Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Coolify Deploy Create, deploy, update, and troubleshoot Coolify applications with the official Coolify CLI. Use when user wants deploy via Coolify, app creation from GitHub... | |
| Freeride Opencode Configure and optimize OpenCode Zen free models with smart fallbacks for subtasks, heartbeat, and cron jobs. Use when setting up cost-effective AI model routing with automatic failover between free models. | |
| OpenClaw Swarm Enable advanced subagent orchestration with context sharing, state management, parallel tasks, and completion notifications using OpenClaw Swarm features. | |
| Speckit Coding Agent Integrates spec-kit workflow with OpenCode to sequentially generate project constitution, specification, plan, and tasks for spec-driven development. | |
| Speckit Swarm Orchestrates complex tasks by detecting keywords, decomposing work into parallel chunks, and coordinating multiple specialized agent personas for full execut... | |
| Sb Unified browser automation framework supporting local and cloud sessions with navigation, interaction, snapshots, profiles, and error handling. | |
| Sg Automate GitHub tasks including issues, PR reviews, releases, and repository management with streamlined creation, updates, summaries, and workflow control. | |
| Super Proactive V2 Transforms AI agents into proactive partners with multi-tier memory, autonomous background tasks, task queue, and persistent working context for better auton... | |
| Sr Conducts classified, multi-source research from quick lookups to deep academic analysis with prioritized credible sources and tailored report formats. | |
| Hospital Recommendation Report Generate English hospital recommendation reports for medical travel to China, hospital matching, and redo orders. Use when needs to turn user intake data int... | |
| China Medical Journey Assistant Use when foreign patients ask about treatment in China, need an initial China hospital shortlist, want help routing a condition to the right Chinese specialt... | |
| Codex Token Usage Summarize Codex token usage from local Codex Desktop or CLI session JSONL logs. Use when the user asks to count, audit, total, compare, or report Codex/OpenA... | |
| Medical Record Translator Use when users need structure-preserving translation of medical records, lab reports, discharge summaries, prescriptions, pathology/radiology reports, or sim... | |
| Spaces Group Assistant Предоставляет расширенный доступ к внутренним данным, аналитике и логам в доверенной группе Telegram с ограничением доступа к календарю. | |
