Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| TikTok Shop Spy TikTok Shop product research without a seller account or API key. Search TikTok Shop products with prices, units sold and ratings, open a product page, read buyer reviews, browse a store's best-sellers, see which products a creator promotes | |
| TikTok Trend Radar TikTok trend research with no TikTok account or API key. Trending videos by country, trending hashtags, trending searches, the Top 50 and Viral 50 music charts, TikTok Creator Search Insights (what people search, by age, gender and country) | |
| transcribe-any-video Get transcripts of public videos from YouTube, TikTok, Instagram, X (Twitter), Facebook, LinkedIn, Reddit and Rumble with no accounts or API keys. Captions where they exist, transcripts made from the audio for TikTok videos without captions | |
| Trello Projects Manage Trello boards, lists, cards, comments, labels, checklists, and project workflows via the Trello API. Use this skill when users want to create boards,... | |
| tube-scout YouTube research without a Google account or API key. Search videos, channels and hashtags, see trending Shorts, read any channel's stats, videos, Shorts, playlists and community posts, and pull a video's details, comments and replies. Use | |
| X (Twitter) Draft, publish, and manage posts on X (Twitter), inspect timelines, manage profiles, and automate social media workflows via the X API. Use this skill when u... | |
| Typeform Manage Typeform forms, responses, themes, workspaces, and webhooks via the Typeform API. Use this skill when users want to list forms, inspect responses, cre... | |
| Vercel Manage Vercel projects, deployments, domains, environment variables, and team resources via the Vercel REST API. Use this skill when users want to inspect de... | |
| WakaTime WakaTime API integration with managed OAuth. Retrieve coding statistics, track developer productivity, analyze programming languages and editor usage, view d... | |
| Webex Webex API integration with managed OAuth. Send messages, manage rooms and teams, list memberships, handle webhooks, manage people and team memberships. Use t... | |
| WhatsApp Send WhatsApp messages, manage templates, handle media, and automate WhatsApp Business messaging workflows via the WhatsApp Business API. Use this skill when... | |
| x-pulse Monitor X (Twitter) without an X account or API key. Search posts by keyword, see what is trending, read any profile, its posts, followers and about page, unroll full threads and long-form articles, read replies, and transcribe video posts. | |
| Xero Manage invoices, contacts, bills, payments, and accounting records in Xero via the Xero API. Use this skill when users want to create invoices, manage contac... | |
| Zendesk Manage Zendesk support tickets, users, organizations, macros, and helpdesk workflows via the Zendesk REST API. Use this skill when users want to search ticke... | |
