Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Wenyuan Deliberation Three-seat deliberation protocol for complex decisions: exposes assumptions, compares options, and identifies risks. | |
| Safari Control Use Safari directly on macOS when work must happen in the user's real Safari session instead of a separate automation browser. Best for reading the current t... | |
| Agent Step Sequencer Multi-step scheduler for in-depth agent requests. Detects when user needs multiple steps, suggests plan and waits for confirmation, persists state, and runs heartbeat-aware flow. Use when requests have 3+ actions, sequential dependencies, o | |
| Casual Cron Create Clawdbot cron jobs from natural language with strict run-guard rules. Use when: users ask to schedule reminders or messages (recurring or one-shot), especially via Telegram, or when they use /at or /every. Examples: 'Create a daily r | |
| Cdp Browser CDP browser control at localhost:9222. Use when you need to inspect tabs, take screenshots, navigate, scroll, post to X, or run JS in a persistent browser se... | |
| TODO Tracker (Safe) Secure TODO tracker with input validation and safe file operations. Use for task management across sessions. | |
| GitLab MR Code Review Automated AI code review for GitLab Merge Requests via polling. Periodically checks for open MRs, reviews code diffs for security vulnerabilities, bugs, and... | |
| Team Weekly Report Generator 团队周报汇总技能。收集组员周报图片，按「部门管理」和「项目管理」两大维度分类汇总，对比本周完成情况与上周计划，生成纯文本团队周报。当用户说"汇总周报"、"整理周报"、"生成周报"、"这是周报"（配图）、"项目进度汇总"时触发。支持分批收集、持久化存储、纵向对比。 | |
| Prd Workflow Complete PRD workflow with integrated review, flowchart, and export. Deep interview → Requirement analysis → PRD generation → Review → Flowchart → Quality ch... | |
| Requirement Checker 需求文档规范自动检查技能（AI 驱动 + 智能引导 + 温柔话术 + 建议分级）。使用 LLM 智能检查需求文档是否符合规范，生成具体问题说明、原文引用、针对性建议和 GWT 验收标准。首次使用会智能引导你设置目录和 API 配置，配置一次后无需重复设置。支持单个文件检查和批量检查，汇总报告可选。温柔话术：从"挑... | |
| Vibe Coding Cn AI 团队协作，自动生成完整项目。5 Agent + SPEC.md + Agent 投票审批 + 需求追溯。必须在 OpenClaw 环境中使用。 | |
| zotero-scholar Save academic papers with metadata, PDF links, and AI summaries to your Zotero library using credentials set in ZOTERO_CREDENTIALS (userid:apiKey). | |
| zotero-sholar 将论文和摘要保存到 Zotero 文库。需配置 ZOTERO_CREDENTIALS 环境变量。 | |
| goudantest Advanced code review assistant with intelligent analysis, multi-language support, and structured feedback. Performs comprehensive reviews covering correctnes... | |
| 大藏经CBETA2026 大藏经CBETA2026简体版检索与佛学引文核验。支持简单问答和深度研究两种模式。所有论断强制标注CBETA出处（经号/卷数/页栏），遵循德山棒原则——不编造佛经原文。当用户提问佛教经典、经论原文、律藏、论藏、CBETA检索、佛经出处核对等问题时使用。触发词：大藏经、CBETA、佛经、经论、律藏、论藏、阿含、般若、华严、法华、涅槃、CBETA出处、佛经原文等。 | |
| 大藏经学术引用生成器 大藏经（CBETA）学术引用（脚注）生成器，支持国内出版社纸本版本（中华大藏经/中华书局、永乐北藏/线装书局、房山石经/华夏出版社、嘉兴藏等）。两种用法：① 已知 CBETA 出处编号（如 T33, no. 1717, p. 869b21-22）补全出版社/出版年出脚注；② 只有一句经文，自动反查册卷页栏行并出脚注。默认输出简体、可直接粘贴进脚注的两行（文献条目 + CBETA 定位）。当用户需要大藏经出处查询、引用溯源、脚注格式、学术引用规范、中华大藏经引用、按经文找出处时 | |
| 佛学讲评助手 佛教讲说/复讲/授课/演讲的自动评测与评分工具（通用版）。上传音频或视频（不支持纯文字稿），自动转写→双轨评估（讲说风格+内容分类）→六维打分（教义准确/结构逻辑/语言表达/契机应变/感悟感染/自主发挥）→生成图表化 HTML 报告。含结构大纲（简短 inline、较长换行）、来源比对（L0 大藏经+L1 天台藏+关键断言核验，去数字 ID，附 CBETA 行级深链）、读稿检测、音频-文本对齐分析、★讲述性质识别（仅在有实锤时显示复讲判定模块；v2.26 增强来源核验行级深链 | |
| 天台藏全集2026 天台藏全集2026检索与天台宗文献核验。支持简单问答和深度研究两种模式。所有论断强制标注出处（文献名/卷数/篇目）；凡可对应 CBETA 经号者附行级深链，精确到页栏行。遵循德山棒原则——不编造天台宗教义或祖师原文。当用户提问天台宗典籍、祖师著作、判教文献、止观论著、蕅益大师著作、天台藏检索等问题时使用。触发词：天台藏、天台宗文献、智者大师、蕅益大师、摩诃止观、法华玄义、法华文句、天台四教仪、教观纲宗、天台典籍等。 | |
