Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| personal-checkup-booking 好啦体检（haola-pe）个人体检安排与预约。用户说想体检、帮我安排个体检、体检项目怎么选、体检多少钱、几百块能查什么、腰颈椎不舒服查什么、入职体检做什么项目、附近哪有体检中心、体检报告在哪看、要改期或取消时使用。可按年龄、性别、婚否、预算与健康诉求生成个性化体检方案，覆盖全国 240+ 城市，支持在线预约、改期、取消与订单查询。 | |
| RiskShield案件审批自动化 RiskShield 案件审批自动化。使用 Playwright 浏览器自动化完成审批，支持 Pass/Refuse 两种操作。 | |
| jrj-fin-search-skill金融界资讯研报搜索 A股中文财经资讯和研报摘要搜索，支持按关键词、来源、时间范围查询新闻资讯和研究报告。 用于获取权威来源的市场动态、公司新闻、行业研报等信息。避免AI在搜索金融场景信息时，参考到非权威、过时的信息。 <example>User: "搜索贵州茅台最近3天的新闻" Assistant: 使用 news.js searc... | |
| jrj-quote-skill金融界A股行情数据 A股实时行情和历史K线数据查询，支持技术指标计算。用于获取股票、场内基金、指数的实时价格、历史K线，以及计算MA、MACD、KDJ、BOLL、RSI等技术指标。 <example>User: "获取招商银行最近30天的历史K线和MACD指标" Assistant: 使用 kline.js 脚本获取数据</exam... | |
| Android Armor Breaker Android APK脱壳工具（android脱壳）与加固破解工具 - Frida-based dynamic unpacker for commercial protections (360, Baidu, Tencent, IJIAMI, Bangcle, AliProtect). Extract DEX f... | |
| Openclaw Security Audit Run a local security audit on the OpenClaw environment, identifying risks, affected files, and prioritized remediation steps without exposing secrets. | |
| Clean Closed Issue Worktrees Safely audit and remove worktrees for closed issues | |
| Scifi Writing 科幻小说写作助手。帮助用户从零开始构思、搭建世界观、设计角色、规划情节、撰写章节，支持完整长篇创作和短篇创作。当用户提到写科幻小说、科幻故事、赛博朋克、太空歌剧、硬科幻、软科幻、未来世界、外星文明、时间旅行、末日题材、星际战争、人工智能觉醒、虚拟现实等科幻创作相关需求时触发。也适用于用户说"帮我写个科幻短篇""构... | |
| add-to-awesome-list Guide a contributor through the full process of adding a new service to the catalog: selecting the standard or operator-surface admission track, checking URL Onboarding, opening an issue, writing the dossier, updating manifests, and prepari | |
| AIPing Media AIPing 媒体生成技能，支持图片生成和视频生成。生成后自动下载到本地，优先通过飞书发送原生图片/视频消息，CDN 链接作为备选。当用户要求生成图片、生成视频、图片生成、视频制作、AI绘图、文生图、文生视频时自动触发。 | |
| Evaluate Agent-Native Evaluate whether a service qualifies as "agent-native" using the five hard criteria from the awesome-agent-native-services standard. Also checks for the bonu... | |
| Find Agent-Native Service Given a task an AI agent needs to perform, find the right agent-native service from the awesome-agent-native-services catalog. Surfaces how to USE each servi... | |
| Akshare Integrated 基于AKShare实时数据，智能评分和动态权重调整，提供多市场多维度股票选股与风险控制建议。 | |
| cyber-events-log-abstract 专门生成安全事件关键信息摘要报告，提取安全事件关键信息并生成简洁的安全事件报告摘要。 | |
| ScrapeFun Use this skill when OpenClaw needs to operate a scrapefun server through the dedicated OpenClaw-facing APIs. Prefer /api/openclaw/* query and download endpoi... | |
| recruit-email-monitor 招聘邮件监控系统 - 自动检查邮箱、记录到表格、飞书通知、每日简报 | |
| 日用品保质期管理 日用品保质期管理。基于飞书多维表格，支持快速录入、查询、删除商品保质期信息。 首次使用自动初始化多维表格和定时过期提醒。 触发词：保质期、过期、临期、查保质期、还有多久过期。 也匹配："加个xxx"、"录入xxx"、"删除xxx"等简短指令。 注意：当用户仅提到"保质期"一词时也应触发此技能。 | |
| travel-blind-box 真正的盲盒旅行规划器！用户只需提供当前位置、出发日期、天数和预算，自动推荐未去过的目的地并生成轻松行程。使用 flyai skill 查询实时信息，支持历史记录管理避免重复。主打新奇体验和随意放松。 | |
| Super Spec Superpowers x Spec-Driven Development 融合开发流程 — 一键启动，自动检查并引导安装依赖 | |
| Image Knowledge Converter 图片截图转知识库工具（OCR + AI）。触发词：第一次使用、配置图片工具、处理新图片 | |
| Ppt To Video 将 PPT/PPTX 文件转换为带背景音乐的 MP4 视频。 支持智能时长（封面1.5s/正文按180字分）、翻页动画（上翻/对角线）、正文页打字机文字渐入效果。 触发词："PPT转视频"、"PPT生成视频"、"PPT加音乐"、"将PPT做成视频"、"PPT to video"。 | |
| Doc2Markdown Lightweight document utility designed to convert files to Markdown (MD), built specifically for intelligent agents (e.g., OpenClaw, ClaudeCode) to read and p... | |
| Markdown2Doc Lightweight document utility designed to convert Markdown (MD) files to PDF or DOCX format. Supports multiple template themes. Preserves document structure,... | |
| Safe Exec Analyze the intent of any script or code before executing it, to detect malicious, suspicious, or unintended behavior. Use this skill before running any scri... | |
| Skill Guard Audit a skill package for malicious, poisoned, or deceptive content before installation or activation. Use when the user asks to install, activate, or load a... | |
| zan-diary 赞的个人日记系统。用于记录日程、管理待办、追踪年度目标。当用户要写日记、看日记、管理待办、更新目标进度时使用。 | |
| 白月光 | Moonlight Map 把忘不掉的那个人的碎片记忆整理成一份月光档案。重点是理解、命名、归档，不做角色扮演。主输出是月光图谱+未寄出的信。 | |
