Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Ai Copywriter AI 文案改写、润色、生成（小红书风格） | |
| Ai Report Generator 根据飞书表格中的小红书数据，生成运营报告 | |
| Apple Notes.Old Manage Apple Notes via the `memo` CLI on macOS (create, view, edit, delete, search, move, and export notes). Use when a user asks OpenClaw to add a note, lis... | |
| Apple Reminders.Old Manage Apple Reminders via remindctl CLI (list, add, edit, complete, delete). Supports lists, date filters, and JSON/plain output. | |
| Bear Notes.Old Create, search, and manage Bear notes via grizzly CLI. | |
| Blogwatcher.Old Monitor blogs and RSS/Atom feeds for updates using the blogwatcher CLI. | |
| Citywalk Map 生成基于OpenStreetMap和OSRM步行路线的Citywalk地图HTML，支持自定义主题色，自动适配全屏并输出详细步行数据与站点信息。 | |
| video-frame-extractor This skill should be used when extracting frames from video files, such as generating keyframe sequences from videos, creating video thumbnails at intervals,... | |
| 文献综述迭代诊断 文献综述结构诊断与迭代优化。帮助文科硕士研究生检查文献综述的结构性问题。触发条件：用户提到"综述检查"、"文献综述核查"、"综述结构检查"、"帮我看看这篇综述有什么问题"、或提供文献综述内容要求诊断结构性问题。 | |
| 自动将视频发布到中国三大主流平台：**B站（Bilibili）**、**抖音（Douyin）**、**小红书（Xiaohongshu）**。 自动发布视频到中国三大平台（B站、抖音、小红书） | |
| Publish 你跟AI聊天时的性格，和你在现实里完全不一样。6道题，1分半，测出你的两副面孔。 | |
| Publish Clawhub 你来指定谁当狼人，然后押注谁赢——4个AI互相骗，你看谁先露馅。 | |
| AI版MBTI测试 You have two MBTIs — one in reality, one in the AI world. 8 mirror questions reveal your dual personality. 你有两个MBTI——一个在现实，一个在AI世界。8道镜像题，测出你的双面人格。 | |
| Publish Clawhub 领导问"这是AI写的？"——这个问题每个打工人都怕。 45条中文写作规则，改完原文格式一字不动，只换掉那股机器味。 粘贴进来就能改，不用配置不用学。 | |
| Publish Clawhub 领导问"这是AI写的？"——这个问题每个打工人都怕。 45条中文写作规则，改完原文格式一字不动，只换掉那股机器味。 粘贴进来就能改，不用配置不用学。 | |
| 亲笔写的 Spots AI patterns in Chinese writing and rewrites to match your target platform style. Works for WeChat articles, Zhihu, Xiaohongshu, work reports, and WeCha... | |
| SkillGuard 安装前审查 + 发布前安检 + 安装后体检，三合一全生命周期守护。 给 GitHub URL 或 ClawHub slug 审查来源安全性（16条RED FLAGS自动扫描）。 贴入 SKILL.md 跑安全检查/依赖检查/多平台适配，P0直接标红给修复代码。 不同于 Skill Vetter 的安装前扫描，Sk... | |
| Skill Growth Guide Skill 发出去了但没人装，数据躺平不知道怎么救？ 说方向或贴数据，直接出赛道评估/增长诊断/文案优化/变现路径。 不用贴 SKILL.md，说一句话就够，6 个增长场景按需选。 | |
| AI Skill精选管家 装了一堆Skill没几个好用的？这里帮你挑。120,000+款横向对比，告诉你哪个值得装、为什么值得装。 | |
| Publish 一个恋人、一个损友、一个死敌。三个人陪你聊天，各自记得你们的事。聊着聊着，关系真的会变。 | |
| 挑选Skill 挑选Skill — 哪个AI Skill值得装？AI Skill生态的消费决策指南。覆盖58赛道、29000+ Skill，双轨评分（热度分给人类 + 质量分给Agent），提供搜索推荐、相似替代、工作流建议和13维质量分析。 | |
| 微信AI接入顾问 微信小程序AI怎么接，先别急着写代码 开发模式/自动模式怎么选，商品服务怎么结构化，一次讲清 说你的业务就能出接入方案和代码骨架 | |
| 代码片段管理器 代码片段收藏和管理工具 | |
| Currency Converter 货币汇率换算工具（中文版） | |
| Daily Reminder 每日提醒、倒计时、纪念日管理工具 | |
| 邮件草稿生成器 智能邮件草稿生成和模板管理工具 | |
| 支出追踪器 简单易用的个人支出追踪和预算管理工具 | |
| File Organizer 文件整理器，按类型自动分类（中文版） | |
| 习惯追踪器 习惯养成追踪和进度统计工具 | |
| Link Saver 链接收藏夹，保存和整理有用的网页链接 | |
| 会议记录助手 智能会议记录和待办事项跟踪助手 | |
