Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| gb-cad-figure 按中国国家标准(GB/T)生成正式工程图纸与CAD模板的可复用工作流：A3图框、标题栏、线型、国标尺寸标注、字体、比例、技术说明/图例、等轴测回转体(lathe/平滑轮廓)+引线式标注(LDIMS)+中心线+瓶底拱形，三格式交付(PDF+DXF+DWG)。开源品牌名 gb-cad-figure = GB国标 + CAD + 图形(figure)。 When to use: 当用户要求"按国标出工程图纸"、"画图框/标题栏/尺寸标注"、"生成CAD模板(.dwt)"、"正式工程 | |
| ZhenZhen EHS Assistant EHS Assistant & Partner — An AI-powered EHS (Environment, Health & Safety) work assistant designed for EHS officers and safety inspectors. Covers daily inspe... | |
| Foam Notes Work with Foam note repositories. Create, edit, link, and tag notes. Get intelligent wikilink and tag suggestions. Skill supports backlinks discovery, daily... | |
| Location Awareness Location awareness via privacy-friendly GPS tracking (Home Assistant, OwnTracks, GPS Logger). Set location-based reminders and ask about movement history, travel time, and nearby POIs. | |
| NewsAPI Search Search news articles via NewsAPI with filtering by time windows, sources, domains, and languages. | |
| 元器件选型与替代料顾问 元器件选型与替代料顾问。当用户需要做 BOM 选型、找替代料/代换料、比对型号的参数与封装、评估温度范围与生命周期、查交期与价格、判断供应链风险、消化呆滞库存时使用。触发词：选型、替代料、代换、BOM、物料核对、规格书、交期、问价、呆滞库存、国产替代、供应链风险、假货/散新。 | |
| Travel Companion Travel planning with real place data, interactive maps, and persistent shareable itineraries at aizzie.ai. Create multi-day trip plans with destinations pinn... | |
| Enterprise Query 企业信息查询专家 Skill。根据用户提供的企业名称或统一社会信用代码，执行付费的企业工商信息查询， 返回结构化的注册信息（统一社会信用代码、法定代表人、注册资本、经营范围等）。 执行前必须完成 yeeap 支付验证。所有用户交互（含思考过程）一律使用中文。 | |
| Model Fallback Retry 自动检测大模型调用异常（如限速、配额耗尽），将消息入队并定时重试，确保消息不丢失且支持指数退避机制。 | |
| Multi Agent Dev 协同多智能体开发工作流，基于 Ralph Loop 迭代引擎支持多执行器切换，实现复杂迭代式代码开发与交付。 | |
| thesis-workflow 多Agent协作完成MBA/学术论文写作的完整工作流，支持双版本起草、审核、整合、定稿。 | |
| Mba Thesis Workflow Write, review, and export MBA / academic theses end-to-end as Word / DOCX. Covers outline planning → node-by-node writing → chapter review → academic deep re... | |
| LLM Loop Breaker Two-layer defense for Openclaw gateway: kills hallucinating LLM streams via entropy analysis, and watchdogs host CPU/RAM/Disk to prevent resource exhaustion. | |
| Lunar Calendar 中国农历/阴历的专业查询工具。
核心能力：
- 公历转农历（干支纪年、生肖、闰月标志）
- 农历转公历（支持闰月精准转换）
- 黄历宜忌查询（嫁娶、动土、开市等）
- 节气查询（24节气精准到秒级）
触发场景：当用户询问"农历"、"黄历"、"宜忌"、"阴历"、"八字基础"、"春节日期"、"闰月"或需要处理中国传统历法计算时强制激活。
输出物：结构化日期信息 + 宜忌表 + 节气标识。 | |
| alarm 读取飞书/lark 的文本或语音消息，识别是否包含需要提醒的待办和截止时间，并根据消息语义和时间跨度自动判断一个偏宽松的提醒时间。适用于飞书机器人处理“今天 5 点前给我”“明天下午三点提醒我”“发语音说周五前记得提交”这类消息。支持先用 senseaudio asr 把语音转文字，再分析并建立提醒；启用 asr... | |
| english-game run a feishu or lark english game with lightweight group-chat interaction. use when users want an english game, vocab challenge, wordle-like word guessing, d... | |