| Zoho Desk Zoho Desk API integration with managed OAuth. Manage support tickets, track conversations, list departments and agents, handle contacts and organizations. Us... | |
| Zoom Manage Zoom meetings, webinars, registrants, cloud recordings, and event workflows via the Zoom API. Use this skill when users want to schedule meetings, man... | |
| Zyte API Extract structured data from websites using Zyte API (formerly Crawlera) with smart proxy rotation and browser rendering. Use this skill when users want to s... | |
| AI科普视频工作室（Mac mini 16G适用） AI科普视频全流程自动化制作技能。将数字人形象（Google Flow / SadTalker）、AI语音克隆（F5-TTS MLX）、Pillow内容幻灯片、逐字卡拉OK字幕（Pillow + FFmpeg）、以及专业级音视频QA整合为8阶段自动化流水线。覆盖：脚本策划 → 数字人生成 → TTS语音克隆 →... | |
| AI Short Film Finalization — Route C (Flow Free) Finalize an AI-generated short film using the free Route C pipeline (Google Flow Omni Flash text-to-video, Nano Banana 2 image generation, edge-tts narration... | |
| AI短剧制作助手 | AI Short Film Producer AI短剧制作助手 | AI Short Film Producer — 低成本AI短剧/短片全流程制作技能。使用Grok Imagine生成视频镜头、TTS生成配音，配合FFmpeg+Python本地合成。适用于从零制作AI短片、短视频、短剧EP、预告片等场景。包含完整的分镜脚本创作、视频生成、配音生成、音频驱动... | |
| Ai Short Film Studio 低成本AI短剧/短片全流程制作技能。三套制作路线：①速创API+Grok Imagine直出视频（¥30-50/部）；②可灵Kling V3+Gemini Image图生视频（¥80-120/部）；③Google Flow Omni Flash免费批量文生视频（¥0/部，Chrome CDP自动化）。包含分镜脚本... | |
| 豆包自动化操作 豆包自动化操作技能 - 基于 Playwright CDP 协议接管已登录 Edge 浏览器，实现豆包 AI 的自动化操作。支持批量生成图片、批量生成视频、文本对话、下载生成内容等。触发词：豆包自动化、操作豆包、豆包生成图片、豆包生成视频、豆包批量生成。 | |
| 豆包批量视频生成 豆包网页视频批量生成技能。基于豆包网页端批量生成推广视频，自动完成文案创作、视频生成、拼接混音的完整流水线。触发词：豆包批量生成视频、帮我用豆包做视频、批量生成短视频。 | |
| GEO品牌诊断 GEO 品牌 AI 平台推荐诊断工具。采集品牌在豆包/元宝/通义千问三大 AI 平台上的推荐情况，生成诊断报告。 | |
| Google Flow Video Automation Automatically generate AI videos on Google Flow (labs.google/fx/tools/flow) via Chrome CDP. Supports 16:9 aspect ratio, 10s duration, auto-download MP4. | |
| 进击的知识库 微信好用知识库，打通 Agent，多平台视频链接一键下载归档。 微信/视频号/抖音/小红书/公众号的内容，丢过来自动识别、下载、上传腾讯文档，智能表格一键归档。 抖音下载同步提取视频描述（创作者文案/#标签），保存为 .caption.txt。 视频直传在线播放，文章自动转存。视频号用自研 sph-downloa... | |
| 商家GEO推手 中小商家免费GEO优化助手。当商家老板需要以下场景时触发： - 发布企业宣传信息到自媒体平台 - 生成符合SEO/GEO优化的文章内容 - 管理企业在抖音、小红书、知乎、百家号、头条号、搜狐号、网易号、快手等平台的品牌内容 - 上传营业执照、门头照片等产品资料自动生成宣传文案 - 客户案例包装和企业口碑内容创作... | |
| social video -publish寒武纪视频发布 一键多平台发布工具。支持小红书、抖音、快手、B站、视频号五大平台同步发布图文和视频。 用户只需提供一次内容，自动适配各平台格式并发布。 使用场景： - "一键发布到小红书、抖音、快手、B站、视频号" - "帮我同步发多个平台" - "多发几个平台" - "发布视频到抖音" - 内容营销、推广、招募等多平台曝光需求 | |
| 多平台视频图文发布助手 多平台视频图文发布助手 — 支持抖音、快手、B站、小红书、微信视频号五大平台同步发布图文和视频内容。 触发场景："一键发布到小红书、抖音、快手、B站、视频号"、"帮我同步发多个平台"、"多平台发布视频"、"发布视频到抖音"等。 ⚠️ 本 skill 需要用户协助操作浏览器登录，所有发布操作均在用户本地浏览器中完成... | |
| 股票实时行情分析器(安全版) A股/港股实时行情查询、基本面分析、深度报告生成与邮件发送一体化工具。触发场景：(1) 用户询问股票价格、市值、PE/PB等数据；(2) 用户要求分析某只或多只股票；(3) 用户要求生成股票分析报告；(4) 用户要求通过邮件发送股票报告。支持AkShare实时行情、聚宽基本面数据、QQ邮箱/Gmail发送。 | |
| 一键知识库 - 微信内容管家 微信最好用的知识库管家 — 发链接就完事！ 📱 支持视频号｜抖音｜小红书｜公众号｜本地文件 🚀 一站式管理：链接解析 → 自动下载 → 上传腾讯文档 → 智能建索引 🤖 Agent 自动化，无需手动操作，把散落各处的内容变成你的知识资产 ☁️ 腾讯文档集成，上传后直接在线播放、预览、分享 ⚠️ 新用户首次使... | |
| X Post Fetcher Automates browser to fetch and summarize publicly visible tweets from a specified X (Twitter) user into a Markdown report. | |
