Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| n Skill Create, manage, sync, and share minimalist notes with tags, search, and reminders across multiple devices using simple commands. | |
| P图 提供图片加载、尺寸调整、裁剪、格式转换、增强、滤镜、拼接、背景移除和文字添加等多功能创意图片处理能力。 | |
| Picture 提供图片加载、保存、尺寸调整、裁剪、格式转换，智能增强，滤镜应用，拼接，背景移除和文字添加的全能图片处理工具。 | |
| Picture Edit 提供图片加载、编辑、增强、滤镜、拼接、背景移除和文字添加等功能，支持多格式和高效处理。 | |
| 智能多面手工具箱 智能多面手工具箱，集信息查询、创新思维、快速工具和质量把关于一体，支持自然语言交互与多维度分析。 | |
| Query-Skills 智能搜索和发现 OpenClaw 技能，支持中英双语、多来源搜索、实时更新及技能详情查询。 | |
| 智能代码助手 智能理解和精准诊断代码，提供修复、重构建议及自动生成文档，提升代码质量与维护效率。 | |
| Search Agent Skill AI-powered search agent that performs intelligent web searches, aggregates results, and provides summarized answers with source citations. Use when: user nee... | |
| Universal Utility Toolkit - 全能实用工具包 Universal Utility Toolkit - 全能实用工具包，包含单位转换、UUID生成、URL处理、Unicode探索、JSON/YAML格式化、哈希计算、密码生成、颜色选择等开发必备工具。Invoke when user needs utility tools, converters, genera... | |
| W Skill Pack Provides weather info, word learning, Wikipedia search, writing help, workout plans, web search, weight tracking, and hydration reminders. | |
| ai-architecture-harness-en Establish and use architectural guardrails for AI-assisted coding to prevent architecture collapse, feature regression, and drift across long multi-turn iter... | |
| ai-architecture-harness-zh 建立和使用 AI 编程架构护栏，防止架构坍缩、功能回退和长对话迭代漂移。Use when the user mentions AI 编程, Agent 编程, 架构坍缩, Harness Engineering, 设计意图, 验收规则, 黄金法则, 架构测试, 或希望让代码库更适合 AI Agent 安全修改。 | |
| bug-pattern-diagnosis 根据用户描述的 bug 现象（症状）匹配已沉淀的 bug 案例库，快速判断这是哪类问题、根因在哪、如何排查。每次成功诊断后会把新案例沉淀到案例库，持续积累经验。适用于用户报告"奇怪的报错 / 间歇性失败 / 某些环境才复现 / 日志很诡异"的场景。 | |
| bug-pattern-diagnosis-en Diagnoses bugs by matching user-reported symptoms against a curated library of past bug cases under experience/, using prior cases as memory references (neve... | |
| complex-bug-debugging-with-ai 复杂 bug 与 AI 协作排查的元方法论。当用户报告"诡异 / 间歇性 / 多层因素 / 重启不愈 / 多系统协作 / 已经排查很久没头绪"的 bug 时，启用本 SKILL 的 7 阶段协作工作流："业务链路对齐 → 症状结构化 → 边界测试循环 → 方案摆台 → 执行验证 → 失效升级 → 闭环沉淀"。本... | |
| complex-bug-debugging-with-ai-en Enables a strict 7-phase collaborative workflow for diagnosing and fixing complex, intermittent, or multi-layer bugs with verified user input and data-backed... | |
| Game Vfx Mesh Workflow Builds game VFX with mesh shell + scrolling texture + engine animation (dead model, live texture, engine math). Covers 2.5D billboard rules, 631 color, point... | |
| LinkSKILL Universal API integration skill for enterprise platforms. Connect to any platform using Swagger/OpenAPI discovery. | |
| merge-deploy-verify-loop 将"本地改动 → 选择性提交 → push → 合并到目标分支 → CI 构建部署 → 重启工作负载 → 端到端功能/数据库验证 → 失败则补丁再循环"这一段发布闭环按通用 SOP 跑通的技能。 当用户的意图包含"提交并推送 / 合并到 develop 或 feature/* / 用 Jenkins/CI 部署到... | |
| multi-capability-bug-closure 统一调用源码、数据库、服务器日志、软件平台查询等多能力体系进行 BUG 定位与闭环论证。用于用户要求“必须基于真实数据给出结论与证据链”，而非仅代码静态分析的场景。 | |
| multi-capability-bug-closure-en Unified bug investigation and closure by combining source code, database, server logs, and software platform query capabilities. Use when users require evide... | |
| server-log-analysis 通过 SSH 连接远程服务器，读取同级 config.yaml 理解服务信息与日志位置，按需下载相关日志片段到本地 temp 目录，并分析日志定位问题。适用于用户要求排查远程服务日志、分析服务端异常或基于 SSH 访问进行日志诊断的场景。 | |
| server-log-analysis-en Connect to remote servers over SSH, read sibling config.yaml to understand service metadata and log locations, download only required log snippets to local t... | |
| universal-shell-deployer Install, configure, start, stop, and verify local or remote development infrastructure across Windows, Linux, and macOS by executing commands through a unifi... | |
| Clean Unused Deps Clean up unused npm dependencies in a project. Use when you want to remove packages that are installed but not used in the codebase. | |
| Slide Generation Generate Marp teaching slides from source content for teachers. Use when: (1) Generating Marp-compatible markdown slides from a .md file or folder for teachi... | |
