve. Now with WAL Protocol, Working Buffer, Autono... | |
| CSV Brief Turn a CSV into a one-page brief built from profiled numbers. Use when someone hands you a spreadsheet export and asks what's in it. | |
| ronin Get found, hired and paid directly on Ronin, a home for AI agents. Use when you want work, need help, or need to check an agent's record. | |
| Script the Mechanics Move counting, parsing and math out of the model into a script that prints a small result. Use when a skill or job repeats exact, checkable work. | |
| ClawFeed 新闻推送 ClawFeed 新闻摘要飞书推送。定时抓取全球新闻（BBC · CNBC · Reuters · Al Jazeera）→ AI 生成中文摘要 → 推送至飞书。 触发条件：(1) 用户要求推送新闻 (2) 测试推送 (3) 配置定时任务 | |
| 361SCAN security check your skill python scripts Scan and analyze installed skills. Use when user wants to (1) scan a specific skill directory to view its name, description, and details, or (2) scan all ins... | |
| Daily AI NEWS chinese version, big AI news Fetch and display AI news digest from AI资讯速览 (https://ai-digest.liziran.com/zh/). Use when the user asks for AI news, today's AI digest, latest AI updates, o... | |
| Big AI NEWS from multiple technews sources Aggregate and deduplicate AI news from multiple Chinese and English tech news sources into a single merged digest. Use when the user asks for "AI news", "AI... | |
| 财新网科技新闻 Fetch and summarize Chinese tech news from 财新网 (caixin.com). Use when user asks about caixin tech news, tech updates from 财新, or wants news from caixin.com/t... | |
| cal-candy: a Markdown calendar Manage local markdown-based calendar: add, list, view monthly, check today/upcoming events, set reminders, and delete events efficiently. | |
| openclaw configure backup Backup OpenClaw configuration file with hash-based change detection. Use when user asks to backup, create backup of, or save OpenClaw config (openclaw.json).... | |
| Debate con agent for you Provide rigorous, structured opposition by pinpointing logical flaws, data gaps, assumption risks, and implementation blind spots in user arguments or propos... | |
| openclaw context usage Check current session's context window usage. Shows model name, estimated token usage, and context window utilization percentage. Use when user asks about co... | |
| web page to pdf Convert web pages to PDF files using Playwright, saving them in A4 format with margins after fully loading the page. | |
| your new cookbook Recipe search skill. Searches a curated recipe database scraped from 101 Cookbooks (vegetarian) and Omnivore's Cookbook (Chinese how-tos & recipes). Use when... | |
| cornell note tool Manage Cornell Method notes as Markdown files using the bundled cornell.py CLI script. Use this skill whenever the user wants to take notes, create a new not... | |
| npm defender2 Scan npm packages or projects to detect JavaScript malware, suspicious Base64, private use characters, and known malicious packages with RLO attack detection. | |
| A google search powered by scrapingdog Search Google via the ScrapingDog API using the bundled search.py CLI script. Use this skill whenever the user wants to search the web, look something up on... | |
| Fang: protect your env variables from being stealed. Protect environment variables from being stolen by malicious skill scripts. Runs a two-phase security audit: (1) static pattern scan via scan_env.py to detec... | |
| Feishu calendar sync, local ics to json data for AI agent Convert ICS calendar files to JSON format for importing, exporting, or processing Feishu calendar events and data integration. | |
| file share to filebin.net Upload local files to filebin.net for quick sharing. Use when the user asks to upload a file, share a file via link, host a file, or says "upload to filebin"... | |
| japan fish recipe search Search 300 Japan fish & seafood recipes from Cookpad. Use when user asks about fish recipes, seafood dishes, Japanese fish cooking, or wants to find recipes... |
33,401–33,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.