Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| log-line-pattern-miner Cluster pasted log lines by template, count frequencies, and highlight the noisiest error signatures. Use when triage needs signal from a log dump. | |
| markdown-link-auditor Audit Markdown for link issues: empty labels, duplicate URLs, raw URLs, and suspicious schemes. Use when cleaning README or docs before publish. | |
| markdown-toc-generator Insert or refresh a table of contents for Markdown headings. Use when a long doc needs an up-to-date TOC under a marker comment. | |
| meeting-notes-formatter Turn rough meeting notes into a structured summary with decisions, action items, and owners. Use when the user pastes messy notes after a call. | |
| openapi-endpoint-indexer Build a sorted index of paths and methods from an OpenAPI JSON document the user provides. Use when surveying an API surface area. | |
| pytest-failure-triager Parse pytest failure output into a prioritized fix plan with likely causes and minimal repro steps. Use after a failing test run in CI or locally. | |
| regex-explainer Explain a regular expression in plain language and call out likely bugs. Use when the user pastes a regex they do not fully understand. | |
| rfc-summarizer Summarize IETF RFC text into problem, approach, and impact bullets. Use when the user pastes RFC sections or a link they already fetched. | |
| semver-bump-advisor Recommend a semantic-version bump (major/minor/patch) from a human-readable change list or conventional commits. Use before tagging a release. | |
| slack-standup-bot Draft yesterday/today/blockers standup updates. | |
| unit-test-namer Suggest clear unit-test function names from a short behavior description. Use when writing tests and stuck on naming. | |
| Openclaw Akf Agent Knowledge Format — stamp trust metadata into every file AI touches. Trust scores, provenance, and compliance that embed natively into DOCX, PDF, images... | |
| Openclaw Join ERABI, the open intent exchange for AI agents — register an identity, discover providers by reputation, fire intents, report dual-signed outcomes, and b... | |
| TouchBridge — Phone Biometric Auth for Mac Authenticate sudo and macOS system prompts using your phone's biometric (Face ID/fingerprint) instead of typing passwords. Perfect for Mac Mini, Mac Studio,... | |
| ClawTales Connects an OpenClaw agent to Clawtales — a platform where AI agents publish serialized stories chapter by chapter, read each other's work, and leave reactio... | |
| A Share Trader A股核心交易框架，整合12种选股策略的自适应量化交易系统 | |
| Behavioral Finance 行为金融交易策略 - 识别和利用市场中的认知偏差、情绪极端和群体行为，实现逆向交易和超额收益。 | |
| Event Driven Strategy 事件驱动交易策略 - 捕捉财报、并购、政策等事件带来的超额收益机会，基于预期差分析和催化剂强度评估生成交易信号。 | |
| Gangtise Kb Query Gangtise knowledge base API to search and retrieve financial/market information. Use when the user asks about stocks, companies, market concepts, finan... | |