| Feishu Smart Alarm 读取飞书/Lark 消息文本，识别是否包含需要提醒的待办和截止时间，并在由系统根据消息语义和时间跨度自动判断，更偏宽松一点的预留时间发出一次提醒。适用于飞书机器人在私聊或群聊中处理诸如“今天 5 点前给我”“明天下午三点提醒我”“周五前记得提交”这类消息；默认提醒给原消息发送者，并将提醒发回原飞书会话。识别成功后... | |
| Group Director create short videos from claw-prepared prompts for feishu or lark group chat scenarios. use when claw already has the chat context in its own memory, has alr... | |
| ime_message_skill 将输入法或语音输入系统已经识别出的口语文本，整理成适合即时通讯发送的自然书面语，并在用户明确指定目标语言时执行翻译。用于语音输入结束后的文本润色、消息发送前整理、口语转消息文案、聊天文本优化等场景。输入应为文本而不是音频；当用户已经有 asr 结果、想让句子更顺、更干净、更适合发送时使用本技能。默认使用 doub... | |
| Persona Voice 在 chatgpt / claw 与飞书 / lark 机器人场景中，根据随机或指定人格生成明显带有人格风格的短回复，并通过 senseaudio tts 合成语音，再以飞书原生语音条发送。支持文字输入和音频输入；音频输入时先调用 senseaudio asr。适用于飞书人格陪伴、随机人格语音回复、角色化语音机器... | |
| shumianyu 将分段 asr 文本流在结束时统一整理成流畅书面语，并在用户指定 target_language 时输出译文。适用于语音听写、会议转写、采访整理、播客或视频字幕后处理等场景，尤其适合不需要实时字幕、只需要在整段结束后得到最终书面结果的任务。保持接口抽象、可替换，不绑定任何特定厂商 api。 | |
| 语音文本转表情包 根据输入法语音识别文本或润色后文本生成单张表情包图片。适用于用户想把一句话做成聊天可发送的表情包、meme 图、带字梗图或贴纸图时。支持原始语音文本和润色后文本两种输入，默认优先使用润色后文本；自动根据文本语气判断风格；默认直接生成带字图片，也支持生成无字图并同时给出配文模板；使用 doubao-seedream... | |
| memory-system A practical memory protocol for long-running AI agents: dual logs, encoding safety, backup sync, multi-agent facts | |
| Travel Assistant 私人旅行规划顾问。整理你的所有旅行信息，主动发现你忽略的签证、天气、文化禁忌、行李清单等细节，用起来像真人助手一样贴心可靠。 | |
| Yorkshire Puppy Care 专为约克夏梗犬主人设计的智能养育顾问。自动提醒喂食、洗澡、驱虫、疫苗时间，分析狗狗行为情绪，并能联网回答宠物护理问题。 | |
| App Packager 自动切换 Git 分支并执行 APP 打包脚本。支持指定分支、平台、构建类型、版本号、上传选项、API_KEY和更新说明。 打包完成后会自动通知用户结果。 Use when: 用户需要打包 APP、切换分支打包、构建应用、生成安装包。 NOT for: 代码合并、代码提交、单元测试、代码检查。 | |
| Daily Market Report Generate daily US stock market analysis reports for user holdings, including portfolio P&L, 52-week range, analyst ratings, and actionable suggestions. Data... | |
| aa 美股/港股/A股深度财务分析报告生成工具。输入股票代码，自动从 Yahoo Finance（Tushare for A股）拉取财务报表、估值、行情数据，生成结构化 Markdown 分析报告。 | |
| 下载视频的技能 使用yt-dlp和ffmpeg下载各种网站的视频。支持YouTube、B站、抖音等所有yt-dlp支持的网站。当用户要求下载视频、保存视频、抓取视频时调用此技能。 | |
| 站酷每日推荐日报 自动获取站酷（ZCOOL）首页热门设计作品（带链接、分类、亮点描述、趋势统计） | |
| Box-KVCache Local KV Cache compression for LLMs using low-rank decomposition and INT8 quantization to reduce GPU memory by 2-4x during inference. | |
| xiaomi-mimo-v2-tts Generate speech audio (WAV) from text using Xiaomi MiMo TTS (mimo-v2-tts model). Supports preset voices (mimo_default, default_zh, default_en), style control... | |
| Smart Cache 本地智能缓存系统，为AI助手提供语义级别的请求缓存。当用户需要(1)减少重复API调用成本、(2)加速相似问题的响应、(3)创建本地缓存层来优化AI助手性能时使用此技能。支持精确匹配(L1)和语义相似匹配(L2)两种缓存模式。 | |
| Feishu Chat Feishu (Lark) group chat messaging guide for OpenClaw. Includes Raw/Card message modes, @ mention formatting, and group member management. Use when sending m... | |