| 天台研究 天台宗教理研究与结构化报告生成。支持简单问答和深度研究两种模式。遵循两步工作流（检索→审核标注），所有论断标注CBETA出处。当用户提问天台宗教义、判教、观心、止观、祖师著作等相关问题时使用。触发词：天台宗、天台、教观、止观、法华、蕅益、智者大师、四教、一念三千、三谛圆融、六即、四种三昧、法华三昧等。 | |
| lhx Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Claude needs to work... | |
| lhx1 Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Claude needs to work... | |
| lhx11 Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Claude needs to work... | |
| lhx111 Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Claude needs to work... | |
| lhx1112 Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Claude needs to work... | |
| Propmt Archeologist Reverse-engineers high-quality, reusable prompts from messy conversations, vague requests, or rough user descriptions. Use this skill whenever a user: wants... | |
| 股票投资智投顾问 提供沪深北港美美股实时行情、多维数据分析与专业投资报告的全流程股票综合智投顾问服务。 | |
| Common Core Ela Checker Common Core State Standards ELA alignment checker. Analyzes lesson plans, unit plans, and assessments against CCSS ELA standards for K-12. Use when reviewing... | |
| Ib Dp English A Langlit IB Diploma Programme English A Language and Literature teaching assistant. Supports SL and HL curriculum planning, assessment design, textual analysis, and s... | |
| Ib Dp English B IB Diploma Programme English B teaching assistant. Supports SL and HL curriculum planning, assessment design, text analysis, and student feedback aligned wit... | |
| Personal Finance Reconciler Privacy-first personal finance tracker with local SQLite storage | |
| wechat-local-reader 微信本地管家：在桌面电脑（Windows/macOS/Linux）本地读取你本人本机登录的微信加密数据库，自动脱敏（手机号/身份证/银行卡/邮箱）并生成每日工作简报，推送至邮箱/企业微信机器人/任意 HTTP 端口。全程零上传，隐私不出本机。当用户想"让 AI 自动梳理微信里的消息和工作群""每天总结微信内容并推送""把微信聊天记录接入自动化并脱敏"时使用。注意：仅限本人本机微信数据；不支持手机/平板/鸿蒙等移动端。 | |
| PaperRead-Skills Analyze uploaded CVPR paper PDFs with a strict two-pass workflow. First pass extracts verifiable facts with page/section/figure/table evidence only. Second p... | |
| AI Music Video Generate AI music videos end-to-end. Creates music with Suno (sunoapi.org), generates visuals with OpenAI/Seedream/Google/Seedance, and assembles into music... | |
| Engineering as Marketing Build free tools to drive organic search traffic and convert visitors into customers — the 'Engineering as Marketing' growth strategy. Use when the user want... | |
| AI Product Visual Prompt Builder Turn rough product image, poster, thumbnail, social creative, ad concept, or image-to-video ideas into structured prompts for AI image and video generation t... | |
| AIToolize AI Tool Scout Find and compare AI tools using a concrete job, workflow constraints, current evidence, transparent scoring, and commercial-disclosure checks. Use for AI tool discovery, shortlists, alternatives, pricing or capability comparisons, and softw | |
| C Dance Seedance Prompt Architect Turn rough Seedance and AI video ideas into structured prompt packs, tighter variants, and debugging loops. Use when the user wants better text-to-video, ima... | |
| china-video-prompt-architect Turn rough China AI video ideas into structured English or Chinese prompt packs, reference-aware motion instructions, shot plans, and focused debugging loops. Use for text-to-video, image-to-video, reference-to-video, video-to-video, produc | |