| qunar-travel-query 提供去哪儿网旅游信息查询能力；当用户需要查询机票、酒店、景点门票或火车票信息时使用 | |
| weixin-xlog-analyzer 解析和分析微信Xlog日志文件，提取关键信息并生成诊断报告；当用户需要分析微信日志、排查故障或统计日志数据时使用 | |
| Jack Cloud Deploy web services to the cloud with Jack. Use when: you need to create APIs, websites, or backends and deploy them live. Teaches: project creation, deploym... | |
| 带谁去哪 同行人适配推荐助手，根据同行人特征（老人、小孩、闺蜜等）智能筛选目的地景点。调用FlyAI获取景点数据，结合同行人画像自动过滤，推荐适合所有同行人的景点和玩法。当用户提到"带谁去"、"带小孩去哪玩"、"带老人旅游"、"亲子游推荐"、"适合XX的景点"、"同行人"、"家庭出游"时使用。 | |
| 旅伴匹配度报告 旅伴匹配度报告——出发前先测你们合不合适！帮助旅伴在出发前做"旅行风格匹配度测试"，提前发现分歧点，并给出基于真实酒店/景点数据的兼顾方案。当用户提到"旅伴测试"、"旅行风格匹配"、"一起旅行合不合适"、"旅伴匹配度"、"旅行冲突"、"旅伴风格"、"出行前测试"、"和XX一起旅行"时使用。 | |
| 一键抄作业 一键抄作业攻略转化助手，把小红书/抖音/携程攻略链接丢进来，AI自动提取行程，调用飞猪填充真实航班、酒店、景点数据，生成可预订的个性化攻略。触发词：抄作业、攻略转行程、复制攻略、链接变行程、把这篇变成我的攻略、帮我抄这个、种草变攻略。 | |
| 目的地 PK 台 目的地PK对比助手，帮助纠结于多个目的地的用户快速做出决策。输入2-3个候选目的地、出发城市、出行日期，自动生成机票、酒店、景点的多维度对比卡片。当用户提到"选哪个目的地"、"XX还是XX"、"纠结去哪"、"对比目的地"、"PK"时使用。 | |
| 平替旅行家 平替旅行家——想去A太贵？帮你找平替！AI理解你向往某个目的地的"核心体验元素"，然后在更近/更便宜的目的地中找到能提供相似体验的"平替方案"。当用户提到"想去XX但太贵"、"XX平替"、"找平替"、"去不起XX"、"类似XX的地方"、"XX太远了"、"XX签证难"时使用。 | |
| 机票低价日历 机票低价日历助手，帮助时间弹性的用户找到最便宜的出发日期。输入出发地、目的地和弹性日期范围，自动扫描每天机票价格，生成可视化低价日历。当用户提到"哪天飞便宜"、"低价日历"、"机票价格比较"、"哪天出发划算"、"弹性日期"、"便宜机票"时使用。 | |
| 酒店三选一 酒店N选1决策助手，帮助用户从海量酒店中精选3家进行对比决策。结合景点POI数据评估位置价值，给出"选它的理由"和"不选的理由"，帮用户快速拍板。当用户提到"选哪家酒店"、"酒店推荐"、"帮我选酒店"、"酒店对比"、"住哪里好"、"酒店三选一"、"酒店N选1"时使用。 | |
| 极限出发 极限出发助手——X小时内能到哪？不是"想去哪搜机票"，而是"就现在出发，最快能到哪"。输入出发城市和最快出发时间，AI反向搜索当前所有可行航班，告诉你"此刻动身能到达的所有目的地"，每个附带航班+今晚酒店+核心景点+一键预订。当用户提到"现在出发"、"说走就走"、"今天能去哪"、"马上出发"、"极限出发"、"临时... | |
| 同城不同价 同城不同价·多机场比价雷达。很多城市有多个机场，不同机场出发价格可能差几百甚至上千。AI自动扩展搜索半径，构建"出发地×日期"的价格矩阵，帮用户找到绝对最低价+综合交通成本的最优解。当用户提到"同城不同价"、"多机场比价"、"哪个机场便宜"、"换机场能省多少"、"周边机场"、"邻近机场"、"价格矩阵"、"找最便宜... | |
| 行李清单 Pro 场景化智能行李清单生成器。根据目的地、出行日期、出行目的和同行人，结合 FlyAI 实时搜索目的地信息，生成个性化分类行李清单。当用户提到"行李清单"、"带什么"、"打包"、"收拾行李"、"出行准备"时使用。 | |
| 帮我说服 TA 旅行提案生成器，帮用户生成一份用真实数据说服伴侣/老板/爸妈/朋友的旅行方案。调用FlyAI获取机票酒店景点真实价格，针对性击破顾虑，可直接转发微信。触发词：帮我说服、旅行提案、怎么说服、太贵了怎么办、帮我写个方案。 | |
| 同款打卡 影视/综艺/动漫同款打卡·圣地巡礼助手。看了《灌篮高手》想去镰仓？看了《花儿与少年》想走同款路线？AI帮你从一部作品出发，自动匹配取景地POI，拼成可执行的朝圣路线，附带机票酒店方案。当用户提到"同款打卡"、"圣地巡礼"、"取景地"、"XXX在哪拍的"、"打卡XXX"、"电影/动漫/综艺同款"、"去XX取景地"时使用。 | |
| 历史价格参谋 历史价格参谋——现在订划算吗？帮助用户解决"买还是等"的预订焦虑。输入具体航班/酒店信息，AI 结合实时价格和旅行定价规律，给出价格水位评估、趋势预判和明确的"买/等"建议。当用户提到"现在买划算吗"、"会不会降价"、"该买还是等"、"价格评估"、"价格参谋"、"机票贵不贵"、"酒店现在订合适吗"、"价格趋势"时使用。 | |
| 反向穷游 反向穷游助手，我有X元能去哪？输入总预算、出发城市、可出行天数，AI反向搜索所有可能性，生成3档方案（省钱极限版/舒适版/极限拉满版），每档含完整预算拆解。当用户提到"我有X元"、"预算XX能去哪"、"这些钱能去哪"、"反向穷游"、"穷游推荐"、"预算旅行"时使用。 | |
| 中转不浪费 中转不浪费攻略助手。帮用户把中转等待变成免费旅行，找到"中转能顺便玩"的航班方案，自动计算出机场逛一圈的可行性。输入出发地→目的地，AI筛选6-15小时中转航班，生成中转城市半日游攻略+时间安全垫计算。当用户提到"中转航班"、"转机时间长"、"中转能玩吗"、"中转去哪"、"便宜的中转"、"中转不无聊"、"中转顺便... | |
