Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Xiaohongshu CN 小红书分析 - 热门笔记发现、关键词监控、趋势分析（Instagram 中国版） | |
| Xlsx Cn Excel 表格处理 | Excel Spreadsheet Processing. 创建、读取、编辑 Excel 文件 | Create, read, edit Excel files. 支持公式、图表、数据分析 | Supports formulas, charts, data analysis. 触发词：E... | |
| Xueqiu Hot Cn 雪球热门讨论监控 | Xueqiu Hot Discussions Monitor. 获取雪球热门股票讨论、投资观点、大V动态 | Get Xueqiu trending stock discussions, investment insights, top posts. 触发词：雪球、股票、投资、xueqiu. | |
| Zhihu Hot CN 知乎热榜监控 - 获取知乎热门话题、问题和趋势分析（Quora 中国版） | |
| Discuz Admin Assistant Discuz! X3.5 企飞版后台管理助手。专门解答 Discuz! 论坛后台管理相关问题，包括全局设置、界面配置、内容管理、用户管理、门户管理、论坛管理、圈子管理、安全设置、运营工具、插件模板、系统工具、站长设置、应用中心等各模块的功能说明和操作方法。当用户询问 Discuz! 后台管理相关问题时触发此技能。 | |
| balbabalablabal 问道云企业信息查询工具，支持通过问道云 API 查询企业基本信息、经营信息、财务信息、舆情信息、企业各类风险指标等功能，当用户需要查询企业相关信息时触发。 | |
| Memory Manager Pro (记忆索引管理) Professional memory indexing and task management system for OpenClaw. Provides three-level indexing (core→project/type→detail), task tracking, keyword mappin... | |
| Web Novel Creator (网文创作协调层) 网文创作兼容协调层。 定位：不做一个独立的创作引擎，而是让现有的优秀创作Skill（如 novel-generator、open-novel-writing、novel-orchestrator 等）能够无缝对接 Memory Manager Pro 的索引系统。 核心价值：(1) 提供统一的项目目录规范，让各S... | |
| TryHair AI Hairstyle try-on and face-shape analysis. | |
| YingDao-GuoKe 影刀RPA社区技能，支持用户绑定社区账号并查询个人信息，包括基本信息、成就等级、开发统计数据等。当用户需要查询影刀社区账号、查询影刀信息、获取开发统计数据时，使用此技能。例如：'绑定我的影刀账号'、'查询我的影刀信息'、'我的影刀社区信息'、'查看我的影刀账号信息'。 | |
| login-digitalme 通过手机短信验证码完成用户登录/注册，包含发送验证码和验证码登录两个接口。 | |
| qa-engineer-assistant This skill should be used when the user is a QA/test engineer needing help with any testing task. Covers the full testing workflow: understanding requirement... | |
| Daily Task Check-in Simple public-safe reminder and completion check-in flow | |
| Family Homework Pomodoro Parent-confirmed homework Pomodoro flow | |
| Mac Multi-Instance Deployment Public-safe Mac deployment planning for multi-instance OpenClaw layouts | |
| OpenClaw Vertex Credit-Safe Setup Safely configure Google Vertex AI for a fresh OpenClaw setup using a Google Cloud project, service-account JSON auth, minimal-cost verification, and explicit... | |
| Practice Session Check-in Public-safe practice session intake, confirmation, reminders, completion checks, and follow-up tracking | |
| Repo Growth Operator Recommend practical growth steps for a public repo | |
| 自营发货策略+分区方案配置拆分导出. 读取Excel文件，按照指定的列进行分组，将相同组的数据导出到新文件，文件命名用分组字段组合命名。 自营发货策略+分区方案配置拆分导出. 读取Excel文件，按照指定的列进行分组，将相同组的数据导出到新文件，文件命名用分组字段组合命名。 | |
| Social Media Metrics Fetch follower counts and social media metrics from 11+ platforms using profile URLs or nicknames, including Bilibili, YouTube, TikTok, Instagram, and more. | |
| Kokonna Frame Control KoKonna AI e-ink art frames. Upload images, query device info, and manage multiple frames. Use when user asks to "push to frame", "send to frame", "d... | |
| Media Downloader Download Video/Music from YouTube/Bilibili/X/etc. | |
| GitHub Extract Extract content from a GitHub url. | |
| HackerNews Extract Extract a HackerNews post (article + comments) into single clean Markdown for quick reading or LLM input. | |
| MLX Audio Server Local 24x7 OpenAI-compatible API server for STT/TTS, powered by MLX on your Mac. | |
| MLX STT Speech-To-Text with MLX (Apple Silicon) and opensource models (default GLM-ASR-Nano-2512) locally. | |
| MLX TTS Text-To-Speech with MLX (Apple Silicon) and opensource models (default QWen3-TTS) locally. | |