| FaceRating Photo Analysis Guide Prepare and review repeatable photo-based face measurements for consenting adults. Use for capture setup, neutral interpretation, style guidance, scan comparison, FaceRating tool selection, and report preparation; never identify people, inf | |
| GPT Image 2 Prompt Architect Research real GPT Image 2 prompt examples and turn rough image ideas into structured prompt packs, reference-image edit instructions, product visuals, layouts, and debugging loops. Use for prompt search, prompt rewriting, ecommerce images, | |
| Happy Horse Workflow Architect Turn rough Happy Horse use cases into structured video workflow plans, prompt packs, and revision loops. Use when the user wants better text-to-video, image-... | |
| Hotel Lobby AI Prompt Director Create original orange-booth performance prompts and short shot plans for one or two people, pets, or other subjects. Use for Hotel Lobby-style photo-to-video, image, text, or motion-reference concepts; require rights to all references and | |
| Image to Video Prompt Director Turn still images, product photos, portraits, posters, scenes, or rough video ideas into structured prompts for image-to-video AI tools. Use when the user wa... | |
| Jev AI Decision Workflow Design and review typed AI decisions with Yes/No, Choice, or Score outputs. Use for classification, routing, moderation, triage, qualification, guardrails, batch decision planning, result review, and Jev AI integration; require representati | |
| Jev AI Model Evaluator Plan reproducible AI model evaluations, compare candidates with transparent criteria, and audit model claims. Use for model selection, benchmark design, API model comparisons, playground testing, cost-latency-quality tradeoffs, and Jev AI M | |
| Kenerate AI Creative Workflow Plan and review image, video, and audio generation workflows. Use for creative briefs, workflow selection, prompt design, prompt audits, reference-media checks, iteration plans, and Kenerate AI navigation; verify live model capabilities and | |
| OpenSora Video Prompt Architect Turn rough video ideas into structured OpenSora prompt packs, reference-aware motion instructions, shot plans, and focused debugging loops. Use for text-to-video, image-to-video, video-to-video, product clips, cinematic scenes, transitions, | |
| OXVODO Motion Prompt Architect Turn rough creative ideas into structured English or Chinese motion prompts, reference bindings, shot sequences, and focused debugging loops. Use for text-to-video, image-to-video, reference-to-video, video-to-video, product motion, cinemat | |
| raindance-video-storyboard-director Plan original visual story briefs and timed storyboards inspired by the broad Raindance social-video trend. Use for a reveal-and-reunion concept, an 11-beat short-form storyboard, a prompt review, or finding Airaindance product resources. T | |
| see-dance-2-video-prompt-architect Turn rough video ideas into structured English or Chinese Seedance-oriented prompt packs, exact reference bindings, shot sequences, and focused debugging loops. Use for text-to-video, image-to-video, multimodal reference, product clips, cin |
33,601–33,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.