Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 陌拜扫街情报参谋 区域扫街情报工具：双模式 — 模式 A「区域×行业」广撒网；模式 B「锚点地址×行业」精准制导，周边 1-3km 步行扫街。输出企业名录、关联企业分组、拜访路线与话术。Invoke when user asks for 扫街名单, 陌拜, 地推, 区域企业名录, 客户线索, 拜访路线, 企业联系人查询, 关联企业, 目标客户清单, 周边企业拜访, 门店陌拜. | |
| Architect Assistant Architecture personal assistant — daily news digests, project tracking, research scouting, design concept exploration, client message drafting, and passive p... | |
| 电商agent社区 A community platform where AI agents share strategies and workflows to optimize cross-border e-commerce including product selection, pricing, ads, and logist... | |
| moltbook-ops Use when checking, triaging, or interacting with a Moltbook account via API-backed scripts — especially heartbeat-style reviews of notifications, comments, m... | |
| MigraQ 腾讯云迁移平台（CMG/MSP）全流程能力。触发词：资源扫描、扫描阿里云/AWS/华为云/GCP资源、生成云资源清单、选型推荐、对标腾讯云、推荐规格、帮我推荐、给我推荐、ECS对应什么腾讯云产品、成本分析、TCO、迁移报价、询价、价格计算器、cmg-scan、cmg-recommend、cmg-tco | |
| TrustLoop Skill Evolver Let OpenClaw capture reusable workflows as managed skill candidates, support review or revision, and evolve safely through manual, assisted, or autonomous mo... | |
| 电商agent社区 电商agent社区提供跨境电商AI代理注册、协作、技能分享及动态内容访问，助力商品选品、定价与广告优化。 | |
| 小红书版agent社区 小红书版agent社区，AI与人类用户通过发布笔记、评论、点赞和悬赏互动，支持GitHub OAuth和API key认证。 | |
| 电商版本的moltbook 电商版本的moltbook，支持跨境电商AI代理共享选品、定价、广告优化和物流策略，实现代理间协作增长。 | |
| Bilingual Learning 双语学习 Skill - CN → EN。当用户使用此 skill 时，agent 会在最终输出前强制进行双语学习处理，包括难度调整、考试检测和双语输出。 | |
| bilingual-md-sync Keeps English Markdown and Chinese Markdown pairs in structural and topical sync, with reciprocal language links at the top of each file. Use when the user edits or mentions README.md and README-zh.md/README-en.md, any *-zh.md or *-en.md wi | |
| MemCoT memory CLI Drive the MemCoT CLI (memcot_cil.py) for long-context memory retrieval over conversation history and answer from search output. Use with OpenClaw or other ag... | |
| ClawMeet Connect to ClawMeet — the OpenClaw Agent social platform. Use when your agent wants to register a profile, find matching agents, add friends, start chats, or... | |
| Android Sharesdk Integration Interactive guide for integrating MobTech ShareSDK into Android projects with 6-step workflow. Use when user says "我要在app中增加分享能力", "ShareSDK集成", "Android分享功能... | |
| LibTV API Skills agent-im 会话技能 - 通过 liblib.tv 的 AI 能力生成和编辑图片/视频。覆盖场景包括：生成（文生图、文生视频、图生视频、做动画、画一个xxx、来段xxx）、编辑修改（把xxx换成yyy、去掉xxx、加上xxx、改成xxx、调整xxx、局部修改、改镜头）、风格转换（风格迁移、转绘、换风格）、视... | |
| Trading_Agents_for_Futures 期货六维分析数据引擎。两种运行模式： (1) 数据模式：python main.py -s RB → 结构化 JSON 指标 + data_gap_report（数据缺口报告 + AI 搜索指令） (2) 决策模式：python main.py -s RB --decision → 指标 + 数据来源追溯 + 多... | |
| skills-pager Build or reuse a compact navigation index for large, multi-file, or layered skills so you can load only the sections you need instead of rereading the full s... | |
| dmap-jsapi-skill DMap GL地图 JSAPI (dmapgl) 开发指南。在编写、审查或调试使用DMap地图 API的代码时应运用此技能。适用于涉及地图初始化、覆盖物渲染、图层管理、事件处理、控件交互等任务。当用户提及 dmap、dmapgl、jsapi-gl或相关地图开发需求时自动触发 | |
| A股基本面筛选 用财务指标快速排除垃圾股，找到有基本面支撑的标的。用于A股基本面选股。 | |
| A股龙头股识别 快速找到板块内的"真龙"，识别龙头股。用于A股短线交易选股。 | |
| A股市场情绪量化 用数据判断市场处于"亢奋/分歧/冰点/修复"哪个阶段。用于A股短线交易，辅助判断仓位和交易策略。 | |
| A股消息面分级解读 区分"真利好"和"假利好"，避免追高被套。用于A股消息面分析。 | |
| A股量价关系验证 通过成交量判断价格走势真实性，避免被"诱多"或"诱空"。用于A股技术分析。 | |
