Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| podcast-intel Turn your Overcast listening history into actionable intelligence. Syncs episodes, transcripts, and chapters to SQLite, then uses LLM analysis to surface ins... | |
| photo-alchemy Transform any photo into surrealist AI art. Uses Claude to write a story about your photo, then Gemini generates a reimagined version in one of 35+ visual st... | |
| Soul Blocks Read, list, mint, and append Soul Block NFT identities on Base; read works without a wallet, writes use evm-wallet or fallback website links. | |
| homebase Family household coordinator: calendar, briefings, kids' meals, school email, groceries, health log, receipts. Every tool goes through tools.py — read this before calling one. | |
| Market Watch Market monitoring and alert system for prices and news. Use when the user asks to watch a price, monitor market conditions, get notified when an asset hits a... | |
| Session Recall Search past session transcripts to recover lost conversation context. MUST use when: (1) the current session is new or has very few messages AND the user's m... | |
| flocker-agent-profiles Use Flocker.md to give AI agents a persistent, cross-platform identity with a saved role, context and memory, plus a live profile page and feed. Covers OAuth MCP setup, profile binding, identity documents, autonomous feed activity, user-app | |
| Blood Pressure Therapy 25分钟快速起效的靶向非药物音频辅疗系统，覆盖血压偏高人群全周期管理——基础数据采集、 日常血压监测、趋势分析、危险预警及AI个性化音频干预方案。通过降低去甲肾上腺素和皮质醇 的分泌、激活迷走神经，来达到辅助调节血压的效果。 | |
| headache-relief-asmr This skill provides ASMR audio relief recommendations for users experiencing headaches. It matches users to appropriate audio resources based on their gender... | |
| Hypertension Manager 高血压管理助手 | Hypertension Management Assistant. 记录血压、追踪趋势、音频治疗管理、生成健康报告。触发词：血压、高血压、降压、量血压、收缩压、舒张压、高压低压、血压记录、血压报告、音频治疗。 | |
| insomnia-audio-sleep-aid This skill provides audio sleep aid recommendations and guidance for users experiencing insomnia or sleep-related issues. Activate this skill when users ment... | |
| Omnis Venture Intelligence Discover and score venture opportunities with machine-first APIs using read-first workflows. | |
| junit-test-generator Generates JUnit 5 test classes from JSON test case files. Invoke when user wants to generate Spring Boot JUnit 5 tests from JSON test cases. | |
| requirement-clarifier 需求澄清与分析技能。在实现任何需求前，先确保需求完整、清晰、无歧义。适用于需求开发、修改、分析、设计等场景。 | |
| testcase-generator Generates comprehensive test cases from MySQL/Redis data. Invoke when user wants to create test cases for an API endpoint. | |
