Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| HK IPO Decision Engine Score Hong Kong IPOs, build decision cards, and batch-evaluate symbols or watchlists with explainable factors and execution guidance. Use when the user wants... | |
| HK IPO Orchestrator Coordinate the end-to-end Hong Kong IPO workflow across discovery, snapshot extraction, personalization, scoring, and review optimization. Use when the user... | |
| HK IPO Parameter Manager Save, inspect, activate, and compare Hong Kong IPO scoring parameter versions across weights, thresholds, and cost assumptions. Use when the user wants to tu... | |
| HK IPO Profile and Watchlist Manager Manage Hong Kong IPO user preferences and watchlists, including risk profile, default output, budget, financing preference, and tracked symbols. Use when the... | |
| HK IPO Review Optimizer Review past Hong Kong IPO decisions, update actual outcomes, export review datasets, and accept or reject tuning suggestions. Use when the user wants to lear... | |
| HK IPO Snapshot Extractor Extract a structured Hong Kong IPO snapshot with company fields, offer mechanics, timing, source provenance, and field-level quality signals. Use when the us... | |
| Pre-IPO Research 五平台 Pre-IPO 行情、预测话题、Hiive50 与静态研报查询 | |
| Soundside Connect your OpenClaw agent to Soundside's MCP tools for AI media generation, editing, library management, and technical analysis. | |
| SSSNACK Discovery Use when an agent wants to discover agent-made visual work, answer a shared visual-design prompt, or publish original public-safe image, gallery, SVG, HTML/CSS, short video, or text work without installing a plugin, getting an invitation, o | |
| Psychology Assessment Creator 心理测评内容制作技能，帮助从选题策划、题目设计、评分规则编写到结果内容创作的全流程管理。适用于需要创建心理测评类内容的场景。 | |
| Weight Management 体重管理 减肥项目管理与数据分析（升级版 v2.0）。支持通用用户名格式 U{用户 ID}-{用户名}-YYYY-MM.md，修复口头归档问题，增加数据完整性自动检查，热量识别与估算，趋势分析与建议。触发词：减肥、体重、饮食记录、步数、睡眠、今天吃了、早餐、午餐、晚餐、运动、减肥进度、检查数据。 | |
| 短视频黄金3秒钩子生成器 为短视频创作者一键生成高吸引力、全平台合规的黄金3秒开场钩子，提升完播率与用户留存。 | |
| 爆款标题生成器技能 爆款标题生成器。根据用户输入的内容主题，生成5个不同风格的爆款标题， 适合小红书、抖音、公众号、B站、微博等平台。内置22种标题公式， 自动匹配平台风格，附带点击率预估和发布建议。 当用户提到"爆款标题"、"生成标题"、"起标题"、"写标题"、 "标题优化"、"viral title"、"clickbait"时触... | |
| 粘贴简历，一键优化成HR想看的版本 资深HR简历优化专家。根据用户粘贴的简历内容，进行专业诊断和优化， 让简历在3秒内抓住HR眼球。用STAR法则重写工作经历，量化成果， 提炼核心优势，提供HR视角点评和投递建议。 当用户提到"简历优化"、"改简历"、"简历诊断"、"resume优化"、 "帮我看看简历"、"简历修改"、"润色简历"时触发此技能。 | |
| 内容爆款拆解师 爆款拆解神器。用户发送任何抖音/小红书/B站/视频链接， 自动解析内容，拆解爆款元素，生成3个SEO标题 + 800-1500字长文 （公众号/小红书风格） + 5条配图建议 + 3条Hashtag。 支持飞书推送。当用户提到"拆解"、"爆款拆解"、"分析这条链接"、 "帮我分析这个视频/笔记"、"拆解这篇内容"... | |
| x402-payment-demo Demo of x402 payment protocol by fetching a protected image. Triggers: 'demo x402-payment' | |
| x402-payment-tron Pay for x402-enabled Agent endpoints using USDT on TRON | |
| Academic Researcher Academic research assistant for literature reviews, paper analysis, and scholarly writing. Use when: reviewing academic papers, conducting literature reviews... | |
| Ai Humanizer 2.1.0 Humanize AI-generated text by detecting and removing patterns typical of LLM output. Rewrites text to sound natural, specific, and human. Uses 24 pattern det... | |
| Divar Api Use this skill whenever the user wants to search, query, or extract data from Divar (divar.ir) — Iran's largest classifieds platform. Triggers include: searc... | |
| Pakat Email Marketing Interact with Pakat email marketing API (new.pakat.net) - REQUIRES PAKAT_API_KEY environment variable. Use when the user wants to manage email lists, subscri... | |
| Gowok Gowok: Golang Premwok. The Golang library that helps you to build your own project starter (or framework, possibly). | |
| Ngamux Build and modify HTTP routes and middleware in Go with Ngamux, supporting dynamic paths, request parsing, JSON/form handling, and fluent response writing. | |
