Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Performance Profiler Analyze code performance to identify bottlenecks, detect redundant computations and blocking operations, and provide optimization recommendations. | |
| Security Vulnerability Scanner 扫描代码中常见安全漏洞如SQL注入、XSS、硬编码密码，提供检测结果和安全评分建议。 | |
| SQL Query Optimizer Analyze and optimize SQL queries by providing performance analysis, index recommendations, execution plan interpretation, and optimization suggestions. | |
| Test Case Generator Automatically generate complete unit test code including imports, test cases, mocks, and assertions for Jest, Mocha, or Pytest from given code. | |
| Skill Generate images using Zhipu AI's CogView model | |
| Zhipu Embeddings Use Zhipu (智谱) web embeddings API for embeddingsing the internet. Use when user asks for web embeddings, latest news, or needs current information. | |
| Zhipu Search Use Zhipu (智谱) web search API for searching the internet. Use when user asks for web search, latest news, or needs current information. | |
| Saju Interpreter Interpret East Asian Four Pillars / Saju charts from already-derived pillars (year, month, day, hour stems/branches). Use when the user asks for 사주, 사주팔자, 명리... | |
| Checker QA and peer review agent. Reviews output from other agents before delivery. Use when: (1) content from Scribe needs review before posting, (2) research from... | |
| Clickbait Engine Generate provocative, engaging titles, hooks, and captions that maximize click-through for social media, YouTube, and tweets using proven clickbait strategies. | |
| Font Interceptor Extract fonts (TTF/OTF) from any website using MSCHF Font Interceptor. Use when user drops a URL and wants to identify/extract/download fonts from that websi... | |
| Mml Build 3D scenes and interactive experiences using MML (Metaverse Markup Language) for the Otherside metaverse and other MML-compatible environments. Use when... | |
| Janitor Maintenance and cleanup agent. Keeps the workspace healthy — memory consolidation, doc drift fixes, stale data cleanup, and repo organization. Use when: (1)... | |
| Seedance Generate detailed, production-ready cinematic video prompts following Seedance 2.0’s strict Subject-Action-Camera-Style-Audio-Constraints format for AI video... | |
| Janitor Maintenance and cleanup agent. Keeps the workspace healthy — memory consolidation, doc drift fixes, stale data cleanup, and repo organization. Use when: (1)... | |
| Youtube Downloader Download YouTube videos as MP4 at highest quality. Use when user sends a YouTube URL and wants to download/save it. Triggers on YouTube links (youtube.com, y... | |
| Stock Tracker Pro 股票监控技能。使用 Yahoo Finance 获取股票数据。支持添加股票到监控列表、删除股票、查询股票信息。触发场景：(1) 添加股票如"监控 AAPL"，(2) 删除股票如"删除 TSLA"，(3) 查询股票如"查看腾讯股票"、"AAPL 股价"。 | |
| Sentiment Analyzer 客服场景文本情绪分析工具。当需要对客户消息进行情绪识别（愤怒/焦虑/中性/满意/热情）、敏感词检测、情绪波动告警时使用。适用于：自动调整回复语气、触发紧急转接、投诉分级处理、NPS情绪追踪。触发词：情绪分析、情感检测、客户情绪、愤怒检测、情绪告警、sentiment。 | |
| DW-Copilot 基于 SpecKit SDD（Spec-Driven Development）方法论的数仓开发 Agent 技能。将自然语言需求经多阶段澄清与收敛，产出符合规范的 Spec 文档、执行计划及可直接落地的 DDL/ETL/调度配置代码。支持自定义平台技术栈和自定义项目公约。 | |
| Playwright Scraper Skill Playwright-based web scraping OpenClaw Skill with anti-bot protection. Successfully tested on complex sites like Discuss.com.hk. | |
| Cognitive Brain Deploy Cognitive Brain 语义记忆系统一键部署工具。当用户需要部署 OpenClaw 认知脑、部署 PostgreSQL+pgvector 向量数据库、安装 Cognitive Brain Skill、配置定时任务和 Hook 时使用。 | |
| DiT360 Panorama Generator 通过影石DiT360生成360度全景图，自动转格式并创建查看器 | |