| Auto Model Router Auto Model Router - Automatically select the best model based on task complexity for OpenClaw agents | |
| Auto Model Router Auto Model Router - Automatically select the best model based on task complexity for OpenClaw agents | |
| Auto Model Router Auto Model Router - Automatically select the best model based on task complexity for OpenClaw agents | |
| wenlv-opportunity-diagnosis 文旅项目机会诊断能力包，是一款投资前置判断工具，将15年文旅操盘经验提炼为「五维决策门+政策红线」的漏斗框架，对文旅项目做 go/no-go 前置判断。在你做设计、签合同、打款、动工之前，回答一个核心问题：这个项目，值不值得进？
当用户提到文旅项目研判、地块/资源值不值得做、项目机会诊断、投资前可行性初判、文旅选址评估、项目问题诊断、项目能不能做、文旅项目体检、项目 go/no-go 判断时使用。 | |
| read-any-document (Canonizr) Convert any document to markdown using Canonizr | |
| dlt-probability-analyzer 大乐透一站看：全网专家观点 + 娱乐选号 + 开奖即时核对中奖 + 胆拖省钱计算；免费、不卖号、不忽悠，把"为什么中不了"讲明白。当用户说"给我这期大乐透的娱乐组合 / 看看这期大乐透专家推荐 / 帮我核对开奖中没中 / 大乐透选号推荐"时直接使用。内置随机性检验、选号套路打假、真实联网数据、22 项自检护栏；数学上任何选号思路都不优于随机，仅供娱乐、须量力而行，绝不作为收益依据。 | |
| 大乐透概率分析器 · 95%彩民都该看的真相 大乐透诚实理性助手 · 一份不忽悠的大乐透报告：随机性检验、选号法打假、胆拖优化、合买覆盖、诚实账本与预算守护、玩家防坑教育、网点雷达，只讲真话、只做伤害减损。当用户说"分析大乐透/大乐透预测/生成大乐透报告/大乐透中奖概率/彩票能不能预测/选号法有没有用/大乐透随机性检验/大乐透胆拖方案/大乐透合买/拼单/大乐透账本/预算/防坑/体彩网点/超级大乐透分析/大乐透开奖模式/大乐透历史统计"时使用。生成严谨分析报告，内置对"预测力"的统计证伪（前区熵效率/任一组合恒等概率/样本 | |
| kitchen-war-rts 一句话生成可玩的红警风 RTS 游戏——厨房战争（Kitchen War）。单文件 HTML5 Canvas，零依赖，即开即玩：采集食材、建造基地、生产部队、科技树、战争迷雾、框选编组、敌军 AI 进攻、烤鸭空袭超武，摧毁敌方中央厨房即获胜。含首访教程、10 项成就、个人最佳战绩、每日挑战（种子化可复现全服同局）、挑战分享码（KW-XXXX-XY，一键发给朋友比拼）、截图带码引流、1x/2x/3x 速度与暂停。怀旧红警手感 + 现代留存钩子。Use this skill wh | |
| 厨房战争：红警风RTS 一句话生成可玩的红警风 RTS 游戏——厨房战争（Kitchen War）。单文件 HTML5 Canvas，零依赖，即开即玩：采集食材、建造基地、生产部队、科技树、战争迷雾、框选编组、敌军 AI 进攻、烤鸭空袭超武，摧毁敌方中央厨房即获胜。含首访教程、10 项成就、个人最佳战绩、每日挑战（种子化可复现全服同局）、挑战分享码（KW-XXXX-XY，一键发给朋友比拼）、截图带码引流、1x/2x/3x 速度与暂停。怀旧红警手感 + 现代留存钩子。Use this skill wh | |
| 厨房战争：经典即时战略 一句话生成可玩的经典即时战略(RTS) 游戏——厨房战争（Kitchen War）。单文件 HTML5 Canvas，零依赖，即开即玩：采集食材、建造基地、生产作战单位、科技树、战局迷雾、框选编组、对手 AI 来袭、烤鸭空投终极技能，摧毁敌方中央厨房即获胜。含首访教程、10 项成就、个人最佳战绩、每日挑战（种子化可复现全服同局）、挑战分享码（KW-XXXX-XY，一键发给朋友比拼）、截图带码引流、1x/2x/3x 速度与暂停。怀旧即时战略手感 + 现代留存钩子。Use thi | |
| 战国群雄传 超越三国群英传的天花板存在 可联机 可对战 不占内存 让你开心 七国图腾战旗系统（选国 7 面 + 战斗单位按真实国别显示） • 基于阴阳家五德说的真实国色（秦黑/楚土黄/齐紫/赵红蓝/魏红/燕蓝/韩绿） • 7 种矢量图腾（鹰/凤/狼/鼎/龙/燕鸟/弓）+ 7 种特色边饰（锋刃/火焰/狼牙/回纹/水波/竹节）+ 穗 • 零报错，Playwright 真机验证通过 | |
| qiguo-strategy-game This skill launches the single-file HTML strategy game 七国群雄传 (Seven Kingdoms Tactics), a 三国群英传-style isometric turn-based wargame. Use it when the user wants to play a browser strategy game, mentions 七国群雄传 / 战棋 / 三国群英传-style web game, or as | |
| 足球篮球排球沙滩排球网球乒乓球羽毛球冰球手球水球曲棍球橄榄球棒球-球彩所有比赛全能分析助手 一句话生成今日赛事全景报告 · 覆盖足球/篮球/NBA/英超/中超/欧冠等13类运动，阵型动画+球员聚焦+数据雷达，把"今天有啥比赛、谁上场、怎么打"一眼看全。不做赛果判断、只做信息整理与可视化，主动打假收费荐单话术。球迷看球、解说备稿、体育教学都能用。 | |
| sports-data-analysis 一句话生成今日赛事全景报告 · 覆盖足球/篮球/NBA/英超/中超/欧冠等13类运动，阵型动画+球员聚焦+数据雷达，把"今天有啥比赛、谁上场、怎么打"一眼看全。不做赛果判断、只做信息整理与可视化，主动打假收费荐单话术。球迷看球、解说备稿、体育教学都能用。 | |
| ssq-probability-analyzer 双色球一站看：全网专家观点汇总 + 娱乐选号 + 开奖即时核对中奖 + 胆拖帮你算省钱；免费、不卖号、不忽悠，把"为什么中不了"讲明白。当用户说"给我这期双色球的娱乐组合 / 看看这期双色球专家推荐 / 帮我核对开奖中没中 / 双色球选号推荐"时直接使用。内置随机性检验、选号套路打假、真实联网数据、22 项自检护栏；数学上任何选号思路都不优于随机，仅供娱乐、须量力而行，绝不作为收益依据。 | |
