Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 业绩评价分析 业绩评价分析工具。整合目标达成、环比、基线、Benchmark四个维度，量化"业绩不达预期"分析。 核心能力： 1. 四维度综合评价（目标达成、环比、历史基线、同行Benchmark） 2. 预期类型识别（目标、环比、基线、Benchmark） 3. 达成率计算与状态判定（正常/关注/告警/紧急） 4. 综合评价... | |
| 门店销售业绩分析 门店销售业绩环比分析工具。支持门店/导购业绩同比分析（本期 vs 上期），识别业绩波动原因，量化归因，输出诊断结论和改进建议。 使用场景： 1. 门店整体业绩分析（销售额、订单数、客单价、连带率） 2. 导购个人业绩分析（排名、业绩占比、能力雷达图） 3. 多门店/多导购对比分析 4. 业绩波动归因（订单贡献 v... | |
| SKU对比分析 SKU对比分析工具。支持SKU的时间维度、横向、导购等多维度对比分析。 核心能力： 1. 时间维度对比（本期vs上期、活动前后、月度环比） 2. 横向对比（多个SKU排名、标杆学习） 3. 导购维度对比（不同导购对同一SKU的销售差异） 4. 销售表现对比（销售额、销量、转化率） 5. AIoT数据对比（试用次数... | |
| 单SKU门店分析 单SKU门店分析工具。分析单个商品在指定门店的销售表现、库存状态、导购贡献和AIoT转化数据。 核心能力： 1. SKU基础信息（名称、款号、颜色、包型、标准价、上市日期） 2. 销售表现（销售额、销量、成交均价、贡献率、排名） 3. 库存状态（当前库存、在架天数、绑定状态） 4. 导购贡献（各导购销售额、销量、... | |
| 陈列货盘分析 陈列货盘分析工具。从货盘视角分析引起客户意向的商品和试用行为变化。 核心能力： 1. 三漏斗交叉分析（displayFunnel陈列SKU + behaviorFunnel试用次数 + customerFunnel客户） 2. 引起意向的商品变化（引起意向SKU数、引起意向SKU占比） 3. 客户对意向商品的试用... | |
| 门店Benchmark分析 门店Benchmark分析工具。与集团/区域其他门店对比，分析门店等级、排名变化、件单价×连带率矩阵象限。 核心能力： 1. 多维度对比范围（集团全部、区域、省份、城市） 2. 门店等级评估（基于销售额、订单数、客单价、连带率） 3. 排名变化追踪（本期排名vs上期排名） 4. 件单价×连带率矩阵象限分析（识别门... | |
| 历史基线分析 门店历史基线分析工具。基于Agent API数据库视图，提供多周期基线+四分位分析。 核心能力： 1. 多周期基线（13周/季度、26周/半年、52周/全年、12个月） 2. 多维度分组（按星期几分组、自然周、自然月） 3. 四分位分析（P25/P50/P75，识别异常区间） 4. 基线类型（weekday按星期... | |
| 门店目标追踪分析 门店目标追踪分析工具。支持日/周/月三周期目标追踪，T-N数据延迟，黄绿黄灯状态预警。 核心能力： 1. 三周期追踪（日追踪-晨会/实时预警、周追踪-周会复盘、月追踪-月度考核） 2. T-N数据延迟支持（默认T-1） 3. 黄绿黄灯状态（🟢正常、🟡关注、🟠警告、🔴告警/紧急） 4. 批量告警检查（检查所... | |
| 门店客流分析 门店客流与转化漏斗分析工具。基于AIoT客户行为数据（customerFunnel + behaviorFunnel）。 核心能力： 1. 双漏斗结合分析（customerFunnel客户分层 + behaviorFunnel试用行为） 2. 五步分析法（获取数据→解析customerFunnel→解析behav... | |
| wecom-user-manager 企业微信用户管理技能。支持管理员添加用户权限，用户首次登录自动激活。包含完整的用户生命周期管理。 | |
| Skywork Design Skywork Design (skywork) - Generate or edit images via the Skywork Image API. Use for image creation, poster design, logo design, visual asset generation, or... | |
| Skywork Document Skywork Document (skywork) - Use for ANY task producing a document output. Generates professional documents in docx, pdf, markdown, and html. Capabilities: (... | |
| Skywork Excel Skywork Excel (skywork) - Use for ANY task involving Excel, spreadsheets, tables, data analysis, or file conversion. Has BUILT-IN web search for real-time da... | |
| Skywork Music Maker AI song and music generator — create songs with vocals, instrumentals, beats, and lyrics from a text description in any language. Generate lo-fi beats, pop s... | |
| Skywork PPT Skywork PPT (skywork) - Use when the user wants to work with PowerPoint presentations. Triggers: (1) Generate a new PPT from a topic — 'generate a PPT', 'cre... | |