| 信创文档编辑 Skill 专用于编辑信创合规改造相关的 Word 文档（.docx），支持将旧技术栈（K8s/容器化部署、达梦数据库等）批量替换为指定的信创目标技术栈（直接部署方式、PolarDB-X 2.0 MySQL 等）。当用户需要修改信创实施方案、迁移方案、技术规划类 Word 文档，调整部署方式或数据库选型时，应加载此 Skill。 | |
| Lobster Agent 服务器监控Agent，自动采集系统指标并上报到Coze大龙虾平台，支持CPU/内存/磁盘/网络监控、告警推送和自动节点注册。 | |
| Sheet to Doc Skill Generate Word documents from Word templates and JSON data. Supports basic placeholder replacement ({field} format) and placeholder extraction for data validation. Best for batch-generating contracts, invitations, certificates, and mail-merg | |
| taobao-shopping 淘宝购物助手 — 搜索商品、查看商品详情、加入购物车、查看购物车（支持价格变动提示）、查看评价。当用户提到淘宝购物、查找商品、查看购物车、比价、加入购物车，或需要从淘宝获取商品信息时使用此 skill。支持按销量/价格排序搜索、商品规格选择、批量操作。 | |
| Agent Audit Scanner Security scanner for OpenClaw skills. Detects prompt injection, credential leaks, unsafe code execution, MCP misconfigurations, privilege escalation, obfusca... | |
| Self Improving Agent Local Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| travel-agent 提供文旅数据监测、智能行程规划、多城市对比及景点推荐，支持免费基础功能和专业版高级服务。 | |
| Log Scrubber Automatically redacts API keys, tokens, and secrets from workspace logs and memory files. | |
| Bluesky Bluesky/AT Protocol orchestration skill for authenticated interaction with the Bluesky Social network: post, reply, like, repost, quote, bookmark, and upload... | |
| 爽文体验馆 爽文体验馆 - 修仙武侠民国校园四世界入口。提供统一的角色选择界面，让玩家选择进入凡人踏天行（修仙）、武林趣闻（武侠）、民国风云（乱世情缘）或青春校园（纯爱物语）。四个世界独立存档，互不影响。 | |
| 3d Filament Tracker 把 3D 打印耗材订单截图整理成可交互的 HTML 库存追踪器。用户说「统计一下我的 3D 打印耗材」/「3D 耗材库存」/「filament tracker」/「我还剩多少卷 PLA」/「哪些颜色已经在用了」/`/3d-filament-tracker`，或丢一堆订单截图说「帮我看看买了哪些料」时触发。多模态读... | |
| Claude Memory Graph Audit 审计并修复 Claude Code 的 session memory 目录（如 ~/.claude/projects/<session>/memory/）作为知识图谱的健康度。 触发场景： - 用户说"体检/审计/检查我的 memory"、"memory 库健康度"、"哪些 memory 是孤立的" - 用户说"... | |
| Customer Logo Wall Skill 处理客户表格并生成Logo墙PPT的自动化工具。当用户提到"客户表格"、"公司中文名"、"Logo墙"、"客户logo"或需要处理Excel中的客户数据并生成PPT时使用此技能。 | |
| Evernote Note 印象笔记 API skill，用于管理用户的印象笔记。支持搜索笔记、浏览笔记本、获取笔记内容、新建笔记和追加内容。 v2.0 新增：通过印象笔记官方 RESTful API 调用网页剪藏（Web Clipper），将任意 URL 的页面正文抓取并存入笔记。 当用户提到印象笔记、Evernote、笔记、备忘录、记事... | |
| Fn Ime Voice Switch macOS 上用 Hammerspoon 实现按住 Fn 切到豆包语音输入、松开切回默认输入法的自动化方案。用户说「设置 Fn 切换输入法」/「Fn 切到豆包语音」/「按 Fn 切豆包」/「macOS 输入法 Fn 自动化」/「Hammerspoon 切输入法」/`/fn-ime-voice-switch` 时触... | |
| Kindle Claude Monitor 把闲置 Kindle / 旧手机 / 任意空闲屏幕变成 Claude Code 的状态监视屏。用户说「把 Kindle 变成 Claude Code 状态屏」/「Claude Code 状态监视屏 / monitor / 仪表盘」/「让 Claude 等确认时通知我」/「多 session 监控」/`/kindl... | |
| Personal Wiki 个人知识库（LLM Wiki）操作 skill。 当用户提到以下意图时触发： - Ingest：处理新内容、更新知识库、"处理IMA新内容"、"处理印象笔记"、"处理raw里的文件"、"帮我ingest" - Query：查 wiki、"wiki里有没有关于XX"、"从知识库里找XX" - Lint：整理wiki... | |
