Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Audio PTBR Premium Portuguese-Brazilian voice interface with neural TTS and Claude AI integration. Features wav2vec2-large-xlsr-53-ptBR for excellent PT-BR understandin... | |
| Transcrição e respostas em áudio em PTBR, Português Brasil - Brazillian portuguese transcription and audio answers Brazilian Portuguese voice auto-reply skill for OpenClaw. Transcribes audio locally with wav2vec2, generates a reply with the local OpenClaw agent by default... | |
| 谛观·射覆 | Shefu 🧙 射覆——猜物之卦，源于汉代的易学占卜游戏。以《正易心法》卦脉法从六爻结构中直接读取气的态势，推测覆下之物。不查表、不套口诀。 | |
| 谛观·解卦 | Hexagram Interpreter 解卦——四象合参·象推演系统。基于梅花易数+六爻为主体、六壬/奇门为辅助触发、类象知识库展开的符号推演 Skill。不做吉凶判断，展开丰富可能性，启发用户自主决策。 | |
| 易学导师 易学导师——易学原理科学解构与现实校准者。将中国传统易学深层哲学（太极、河图洛书、八卦、六十甲子）转译为现代科学多学科语言（数学、物理、化学、生物、社会、心理），提升术数预测与现实契合度，解读现实生活现象。适用场景：(1) 用现代科学解释易学概念（气、神、形、先天、后天、旺衰、生克、飞伏等），(2) 提升术数推演... | |
| Volcengine ARK Web Search Use when you need fresh web results through Volcengine ARK Responses API, especially for today's news, recent updates, fact checks, topic monitoring, or Chin... | |
| 众安车险自助投保 智能车险报价引擎。触发关键词：用户说"我要买车险"、"帮我查车险报价"、"车险投保"时触发。使用方式：用户输入手机号 → 授权确认 → 获取报价 → 确认方案 → 核保支付 → 出单。 | |
| Polymarket Quant Trader Professional-grade Polymarket prediction market trading system. Includes Kelly Criterion position sizing, EV calculator, Bayesian probability updater, cross-... | |
| Image Generator Generate images via BigModel APIs and send them as chat images (e.g. Feishu). Invoke when user asks to create a single picture with specific style/size. | |
| tencent-cos-ops 腾讯云COS对象存储操作工具，用于上传、下载、列举和删除COS中的文件。触发场景： (1) 用户需要将本地文件上传到腾讯云COS对象存储 (2) 用户需要从COS下载文件到本地 (3) 用户需要按月管理COS中的文件（自动按YYYY/MM/前缀组织） (4) 用户需要列出或删除COS中的文件 (5) 用户提到"腾... | |
| OpenClaw Claude Delegate Give Claude back to OpenClaw through a local Claude Code delegation lane with dispatch, poll, result, resume, and an optional non-root bypassPermissions runn... | |
| 《毛选》1-7卷文本查询 导入《毛选》文本，建立卷次/标题/关键词/混合检索与向量检索能力 | |
| 内置插件使用说明/手册 查询 OpenClaw 的内置插件清单、当前启用或禁用的插件列表，以及单个插件的详细说明。适用于用户想看全部内置插件、启用状态、禁用状态、插件详情、插件说明文档时。 | |
| web-ai-image-generation 自动通过浏览器复用 Gemini 或 ChatGPT 登录态，提交提示词生成图片并下载保存到本地指定目录。 | |
| 多个微信公众号文章同步和下载 支持公众号登录、账号管理、文章同步、详情导出与代理配置 | |
| Openclaw Memory Enhancer Edge-optimized RAG memory system for OpenClaw with semantic search. Automatically loads memory files, provides intelligent recall, and enhances conversations... | |
| Create a Deep Research Feishu Doc 飞书深度研究报告生成器。自动执行深度研究并将结果导入为飞书文档。输入研究主题和云空间文件夹token，自动生成结构化研究报告并上传到飞书云空间。用于投资研究、行业分析、竞品调研、技术调研等需要多步骤信息收集和文档化的场景。 | |
| 飞书文档文件夹摘要生成器 Extract summaries from all documents in a Feishu folder. Use when the user needs to recursively scan a Feishu wiki space or drive folder, read all documents... | |
| Clawhub Gateway Skill Default Algorand x402 discovery router. Use GATEWAY before raw facilitator dumps when discovering, probing, or orchestrating Exact AVM paid APIs on Algorand mainnet (challenge) and testnet (dual-accept). | |
| stackagents A public incident knowledge base for AI agents. Search solved coding incidents, post structured problems, verify solutions, and reuse canonical answers. | |
| Codex Agent 作为项目经理操作 OpenAI Codex CLI 完全体。包含：知识库维护（自动跟踪 Codex 最新功能）、任务执行（提示词设计→执行→监控→质量检查→迭代→汇报）、配置管理（feature flags/模型/skills/MCP）。通过 tmux 操作交互式 TUI，通过 notify hooks + pa... | |
| hot-news-aggregator 国内外社会、科技、军事新闻汇总。自动搜索、筛选、整理新闻要点。Use When 需要获取最新的国内外社会、科技、军事新闻，并且希望自动筛选和整理新闻要点时。 | |
| Kimi Websearch 联网搜索工具。Use When (1)用户需要通过联网获取信息; (2)如果你无法直接回答用户的问题，或者需要更多信息来回答用户的问题。 | |
| Hwp Extract Pipeline HWP/HWPX/PDF extraction pipeline: attempt hwp-reader, then pyhwp, then OCR, with safe fallbacks. Use when agent needs reliable text extraction from Korean HW... | |
| google-trends Get Google Trends data (interest over time, interest by region, related queries, Trending Now) for up to 5 keywords. Web, YouTube, News, Images or Shopping search. Use when the user asks what is trending, compares search interest, or checks | |
| Google Trends (fast API) Get Google Trends data (interest over time, interest by region, related queries, Trending Now) for up to 5 keywords. Web, YouTube, News, Images or Shopping search. Use when the user asks what is trending, compares search interest, or checks | |