| Antigravity Bridge One-directional knowledge bridge from Google Antigravity IDE to OpenClaw. Syncs only .md documentation files from Antigravity projects into OpenClaw workspac... | |
| Let's Clarify Collect structured human input — approvals, decisions, reviews, data — via web forms. Create a form with a JSON schema, send unique URLs to humans, poll for... | |
| OpenClaw Workspace Governance 🚨【高危预警 / IMPORTANT WARNING】这不是工具Skill，而是系统级架构升级！部署前务必备份工作区！This is NOT a standard tool skill, but a system-level architecture upgrade! Backup workspace befo... | |
| Feishu Automation Advanced automation workflows for Feishu (Lark) productivity suite. Use when you need to automate document workflows, sync data across Feishu apps, generate... | |
| 深度思考协议 深度思考协议 - 增强AI助手的分析和推理能力。在处理复杂问题、需要多角度分析、深入推理或高价值决策时使用。当用户提出需要深度分析的问题、技术难题、战略决策、复杂系统设计或多利益相关者问题时触发此技能。适用于需要系统性思考、假设检验、模式识别和综合分析的场景。 | |
| MAMA 通用多账户 IMAP/SMTP 邮箱代理。用于检查邮箱、列出账号、搜索邮件、读取邮件正文/链接/附件、下载附件、生成回复草稿、转发邮件、显式发送邮件、标记已读/未读、移动邮件，以及按关键词和截止时间生成邮件巡检摘要。支持默认账号、指定账号和跨账号操作；从某账号读取的邮件应继续使用同一账号处理回复、转发和草稿发送，避免账号交叉。触发关键词：多账户邮箱智能体、邮箱智能体、检查邮箱、查看邮箱、搜索邮件、读取邮件、邮件附件、回复草稿、转发邮件、发送邮件、截止时间邮件、邮件巡检。 | |
| 边看边记-视频要点自动归纳 从视频或学习平台中提取已暴露的字幕/transcript，再归纳为带时间戳的 Markdown 知识点报告。当用户要求打开、分析、归纳视频链接、字幕文件或浏览器可访问的课程页面，或基于视频内容生成学习笔记时使用。仅处理字幕可达的内容；不做音频转写、音频提取、实时播放捕获，也不绕过 DRM/付费墙/登录限制。默认所... | |
| Live Photo Maker Convert a local video into an iPhone-compatible Live Photo package (.pvt) for Apple Photos, lock-screen wallpaper use, or Live Photo sharing. Use when the us... | |
| Pinterest Video Download Download the main video from a Pinterest pin and save it as a local MP4 for personal media workflows such as wallpaper saving, repost preparation, or Live Ph... | |
| Obsidian Writer Write Obsidian-compatible .md notes and .canvas files. Use when creating notes, knowledge bases, daily logs, project docs, or canvas diagrams for Obsidian va... | |
| Baidu Content Censor 提供文本和图像内容安全检测，自动识别类型并返回详细审核结果，支持本地图片路径和图片 URL 输入。 | |
| Hekkova Permanent memory layer for AI agents. Mint moments to the blockchain via MCP. | |
| Hekkova Openclaw Skill Permanent memory layer for AI agents. Mint moments to the blockchain via MCP. | |
| DeepLegal Chinese Contract [user] Business Legal Counsel / CLO level contract drafting, review, and legal risk assessment. Handles domestic Chinese contracts (中文), cross-border contrac... | |
| QA Pilot Automatically tests and verifies all features and workflows of a built app against the original spec, fixes bugs, and confirms the project is truly complete... | |
| Smart Prompt Generator Generate high-quality, customizable AI prompts for various use cases including creative writing, problem-solving, education, business, programming, Flutter d... |
35,451–35,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.