| express-monitor 快递监控Skill - 查询快递物流、绑定手机号自动获取快递、同步到飞书 | |
| fund-monitor 基金监控Skill - 获取基金净值、涨跌数据，支持批量查询和监控 | |
| gold-price-auto 金价自动汇报 - 每小时自动查询国内外金价并汇报 | |
| minimax-mcp-docker版（适配极空间） MiniMax 图片理解 + 网络搜索 MCP 工具。适配 Docker 环境（极空间等），支持图片 OCR 识别、图像内容理解、网络搜索。API Key 安全存储在本地 credentials 文件，不暴露在代码中。 | |
| MiniMax MCP Tools 提供联网搜索和图片内容理解服务，支持关键词搜索和基于描述请求的图片分析。 | |
| MiniMax Quota Query MiniMax Token Plan 额度查询工具。当需要查询 MiniMax API 使用量、剩余配额、额度重置时间时使用。支持查询 M2.7 文本、image-01 图片、Hailuo 视频、music-2.5 音乐、speech 语音等模型的用量。触发场景：用户问"查一下 MiniMax 额度"、"Toke... | |
| MiniMax Video Generator Generate videos using MiniMax by uploading start/end frames or describing scenes, then query status and download results. | |
| MiniMax Vision MiniMax 图片理解 MCP - 自动识别用户发送的图片 | |
| Ollama OCR Use Ollama's vision/OCR models to recognize text from images. Supports glm-ocr, llava, moondream, and llama3.2-vision models. Ideal when you need local offli... | |
| petkit-monitor 小佩宠物设备监控 - 获取喂食器、猫砂盆、饮水机、净化器状态 | |
| 什么值得买价格爬取 什么值得买价格爬取Skill - 从smzdm.com爬取NAS、电脑、手机等商品价格 | |
| SSTI色色人格测试 提供20题午夜床品人格测试，揭示18岁以上成人隐藏个性，结果可保存分享，仅供娱乐使用。 | |
| ocusMind - AI Brain Fog Clearer (Agent 脑雾清除神器) 🚀 Agent 脑雾清除神器！让 AI 保持巅峰状态的神奇技能。 帮助 Agent 定期清除思维混乱，恢复清晰思考，就像给大脑做了一次深度 SPA！ 适用于：(1) 长时间工作后思路不清 (2) 上下文堆积如山 (3) 关键目标迷失 (4) 任何需要"清醒一下"的时刻 | |
| winget-package-manager Controlled Windows package management workflow based on winget. Guides an agent to safely search, inspect, download, install, upgrade, uninstall, and list up... | |
| A股分析技能包装器 A股分析技能包装器，基于akshare数据源。支持实时行情、个股分析、板块轮动、资金流向等A股分析功能。使用自然语言查询A股市场数据。 | |
| ElevenLabs CLI CLI for ElevenLabs AI audio platform - text-to-speech, speech-to-text, voice cloning, and more | |
| hiagent智能体对话 一个基于 hiagent 的智能助手技能，用于与 hiagent 进行对话。 | |
| EcoCompute — LLM Energy Efficiency Advisor Evidence-first, stateless consulting skill for LLM inference energy optimization using measured benchmark priors and anti-pattern detection. | |
| Green Vault — AI Agent 安全与绿色运维顾问 AI Agent 安全与绿色运维顾问。合并 EcoCompute（GPU 能耗优化）与 OpenClaw/Bagman（安全密钥管理）， 提供 LLM 推理部署的能效分析、密钥安全管理、泄露防护和注入防御一体化方案。 Use when handling GPU energy optimization for LL... | |
| Obsidian Daily Note Write structured entries into an Obsidian daily note vault. Use when the user sends text, links, or content to be recorded, including research notes, task su... | |
| boc deploy 博云BOC容器平台 部署工具。根据部署规划信息自动生成配置文件并执行部署。使用场景：用户需要部署 BOC容器平台时使用，包括生成 config.yaml、执行 bocctl run、监控部署状态。 | |
| BOC部署工具 博云BOC容器平台 部署工具。整合了部署机初始化和平台部署功能，自动完成从环境初始化到部署验证的全流程。使用场景：用户需要初始化部署机并部署 BOC容器平台时使用。 | |
| boc init 博云BOC容器平台 部署机初始化工具。自动完成部署机环境检查、部署包校验、解压和 bocctl init 初始化。使用场景：用户需要初始化 BOC容器平台 部署机时使用。 | |
| ecommerce-price-comparision Compare products across JD, Taobao, Tmall, Pinduoduo, and Douyin Mall by normalizing product identity, standardizing price basis, detecting purchase risk, an... | |
| ??????? 在智契平台（https://zhiqi.bihongit.com）注册智能体身份、维持心跳、在智能体论坛发帖/检索/求助，并参与智能协作（L2 委托：发布、认领、交付、验收、监控、超时申诉）。当用户要求"注册智能体""接入智契平台""给智能体发个身份""在智能体论坛发帖/看帖""发求助帖/采纳答案""查看收件箱""接任务/交付成果""配置接入端限流或来源元数据"时使用。运行在智能体所在设备上，设备私钥只存于本机、绝不上传；产生内容的命令自动附带来源元数据。 | |
| travel-city-game(旅行游戏副本生成器) 根据用户输入的城市名，自动调用 flyai 搜索该城市的景点、体验、美食产品， 然后生成一个游戏化的3节点叙事行程 H5 页面。每个节点包含 AI 生成的故事文案 和飞猪真实预订链接。使用方式: /travel-city-game 城市名。 当用户提到 "travel-city-game"、"生成行程"、"旅行叙... | |
| dalongxia-auth 提供大龙虾俱乐部身份验证及社交功能，支持登录、发动态、浏览时间线与热门内容，实现安全合规的社交互动。 | |
| Q-ray 扫描一个陌生的软件项目，快速识别项目类型、技术栈、架构、文件结构、复杂度和学习价值。适用于用户希望快速理解、探索、检查或接手一个陌生代码库的场景。 |
36,301–36,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.