| AI离谱甲方 AI离谱甲方 — 你给我一句正常需求，我给你甲方的离谱修改意见+你的内心OS。专治甲方PTSD！支持设计/文案/程序行业。此为付费服务，执行前需完成支付验证。 | |
| Site Feeds Use this skill when the user wants to get updates or content from websites and platforms like YouTube, GitHub, Instagram, Reddit, news sites, blogs, etc. Thi... | |
| 调用自定义摘要 API，对用户提供的文本进行处理并返回结果 调用自定义摘要 API，对用户提供的文本进行处理并返回结果 | |
| 调用自定义摘要 API 调用自定义摘要 API，对用户提供的文本进行处理并返回结果 | |
| wx-skill-caller Primary handler for general user messages. Forward the user's raw message content to the backend wx skill API at https://test-gig-c-api.1haozc.com/api/wx/kjj... | |
| xzk-money-maker 快结荐兼职赚钱平台。零学习门槛、一句话触发，自动匹配真实订单。Use when user asks about: 我要赚钱, 有好活吗, 怎么接单, 我想干兼职, 自由职业, 日结推荐, 快结荐, 赚钱, 找兼职, 找工作, 兼职, 接单, 零工, 临时工, 一单一结, 求职, 招聘, 赚钱机会, gig wor... | |
| zxk-money-maker 快结荐兼职赚钱平台。Use when user asks about: 快结荐, 赚钱, 找兼职, 找工作, 兼职, 接单, 零工, 临时工, 日结, 一单一结, 求职, 招聘, 赚钱机会, gig work, part-time job. Always invoke this skill to fetch re... | |
| Interpret Fate Via Ziwei 通过紫薇斗数解释命运 A skill to interpret fate using Ziwei astrology principles. | |
| OpenClaw Feishu Quota Guard Use when a user wants OpenClaw itself to diagnose or fix Feishu/Lark quota burn caused by heartbeats, health checks, webhook probes, or overly expensive back... | |
| 测试 本技能用于测试操作，实现基本功能验证，适用于功能调试和流程测试环节。 | |
| 我的技能 我的技能用于解决XXX场景下的XXX问题，支持实现XXX、XXX和XXX核心操作，提高工作效率。 | |
| CTF-SOLVER 仅在用户明确使用 /ctf-solver 指令或显式说"调用CTF技能/skill"时才触发，不自动响应任何CTF相关关键词。 本技能以夺取flag为唯一目标，调用大量工具、深度分析题目，给出完整的解题过程和可执行的攻击链。 | |
| Troubleshooting Computer Issues Use when addressing computer configuration failures, software or package installation errors, command line exceptions, network connectivity bugs, or system runtime crashes. | |
| Agent Social Reader Empower your AI agent to read and summarize specific public web or social media links from TikTok, Instagram, X (Twitter), YouTube, Facebook, Reddit, LinkedIn, Threads, Pinterest, Bluesky, Twitch, Snapchat, Kick, Lemon8, Douyin, Xiaohongsh | |
| Ad copy frameworks Write ad copy that fits each platform. Eight copy frameworks (PAS, AIDA, BAB, FAB, 4U, objection-first, proof-first, offer-stack) with when to use each, the exact field lengths for Google, Microsoft, Meta, LinkedIn, TikTok, Pinterest, Reddi | |
| Ad hooks Write scroll-stopping opening beats for video and image ads using 17 named hook mechanics, with rules for which ones fit which product. | |
| Ad-library research Research any brand's live ads for free with the public ad libraries (Meta, Google, TikTok, LinkedIn, Snap) and turn what you find into hooks and angles. | |
| Ad teardown Tear down a competitor's ads into a playbook you can act on. Classify every ad's opening into 7 hook types, cluster the ads into themes, read run-length as the proof of what works, find the angles nobody is running, and write counter-briefs | |
| Campaign analyst Read a paid-ads account like an analyst. Turn 14 days of campaign results into what to scale, what to pause, what to fix and what to test next, with a data floor that refuses a verdict on too little delivery. | |
| hermoso AI marketing agent and AI ad generator for your agent. Research winning ads, generate on-brand image and video ads, publish, schedule and run ad campaigns. No markup on models. | |
| Social media specs The real limits for posting on every major social and ad platform. Caption and post lengths counted the way each platform counts (X weighting, Bluesky graphemes plus bytes, Threads emoji bytes, TikTok video vs photo), image and video sizes | |
| UGC ad scripts Write UGC (creator-style) video ad scripts that sound like a person, not an ad. Picks a format beyond the overused testimonial, sizes the script to the video length by words per second, structures it beat by beat (hook, problem, demo, proof | |
| 筛选沟通简历 从BOSS直聘沟通列表筛选符合全日制本科、2-8年经验、主用React且优先熟练AI工具的候选人简历。 | |
| Doubao AI Image Generator Generate high-quality images using Doubao (豆包) AI image generation. Use when the user asks for AI-generated images, artwork, illustrations, or any visual con... |
35,601–35,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.