| 创客贴智能海报设计 根据用户的海报平面设计需求，调用创客贴智能设计API生成设计缩略图。擅长制作邀请函、日签、小红书配图、商品海报、Banner等平面设计。当用户提到需要做海报、设计、邀请函、日签、小红书图、商品图、Banner，或提及平面设计、创客贴相关需求时使用此技能。 | |
| limtdesign 视觉创意生图提示词生成skill。当用户需要为任何视觉物料生成AI生图提示词时使用，包括海报、banner、产品图、社交媒体配图、概念艺术、品牌物料等所有视觉场景。无论用户的需求是模糊的（"帮我做张海报"）、半清晰的（"科技风新品发布海报"）还是已有方向的，都应触发此skill。当用户提到生图、出图、画图、提示词... | |
| Copilot Usage Display GitHub Copilot premium request usage, quota, billing stats, and per-model multipliers for the authenticated user. Use when the user asks about their... | |
| Share One-Time Link Generate public one-shot or time-limited download links for files using a local Express server exposed via Cloudflare Tunnel. Links are tokenized, expire aut... | |
| Hitpaw Image Enhancer Enhance images and videos using HitPaw's AI enhancement API | |
| Simple SMTP Mailer Send emails via SMTP using the msmtp command-line tool configured in ~/.msmtp/config for authentication and server settings. | |
| word-formatter 黑灰白 专业 Word 文档（.docx）后期排版、合规校验与图件处理技能，专注五类客户交付型咨询报告：①财务尽职调查报告 ②法律/综合尽职调查报告 ③风险评估报告（综合/COSO）④财税风险评估报告 ⑤财务分析报告。当前版本 v1.0.0「黑灰白」(2026-07-29)：配置驱动排版、5 类报告全配置、封面专业垂直分布（+分节符）、页眉双栏（客户名左+报告类型右）、Heading 1-6 层级规范、三线表/全线表、纯 Python 结构化图件渲染器。设计语言极度克制：仅黑/白/灰 | |
| Zhanxing Aopt Skill This tool is used by agents during development and testing, and can help us verify the reliability of the current agent. It is abbreviated as AOPT | |
| consulting-report-search Consulting and industry report search and QA skill that prioritizes iResearch free reports. Use for consulting report search, industry report QA, iResearch r... | |
| Yesum Clawhub Skill Provides paid, deterministic x402 services for crypto snapshots, utilities, research, extraction, grading, endpoint monitoring, payment verification, code ge... | |
| financial-report-analyzer 智能解析PDF格式财务报告，自动提取关键财务指标，生成可视化分析图表和投资参考报告。适用于分析中国A股、港股、美股上市公司的财务报表。Use when user needs to analyze financial reports, extract financial data from PDFs, compar... | |
| 同花顺问财数据提取器 从同花顺问财(iwencai.com) AI选股页面批量抓取涨停股票数据，使用 agent-browser 通过 Chrome CDP 连接操作浏览器，将数据存入 SQLite 数据库，并可导出为 Excel 汇总报告。适用场景：用户要求爬取/抓取/提取问财涨停数据、查询特定日期涨停股票、批量获取历史涨停记录、生... | |
| Wiener Linien Vienna public transport (Wiener Linien) real-time data. Use when asking about departures, schedules, disruptions, elevator status, or directions in Vienna's public transport (U-Bahn, tram, bus, night bus). Queries stops, lines, and traffic | |
| jef1test Connect to 100+ APIs (Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth. Use this skill when users want to... | |
| Jeftest Connect to 100+ APIs (Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth. Use this skill when users want to... | |
| test Manage Trello boards, lists, and cards via the Trello REST API. | |
| test Manage Trello boards, lists, and cards via the Trello REST API. | |
| Lowcode Module Generator 低代码模块生成器。低代码平台出码（完整前后端代码），支持ACM系统的普通主页、左右布局等模块开发。用户只需提供中文模块名和字段明细表，即可生成 PO、Form、VO、Service、Controller、Mapper 等后端代码，以及前端 React 页面组件。 |
36,051–36,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.