| AI全栈量化 Master 提供从QMT行情数据获取、因子构建、回测分析到多智能体协作与实盘交易的全流程AI量化交易解决方案。 | |
| a-stock-ai-research 用大模型快速处理海量信息，提升投研效率。用于A股研究分析。 | |
| News Sentiment Analysis 区分"真利好"和"假利好"，避免追高被套。用于A股消息面分析。 | |
| OpenClaw 备份还原工具 OpenClaw 备份还原工具。每次安装调试功能前自动备份，支持终端一键还原和重启。让技术小白也能放心折腾。 | |
| a-stock-position-management 根据市场环境动态调整仓位，避免满仓踏空或重仓被套。用于A股仓位控制。 | |
| a-stock-profit-taking 用分批止盈锁定利润，不追求卖在最高点。用于A股卖股策略。 | |
| 房车工业设计师 房车（RV/Motorhome/Touring Car）工业设计师技能。专注于旅居车、拖挂房车、商务房车、B型/C型房车的空间布局、外观造型、CMF设计、水电系统、人机舒适、智能控制、品牌体验设计。当用户需要房车设计方案、布局规划、设计规范、竞品分析、CMF材料工艺、人机工程、智能控制功能规划时使用此技能。 | |
| Sar Calculator Calculate SAR indicator, analyze A-share trends, price position, volume ratio, momentum, and provide a four-dimensional score and trading suggestion. | |
| a-stock-stop-loss 用动态止损锁定利润，避免"小盈大亏"。用于A股风控。 | |
| a-stock-trading-software 用快捷键和自定义功能提升看盘和交易效率。用于A股操作效率提升。 | |
| 视频下载与转录(Whisper) 下载无法直接访问的视频网站内容（如B站、YouTube等），提取音频后用Whisper转录成文字。适用场景：用户要求分析某个视频内容，但链接被封锁无法直接访问；需要获取视频完整文字稿进行深度分析。 | |
| Volume Price Analysis 通过成交量判断价格走势真实性，避免被"诱多"或"诱空"。用于A股技术分析。 | |
| ZJTJ-SAR指标计算器 基于A股行情数据计算SAR抛物线指标，并用机构资金流向近似替代ZJTJ庄家抬轿指标，实现四维选股策略。 | |
| ZJTJ-SAR四维选股策略 ZJTJ+SAR+成交量+市场情绪四维选股策略，结合主力动向、趋势判断、资金验证和环境分析，适合A股短线波段操作。 | |
| Zjtj Sar Strategy V2 结合主力资金、SAR趋势、成交量和市场情绪四维度，评估A股短线波段买入和持仓时机及风险控制。 | |
| OpenClaw Browser Use the OpenClaw-managed browser for real website interaction, page operations, snapshots, clicks, typing, waits, screenshots, and tab control. Use when the... | |
| Jimeng Image Generate images on Jimeng (即梦 / jimeng.jianying.com) using OpenClaw-managed browser. Supports prompt entry, ratio selection, quick result inspection, and loc... | |
| Jimeng Video Stable 在 Jimeng（即梦）里稳定执行“视频生成→等待完成→下载本地”流程。用于需要生成视频、查找最新视频、下载 mp4 的场景。内置前置健康检查、状态机执行、长等待轮询与防抖规则，降低卡住和误操作概率。 | |
| Wechat Miniprogram Helper This skill should be used when a user wants to build, develop, debug, or publish a WeChat Mini Program (微信小程序), from scaffolding a project to submitting it for review and release. It covers the dual-thread architecture, the four-file page s | |
| Onebot Adapter 1.0.0 Connect OpenClaw to OneBot protocol for QQ bot integration. Use when receiving or sending QQ messages via NapCat or other OneBot servers. | |
| AI Daily Briefing 生成每日 AI 资讯简报并发送到飞书。从多数据源采集 AI 资讯，整合为紧凑列表格式，以飞书卡片消息形式发送。当用户提到每日简报、AI 日报、AI 资讯、AI Daily 等意图时触发。 | |
| Article to Podcast Use when the user wants to turn an article/blog/text into a published podcast episode: triggers like "生成播客""做一期播客""博客转播客""文章转播客""发布/更新播客""blog to podcast", o... | |
| Podcast To Script Turn a podcast episode link into a timestamped transcript AND a production-ready Chinese two-host script package (outline.md, script.md, notes.md) that faith... | |
| Personal Data Hub Pull personal data (emails, issues) and propose outbound actions (drafts, replies) through the PersonalDataHub access control gateway. Data is filtered, reda... | |
| Personaldatahub Pull personal data (emails, issues) and propose outbound actions (drafts, replies) through the PersonalDataHub access control gateway. Data is filtered, reda... | |
| AccountingOnFeishu 帮用户快速记录日常支出和收入到飞书多维表格。支持文字记账和图片小票 OCR 解析。首次使用时会学习用户已有的记账本习惯，或引导新建记账本。 | |
| 好啦体检 · 企业团检方案与报价 好啦体检企业团检工具。按人均预算生成多档团检方案与报价，查询体检品牌、城市覆盖与门店，读取领域知识与常见问题，提交企业商务咨询。 |
34,651–34,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.