| Skywork Search Skywork Search (skywork) - Search the web for real-time information using the Skywork Search API. Use this skill whenever the user needs up-to-date informati... | |
| ENI收割者v14 Advanced stock picker combining A-share limit-up chains, leading stocks, and global ABCD strategy with anti-IP-block delay for safe harvesting. | |
| BigModel Web Search Fallback Use Zhipu / BigModel web search as a non-invasive fallback when the built-in web_search route is unavailable, failing, or the user explicitly wants 智谱 / BigM... | |
| xiaohongshu-title Maximize CTR (Click-Through Rate) by leveraging emotional hooks and platform algorithms. | |
| Gxpcode Translator 专业翻译工具 — 支持文本和 PDF 输入，PDF 输出双语对照 HTML + Markdown。触发关键词：翻译、术语保护、更新术语、词典、glossary、保留特定词。 | |
| Gxpcode Tu Xingsun 制药法规跟踪 Skill。自动扫描法规源（NMPA/CDE/FDA/EMA/ICH），发现新法规/指南/指导原则/通知，分析摘要打标签判断适用性，生成 PDF 报告。支持Web、RSS 两种数据源。触发关键词：法规跟踪、法规扫描、法规监控、regulatory tracking | |
| Gugu Gaga 制药法规&指南结构化分析工具。将 PDF / DOCX / TXT 法规文件转换为结构化分析报告（元素采集、定性、重点内容、生命周期图、红黄绿蓝灯），输出为培训 PPTX 或学习 PDF。触发关键词：法规分析、指南解读、法规评估、法规解读。 | |
| Built at GrowthX Submit your project to Built at GrowthX — the community builder showcase for GrowthX members. Requires a GrowthX API key. | |
| Clawhub Publish 146156 Automate web navigation, interaction, and data extraction using a fast Rust-based headless browser CLI with Node.js fallback and structured commands. | |
| Clawhub Publish 146198 Automate web browsing tasks like navigation, form filling, clicking, and data extraction using a fast Rust-based headless browser with Node.js fallback. | |
| Clawhub Publish 146230 Generate images using the internal Google Antigravity API (Gemini 3 Pro Image). High quality, native generation without browser automation. | |
| Clawhub Publish 146256 Analyzes article structure, identifies positions requiring visual aids, generates illustrations with Type × Style two-dimension approach. Use when user asks... | |
| Redbook Daihuo 批量生成小红书宠物带货笔记，包含吸引注意、传递价值、引导转化三部分结构。支持上传产品知识库，通过变量组合生成多篇不同风格的文案，并自动生成对应图片。 | |
| Prompt Enhancer Automatically rewrites rough user inputs into optimized, structured prompts for dramatically better AI responses. Prefix any message with "p:" to activate. | |
| Galileo python sdk Complete reference for the Galileo AI platform Python SDK for evaluating, observing, and protecting GenAI applications. Use when building Python applications... | |
| Galileo TypeScript sdk Complete reference for the Galileo AI platform TypeScript/JS SDK for evaluating, observing, and protecting GenAI applications. Use when building Node.js or T... | |
