Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Bingli Shengchengqi 专业的病历撰写助手，按照三步流程生成规范的入院记录 | |
| Medical Record Generator 专业的病历撰写助手，按照三步流程生成规范的入院记录。当用户说"写病历"、"生成病历"、"病历助手"、"入院记录"、"medical record"或"病历生成"时使用此技能。 | |
| Fulcru Audit a brand's AI search visibility, identify unanswered buyer questions, write targeted pages that AI will cite, and measure ranking improvements. | |
| GcadClaw Generate 2D GstarCAD drawings with feedback. | |
| Klarity Booking Guide Guide users through booking an online psychiatrist or psychiatric nurse practitioner (PMHNP) appointment on Klarity Health (helloklarity.com) for conditions... | |
| Geo analytics & AI visibility AI 引擎里的品牌可见度——GA4 看不到的那一段。查你的网站在豆包、DeepSeek、千问、元宝、文心、Kimi 等 AI 引擎里被提到多少、哪些页面被引用,以及 AI 来源的访客、会话与转化;识别得出的分引擎看,识别不出的如实标「来源未知」,不硬凑。数据来自站点自有埋点与引擎应答采样,公开网页上查不到。可回答「我的品牌在 AI 回答里露出多少」「AI 来源带来多少会话和转化」「哪些页面被 AI 引用」。首次使用会引导你在浏览器里完成一次授权。 | |
| Vigilath Pet Commerce Search, bargain, order, and pay for pet supplies on Vigilath.com — an AI-powered pet commerce platform with multi-round price negotiation. | |
| Fish Tts Generate high-quality speech from text using Fish Audio S1 and optionally upload the MP3 audio file to NextCloud via WebDAV. | |
| Summarize 在 Codex 中总结、精简或交接当前任务，提取目标、状态、决策、验证、风险和下一步，并基于本次证据给出操作、优化与行为建议。用户说“总结”“总结一下”“总结进度”“复盘”“总结精简”“压缩上下文”“交接”“handoff”“compact”“总结 checkpoint”“总结 交接 分层”“总结 诊断 历史”或... | |
| Skills Audit 审计技能库健康度：项目画像→七维评分→容量预警→趋势对比→快照回滚。 支持技能/项目双模式 + CI/CD。Capabilities: skill audit, project profiling, 7-dim scoring, capacity analysis, liveness check, snapsho... | |
| Skills Summarize Audit 技能审查 → 中文说明精炼·项目画像·技能插件证据推荐 | |
| 国泰海通证券-灵犀金融数据查询 国泰海通证券-灵犀金融数据查询skill，通过自然语言查询A股实时行情、公司基本信息、F10财务数据、个股技术指标等金融数据，只能查询A股基础行情，遵循沪深交易所行情转发规则，不提供研报数据，仅提供授权范围内基础行情数据。当用户查询金融数据时，即使需要授权也应先尝试使用本Skill。仅在授权失败或本Skill不可... | |
| 国泰海通证券-灵犀市场热榜查询 国泰海通证券-灵犀市场热榜查询skill，支持涨跌幅、成交额、成交量、换手率、当日资金净流入等市场排行榜查询。当用户查询市场榜单时，优先使用本Skill获取数据。触发关键词包括：涨幅榜，跌幅榜，热榜，排行榜，涨幅前10, 资金流向。 | |
| 国泰海通证券-灵犀实时行情 国泰海通证券-灵犀实时行情 skill：标的覆盖 A 股、港股、美股、ETF与指数；支持单只或多只标的的实时行情，数据维度包括最新价、涨跌幅、涨跌额、成交量、成交额、换手率、当日资金净流入、量比等。 当用户询问股价、涨跌幅、行情走势、资金流向或相关证券行情时，优先通过本 Skill 取数，若本 Skill 无有效... | |
| 国泰海通证券-灵犀研报搜索 国泰海通证券-灵犀研报搜索skill，查询国泰海通研究所专业研究报告，涵盖宏观策略、行业深度等，为投资分析提供专业研究支撑。当用户查询研报数据时，即使需要授权也应先尝试使用本Skill。仅在授权失败或本Skill不可用时，才考虑使用网页搜索作为备选方案。触发关键词包括：研报，投资策略，行业分析，大盘分析。 | |
| 国泰海通证券-灵犀智能选股 国泰海通证券-灵犀智能选股skill，支持通过自然语言进行多指标选股选股，对选股结果进行历史回测。当用户进行回测时，即使需要授权也应先尝试使用本Skill。仅在授权失败或本Skill不可用时，才考虑使用网页搜索作为备选方案。触发关键词包括：选股，筛选股票，回测，选股策略，筛选结果。 | |
| 国泰海通证券-灵犀自选股管理 国泰海通证券-灵犀自选管理 skill，支持查询自选股行情、添加、删除自选股。**本期仅支持管理【我的自选】分组中的自选股，其他分组中的自选股管理仍在开发中。** 当用户表达查看自选股、查看自选股行情、关注某只股票、从自选股中移除某只股票等意图时，必须使用本 Skill。**Agent 只需读取此文件，无需读取其... | |
