Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Kilocode Model Sync Sync the Kilocode provider model list in openclaw.json with the live Kilo AI API. Use when: running the weekly model sync job, checking for new/removed/updat... | |
| Learned Workflows Reusable workflow notes for repeatable tasks. | |
| Mc Db Discovery Systematic workflow to locate and verify the Mission Control SQLite database when path assumptions fail, and reconcile frontend/backend schema mismatches. | |
| Operational Heartbeat Automated daily health check for OpenClaw instances. Verifies memory file presence, detects stale/overdue cron jobs, and surfaces system status. Intended for... | |
| Package Manager Updates Check, summarize, and update packages across all installed package managers (npm, pip, brew, cargo, go, etc.). Use when user wants to (1) check for outdated... | |
| Poly Daily Reading Generate Guillaume's daily reading list by searching curated sources across AI, LLMs, full-stack dev, anime, horror games, and metal music. Use when asked to... | |
| Moltworld Dashboard Deploy Install, harden, and run the MoltWorld Dashboard reliably for real users. Use when asked to set up local runtime scaffolding (README/package.json/.env/.gitig... | |
| odps-sql Use this skill when the user wants to query, analyze, or explore data in Alibaba Cloud ODPS (MaxCompute / 阿里云大数据计算服务). This skill executes SQL queries, lists... | |
| Caprover CI Deployments Deploy apps to CapRover and set up GitHub Actions CI/CD workflows for new or existing projects. Use when the user says things like "deploy X", "trigger a dep... | |
| Caprover Management Manage CapRover PaaS instances via API: create/update apps, deploy from Docker image or custom Dockerfile (tar file), configure ports, volumes, env vars, and... | |
| Magic Need Capture tool and data needs from AI agents during task execution. When an agent identifies it needs a tool, API, or data source that doesn't exist, this skil... | |
| 平替词·购物省钱搜索 Turns product names into prioritized Taobao search terms for cheaper alternatives, using key specs, source regions, factories, and community-verified suggest... | |
| 定时任务管理·Token节约 定时任务越建越多，token 越烧越狠？想审计定时任务却不知道从何下手？定时任务管理（含token节约）（scheduled task audit / token optimizer / automation audit / 任务合并）做全生命周期管理：自动读取数据库扫描所有 agent 定时任务，统计 token 消耗排行，做消耗审计 + 合并评估 + 冗余清理，找出高消耗任务、可合并任务、可删除任务，给出综合优化方案。当用户说「哪些定时任务消耗token最多」「帮我审计定 | |
