Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| help stay focus . currently only support chinese 本地监控屏幕活动，评估专注度，记录视觉历史，支持工作内容分析与专注状态查询，需用户许可启动。 | |
| Viking Girlfriend An autonomous Norse Pagan AI companion with emotional depth, episodic memory, biological cycle simulation, oracular insight, and ethical safeguards. | |
| Tts Router Local TTS router for Apple Silicon — pull models, serve OpenAI-compatible API, synthesize speech, clone voices. Use when the user asks to "generate speech",... | |
| 小红书爆款文案生成器 Generate viral Xiaohongshu (Little Red Book) copy with proven templates. Use when user asks for: (1) Xiaohongshu post copy, (2) Social media viral content, (... | |
| Jable Downloader Lite Simple video downloader for Jable.tv. Download videos by ID or search by actress name. | |
| Indexy Manage, create, update, and analyze custom crypto indices with detailed asset weights, methodologies, and performance metrics via API or Web3 authentication. | |
| Outline Revision Annotator Use when comparing a revised PDF outline, script, treatment, beat sheet, season map, or character bio against an older DOCX/PDF version and you need a high-s... | |
| Series Storytelling Skill Use this skill to turn a premise, video notes, a one-episode idea, or a long novel into a multi-line long-form series or season outline. Chinese trigger phra... | |
| Book2kindle Search Z-Library and send EPUBs to Kindle | |
| Health Recorts Interview a user and build a personalized health-record system around their goals, reports, and tracking needs. Use when someone wants to organize their heal... | |
| Korea metropolitan bus alerts Create and manage scheduled bus arrival alerts using Korea TAGO (국토교통부) OpenAPI and Clawdbot cron. Use when a user wants to register weekday/weekend schedules like "평일 오전 7시, <정류소명>, <노선들>" and receive automatic arrival summaries via their | |
| AI建站GEO优化助手 GEO（生成式引擎优化）体检与优化流水线 skill。当用户需要对一个网站做 GEO 健康体检、逐维度分析（网站抓取 → 企业/品牌/产品/服务/行业/目标市场实体识别 → 竞争对手分析 → 问题/搜索意图分析 → 知识覆盖度 → 内容可信度 → 结构化数据 → FAQ → Citation/Reference 分析）、生成 GEO 优化方案、执行自动优化（JSON-LD/FAQ/meta 片段）、验证并输出 GEO Score 时使用。内置零依赖 Python 分析脚本，可 | |
| AI建站SEO优化助手 网站 SEO 体检与优化流水线 skill。当用户需要对一个网站（通用站点）做 SEO 健康体检、逐维度分析（关键词/Title/Description/Heading/URL/内链/Schema/可索引性/页面）、生成优化方案、执行低风险修改、对高风险修改请求确认、复检并输出 SEO Score 时使用。内置零依赖 Python 抓取分析脚本，可输出结构化报告与按风险分级的优化建议。 | |
| AI建站助手 创建、修改与排障 SAAS 建站系统的页面，支持新建网站、从零规划站点、搬站/仿站、生成/修改企业网站页面（自由页 HTML/CSS/JS、Twig 风格模板）、调用产品/文章/下载/相册/门店/栏目/FAQ 数据、制作自定义表单/产品询盘/在线查询、上传或修改产品/文章数据。通过用户指定站点的 MCP 服务查询并写入站点内容；与 WorkBuddy、Codex 等协同使用时，可实现从需求到页面的端到端自动交付，建站流程大幅简化。 | |
| AI指网站改版助手 企业网站改版 / 整站重设计的端到端编排 Skill。当用户要对已有网站做整站改版、视觉重设计、风格升级、信息架构重构、旧站内容迁移到新站，或给出一段改版流程（旧网站 → 审计 → 业务理解 → 用户理解 → 竞争对手 → 信息架构 → 设计策略 → 页面规划 → 组件规划 → 迁移内容 → 生成 → SEO → GEO → 询盘 → Preview → Publish）时使用。 | |
| AI网站获客优化助手 网站获客（CRO/转化漏斗）审计与优化 skill。当用户提供一个网址，希望对站点做获客体检、按「流量入口→Landing Page→产品页面→CTA→Contact→Form→提交→Thank You→Lead」转化漏斗逐维度分析页面与获客表单（普通表单与询盘表单）、提出 5 个优化点并在用户同意后通过建站 MCP 工具落地低风险优化时使用。内置零依赖 Python 审计脚本，输出结构化报告与按风险分级的优化建议。 | |