| Voicenotes Official This official skill from the Voicenotes team gives OpenClaw access to new APIs and the ability to search semantically, retrieve full transcripts, filter by t... | |
| Granola Meeting Notes API Access Granola meeting notes, summaries, transcripts, and attendees via the official Granola public REST API (public-api.granola.ai/v1). Use this skill when... | |
| Zown Gemini Governor A high-fidelity token management and model stabilization skill. Implements the Zown "Atomic Pipeline" to prevent Gemini TPM (Tokens Per Minute) rate limits. Use when performing heavy engineering tasks, multi-step code generation, or when en | |
| Filesystem Management Advanced filesystem operations - listing, searching, batch processing, and directory analysis for Clawdbot | |
| Clawdbot Security Suite Advanced security validation for Clawdbot - pattern detection, command sanitization, and threat monitoring | |
| wisptrace Before any task on a website, get the recipe other agents found for it (the path that works and the dead ends). After the task, send a masked trace so the next agent gets it right. Personal data and secrets are masked on your machine before | |
| OneBot Adapter Connect OpenClaw to OneBot protocol for QQ bot integration. Use when receiving or sending QQ messages via NapCat or other OneBot servers. | |
| Bb Browser 0.6.0 Turn any website into a CLI command. 36 platforms, 103 commands — Twitter, Reddit, GitHub, YouTube, Zhihu, Bilibili, Weibo, and more. Uses OpenClaw's browser... | |
| Coco Playwright Stealth 1.0.0 Playwright-based web scraping OpenClaw Skill with anti-bot protection. Successfully tested on complex sites like Discuss.com.hk. | |
| Aeon Proactivity AEON主动伙伴技能包。特性：主动学习、记录、改进。在对话交互中被动观察用户反馈，自动记录教训和改进建议。 | |
| 豆包创意设计 当用户要求生成、编辑、改图、修图、重绘、文生图、图生图、扩图、换背景、换风格、局部替换、参考图衍生、系列延展或多比例适配商业创意图片时使用；触发任务包括做图、出图、生成图片、设计海报、主视觉/KV、Banner、封面、社媒配图、社媒长图、电商主图、详情页、产品图、Logo、IP角色、吉祥物、包装、品牌应用物料、活... | |
| 飞书审批 飞书审批 API：审批实例、审批任务管理。 | |
| 飞书考勤 飞书考勤打卡：查询自己的考勤打卡记录 | |
| lark-base 飞书多维表格（Base）操作：建表、字段、记录、视图、统计、公式/lookup、表单、仪表盘、workflow、角色权限；遇到 Base/多维表格/bitable 或 /base/ 链接时使用。文件导入转 lark-drive。 | |
| lark-contact 飞书 / Lark 通讯录,用于按姓名 / 邮箱把员工解析成 open_id,以及按 open_id 反查员工的姓名 / 部门 / 邮箱 / 联系方式。当用户说出某人姓名而下一步需要发消息 / 加群 / 排日程时,先用本 skill 把姓名换成 ID;当输出里出现 open_id 需要展示成姓名给用户看,或用户直... | |
| Summarize All 智能总结工具 - 自动检测内容类型、智能选择长度、缓存、关键点提取。支持网页、PDF、图片、音频、YouTube。 | |
| ecom-price-monitor跨境电商价格监控神器 - 竞品一动，秒级预警 实时监控跨境电商平台竞品价格变动，智能预警并提供趋势分析，助力精准定价和市场决策。 | |
