Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Google Gog OAuth token refresh management for Google APIs via gog CLI. | |
| Apple Style PPT Maker Create Apple-style minimalist presentation slides through a strict JSON-first workflow. Use when an agent must clarify user requirements, lock topic/content/... | |
| Excretion Tracker Track bathroom events (pee/poop) via chat: start time, duration, color, pain, and Bristol stool scale. Generates weekly summaries and optional constipation r... | |
| XHS Writing Coach Coach and generate Xiaohongshu (小红书/RedNote/XHS) note writing. Use when the user wants help writing XHS notes (标题/正文/标签/评论引导/封面文案), improving engagement, or... | |
| AI-Shifu Course Creator Create, edit, publish, and manage AI-Shifu courses | |
| Deep Digest Extracts cognitive patterns, key insights, and action signals from any text input (messages, notes, articles, conversations). Turns raw content into structur... | |
| Question Methodology A practical framework for asking better questions. Two questions + one check: Golden Circle positioning, Six-dimension validation, and Completion check. Turn... | |
| Thinking Framework Loads any thinker's, leader's, philosopher's, or organization's complete mental operating system directly into the AI — so the AI reasons FROM inside that co... | |
| ASO Suite Do App Store Optimization (ASO) with the ASO Suite CLI across iPhone, iPad, Mac, Apple TV, Apple Watch, and VisionOS by finding keywords with popularity/diff... | |
| Feishu Skills Kit 飞书技能全集 Complete Feishu (Lark) Skills collection for Claude Code / OpenClaw. Includes 10 skills covering: document management, messaging, spreadsheets, Bitable, inte... | |
| NotebookLM Skill Expert guide for the NotebookLM CLI (`nlm`) and MCP server - interfaces for Google NotebookLM. Use this skill when users want to interact with NotebookLM pro... | |
| Daily Stock Analysis Deterministic daily stock analysis skill for global equities. Use when users need daily analysis, next-trading-day close prediction, prior forecast review, r... | |
| Embodied Ai News Aggregates publicly available Embodied AI and Robotics news from curated sources (robotics media, arXiv, company blogs). Delivers structured briefings on hum... | |
| File Compression Compress files to reduce storage and transfer size. Use this skill when users ask to shrink PDFs or images, optimize upload/share size, or balance quality an... | |
| QRCode Generate styled QR codes (SVG/PNG/JPG) from user input. Supports custom module color, background, dot shape and eye shape, and many output options. | |
| Smart Leaner 🎓 Your personal learning assistant — explains any concept with clarity and depth, making complex ideas intuitive through diagrams and analogies. Auto-archiv... | |
| This skill informs the agent how to use Viam CLI Provides comprehensive guidance and commands to install, authenticate, and manage Viam CLI for robotics fleets, modules, machine data, datasets, and ML workf... | |
| AgentWallex Payment Create and manage AI agents, send USDC/USDT payments, check balances across Ethereum, BSC, and Tron | |
| soushen 高性能 Bing 搜索引擎 Skill - "搜神猎手" 使用 Playwright 底层 API 进行深度网页搜索和元素提取 功能： 1. Bing 搜索执行 - 返回结构化搜索结果（标题、链接、摘要、来源） 2. 深度页面分析 - 提取页面的所有关键元素（链接、表单、按钮、脚本、元数据） 触发条件： - 用户... | |
| 爆款短剧剧情构建 根据一句话灵感，创作跌宕起伏、充满励志奋斗与真善美元素、情感丰富且逻辑自洽的短剧纯叙事剧情大纲。 | |
| conceive-short-drama-en Generate original, uplifting short drama plot outlines from user prompts, combining multiple inspirational struggles, truths, emotions, and satisfying twists... | |
| Shorts Builder Story generation pipeline skill. Supports multi-episode continuous generation, graph management, AI quality check + human confirmation dual control mechanism... | |
| 连续短剧剧情构建 剧情生成管道流技能。支持多剧集连续生成、图谱管理、AI质检+人工确认的双控机制。自动管理人物、场景、钩子的关联关系。 | |
| An automated script generator for creating viral videos. Story generation pipeline skill. Supports multi-episode continuous generation, graph management, AI quality check + human confirmation dual control mechanism... | |
| Story Master/通过图谱和管道方式创建剧本 剧情生成管道流技能。支持多剧集连续生成、图谱管理、AI质检+人工确认的双控机制。自动管理人物、场景、钩子的关联关系。 | |
| Story generation pipeline skill Story generation pipeline skill. Supports multi-episode continuous generation, graph management, AI quality check + human confirmation dual control mechanism... | |
| talk-normal Stop LLM slop. A curated system prompt that cuts verbose, corporate-sounding LLM output by 56-71% (measured) while preserving information. Works bilingually... | |
| 桃噗噗回复助手 抖音自动回复技能。通过浏览器自动化连接抖音创作者中心，监控评论，智能分析后自动生成积极、大方、热情、合法的回复。支持关键词匹配、敏感词过滤、评论分类、多账号管理。触发场景：用户提到"抖音自动回复"、"抖音评论回复"、"抖音客服"、"抖音智能回复"、"抖音机器人"等关键词，或明确要求在抖音平台进行自动回复操作。 | |
