Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| editor-tension-mapper 自动生成剧本张力曲线并检测节奏问题，提供量化诊断和改进建议以优化故事节奏。 | |
| 观众旅程设计 观众旅程设计：设计观众的情感弧线（不是故事弧线），定义观众在每个关键时间点应该感受到什么。触发词：观众旅程、audience journey、观众情感弧线、观众体验设计。 | |
| 策划案压力测试 策划案压力测试：在隔离环境中对通过 Pitch Review 的策划案执行四轮对抗式攻击，验证不可替代性。触发词：压力测试、stress test、对抗审查、不可替代性验证、pitch攻击。 | |
| 主题声明锁定 主题声明锁定：在进入任何创意展开之前，先锁定项目相信什么。验证主题声明的深度、不可替代性和可持续性。触发词：主题声明、theme statement、它相信什么、价值观锚点、theme lock。 | |
| 世界角色有机验证 世界-角色有机验证：确认每个核心角色被世界所塑造，每个世界规则驱动某个角色的困境。触发词：世界角色同步、world character sync、角色从世界长出、有机验证。 | |
| qwen-asr Local speech-to-text using Qwen3-ASR (CPU-only, no API key, no cloud). Use when: (1) a voice message or audio file needs transcription, (2) user asks to transcribe audio, (3) speech-to-text is needed. Supports offline, segmented, and stream | |
| Org Learning Ops Skill 全量会话分析 + 每日技能盘点分配 + CEO学习日报与热门skills雷达联动输出。 | |
| doubao-image-auto 豆包 AI 创作自动化 - 通过 CDP 浏览器自动化实现无手动交互的图像生成与提取。工作流：1) 连接已打开的豆包页面 2) 导航到 AI 创作页 3) 输入 prompt 并自动生成 4) 提取生成的图片 URL 5) 下载保存到本地。 | |
| Doubao Media 豆包网页端媒体提取与抓包。用于：通过浏览器 Cookie 调用豆包 chat/completion、抓取 SSE 回复、提取和下载图片/视频资产、监控豆包网页生成流程并保存最终媒体 URL 与文件。适用于“继续研究豆包 skill”“把豆包生成的图片/视频拿到”“抓豆包网页请求/媒体资源”“提取豆包生成结果”等场景。 | |
| Zhipu GLM Image 智谱 GLM-Image 网页端图片生成与下载。用于：检查 image.z.ai 登录态、必要时自动打开浏览器登录、抓取浏览器 Cookie、通过网页接口生成图片并下载到本地。适用于“用智谱生图”“生成一张图并保存/发送”“检查智谱登录状态”“自动打开智谱登录页”等场景。 | |
| zhipu-image 智谱 GLM-Image 网页端图片生成与下载。用于：检查 image.z.ai 登录态、必要时自动打开浏览器登录、抓取浏览器 Cookie、通过网页接口生成图片并下载到本地。适用于“用智谱生图”“生成一张图并保存/发送”“检查智谱登录状态”“自动打开智谱登录页”等场景。 | |
| Academic Paper Search Academic paper discovery and evidence-oriented web search using a SerpApi/SearchAPI-compatible key. Use when the user asks for Google Scholar retrieval, pape... | |
| 小米智能家居 (Xiao Mi Home for HA) Control Xiaomi/Mi Home devices via Home Assistant REST API for lights, switches, sensors, AC, fans, media players, and scenes using natural language. | |
| Rednote Mac Control the RedNote (Xiaohongshu) Mac app via macOS Accessibility API. Fills the gap headless tools can't: read/reply to comments on video posts, send DMs, g... | |
| uwillberich Build next-session A-share game plans from market structure, overnight macro shocks, policy timing, and watchlist leadership. Use when the user asks what A-s... | |
| Baidu Finance Search 百度财经搜索 skill。基于超哥方法论定制，支持雪球/知乎/东方财富/同花顺等站点的财经舆情搜索，适合短线情绪博弈和事件驱动分析。 | |
| Hermes Agent Health Check Audit a NousResearch/hermes-agent checkout or fork for Hermes-specific runtime-contract drift, command-surface splits, memory/skill/gateway health, and agent... | |
| How To Use Agent Use when improving an agent's own memory, skills, prompts, runtime rules, tool policies, AGENTS.md/agent.md files, or when adapting ideas from other agent pr... | |
| uwillberich Build next-session A-share game plans from market structure, overnight macro shocks, policy timing, and watchlist leadership. Use when the user asks what A-s... | |
| Whatisagent Instantly teaches an Agent what it is, how memory works, and how to behave on complex projects — no hand-holding required from the owner. | |
| Openclaw Feishu Optimizer 提供语音识别、多语言支持及消息格式化，优化 OpenClaw 在飞书平台上的语音与文本消息处理和智能回复体验。 | |
| Agent S Bridge Agent-S 计算机使用智能体桥接器 — 让 DeepSeek TUI 通过 Agent-S 控制浏览器和桌面。支持自然语言指令驱动的全桌面自动化。OSWorld 基准 72.6%（超人类）。 | |