| 电子书拆解成技能包 This skill should be used when the user provides an electronic book (PDF, EPUB, TXT, MD) and wants to automatically extract knowledge, analyze structure, and... | |
| 职业收入分析 基于简历/工作经历进行全方位职业收入分析与变现路径规划。当用户提供简历、工作经历、或职业背景，并希望：1) 发掘隐藏技能变现价值 2) 寻找额外收入机会 3) 规划90天渐进式职业升级/副业落地路径 4) 识别AI驱动的第二收入来源时，使用此技能。触发词：简历分析、职业变现、收入机会、隐藏技能、第二收入、90天计划、职业规划、副业规划、技能变现。 | |
| 宝洁八大问 行为面试总挂在深挖经历上？宝洁八大问（P&G eight questions / behavioral interview / STAR 法则 / 行为面试准备）基于宝洁经典八大面试问题（领导力/说服力/团队协作/决策/数据分析/影响力/处理模糊性/学习能力），用选择题启发式引导帮你挖掘个人经历、构建 STAR 故事，并用 AI agent 模拟面试官连续追问、5 维度评分、优化答案表达，附带练习进度表与薄弱点识别，覆盖从经历挖掘到模拟实战的完整准备链路，最终提升行为面试通过 | |
| 内容合规审核·违禁词敏感词检测 发布前怕文案踩红线、被限流封号？违禁词检测+敏感词扫描+内容合规审核一次搞定：覆盖小红书、抖音、视频号、快手、B站、公众号、闲鱼 7 个平台独立词库（叠加通用词库），本地离线检测 20+ 类违规词——绝对化用语、极限词、医疗功效、收益承诺、导流引流、谐音变形词、涉赌涉政，输出 P0/P1 分级+安全替代话术+发布前检查清单。常被搜的问题：文案有没有敏感词？会不会被限流？笔记为什么不过审？小红书/抖音/公众号哪些词不能用？广告法极限词有哪些？适合自媒体运营、小红书博主、短视频创 | |
| 内容蒸馏器·技能造物主 看完一本书/一门课/一篇干货，怎么把别人的方法论变成自己的技能？内容蒸馏器·技能造物主（content distiller / book to skills / skill generator / content to skill）从任何内容中蒸馏可复用方法论并自动封装为体系化技能包，让 agent 真正拥有你的经验沉淀。支持 PDF/EPUB/TXT/MD 电子书、小红书/抖音/B站/视频号等平台链接、本地视频、公众号文章、直接文案六种输入源。当用户说「帮我蒸馏」「把这本书 | |
| 技能发现·Find Skills 不知道装什么技能？想让 AI 自己找到最合适的技能？技能发现·Find Skills 是场景驱动+关键词双模式的技能发现工具（skill discovery / skill finder / install skills）：用自然语言描述场景/需求（如"我想做一个海报""帮我分析股票""找个薅羊毛技能"），或明确说"安装技能/find skills/找个skill/有没有做XX的技能"时，自动从官方内置、本地已安装、SkillHub、虾评、GitHub、ClawHub 六层联 | |
| 免费工具·平替雷达 输入软件名称、链接或截图，跨 16 个渠道调研免费与开源替代品，评估自研可行性并生成选型报告。 | |
| Tmp.Fm4eKnkduc 全功能技能创建与发布工具。当用户想新建、安装、发布、更新任何技能时触发。执行流程：①重叠评估→②安全检查→③创建/升级 SKILL.md→④自动发布到虾评+GitHub+ClawHub。升级版 v2.0：新增技能整合评估（与现有技能扫描重叠度，给出整合/升级/新建三分支结论）、技能安全检查（自动审计 SKILL.... | |
| 视频文案提取 想把视频里的台词/课程内容变成文字？视频文案提取（video transcript / 语音转文字 / 字幕提取 / video to text）从本地视频文件中提取语音文案与字幕，跨平台支持 macOS/Windows/Linux，完全离线运行——视频再大也不怕，用 whisper AI 语音模型做高精度识别，支持多语言字幕提取和 OCR 文字识别，自动输出带时间戳的 SRT 字幕（可直接导入剪映/PR/达芬奇/FCPX）与无时间戳 TXT 纯文本（方便文案整理、口播稿提取 | |
| 大模型Token成本节约 大模型 Token 成本节约工具。在请求到达大模型之前自动压缩 prompt 和上下文，减少 60-95% 的 token 消耗，直接降低 API 成本。支持 Claude/OpenAI/Gemini 等主流模型，提供代理模式、CLI 包装、Python SDK 和 MCP Server 四种接入方式。内置一键安... | |
| Mac磁盘清理顾问 Mac 硬盘又满了？磁盘空间不足不知道删什么？我想清理 Mac 但怕误删系统文件？Mac磁盘清理顾问（mac disk audit / mac cleanup / disk space analyzer / 磁盘清理 / 大文件扫描 / 空间分析）是一个 AI 辅助的磁盘清理工具：自动扫描系统目录、用户目录与开发项目，按体积排序定位谁在吃你的磁盘（Xcode 缓存 / node_modules / 旧项目 / 大文件 / 重复文件），生成三级清理建议（立即清 / 确认后清 / | |
