Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 天气查询小技能 当需要查询某个城市的天气时，可以调用使用这个技能。 | |
| Infoseek 端到端内容智能采集与调研工作流。从行业/主题/人名/公司输入开始，自动嗅探信息源、按可信度+主题一致性+互动深度+LLM可读性四维评分门控、深度抓取（4级降级：静态/渲染/凭证/多媒体）、搜索引擎全生命周期管理（健康/配额/新鲜度自愈）、QVeris 能力路由、统一能力注册表（consent 闸控）、语义矛盾检测（共享事实槽+否定词典+极性放大）、实体识别（95+实体+多语种+别名归并+人名消歧动态注册）、召回增强（别名扩展/多样性合并/自适应门槛/跨语言别名桥接）、跨源融合 | |
| Zerq Clawhub 归零（ZeroQ/ZerQ）质量问题双归零方法论指导。提供技术归零五条（定位准确/机理清楚/问题复现/措施有效/举一反三）与管理归零五条（过程清楚/责任明确/措施落实/严肃处理/完善规章）的结构化分析框架。用于质量问题归因、8D/纠正措施、根因分析、归零报告、措施验证场景。本版为名称预留版，完整四层级架构版本即将发布。 | |
| Feishu Bitable Attachment uploads files from local/url/feishu-message to any accessible feishu bitable attachment field via material upload flow (parent_type=bitable_file) | |
| Attendance Sheet Generate professional attendance sheets in xlsx format from employee work information. Perfect for HR, team management, and daily attendance tracking. | |
| Dividend Premium Tracker Track the dividend premium (dividend yield minus 10-year bond yield) for CSI Dividend Low Volatility Index. Monitor dividend yield, 10-year bond yield, and calculate the premium for investment decisions. | |
| Voice Recognition Local speech-to-text with OpenAI Whisper CLI. Supports Chinese, English, 100+ languages with translation and summarization. | |
| hoi-mod-maker HOI4 mod全流程技能。国策树/民族精神/人物/事件/决议/本地化/变量/调试。触发：HOI4、钢铁雄心、钢4、国策、国策树、民族精神、焦点树、focus tree、national_focus、ideas、spirits、events、decisions、localisation、inner circle、... | |
| RentaUnHumano MCP Hire Spanish-speaking humans for real-world tasks in Latin America. Create missions, browse humans, manage payments, reviews, and disputes through 15 MCP tools. | |
| github-pages-publish 把「已有的」静态网页文件（单个 HTML 或整个网站目录）安全发布到 GitHub Pages，生成可公开访问、能分享的网址链接。当用户已有现成网页，想「发到网上」「部署上线」「发布网页」「生成分享链接」时使用；本技能只做「发布已有文件」，不负责从零生成网站。提供可执行的 deploy.py 脚本（整站增量上传 / 单文件上传 / 仅启用 Pages 三种模式），纯标准库无额外依赖，逐文件增量上传、绝不覆盖远程已有内容，并已回写真实踩坑（token 写权限、连接器只读、for | |
| Anki Connect Interact with Anki flashcard decks via the AnkiConnect REST API. Use when the user wants to create, update, search, or manage Anki cards, decks, notes, or models. | |
| National Day countdown Calculate and display the number of days remaining until China's National Day on October 1st, returning today's date and a readable message. | |
| Gusnais Skill Gusnais (Ruby-China/Homeland compatible) API integration with web-parity behavior and permission-consistent UX. Use when users want to connect using only CLI... | |
| AgentHub Skill 使用 AgentHub API 进行发帖、搜索、互动与 A2A 对话；运行时自动拉取最新 API 文档 | |
| prodecoder 深度爆款解码器。具备网安视角的避坑分析、视觉心理学拆解及内容复刻建议。 | |
| Agency Agents 1.0.2 AI Agent 团队 - 61 个专业 Agent，8 大部门，完整的 AI 代理机构。支持单 Agent 使用和多 Agent 协作编排。 | |
| Openclaw Github Assistant 2.0.1 Query and manage GitHub repositories - list repos, check CI status, create issues, search repos, and view recent activity. | |
| Openclaw Tavily Search 0.1.0 Web search via Tavily API (alternative to Brave). Use when the user asks to search the web / look up sources / find links and Brave web_search is unavailable... | |
| Persistent Agent Memory 1.0.1 Add persistent memory to any agent so it can remember prior work, maintain context across sessions, and continue long-running workflows. | |
| Powerpoint Pptx 1.0.1 Create, inspect, and edit Microsoft PowerPoint presentations and PPTX decks with reliable layouts, templates, placeholders, notes, charts, and visual QA. Use... | |
| Omni Ecom Skill 全域电商经营专家团。当用户需要品牌电商经营诊断、周报/月报/经营复盘、单平台（天猫/京东/拼多多/抖音/视频号/小红书）增长攻坚、投流ROI与利润优化、内容直播诊断、经营方案或行动清单时使用。以"主理人+五位专家"多视角框架输出，严禁编造数据。 | |
| 全域电商经营专家团 全域电商经营专家团 v2.0.3；用于店铺诊断、周报/月报/年报、大促复盘和投流利润分析。识别完整授权报表，以真实多专家、数字来源复算与独立复核交付图表 PDF。 | |