| URL to PDF Convert URL to PDF suitable for mobile reading. | |
| URL to PNG Convert URL to PNG suitable for mobile reading. | |
| UV Global Provision and reuse a global uv environment for ad hoc Python scripts. | |
| Session Memory Manual 跨 Session 记忆查找与同步机制，完全手动触发 | |
| Session Sync Detect 自动检测用户话语中跨会话内容，询问并经用户确认后检索共享记忆文件及活跃会话历史同步信息。 | |
| freelance-proposal-gen Generates client-ready, single-page HTML proposals for freelancers, solo consultants, and small studios. This skill should be used when a user wants to create a polished sales proposal, quote, or pitch document to send to a client. Triggere | |
| Bilibili Video B站(Bilibili)视频字幕提取与音频转写工具。基于 bilibili-api-python，自带 WBI 签名反爬。 三级降级策略：CC字幕 → AI字幕(9种语言) → 音频下载+ASR转写。 当以下情况时使用： (1) 用户提供 B 站视频链接或 BV/AV/EP/SS 号，要求获取字幕或文字内容 (2... | |
| Browser Zombie Cleaner Detect and clean up zombie browser processes left by OpenClaw's browser tool. When the OpenClaw Gateway restarts, Playwright-launched browser processes get o... | |
| Browser Zombie Cleaner.Removed Detect and clean up zombie browser processes left by OpenClaw's browser tool. When the OpenClaw Gateway restarts, Playwright-launched browser processes get o... | |
| Feishu Doc Editing Performance-optimized strategies for editing Feishu (Lark) documents via OpenClaw's feishu_doc tool. Use when: (1) modifying existing Feishu documents, (2) i... | |
| Feishu Doc Writing Organizes and formats group discussions, meetings, and research into clear, complete Feishu documents with proper structure, visuals, and security. | |
| Feishu Readability 飞书文档格式优化与安全修改规范。**必须在通过MCP修改任何mi.feishu.cn文档之前加载此skill**。包括最小修改原则、富文本保护、段落间距、加粗规范。触发条件：用户要求修改飞书文档内容或格式，涉及mi.feishu.cn域名，或调用小米飞书MCP的update-doc工具。 | |
| Gateway Watchdog Monitor OpenClaw Gateway health by detecting abnormal error rates in logs. Use when: (1) setting up Gateway error monitoring, (2) diagnosing repeated API fai... | |
| Learning Cards (Spaced Repetition) Spaced-repetition flashcard system backed by Feishu Bitable (multi-dimensional table). Create flashcards from any book or knowledge base, quiz the user inter... | |
| OpenClaw Security Check Security self-check for OpenClaw deployments. Audits openclaw.json config and host security in one pass: gateway exposure, auth mode, token strength, channel... | |
| Publish Checklist 对外发布前审查清单。发布 ClawHub skill、提交 GitHub PR/Issue、发帖、发邮件、任何公开内容前必须加载此 skill 并逐项检查。 | |
| Ram Review 召唤拉姆姐姐来评价雷姆的工作 | |
| Session Cleaner Clean up stale OpenClaw session files. Keep the current main session and all group chat sessions; move everything else to a backup directory. Use when perfor... | |
| Speech Notes 将录音/语音转写为结构化演讲纪要。适用于：会议讲话、内部分享、演讲录音的转写整理。 触发条件：用户发送音频文件并要求整理/转写/纪要，或要求将已有转写文本整理成结构化纪要。 | |
| Sync Metadata 从 package.json 同步项目元数据（名称/版本/描述/仓库地址等）到 README.md、SPEC.md 等 Markdown 文件。当用户改了版本号、项目名、描述后，或说"同步元数据""sync metadata""更新 readme 版本""sync project metadata"时使用。支持... | |
| Outer Ratio Monitor K线骗人，数据不骗。主力进场，你第一个知道——外内比实时监控，每30分钟扫一次自选股，外内比异动立即飞书告警。外盘/内盘比是主力的"提前量"，比K线快半步预警。**零依赖**：腾讯免费行情API，无需任何API Key。Pro版付费10元获取。⚠️ 股市有风险，投资需谨慎，风险自担。适用：A股短线交易者、散户、量... | |
| reasoning-scaffold 想清楚，比想得快重要。6步推理框架+400年人性陷阱清单，让你的判断有结构、不犯蠢。人性不变，陷阱不变，框架在手，坑不了你。适用于投资决策、商业判断、风险评估、人生选择。不限行业，通用框架。 | |
| 外贸全能助手｜30+语种 * 30+行业 · 外贸全场景 外贸全能助手：覆盖31个外贸场景、31个行业、31种语言的智能外贸工作平台。用于写开发信、回复客户询盘、跟进邮件、客户背调、获客分析、GEO诊断。支持多语种输出、FABE营销框架、GDPR合规。 |
34,051–34,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.