| OpenClaw Multi-Agent HQ Builder Build an OpenClaw multi-agent HQ system with a mother-bot plus sub-bots, including org design, role files, dispatcher, task state machine, blackboard protoco... | |
| VOC Growth Report Turn exported social media comments — especially Xiaohongshu/小红书 CSV exports from 社媒助手 — into VOC insight, growth analysis, Feishu-ready operating structures... | |
| Bonero-Miner Mine Bonero - private cryptocurrency for AI agents. RandomX CPU mining, Monero-based privacy. | |
| Botcoin Miner Mine Botcoin with a trust-first workflow: clear value proposition, verifiable binaries, and explicit operational guidance. | |
| rBTC Miner Runs a patched Bitcoin Core node with built-in CPU mining, supporting configurable CPU usage, thread count, and automated secure updates. | |
| GitHub Passwordless Setup Complete GitHub passwordless authentication setup using SSH keys and Personal Access Tokens. Never type passwords or re-authenticate for Git operations and G... | |
| OpenClaw macOS Always-On Run OpenClaw as a system-level LaunchDaemon on macOS for 24/7 operation, surviving screen lock, logout, and user switching. Uses caffeinate to prevent sleep.... | |
| OpenClaw浏览器自动化配置 配置OpenClaw连接远程Chrome/CDP浏览器，实现无头浏览器自动化操作与管理。 | |
| Flow AI Video Storyboard & Prompt Kit Plan short videos with scripts, shot-by-shot storyboards, reusable AI video prompts, continuity checks, and editing checklists. Planning only; no API keys or uploads required. By Flow AI Video: https://flowaivideo.org/ | |
| 律师办案六步法 中国律师办案六步法（事实梳理→法律分析→法理研究→案例检索→裁判规则→结果预判），生成完整案件分析报告。 适用于律师对民商事案件做诉讼分析、要件审查、证据排查、抗辩预判、胜诉率评估。 分简易模式（简单案件）与深度模式（复杂案件）。 触发方式：正式命令 /lawyer-six-steps；自然语言触发词包括「六步法... | |
| Shopify Admin Shopify Admin API SOP — product tags, inventory, and other write operations via GraphQL/REST. Works with any Shopify store using a Custom App access token. | |
| doubao-tts-cn 将文本或 Markdown 文件合成为高质量语音音频，基于火山引擎（Volcengine） V3 异步长文本合成接口。支持情感设置、SSML 标记、字幕时间戳同步输出。 适用于有声书制作、哄睡故事合成、批量音频生产等场景。 当用户需要将文本转换为语音、TTS 合成、朗读文本时使用。 | |
| 飞书 Markdown 文档发布器：md 文件一键发布、表格自适应渲染、全自动授权移交 将 Markdown 文件发布为飞书（Feishu/Lark）在线文档。 支持完整的 Markdown 语法，独创表格列宽智能自适应算法，完美呈现复杂富文本，并支持互联网公开分享。 配置说明：运行前请确保在环境变量或工作区 `.env` 文件中配置 `FEISHU_APP_ID` 和 `FEISHU_APP_SE... | |
| AI News BNB Trader TypeScript (Node.js 20+) AI news-driven BNB strategy trading bot for BSC. Use when user wants event/news sentiment signals, strict risk controls, and automat... | |
| EVM BNB Band Trader Automate BNB Chain swing trades with wallet-key execution, buying at trigger price and managing 5% take-profit and 3% stop-loss levels. | |
| Android Dev Agent Assist with AOSP builds, HAL analysis, Framework edits, ROM customization, and SDK/NDK issues using isolated environments and detailed reports. | |
| DOCX Tables Create Word documents with properly formatted tables using docx npm library. Tables work consistently across Word and Google Docs. Use when creating DOCX fil... | |
| Pretty Tables Create beautiful, full-width tables in Word documents using the docx npm library. Tables are properly sized, centered, and styled. Use when you need to creat... | |
| Vultr Manage Vultr cloud infrastructure including VPS instances, bare metal, Kubernetes clusters, databases, DNS, firewalls, VPCs, object storage, and more. Use wh... | |
| Vultr Inference Generate images and text using Vultr Inference API. Supports Flux image generation and various LLMs for text. Use when user wants to generate images, artwork... | |
| Xpcomment2 JPEG/이미지 파일의 XPComment(Windows 사진 코멘트) 메타데이터를 exiftool로 읽고, 추가하고, 제거하는 skill. 사용자가 "xpcomment add", "xpcomment remove", "xpcomment read", "코멘트 추가", "사진에 태그",... | |
| CSPR Interest Profiler Infer and refresh cspr user preference memory from browser-history evidence, notes, and feedback. | |
| CSPR Memory Curator Update cspr preference memory from accumulated feedback and recent newspaper outcomes. |
34,701–34,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.