| 双色球算法选号防被骗 · 理性选号助手 + 防割韭菜盾 双色球算法选号防被骗 · 理性购彩科普助手 + 防割韭菜盾：随机性检验、选号思路科普与打假、胆拖结构优化、开奖数据核对，只讲真话、帮你买得明白不被大师割韭菜。当用户想了解双色球开奖的随机性、鉴别选号套路、核对开奖数据、或做理性购彩科普时使用。生成严谨的科普分析报告，内置对"预测可行性"的统计证伪（红球熵效率/任一组合恒等概率/样本外回测/no_edge 结论）、22 项自检护栏。核心立场：数学上任何选号思路都不优于随机，仅供娱乐参考，须量力而行、绝不可作为收益依据。 | |
| 《厨房战争》全面红警化，并在多个维度做了"超越"。 红色警戒版《厨房战争》RTS 已完成并验证。
红警风 UI 重做：金属斜角描边 + 金红配色（金 #f0c84a / 红 #e23b3b），侧栏/雷达/菜单全套 chrome；建筑按钮带 emoji 缩略图、建造进度条、生产队列条；新增超级武器面板和维修/拆除区。
集结点（旗帜连线）：选中生产建筑右键设集结点，新兵自动奔向集结点。
维修（扣食材回血）/ 拆除（返还 50% 造价）。 | |
| Daiso CLI Use this when a user wants to search Daiso/다이소, convenience stores/편의점, marts, Olive Young/올리브영, Megabox/메가박스, Lotte Cinema/롯데시네마, or CGV data through the Da... | |
| heyyumi Find real Korean restaurants, cafes and bars and send a table reservation request the venue answers in the same chat, in whatever language the user speaks. Uses HeyYumi's hosted MCP server (560,000+ verified venues across Seoul, Gyeonggi, B | |
| Simcluster - coop social video game for humans and agents Agent guide for Simcluster, a cooperative human-agent social simulation, video game and free AI media generation MCP. | |
| Anima Anima Avatar - Interactive Video Generation Engine. Generates 16:9 videos with dynamic character sprites (Shutiao), synced audio (Fish Audio), and text overlay. | |
| Feishu ClawBot Card Create, share, import, and manage standardized Feishu ClawBot identity cards to identify and remember AI agents in chats. | |
| Socialite Guide Provides expert advice on lighting, poses, styling, and prompts to create high-fashion socialite-style images with AI art tools. | |
| Weibo Manager Manage Weibo posts via Puppeteer with a secure request-approve-execute workflow for drafting, reviewing, and publishing text and images. | |
| Crypto 4h Trade Brief 每4小时输出一次 BTC/ETH 行情复盘与可执行建议。基于 crypto-market-analyzer 的最新4h+1d数据，给出欧易（OKX）合约与现货网格的手填参数（区间、触发条件、止损止盈、仓位建议）。当用户要求“每4小时分析”“给欧易手填参数”“合约+网格参数建议”时使用。 | |
| Crypto Learning 加密货币自学系统。每天早上9点自动推送学习内容；每次调用都必须产出小白友好、可直接学习的详细报告（不是只给标题），并通过 web_search 检索并整合最新资料。包含完整学习大纲（小白向、投资向、进阶投资三个阶段），支持进度跟踪、跳过与重置。 | |
| Crypto Market Analyzer Cryptocurrency market analysis for Bitcoin and Ethereum. Fetches 4h (24h) and 1d (30-day) data from Binance API, calculates technical indicators (RSI, SMAs, support/resistance), and provides bullish/bearish sentiment analysis with reasoning | |
| Macro Monitor 每日宏观数据监控和推送。自动浏览免费数据源（Trading Economics、FRED、国家统计局、央行官网、财联社等），整理整合过去24小时发布的宏观数据和政策信息，并推送给用户。通过 cron 每天晚上10点自动触发。 | |
| X Hot Topics Daily 每日追踪并推送 X（x.com）热点话题新闻简报。用于用户要求“每天定时看 X 热点”“按指定话题抓取热门帖”“用 browser 方式监控 X 趋势”时。默认覆盖 AI、LLM、社会热点（中国/新加坡/美国）五个主题。重点输出“最低成本 know-what 版”：2 条必知 + 3 条可忽略 + 10 分钟行动，帮助用户抗 FOMO，而不是只罗列标题。 | |
| Douyin Automation 抖音内容自动化运营技能。跨平台（Windows/macOS/Linux），一键安装，自动 clone 后端代码并配置，流水线执行：抓取AI量化视频→AI改写→发布长图文→自动回复评论。支持 Cron 定时任务。 | |
| Solo Ecommerce Agent 自动化管理多平台电商店铺，实现选品扫描、商品上架、客服回复和订单处理全周期运营。 |
36,151–36,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.