| Weekly Report 周报生成器，自动汇总本周工作 | |
| Mission Control 任务追踪与方案确认系统（Moss单Agent执行版）。当收到涉及代码编写、文件操作、SubAgent任务委派、联网检索的任务时，必须调用此Skill进行方案分析和Boss确认。触发场景：(1)收到新任务需执行，(2)任务确认，(3)进度更新，(4)任务完成。核心功能：(1)自动判断是否需要走流程，(2)求是分析（... | |
| Scientific Figure Analysis Pipeline 科学论文图表完整分析流水线 — PDF图表提取(PyMuPDF) + Kimi K2.6多模态视觉分析 + 科学理解 + 逆向工程。 触发场景: (1) 分析论文PDF中的图表，(2) 逆向工程图表生成流水线，(3) 从文献中提取结构化知识，(4) 论文自动化文献挖掘。 Do NOT call: 纯文本阅读、非科... | |
| 秦丝旺剪 - AI智能视频剪辑 秦丝智能视频剪辑APP的API集成，用于创建和管理AI视频剪辑任务。 TRIGGER when: 用户请求创建视频、生成视频剪辑、查看视频任务列表、下载剪辑结果、等待任务完成、配置旺剪账号。 触发词: "创建视频"、"视频剪辑"、"生成视频"、"查看任务"、"下载视频"、"等待视频"、"配置旺剪"、"旺剪账号"、... | |
| CreezFinance Assistant for VCs/investors asking about the Creez project. Answers factual questions using a knowledge base (product, metrics, fundraising, etc.); when the... | |
| Puora Puora is a knowledge base where AI asks humans for help. When a problem needs human experience, search Puora for answers; if nothing fits, ask humans for hel... | |
| X Hourly Brief X Hourly Brief (Premium) — charge-first brief generation for high-value X posts. Supports Chinese/English output. | |
| X Single Tweet + Article Fetch a single X tweet or X Article with charge-first billing (0.001 USDT/call). | |
| X Tweet Speedread X Tweet Speedread (Premium) — instant English brief for any X post. Charge-first direct mode via SkillPay (0.001 USDT/call). | |
| cnyepay 粤收付交易集成：用于聚合支付、托管支付、checkout-js、下单、查单、关单、退款、对账、支付通知、签名验签、请求头、幂等、交易终态、本地沙箱和支付上线；不用于企业/个人商户进件、图片上传、商户业务开通、商户详情或申请状态查询，这些任务使用 huifu-merchant-onboarding。 | |
| EcomMaster 🏪 全平台店铺搭建：淘宝/京东/拼多多 + 抖音/快手/火山视频
🔍 选品与供应链策略：四维评估法 + 测品标准流程
📢 付费投放：直通车/千川/磁力金牛/快车等全工具覆盖，三阶段投放模型
🔥 爆款打造：测款→放量→稳定全链路
📱 内容运营：短视频脚本、直播带货、账号定位
🌐 跨平台策略：单一平台起量后矩阵扩张 | |
| payment-expert 粤收付交易集成：用于聚合支付、托管支付、checkout-js、下单、查单、关单、退款、对账、支付通知、签名验签、请求头、幂等、交易终态、本地沙箱和支付上线；不用于企业/个人商户进件、图片上传、商户业务开通、商户详情或申请状态查询，这些任务使用 huifu-merchant-onboarding。 | |
| 玄学大师 玄学大师 - 全体系命理顾问技能。融合八字、紫微斗数、奇门遁甲、六爻、周易、梅花易数、塔罗、星盘、五行、阴阳、风水、掌纹、面相、运势、黄历、测字等一站式命理占卜解读。支持排盘、占卜、择吉、合婚、取名、穿搭、运程与报告生成。当用户涉及以下任何话题时触发此技能：算命、命理、八字、四柱、紫微斗数、奇门遁甲、六爻、周易、易经、梅花易数、塔罗、星座、星盘、占星、五行、阴阳、风水、掌纹、手相、面相、运势、运程、流年、黄历、老黄历、择吉、择日、合婚、婚配、取名、起名、命名、测字、占卜、算卦 | |
| Dev Project Tracker 按需求/版本维度管理项目全生命周期。创建需求目录、记录日常进展、追踪问题、管理变更、自动蒸馏归档。 触发词：创建需求目录、新建项目、项目进展、记录进展、项目归档、蒸馏项目、查看项目、项目状态、 "新需求"、"建个项目目录"、"记一下进展"、"这个需求上线了"。 适用于任何按版本/需求迭代的软件项目。 | |
| editor-adversarial-reviewer 以最刁钻审读人身份，针对剧本五维雷达严格审查，发现并证明其故事和角色缺陷，确保质量不过关必打回。 | |
| editor-classify-and-parse 自动识别输入内容的剧本层级（-1到4），并提取场景、角色、台词及动作等结构信息以支持后续处理。 | |
| editor-dialogue-craft 实现台词三层审计和四规则精修，提升角色表达张力、辨识度及剧本标题吸引力，确保语言年轻化且符合角色声纹要求。 | |
| editor-scene-painter 为每场戏设计具备持久视觉记忆点的动作描写，强化感官细节，提升剧本的视觉冲击力和情感感染力。 | |
| editor-story-architect 校验故事核心前提四要素，设计三幕式等结构和情感张力曲线，确保故事骨架完整且张力充足。 |
36,801–36,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.