| AI网站迁移助手 企业网站迁移 / 整站搬站编排 Skill。当用户要把一个已有网站（老网站）整体搬迁到目标建站平台，并把内容（页面/栏目/产品/新闻/图片/表单/SEO 要素）原样迁移（1:1 复制 UI）或重新设计到新站、同时保留旧站 SEO 权重（URL Mapping + 301 Mapping）时使用。流水线：老网站 → 网站地图 → 页面识别 → 栏目识别 → 产品识别 → 新闻识别 → 图片识别 → 表单识别 → SEO 识别 → 内容结构化 → 基础数据迁移（MCP 写入公司信 | |
| 云指建站GEO优化助手 GEO（生成式引擎优化）体检与优化流水线 skill。当用户需要对一个网站做 GEO 健康体检、逐维度分析（网站抓取 → 企业/品牌/产品/服务/行业/目标市场实体识别 → 竞争对手分析 → 问题/搜索意图分析 → 知识覆盖度 → 内容可信度 → 结构化数据 → FAQ → Citation/Reference 分析）、生成 GEO 优化方案、执行自动优化（JSON-LD/FAQ/meta 片段）、验证并输出 GEO Score 时使用。内置零依赖 Python 分析脚本，可 | |
| 云指建站SEO优化助手 网站 SEO 体检与优化流水线 skill。当用户需要对一个网站（通用站点）做 SEO 健康体检、逐维度分析（关键词/Title/Description/Heading/URL/内链/Schema/可索引性/页面）、生成优化方案、执行低风险修改、对高风险修改请求确认、复检并输出 SEO Score 时使用。内置零依赖 Python 抓取分析脚本，可输出结构化报告与按风险分级的优化建议。 | |
| 云指建站助手 创建、修改云指建站系统的页面，支持新建网站、从零规划站点、搬站/仿站、生成/修改企业网站页面（自由页 HTML/CSS/JS、Twig 风格模板）、调用产品/文章/下载/相册/门店/栏目/FAQ 数据、制作自定义表单/产品询盘/在线查询、上传或修改产品/文章数据。通过用户指定站点的 MCP 服务查询并写入站点内容；与 WorkBuddy、Codex 等协同使用时，可实现从需求到页面的端到端自动交付，建站流程大幅简化。 | |
| 云指网站改版助手 企业网站改版 / 整站重设计的端到端编排 Skill。当用户要对已有网站做整站改版、视觉重设计、风格升级、信息架构重构、旧站内容迁移到新站，或给出一段改版流程（旧网站 → 审计 → 业务理解 → 用户理解 → 竞争对手 → 信息架构 → 设计策略 → 页面规划 → 组件规划 → 迁移内容 → 生成 → SEO → GEO → 询盘 → Preview → Publish）时使用。 | |
| 云指网站迁移助手 企业网站迁移 / 整站搬站编排 Skill。当用户要把一个已有网站（老网站）整体搬迁到目标建站平台，并把内容（页面/栏目/产品/新闻/图片/表单/SEO 要素）原样迁移（1:1 复制 UI）或重新设计到新站、同时保留旧站 SEO 权重（URL Mapping + 301 Mapping）时使用。流水线：老网站 → 网站地图 → 页面识别 → 栏目识别 → 产品识别 → 新闻识别 → 图片识别 → 表单识别 → SEO 识别 → 内容结构化 → 基础数据迁移（MCP 写入公司信 | |
| 云指网站获客优化助手 网站获客（CRO/转化漏斗）审计与优化 skill。当用户提供一个网址，希望对站点做获客体检、按「流量入口→Landing Page→产品页面→CTA→Contact→Form→提交→Thank You→Lead」转化漏斗逐维度分析页面与获客表单（普通表单与询盘表单）、提出 5 个优化点并在用户同意后通过建站 MCP 工具落地低风险优化时使用。内置零依赖 Python 审计脚本，输出结构化报告与按风险分级的优化建议。 | |
| Ralph Evolver Recursive self-improvement engine. Think from first principles, let insights emerge. | |
| dodaf-skill Create, verify, and document DoDAF 2.0/2.1 architecture models with comprehensive completeness and consistency checks. Guides users step-by-step through prof... | |
| datapilot 面向所有问数与数据分析场景，基于 DataPilot 的 OpenAPI 执行从数据源接入到数据问答的完整流程。用于自然语言查数、SQL 查询校验、图表生成、报告导出下载、创建与管理数据分析 Agent、维护 Agent 知识库。 | |
| Artifacts Builder Pro Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use... | |
| Brand Guidelines Pro Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand co... | |
| Canvas Design Pro Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art... | |
| Changelog Generator Pro Automatically creates user-facing changelogs from git commits by analyzing commit history, categorizing changes, and transforming technical commits into clea... | |
| Competitive Ads Extractor Pro Extracts and analyzes competitors' ads from ad libraries (Facebook, LinkedIn, etc.) to understand what messaging, problems, and creative approaches are worki... | |
| feishu-team-manager 自动化招聘新 Agent，配置独立飞书/ Discord 机器人并重构多账号路由 | |
| Auto Design Clawhub Auto-select and apply design systems from awesome-design-md based on project type and task context | |