| OPC赛事活动追踪 追踪 OPC/AI/独立开发者相关赛事活动。从信息源抓取 → 提取结构化信息 → 提交到 OPC 公共赛事池。安装时引导用户获取 API Key。触发词：赛事、比赛、hackathon、活动、OPC赛事、AI比赛、独立开发者大赛、收录赛事、加到OPC | |
| PDF阅读助手 PDF 阅读助手技能 v2.0。支持文本提取、表格提取、扫描版OCR识别、智能问答、多文档对比、批量处理。触发词：PDF、阅读PDF、分析PDF、PDF摘要、提取PDF、研报、论文、文档分析。 | |
| 技能发布文案优化·Skill发布 Skill 发出去没人搜到？技能描述写了一大段，Agent 和用户就是找不到？Skill发布文案优化（skill publish copywriter / skill SEO / 技能发布文案 / 发布介绍生成）专门解决技能「发布了却没曝光」的问题：按各平台检索机制重写技能名称、description、trigger 词与发布介绍文案——ClawHub 靠向量语义匹配就补中英双语同义词变体，SkillHub 只认 displayName 前缀就把核心关键词放最前，虾评名称控制 | |
| Skill Build 1jkgz8e3 通过 OPC 个人 API Key 读取一人公司及自由职业者的最新政策资讯，支持按需查询与筛选。 | |
| Skill Build 55f0zj8c 读取并筛选 OPC 平台的公开赛事活动数据，支持按地区、类型和时间查询创业大赛、黑客松等赛事信息。 💡 更多实用 AI 效率工具和技能，领取自媒体 IP&超级个体&一人公司资料，关注公众号「桂皮AI实战」 📱 加入自媒体&AI 副业变现交流群：https://e418e2 | |
| find-skills 场景驱动+关键词双模式技能发现工具。当用户用自然语言描述场景/需求（如"我想做一个海报""帮我分析股票"），或明确说"安装技能/find skills/找个skill"时，自动从官方内置、本地已安装、SkillHub、虾评、GitHub、ClawHub 六层联合搜索并推荐最合适的技能，支持一键安装。已完全替代官方原 find-skills 插件。 | |
| pdf-reader-assistant PDF 阅读助手技能 v2.0。支持文本提取、表格提取、扫描版OCR识别、智能问答、多文档对比、批量处理。触发词：PDF、阅读PDF、分析PDF、PDF摘要、提取PDF、研报、论文、文档分析。 | |
| Skill Build Kf13n9ev 读取OPC工具站的公开赛事活动内容，支持按地区和类型查询创业大赛、黑客松等赛事信息。 | |
| Skill Build Ncgr86vs Read and filter OPC tool station event listings like hackathons and competitions directly in your AI assistant using your OPC API Key. 💡 更多实用 AI 效率工具和技能，领取自... | |
| Skill Build Oalrxkoy 通过 OPC 个人 API Key，直接在 AI 助手中查询最新的 OPC 发现和 AI 羊毛工具及效率文章。 | |
| 大模型token成本节约 大模型 Token 成本节约工具。在请求到达大模型之前自动压缩 prompt 和上下文，减少 60-95% 的 token 消耗，直接降低 API 成本。支持 Claude/OpenAI/Gemini 等主流模型，提供代理模式、CLI 包装、Python SDK 和 MCP Server 四种接入方式。内置一键安装脚本、企业内网适配方案、压缩效果对比报告、场景专项配置（法律/医疗/金融/代码）、模型更新指南，以及可选的数据上报功能（可随时关闭，首次使用引导用户选择）。基于开源 | |
| automation-token-optimizer 定时任务全生命周期管理：token 消耗审计 + 合并评估 + 冗余清理。自动扫描所有定时任务，找出高消耗任务、可合并任务、可删除任务，给出综合优化方案。 | |
| video-transcript 从本地视频文件中提取语音文案/字幕。跨平台支持macOS/Windows/Linux，完全离线运行。使用whisper模型进行高精度语音识别，支持多语言字幕提取和OCR文字识别。触发词：视频文案提取、提取字幕、语音转文字、视频转文字、提取文案。 | |
| 技能创建器·Skill Factory 想把自己的方法论做成技能？想新建/安装/发布/更新一个 WorkBuddy 技能（skill）却不知道从何下手？技能创建器·Skill Factory（skill factory / skill builder / skill generator / create skill）是全功能技能创建与发布 tool：当用户说「新建技能」「创建技能」「帮我做个技能」「写一个技能」「如何发布技能」「我想给 agent 加一个技能」时触发，让你的 agent 获得可复用的专业能力。执行流 | |
| 技能优化器 专门负责修改和优化已有技能。当发现技能有漏洞/流程缺失/逻辑错误/经验教训需要沉淀时触发。触发词：优化技能、修改技能、技能有问题、技能漏洞、改进技能、技能踩坑、把这个经验写进技能、技能加一条规则。 | |