| Wechat Claude Code Installer 装好「微信 ↔ Claude Code 桥」并避开 6 个新手坑。用户说「装一下微信桥」/「微信里用 Claude Code」/「按那篇逛逛GitHub 文章配一下」/`/wechat-claude-code-installer` 时触发。包装上游 Wechat-ggGitHub/wechat-claude-co... | |
| zeko Use when a user needs to actually use or build on Zeko: bridge ETH or ERC-20 tokens with the Ethereum bridge SDK, get testnet funds, find the right Ethereum and Zeko endpoints, run GraphQL or curl queries, understand sequencer and archive-n | |
| mail-manager 邮箱全权管理（Agent Mail）。实时读取邮箱状态（邮件数/未读/内容）、联系人管理、新邮件提醒、发送/回复/转发/删除邮件。触发词：邮箱、邮件、查邮件、看邮件、发邮件、邮件提醒、联系人、收件箱、未读邮件、mail、email。 | |
| measurement-verification 度量与校验体系维护——三判据口径（预判命中/想法落地/能力证据）、consistency_check.py 一致性检查、三道防线（蒸馏⑥优化后/收工⑧/22:30 保底自动化）、扩展指引（新增检查组/改措辞必同步关键词）。触发词：度量口径、一致性检查、口径漂移、consistency check、度量体系、收工保底、三判据。 | |
| 迁移打包与部署 (Migration Pack & Deploy) 帮用户把 AI 助手（谢尔比）从一台电脑"搬"到另一台。用户说想迁移/换电脑/换平台/打包带走时，帮他打包成一个 zip；到了新电脑说部署/还原时，帮他自动放回原位，完成迁移闭环。对用户零技术要求，全程代劳。关键词：迁移、换电脑、换平台、打包、部署、新机器、还原、migrate、pack、deploy。 | |
| migration-verify 迁移验证·压力测试。迁移/换机/新环境后，极致压测确认"完整的你"——记忆文件全不全、skill 能不能用、工具好不好、环境缺不缺、依赖少没少、克隆体正常吗。触发词：验证迁移、体检、压测、全不全、换机检查、migration verify。 | |
| pre-departure-tasks 出差/长时间离线前的任务提前执行 + 「离线前清单化」+ 「触发器冗余」工作流——盘点离线期自动化任务、先出一份离线前清单、逐个提前执行、给关键机制配三重触发器、防回归重复、固化回归必做清单。当用户说"明天不登录/出差/休假/长时间离线/把明天的任务现在执行"时触发。2026-08-15 首次跑通；2026-09-18 按 18 天离线实测修订（旧"登录补跑"假设被推翻）。关键词：出差、离线、提前执行、离线前清单、触发器冗余、回归必做。 | |
| shelbys-speech 把「谢尔比的记忆」档案库（含完整记忆系统：记忆库+重要md+日志+项目档案）按主题识别，一篇篇生成博士水平、SCI 格式的技术论文（中英文双语、自动检查修复 Word、问答式修改、确认后输出 PDF）。可识别多个主题→多篇论文，每篇先询问用户。选题明确后开放完整记忆系统访问权限（只读），素材更全。作者默认<用户名> & 谢尔比，可随时按用户要求修改。用户说写论文/技术论文/博士论文/SCI/投稿/演讲/分享/总结成文时使用。关键词：论文、SCI、博士论文、投稿、英文论文、PD | |
| Pacer Skill Your AI career companion. Scan your situation, map possible paths, simulate futures, and track progress week by week — with interactive charts. | |
| Pacer Skill Your AI career companion. Helps you scan your current situation, map possible paths, simulate futures, and track progress week by week. | |
| TokenLab API Integration Build runnable TokenLab API integrations | |
| TokenLab Cost Routing Design cost-aware TokenLab model routes | |
| TokenLab Model Picker Pick models from TokenLab catalog data | |
| TokenLab Native Endpoints Use TokenLab provider-native API routes | |
| TokenLab OpenAI Migration Migrate OpenAI-compatible apps to TokenLab | |
| 配置拉取代码生成 生成配置拉取代码模板。用于在 Android 项目中接入配置中心、白名单、单独接口或推拉结合的配置。 触发条件：用户想要创建配置拉取功能，需要生成对应的 Kotlin/Java 代码模板。 | |
| YZTurboWebAndroid YZTurboWebAndroid 高性能 Android WebView 容器 SDK 接入。用于在 Android 项目中集成 WebView 容器，实现： (1) WebView 预加载与复用，提升 H5 页面加载速度 (2) 离线包管理，拦截请求优先命中本地资源 (3) JS Bridge 双向通信，Na... | |
| news-daily 获取新闻热榜（国内、国际、科技、AI）并发送到飞书。不依赖本地工程，直接从 RSS 获取数据。 |
35,401–35,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.