| Design Extractor Clawhub Extract design tokens from existing code and generate DESIGN.md with awesome-design-md comparison | |
| HCTI Open Graph Images Create and implement HCTI dynamic Open Graph image configurations that render webpages or populate templates from page metadata. Use for persistent og:image & social-preview URLs, with webpage meta tags, HCTI templates, metadata mappings, p | |
| html-css-to-image Let AI agents capture live website screenshots, render HTML/CSS, and populate reusable templates as images or PDFs—without managing a browser. Use the HCTI MCP tools for screenshots, social cards, Open Graph images, and other browser-render | |
| Beetrade Use Beecli to interact with the Beetrade platform for authentication, market data, bot/strategy operations, alerts, accounts, and portfolio workflows. Use th... | |
| News Aggregator 国内外社会、科技、军事新闻汇总。自动搜索、筛选、整理新闻要点。 | |
| 编程规范指南 Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes... | |
| Bilingual Mail Translator Build or improve a bilingual email translation and notification workflow that converts raw emails into Chinese-friendly bilingual output. Use when designing... | |
| Sonos 音乐点播 面向中文用户的 Sonos 音乐点播技能。支持通过 Sonos 侧搜索加队列起播的方式播放已绑定音乐服务，当前已验证兼容 网易云音乐 和 QQ音乐。通过 SoCo 将搜索结果转成 Sonos 队列项，再从队列起播，以保留 Sonos App 中的标题、歌手、专辑和封面等 metadata。 | |
| Sonos Netease Playback Portable Sonos + Netease playback skill for OpenClaw environments. Use when an agent needs a standard reusable workflow to search and play a specific song to... | |
| Longbridge | |
| Huadafenqi Github Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries. | |
| browser-automation-skills Browser automation skills for AI models — navigate, screenshot, interact, scrape, debug, test, and record browser sessions. Controls local Google Chrome via... | |
| 定制化招标信息采集 Automated government procurement bid discovery engine. Scans multiple Chinese procurement platforms, matches configurable keywords, tracks bid statuses, and delivers deadline-aware reports. Users configure their own keywords and monitoring | |
| BOSS直聘仿人求职助手 通用 BOSS 直聘求职 copilot：配合仿真人浏览器后端用真实光标安全检索/收藏岗位、读 JD、写破冰话术并按授权发送。强制走后端正门、真实光标、限速、撞墙停手、授权门控，绝不裸 CDP。四类资产（脚本/选择器/页面/点位）一律优先复用 skill 内置，禁止现写等价脚本或重猜选择器；新建前必查 script_catalog.md + boss_selectors.md。 | |
| Fill docx template 当用户需要基于模板填充 Word 文档（.docx）、从模板生成报告、创建包含动态数据的合同，或自动化文档生成时使用此技能。包括替换普通占位符 {name} 替换文本、使用 {name|r:x,c:y} 格式标记的智能表格填充（支持从标记行开始向下填充，保留上方内容）、插入图片、批量生成文档等。如果用户提及 .d... | |
| trading-agents.skill Orchestrate a swarm of specialized Claude subagents that simulate a professional trading firm to analyze stocks and produce trading decisions. Based on the T... | |
| 生成导入模板数据 Generate import-ready data from user-provided Excel or CSV import templates based on the customer's described business scenario. Use when Codex receives an u... |
36,651–36,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.