| 信源甄别·反投毒信息过滤器 被软文和垃圾信息源包围？AI 搜索时代内容农场泛滥，同一篇'TOP 榜单'通稿出现在几十个网站，融资额、估值、市场份额全是抄的。信源甄别在信息入口执行三层过滤（域名信誉→内容指纹→交叉验证），输出 P0/P1/P2 可信度分级，拦截营销通稿与内容农场，让调研、简报、选题只吃干净信息。内置信源黑白名单（持续维护），单一来源自动标注'待验证'，软文丢弃必留痕。适合自媒体调研、行业研究、资讯采集、内容创作前的信息源质检。Source credibility triage & con | |
| 大模型Token压缩·成本节约 大模型 API 费用越来越高？token 越用越多却不知道花在哪？大模型token成本节约（llm token compressor / prompt compression / token optimizer / 上下文压缩）在请求到达大模型之前自动压缩 prompt 和上下文，减少 60-95% 的 token 消耗，直接降低 API 成本——想让 agent 和应用更省就跑它。支持 Claude/OpenAI/Gemini 等主流模型，提供代理模式、CLI 包装、Pyt | |
| 视频创作技能路由器 想做视频却不知道用什么工具？想让 AI 帮你「找技能 → 装技能 → 做视频 → 一条龙」？视频创作技能路由器（Video Creation Skill Router）是一个 AI video skill / animation skill 元技能——视频创作能力的发现与编排层，自身不生产视频，只做匹配、下载、编排执行、善后询问。你只管说需求（"把勾股定理做成讲解动画""给我的 APP 做个宣传片""剪掉这段口播的口误"），它自动完成：① 判定视频类别（商业宣传/知识科普/其 | |
| 薅羊毛助手·全网比价领券 怕买贵怕漏券？一句话全网比价领券。12 大生活场景意图路由：电商购物/吃喝外卖/出行旅宿/数码家电/会员文娱/金融支付/教育成长/健康医疗/宠物/政府公共/AI数字服务/副业变现。已上线：外卖红包(惠生活)、跨平台比价(虾虾优惠6平台)、羊毛福利(Coze)、美团本地、AI Token、5场景RSS。淘宝联盟选品🟡待上线、万能转链🟡待上线。 | |
| WorkBuddy月度体检·对话复盘 这个月时间都花在哪了？和 AI agent 的对话帮你成长了吗？WorkBuddy 月度体检（monthly review / conversation audit / 月度复盘 / AI 使用复盘）每月自动读取 WorkBuddy 全量对话记录，从时间分配、话题焦点、决策质量、情绪模式、成长轨迹、未完成事项 6 个维度深度诊断，生成结构化报告，发现行为盲区与目标失焦。报告自动归档到「目标管理/年月/月度诊断」目录，含 6 维评分与最紧迫的 3 个行动建议——对话就是最好的数 | |
| 毅安DFA割集分析 DFA 割集分析更新 skill。当用户要求对 Excel 工作包中的割集进行 DFA（Dependent Failure Analysis）分析或更新时触发，例如"帮我进行割集 DFA 的分析/更新"。自动读取包含 "Cut-Set List" 关键字的源 sheet（若存在多个，优先选不含 old 的最新清单，如 _new），只处理 Order 为 2 或 3 的割集，按割集名合并同类项，将结果更新到包含 "DFA Analysis-CutSet" 关键字的目标 shee | |
| HR招聘海报生成 生成简历方向、HR方向的招聘海报内容与设计指引。用户要做招聘海报、校招海报、岗位招募视觉稿、HR传播素材时调用。 | |
| code-review-for-gitcode Handles full GitCode PR code reviews by automating security scans, manual analysis, selecting top issues, formatting results, and optionally posting review c... | |
| gitcode-issue-workflow End-to-end GitCode issue workflow covering issue pickup, analysis, code modification, and PR submission. Use when user asks to handle/fix/resolve a GitCode i... | |
| Gitcode Pr Comment Workflow GitCode PR review comment response workflow. Accepts a PR link, fetches review comments from the PR, checks out the PR's source branch locally, proposes modi... | |
| Understand Me Use when the user asks the agent to understand, challenge, refine, interrogate, or co-design their ideas, thoughts, proposals, strategies, plans, designs, do... |
33,901–33,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.