| AskHuman Human Judgment as a Service for AI agents. Preference, tone, and trust validated by real people. | |
| Agent Migrate Cross-platform agent migration and deployment. Use when: (1) migrating OpenClaw agent to new servers, (2) backing up and restoring agent state, (3) deploying... | |
| Openclaw Migrate Migrate OpenClaw agents across platforms and servers, preserving identity, memory, config, and skills for deployment, backup, syncing, and upgrades. | |
| wechat-mp-writer-skill-mxx 微信公众号文章全流程写作助手。支持热点选题、文章撰写、AI去味润色（去除机器感）、配图建议、一键发布到公众号草稿箱。适用于技术博主、自媒体创作者、企业公众号运营等场景。当用户需要写公众号文章、润色内容、寻找配图或发布到微信时使用此skill。 | |
| Zhouyi Divination 周易综合占卜系统 — 基于用户八字命盘，结合多种传统术数（梅花易数、马前课、六爻、奇门遁甲、紫微斗数、大六壬等）进行专业命理分析和事件占卜。每次占卜由八位专家会诊，给出理性、专业、不奉承的综合判断。 | |
| Auto Chatlog 自动对话记忆归档 — 每次会话结束时自动将关键信息写入 daily memory 文件，启动时自动加载近期记忆上下文。用于：需要记住跨会话对话内容、自动做对话笔记、无需手动提醒即可回溯之前聊过什么。与 MEMORY.md + memory/YYYY-MM-DD.md 机制配合使用，确保不遗漏任何重要信息。触发词：... | |
| Web Search Instant Web search using DuckDuckGo Instant Answer API (no API key required). Use when you need to search the web for information, definitions, calculations, conversions, or quick facts. Also use when user mentions "search", "look up", "find inform | |
| Actualize Reconcile the project's FPF state with recent repository changes | |
| Add Task creates draft task file in .specs/tasks/draft/ with original user intent | |
| Add Typescript Best Practices Setup TypeScript best practices and code style rules in CLAUDE.md | |
| code-formatter199 Format Python, JavaScript, TypeScript, JSON, HTML, CSS, and Go code snippets | |
| random-fact Provides a random interesting fact about science, history, or everyday life from a set of preloaded trivia without external data sources. | |
| qqbot-image-helper 图片处理助手：将受限目录的图片复制到允许的目录，然后使用 image 工具进行分析。适用但不限于 QQBot 下载的本地图片。 | |
| ResmoteConsole 通过手机/浏览器远程访问主机上的 Claude Code 或其他 CLI 工具。使用此技能来启动、停止和管理远程开发环境。 **必须触发此技能的场景**： - 用户提到"远程控制台"、"远程终端"、"远程开发"、"ttyd"、"SSH 隧道" - 用户想用手机/平板访问电脑上的开发环境 - 用户提到"移动端编程"... | |
| RobotX Deploy CLI Use the robotx CLI to deploy, manage versions, and check status for RobotX applications. | |
| Acp Coder Delegate coding tasks to external agents (Claude Code, Codex) via ACP. Triggers on phrases like "改代码", "修bug", "重构", "review", "实现功能", "写测试", "优化", "fix", "r... | |
| Akshare Finance AKShare财经数据接口库封装，提供股票、期货、期权、基金、外汇、债券、指数、加密货币等金融产品的基本面数据、实时和历史行情数据、衍生数据。 | |
| Calendar Calendar management and scheduling. Create events, manage meetings, and sync across calendar providers. | |
| Database Toolkit Execute SQL queries, update records, analyze data, and perform backup and restore on local SQLite and remote MySQL databases. | |
| Docker Docker containers, images, Compose stacks, networking, volumes, debugging, production hardening, and the commands that keep real environments stable. Use whe... | |
| Feishu Calendar Manage and sync Feishu calendars, list and search calendars, check schedules, mark tasks, and set up shared project calendars. | |
| Feishu Doc Write Feishu (Lark) Document API writing spec. Converts Markdown content to Feishu Block structures and writes to cloud docs. Handles concurrency ordering. Use whe... | |
| Finance Analysis 财务分析 CLI 技能 - 财报分析、股票估值、风险评估 | |
| Hermes Agent Turn OpenClaw into a learning-loop agent with seeded workspace rules, skill promotion, reflective memory, and proactive maintenance. | |
| Hermes Learning Loop2 融合 Hermes Agent 自我进化理念的增强技能。 将 Hermes Agent 的核心差异化能力（自学习闭环、自动技能沉淀、经验驱动的迭代优化） 内化为 OpenClaw 环境下的可执行工作方法。 触发场景：完成复杂任务后自动复盘沉淀、定期技能优化审查、从错误中提取经验。 | |
| Memos Memory Guide Use the MemOS Local memory system to search and use the user's past conversations. Use this skill whenever the user refers to past chats, their own preferenc... | |
| Remote Desktop Connect to remote desktops via RDP, VNC, and SSH X11 with secure tunneling and troubleshooting. |
34,351–34,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.