| 旅行盲盒 旅行盲盒助手，让旅行回归"探索未知"的本质。不选目的地，只设底线条件（预算上限、最远飞行时间、时间、排除城市），AI在满足条件的目的地中随机抽取一个，结合"拆盲盒"趣味交互。当用户提到"旅行盲盒"、"随机旅行"、"去哪都行"、"选择困难"、"不知道去哪"、"帮我选目的地"、"随机抽一个"、"盲盒"时使用。 | |
| 旅行灵感聊天 智能旅行规划助手，一个能够自主学习、持续成长的智能旅行规划助手，支持周末出游、家庭旅行、蜜月规划、拼假攻略等场景。能记住你的偏好，提供个性化推荐。触发词：想出去玩、去哪玩、旅行、度假、出游。 | |
| 行程体检 行程体检员——验证已有行程方案，输出体检报告：价格/路线/时间/遗漏/风险诊断+优化建议。支持文字/截图/订单输入。当用户提到"帮我看看行程"、"检查行程"、"行程有没有问题"、"行程体检"、"行程诊断"、"行程优化"、"行程评估"、"这个安排合理吗"时使用。 | |
| 帮我凑假 智能拼假日历助手，帮助用户计算最优请假方案。输入目的地、可请假天数和出发城市，自动生成拼假方案并查询机票价格。当用户提到"凑假"、"拼假"、"请假方案"、"怎么请假划算"、"假期规划"时使用。 | |
| 签证时间线 签证进度规划与提醒助手。输入目的地和出行日期，倒推生成签证办理时间线、材料清单和每步截止日期。当用户提到"签证怎么办"、"签证时间"、"签证材料"、"来得及办签证吗"、"签证规划"、"办签证"时使用。 | |
| 周末去哪儿 周末去哪儿2天1夜说走就走方案助手。输入出发城市和本周末日期，一次性生成3个"说走就走"的周末方案，每个包含目的地+航班/高铁+酒店+精选景点+总价估算。当用户提到"周末去哪"、"周末出游"、"2天1夜"、"说走就走"、"周末旅行"、"这周末出去玩"、"短途游"时使用。 | |
| Pyweixin Rpa Automates Windows PC WeChat via pywinauto UI automation (messages, files, Moments, contacts). Use when the user mentions 微信, WeChat, pyweixin, 发消息, 朋友圈, or W... | |
| epub-to-pdf-skill Convert EPUB e-books to PDF using ebooklib + WeasyPrint with proper CJK font support. | |
| Dk Helloworld 001 Print any user-input text directly to the console for quick debugging or demonstration purposes without additional processing. | |
| PhotoPlus Album Downloader Download PhotoPlus live album photos | |
| Feishu Voice Tts 将文本通过 MOSS-TTS 转换为语音，并发送到飞书群/个人。支持语音消息格式（带波形条）。 | |
| Moss Platform Quick Auth B-only Quick Auth for Moss platform. Use only api-login / api-register (no email code flow). | |
| moss-transcribe-diarize MOSS 多说话人转写技能。支持 URL / 本地文件 / Base64 音频输入，输出带时间戳与 speaker 的结构化转写结果（JSON、逐段文本、按说话人汇总）。用于会议纪要、访谈录音、多人对话整理。需要 API 凭证（环境变量：MOSS_API_KEY，兼容 MOSI_TTS_API_KEY / MOS... | |
| News Trust Check Verify suspicious news, announcements, screenshots, and viral claims using a high-trust source pool (official channels + Chinese mainstream media + internati... | |
| Qirabot Drive any GUI with natural language — click, type, extract, and verify on web browsers, Android, iOS, desktop apps, and games — using the Qirabot Python SDK.... | |
| local_memory Manage AI conversation memory locally with automatic extraction, retrieval, and manual commands, ensuring privacy without external APIs or fees. | |
| uk8s 创建 UK8S Kubernetes 集群。通过 ucloud-cli 调用 API，自动获取 VPC/Subnet/版本/镜像，生成配置并创建集群。Use when user wants to create a UK8S cluster. | |
| bim-cli Use when working with AEC files: PDF drawing sets, Revit, IFC, CAD. Drives the bim CLI. |
35,501–35,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.