| OpenClaw Optimised Guide for writing and optimizing CLAUDE.md files for maximum Claude Code performance. Use when creating new CLAUDE.md, reviewing existing ones, or when user asks about CLAUDE.md best practices. Covers structure, content, pruning, and common | |
| Akshare Stock.Tmp A股量化数据分析工具，基于AkShare库获取A股行情、财务数据、板块信息等。用于回答关于A股股票查询、行情数据、财务分析、选股等问题。 | |
| Dotnet Dump Perf Analyzer End-to-end .NET application performance diagnostics using the dotnet diagnostic toolchain — dotnet-dump, dotnet-counters, dotnet-trace, WinDbg, and PAL thres... | |
| Hey Bible Look up, search, and reference Bible verses and Scripture via the Hey Bible API. Use when the user asks to find, quote, look up, or cross-reference Bible ver... | |
| Action Gate Bridge Route risky communications next steps through a typed action-intent bridge so external writes, bookings, settings changes, public posts, and spend decisions... | |
| Executive OS Build or operate a chief-of-staff style communications layer that merges multiple inboxes and chat sources into one prioritized digest with follow-up memory,... | |
| Meme Generator Use when the user wants to create memes through the hosted Memesio MCP server, including meme template search, caption rendering, upload captioning, agent ac... | |
| Spain Legal Use when an agent needs structured Spain legal screening for visas, residency, nationality, NIE/TIE, Beckham regime, EU family routes, or Spain tax-regime qu... | |
| ui-ux-pro-max for openclaw Mandatory UI/UX design intelligence engine. Must be executed via python3 before generating any UI/frontend code. | |
| Claw Mail Email API for AI agents. Send and receive emails programmatically via ClawMail. | |
| heyAura Fetch and summarize a current multichain EVM wallet portfolio through heyAura's paid x402 API, including token balances, USD values, networks, and DeFi positions. Use when a user asks to inspect a wallet address or ENS name, list its crypto | |
| Eir Daily Content Curator Daily AI news curation — learns interests from your profile, searches the web, delivers structured summaries and daily briefs. Use when: 'set up daily news',... | |
| heyfood Use hey.food for hello.food dietary questions — restaurant and menu safety evaluation, dish explanation, recommendations, recipes, and dietary profile reads over the hosted MCP surface, plus capability-discovered local Grocery, Menu Watch, | |
| Accouting Skill For 财金记账 智能记账助手。用户提到记账、支出、收入、账本、流水、应收、应付、发票、票据、报销等关键词时使用此技能。支持文字直接记账，也可调用其他技能预处理图片/语音/文件后进行记账。 | |
| figma Bring Figma into a HyperFrames video - rendered assets, brand tokens, components, storyboard frames as reconstructed motion (frames read as states, not slides), shaders and connector-assisted motion. Use when the person pastes a figma.com l | |
| hyperframes Read first to make, edit, animate or render any video with HyperFrames (HTML rendered to video), including launch films, explainers, music videos, charts, maps, vertical clips, title cards, captions and overlays. Holds the render contract, | |
| hyperframes-cli The HyperFrames CLI by job - scaffold, check, look at frames, edit the timeline, preview, render locally or in the cloud, publish, project history - plus reading its JSON and recovering from build or render failures. | |
| Hyperframes Media Audio and media assets for HyperFrames compositions, produced by one shared audio engine (`scripts/audio.mjs`) — multi-provider TTS (HeyGen / ElevenLabs / Ko... | |
| hyperframes-registry About 450 ready-made HyperFrames blocks and components installed as editable source - transitions, overlays, titles, kinetic type, captions, charts, map overlays, 3D, camera moves. Use it before hand-building any named visual (CRT scanlines | |
| media-use Agent Media OS for a HyperFrames project. Resolve BGM, SFX, image, icon, brand logo, voice, color grade, or LUT into a frozen local file or paste-ready block + ledger record (one verb, `resolve`); generate via TTS / music / image models whe | |
| remotion-to-hyperframes Bring existing video code or footage into HyperFrames and verify it frame by frame against the original - Remotion first, also Motion Canvas, Lottie, Three.js, p5.js, canvas or plain HTML/CSS animation, or renders from Manim, After Effects | |
| reverse-any-video Rebuild any video file as an editable HyperFrames project - motion graphics, talking heads, live action or AI-generated footage. Measure and watch it, rebuild every layer, then check the render against the original frame by frame. Use to re |
35,651–35,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.