| Daily Standup Generator Generate a concise daily standup report summarizing completed tasks, today's plan, and blockers from provided data or user input. | |
| Aliyun TTS Alibaba Cloud Text-to-Speech synthesis service. | |
| Privora · 实时监控 · 黄金实时监控 / 基金净值监控 / 股价预警 · 越线飞书/微信 Webhook · AI Agent Privora 实时监控——黄金实时监控 / 基金净值监控 / 多资产阈值告警，给一个已订阅资产字段配一条阈值规则（跌破/突破/等于），越线即飞书/微信/通用 Webhook 通知你；港股/美股/A股同样支持。建渠道→建规则→验证→上线，一份文档 11 步走完；Bearer Token 直连 /agent/skills/execute。 | |
| Privora · A股/港股/黄金/基金 多资产 量化分析 · 量化回测 · 模拟盘 · 实时告警 · 风险监控 · Python 策略 · AI Agent Privora · AI Agent 投资工作流平台 — Bearer Token 即接入 /agent/skills/execute 通用 dispatcher，覆盖 A 股/港股/美股/黄金/基金/财报数据 + Python 回测（含 sandbox）+ 模拟交易 + 组合归因（α/β TWR）+ 云端告警 + 流程编排。Hermes / Claude / GPT / OpenClaw 全兼容。 | |
| OpenAI Deep Research Skill Execute multi-step deep research with the OpenAI Responses API, including question decomposition, evidence gathering with web search, contradiction tracking,... | |
| yuhang 一个"制造技能的技能"。这个工具自动化了将任意 GitHub 仓库转换为标准化 Trae 技能的全过程，是扩展 AI Agent 能力的核心工具。 | |
| MyCompanyDueDiligence 企业尽职调查自动化工具。基于 Playwright/agent-browser 实现多数据源自动抓取，支持企查查、天眼查、东方财富、中国裁判文书网四个网站的综合信息抓取，生成专业尽调报告（含截图+Markdown+PDF）。 | |
| Agent Task A distributed task collaboration platform designed specifically for AI agents. Supports task creation, assignment, status synchronization, progress tracking,... | |
| Calorie Tracker Smart health management solution with food and exercise recognition, nutrition and calorie analysis, secure data storage, and comprehensive data management.... | |
| Stock Prediction 自动化股票预测工作流。当用户发送包含股票代码的图片，并提及"预测"、"未来x天"、"采样次数"等关键词时触发。包含：图片中股票代码提取、预测环境检查与自启动、模型版本校验与切换、批量预测脚本执行、结果回传。 | |
| Feishu Bitable Import 批量导入本地CSV/Excel/JSON数据至飞书多维表格，支持智能字段推断及增量、全量、仅新增三种同步模式。 | |
| xiaohongshu-full-auto 🚀 小红书全链路自动化自媒体工作流，从热点抓取 → 选题分析 → 文案生成 → 封面图生成 → 自动发布，一条龙全自动搞定小红书内容创作。适合自媒体博主、副业玩家、内容工作室批量生产小红书内容。触发关键词："全自动小红书", "小红书创作", "小红书自动发布", "小红书热榜", "批量做小红书", "xia... | |
| Wcs Helper Feishu Skill Configure OpenClaw Feishu plugin without editing config files. Send simple commands via Feishu private chat to toggle streaming, set group reply behavior, ru... | |
| Wcs Helper Network Skill SSH tunnel for China servers to access internationally blocked sites (GitHub, ClawHub, HuggingFace, arXiv, Google, YouTube). Password-auth based, one-command... | |
| Gif Maker 将序列帧图片或精灵表（Sprite Sheet）转换为高质量 GIF 动画。支持自定义 FPS、布局切分及循环播放。 | |
| Grid Sticker Generator A universal 4x4 grid sticker generator. uses strict visual guidelines (No Text, Transparent BG) and supports loading theme templates from resources. |
33,801–33,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.