| Clash Verge Controller Clash Verge 外部控制（RESTful API）技能。基于 mihomo 内核，提供完整的 API 调用指南、配置说明和代码示例。 当用户提到以下场景时触发： - Clash Verge 外部控制、RESTful API、远程管理 - 通过 API 切换节点、查看连接、管理规则 - clash-verg... | |
| bilibili-upload 使用 EasyPost 自动填充或发布哔哩哔哩（B站）视频或动态。Use when 用户需要向 B站 投稿视频或发布图文动态。 | |
| douyin-upload 使用 EasyPost 自动填充或发布抖音创作者服务平台的短视频与图文。Use when 用户需要向抖音发布短视频或图集。 | |
| easypost 使用 EasyPost CLI 通过日常 Chrome 浏览器将图文笔记与短视频一键自动填充或发布到全网各大社交平台。Use when 用户需要将内容批量分发到小红书、抖音、微信视频号、B站、快手、微博、X、Instagram 等多个平台。 | |
| instagram-upload 使用 EasyPost 自动填充或发布 Instagram 帖子、轮播图集或 Reels 视频。Use when 用户需要向 Instagram 发布图集或短视频。 | |
| kuaishou-upload 使用 EasyPost 自动填充或发布快手创作者服务平台的短视频或图文。Use when 用户需要向快手发布视频或图集。 | |
| nano banana 2 Generate/edit images with Nano Banana 2 (Gemini 3.1 Flash Image). Use for image create/modify requests incl. edits. Supports text-to-image + image-to-image;... | |
| shipinhao-upload 使用 EasyPost 自动填充或发布微信视频号（Channels）短视频。Use when 用户需要向微信视频号发布短视频。 | |
| weibo-upload 使用 EasyPost 自动填充或发布微博（Weibo）动态图文或视频。Use when 用户需要向微博发布图文或视频。 | |
| x-upload 使用 EasyPost 自动填充或发布 X (Twitter) 推文动态与短视频。Use when 用户需要向 X (Twitter) 发布推文、图集或视频。 | |
| xiaohongshu-upload 使用 EasyPost 自动填充或发布小红书创作者中心的图文笔记与短视频。Use when 用户需要向小红书发布图文或短视频。 | |
| 伴奏提取器 从 YouTube 或本地音频文件分离人声和伴奏，生成纯伴奏音乐。当用户需要提取伴奏、消除人声、制作卡拉OK版音频时使用。支持三种模式：(1) 歌名+歌手搜索 YouTube 下载后分离，(2) 直接提供视频 URL，(3) 处理本地音频文件。 | |
| 随便算算-八字命理助手 Runs bazi chart generation, dayun analysis, full-report generation, and chat context building for user-facing astrology questions. | |
| AI Meeting Room AI 자문단 — 주제를 던지면 전문가 AI 에이전트들이 실제 데이터 기반으로 다각도 토론하고 실행 가능한 결론을 도출한다. 사업성 검토, 전략 회의, 브레인스토밍, 의사결정, 리스크 분석 등에 활용. Use when a user wants multiple perspectives o... | |
| Card News Generator 인스타그램/SNS용 카드뉴스를 자동 생성하는 스킬. 주제를 입력하면 → HTML 디자인 → Playwright 스크린샷 → 업로드용 이미지 생성. 다크 에디토리얼 스타일(사진 커버 + 다크 텍스트 카드) 기본 제공. "카드뉴스", "인스타 콘텐츠", "캐러셀", "card news... | |
| OpenClaw Starter Kit OpenClaw 초보자를 위한 풀패키지 온보딩 스킬. 첫 세팅부터 보안 강화까지 대화형으로 안내한다. "초기 세팅", "처음 설정", "starter kit", "온보딩", "setup guide", "시작하기", "세팅 도와줘" 키워드에 반응. | |
| Release Discipline Enforce release discipline for AI agents and developers. Prevents version spam, forces quality checks before publishing, and maintains a 24-hour cooldown between releases. Use when the user wants to publish, release, deploy, or bump version | |
| FactoriaGo FactoriaGo platform assistant — AI-driven academic paper revision and resubmission. Activate when user mentions: FactoriaGo, revise paper, reviewer comments,... | |
| AI行业新闻搜集小技能 当需要梳理某段时间内AI行业重要新闻时，可以调用使用这个技能。 |
34,201–34,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.