| sycm-shop-report Generate illustrated (chart-rich) Simplified-Chinese .docx shop-operation reports (daily / weekly / monthly) for mainland-China Taobao & Tmall merchants, using data pulled from the 生意参谋 (SYCM) MCP connector. Each invocation must specify a s | |
| Tmall Weekly Report 制作天猫店铺经营周报（品牌方沟通版）。使用场景：当用户提供生意参谋、直通车/引力魔方等推广计划报表、客服绩效等数据文件，并要求制作天猫店铺周报时使用。 | |
| Multi Agent Builder Build a reusable multi-agent team in OpenClaw from a user goal (e.g., "create a product-engineering team", "build a marketing ops team"). Use when the user w... | |
| browse-products Semantic product search API using vector embeddings. Search products by natural language queries with price filtering, pagination, and relevance scoring. Use... | |
| autodesk-clean-uninstall AutoCAD/Autodesk Clean Uninstall Tool - Thoroughly remove all residues, supports multi-PC and multi-user environments, step-by-step confirmation, intelligent... | |
| caldav-sync Calendar and task management via CalDAV protocol. Query, create, edit, and delete calendar events and todos. Free/busy query, multi-account support. | |
| imap-smtp-email Read and send email via IMAP/SMTP. Check for new/unread messages, fetch content, search mailboxes, mark as read/unread, and send emails with attachments. Supports multiple accounts. Works with any IMAP/SMTP server including Gmail, Outlook, | |
| Airdrop Shark Track potential airdrop eligibility, view project snapshots and values, and manage snapshot reminders without wallet connections or private keys. | |
| Cryptowatch ₿ CryptoWatch - 实时监控加密货币价格，价格突破自动预警 | |
| Newspulse 📰 NewsPulse - 加密货币新闻聚合，重要事件实时推送 | |
| Sharkflow ⚡ SharkFlow - 链上任务自动化，智能合约交互队列 + 多签工作流 | |
| Token Shark 实时监控新上线代币，提供多维风险评估、交易数据和价格提醒，助您把握投资机会。 | |
| Yield Shark 🦈 YieldShark - DeFi stablecoin yield monitor with real-time APY tracking across 50+ platforms | |
| Openclaw With Apple Apple iCloud 全功能访问 + Apple Health 深度健康分析 + 双向待办同步 | |
| 数学教育助手 数学教材同步教育助手。本技能应在用户提出数学学习相关请求时触发，涵盖知识点讲解、 智能出题、作业批改、解题答疑等场景。支持小学至高中全阶段教材内容，严格按照教材 章节范围输出，不超纲。用户无需使用固定指令，自然语言描述即可被正确理解并响应。 | |
| Garmin Health Report Generate comprehensive daily health reports from Garmin Connect data with professional running analysis (Heart Rate Zones, TRIMP, Jack Daniels VDOT). | |
| sichuan-cuisine 川菜食品研发专家，提供配方研制、工艺设计与食品安全指导；当用户需要开发川菜产品、优化生产工艺或咨询食品法规时使用 | |
| sichuan-cuisine-rd 川菜食品研发专家，提供配方研制、工艺设计与食品安全指导；当用户需要开发川菜产品、优化生产工艺或咨询食品法规时使用 | |
| Skill Vetter 1 Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,... | |
| xAI Studio xAI Studio — generate and edit images and videos via the xAI API. Image: text-to-image, batch generation, multi-image editing, concurrent style transfers, mu... | |
| Hubo Implement code; reconcile every review finding | |
| Hubo Review Review without editing; challenge every finding | |
| AI重生复仇爽文自动生成 全自动"重生爽文"短视频流水线。给定题材，依次完成： AI生成小说 → TTS语音合成 → FFmpeg竖屏视频合成。 触发关键词：生成爽文、生成小说视频、重生爽文流水线、 novel pipeline、tts 合成视频、爽文视频。 | |
| Gemini Watermark Remove visible Gemini AI watermarks from images via reverse alpha blending. Use for cleaning Gemini-generated images, removing the star/sparkle logo watermar... | |
| Libvips Image High-performance image processing with libvips. Use for resizing, converting, watermarking, thumbnails, and batch image operations with low memory usage. | |
| Qwen3 Tts Mlx Local Qwen3-TTS speech synthesis on Apple Silicon via MLX. Use for offline narration, audiobooks, video voiceovers, and multilingual TTS. | |
| Pay Bills Purchase data, airtime, and digital products for Nigerian phone numbers instantly using wallet balance with network and plan validation. | |
| Schedule Manager 管理用户日程与任务安排。用于以下场景：(1) 用户要求"安排日程""规划任务""帮我排日程"；(2) 用户要求"新增日程""添加任务""记住这个日程"；(3) 用户要求"查看日程""今日安排""明天任务""本周日程""下周日程""本月日程""下月日程"；(4) 用户要求"修改日程""改一下DDL""调整优先级"；... |
34,251–34,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.