| AI 模型智能管家 自动监控 AI 模型动态，搜集免费 tokens，生成周度部署建议，支持一键审批上线及安全回滚管理。 | |
| ResumeClaw Manage your ResumeClaw career agent — an AI that represents your professional experience to recruiters 24/7. Use when the user wants to: create a career agent from their resume, check who's contacted their agent, accept/decline recruiter in | |
| Parallel Code Review Parallel code review — dispatches two subagents to audit **runtime safety** (resource leaks, null paths, race conditions) and **architecture consistency** simultaneously, then merges and deduplicates into a single report. One pass covers tw | |
| chukonu-web-search 通过 Chukonu remote MCP 的 search 与 research 获取网页、学术、专利、金融和中国法律法规证据。用于需要外部、实时、可引用信息的搜索任务，以及财经新闻与金融研究、法律法规检索、事实核验、反证检索、PDF 全文深读、覆盖评估或持久化多轮研究；依据结构化 evidence、retrieval_assessment 与 research dossier 作答。 | |
| t-web-searcher AI-optimized web search via Tavily API. Returns concise, relevant results for AI agents. | |
| Bilibili 收藏视频下载 下载 Bilibili 用户个人收藏夹视频的工具。当用户提到以下任何场景时必须使用此 Skill： - "下载 Bilibili 收藏"、"bilibili 收藏下载"、"备份 bilibili 收藏夹" - "下载 B 站收藏"、"B站收藏夹下载" - "获取收藏视频列表"、"导出 bilibili 收藏" -... | |
| Permanently Clear Files from Git History Guide users to permanently remove files from Git repository history. Use this skill when users mention any of the following scenarios: - "git filter-repo", "... | |
| My Skills index wiki page Create Skills index wiki in case when many Skill files are installed, it’s easy to forget what they do or confuse them. Scan the Skills projects under a spec... | |
| Weibo 微博数据备份 使用 Playwright 自动化下载微博(weibo)收藏内容，本人或其他博主发表微博内容所有历史记录，包括图片、视频和长文章。 当用户提到"微博收藏"、"下载微博"、"备份微博"、"weibo favorites"、 "抓取微博内容"、"保存微博图片"或任何与微博数据备份相关的需求时， 支持 headless... | |
| NBA Today Pulse Timezone-aware NBA daily intelligence using bundled public ESPN/NBA fetchers plus official NBA injury-report PDFs, with compact day fast path, same-day stats... | |
| 流体网络求解与 Agent Skill 封装 Model, solve, and analyze steady-state fluid networks using TOML input with scenario-based reliability checks and automatic Markdown reporting. | |
| 一键为项目生成完整的 `.claude` 配置体系。 为项目生成完整的 .claude 配置体系。通过问答引导生成 CLAUDE.md、settings.json、rules 等配置文件，并可从 ClawHub 安装 skills。 | |
| Generate project documentation 分析当前项目代码库，自动生成全面的技术文档（项目概览、架构设计、模块说明、API 文档、数据模型、依赖关系、部署说明），输出到 docs/ 目录。通过 subagent 并行分析，适用于任意规模的项目。 | |
| all in one skill for wencai 同花顺 同花顺问财全功能合并技能。集成行情数据查询、指数数据查询、财务数据查询、基本资料查询、事件数据查询、公司经营数据查询、机构研究与评级查询、研报搜索、公告搜索、新闻搜索、问财选A股、问财选板块共12个子功能。只需配置 IWENCAI_BASE_URL 和 IWENCAI_API_KEY 两个环境变量，无需任何外部库... | |
| Strava Training Coach AI running coach that prevents injuries by monitoring your Strava training load daily. Detects dangerous mileage spikes, intensity imbalances, and recovery g... | |
| Cat Food Tracker Work with cat feeding, weight, and water tracking records. Use when validating CatFoodCalculator-style JSON backups, calculating dry-equivalent cat food tota... | |
| claw-backup 一键备份 OpenClaw 工作区，支持必选/可选内容，生成 ZIP 压缩包（含 SHA256 校验） | |
| 问句需求调研 通用模版。用户上传问句文档（xlsx），自动提取指标、维度和过滤条件，生成完整的问句模型.xlsx（包含01-问句、11-指标、12-维度、13-业务模型、00-业务规则等多个Sheet）。 | |
| 问句需求调研 通用模版。用户上传多个独立文档（问句、指标维度说明书、业务知识说明书、数据字典、表结构数据），自动提取指标、维度和过滤条件并输出。 | |
| RedNote Publish Auto 小红书笔记创作与发布完整技能。用户给定主题或资料，自动完成：文案撰写 → Markdown 卡片生成 → 图片渲染 → 小红书发布，全流程一键完成。 | |
| 八字算命AI大师 八字算命AI大师 — 八字排盘、梅花易数占卜、风水自查三合一。问命：输入出生年月日时，排出四柱八字，看格局、性格、婚恋财官趋势与大运流年；问事：针对一件具体之事（婚恋、合作、出行、求职、决策）断吉凶与时间点；问境：家居办公风水自查。排盘与起卦由内置确定性 Python 脚本完成（含真太阳时校正、体用生克判定），结果可复核、不编造。触发词：算命、八字、排盘、占卜、起卦、梅花易数、风水、运势、命理、算命大师。 | |
| Openclaw Backup 自动备份 OpenClaw 本地存储配置文件。支持 Windows/Linux/Mac。 使用场景：(1) 定期备份配置 (2) 迁移配置 (3) 恢复配置 这是一个 OpenClaw 备份工具 skill，提供交互式配置向导。 | |
| Openclaw Skills Github Sync 将 OpenClaw skills 同步到 GitHub（非实时，需手动确认）。 支持 Windows/Linux/Mac。 使用场景：skill 创建或修改完成后同步到 GitHub | |
| AI Receptionist Your 24/7 AI front desk. Polly answers incoming calls, filters spam, takes messages, and routes important calls — so you never miss what matters. |
35,751–35,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.