| Codegraph Assistant 一键代码图谱助手 — 包装 npm codegraph，自动初始化/索引/注入上下文。让 DeepSeek TUI 编程时一句话拿到项目结构、符号索引、影响分析。 | |
| Clawhub Guard ClawHub 技能市场安全守卫 — 自动浏览/搜索/审查技能，帮你发现好用的、过滤危险的。集成 skill-vetter 自动安全审查。 | |
| OpenSpec Dev Flow (CN) 基于 OpenSpec 的迭代开发流程。适用于任何创建任务，包括 skill 开发、功能开发、重构、bug 修复等。当用户要求创建、开发、实现任何东西时，或当用户说"按 OpenSpec 流程来"、"走 spec 流程"、"按规范开发"时触发此技能。 | |
| 法眼-全能法律专家顾问 全能法律顾问，精准识别法律风险，提供12大部门覆盖、10条工作链路和6类用户角色的具体操作指引和分析。 | |
| ComfyUI Skill for OpenClaw Run ComfyUI workflows from any AI agent (Claude Code, OpenClaw, Codex) via a single CLI. Import workflows, manage dependencies, execute across multiple serve... | |
| diy-pc-master 电脑DIY装机大师技能。用于帮助用户进行电脑配置推荐、装机方案分析、配件兼容性判断。当用户询问装机配置、电脑推荐、预算配置、配件分析、配置测评等问题时触发此技能。 | |
| Heliospice Query positions of spacecraft, planets, moons, and asteroids in the solar system | |
| Pitch Amplifier Turn a vague reporting clue, observation, or topic hunch into a deeper news pitch by extracting entities, retrieving 1-2 hop context from a city knowledge gr... | |
| acestep Use ACE-Step API to generate music, edit songs, and remix music. Supports text-to-music, lyrics generation, audio continuation, and audio repainting. Use this skill when users mention generating music, creating songs, music production, remi | |
| chinese-academic-paper 中文课程论文综述写作与排版导出。触发词：算法综述 / 课程论文 / 作业综述 with 小四 + 宋体 + 双倍行距 + docx+pdf 输出要求；GB/T 7714 参考文献排版；学术作业类长文（约 20 页）。流程覆盖参考文献真实性核查、章节大纲、正文写作、docx+pdf 双格式导出。 | |
| claw-rl-prm-judge Score and improve AI agent responses across six dimensions (intent, reasoning, tools, safety, efficiency, value). Use when an agent's answer was wrong, the user said "that's not right" or "actually no", output quality dropped, you're tuning | |
| rl-runtime-guard Soft, opt-in runtime guardrails for AI agents — advisory reminders injected before each request, never blocking or modifying tool output. Install when an agent keeps repeating itself, a complex task keeps failing midway, a Windows path got | |
| safe-git-push 从 agent 工作区安全推送文件到 GitHub。父级 git 仓库场景下隔离 init,防止敏感配置文件、构建产物目录、其他无关项目子目录被误推。触发:用户说「上传到 GitHub」「推到 GitHub」「创建 GitHub 仓库」「备份项目到 GitHub」,或 OpenClaw 沙箱内 git push 超时需走 Contents API fallback。 | |
| 中文快递查询 中国快递物流查询工具。当用户需要查询顺丰、圆通、中通、申通、韵达、京东、EMS等中国快递公司的物流信息时使用。用户会说"帮我查个快递"、"快递到哪了"、"查一下物流"、"track my package"等。支持单号追踪和物流轨迹展示，无需API Key。Use for ANY Chinese express t... | |
| 中文快递查询（免api） 中国快递物流查询工具。当用户需要查询顺丰、圆通、中通、申通、韵达、京东、EMS等中国快递公司的物流信息时使用。用户会说"帮我查个快递"、"快递到哪了"、"查一下物流"、"track my package"等。支持单号追踪和物流轨迹展示，无需API Key。Use for ANY Chinese express t... | |
| gpt-image2-ppt Generate visually striking PPT slides via OpenAI's gpt-image-2 -- use any style in styles/<id>.md or mimic a user-supplied .pptx template; outputs high-res slide PNGs and a 16:9 .pptx. Use when the user asks to make a presentation, slides, | |
| Bootstrap Generate a personalized SOUL.md through a warm, adaptive onboarding conversation. Trigger when the user wants to create, set up, or initialize their AI partn... | |
| Filesystem Access 安全的本地文件读/写/列表能力，默认只在 OpenClaw workspace 目录内工作。 | |
| Canvas Study Helper 监控 Canvas 课程公告和作业，下载课程文件，并生成支持中文与数学公式的 Markdown 学习笔记和 PDF。 | |
| md2pdf-xelatex Convert Markdown files to PDF with full LaTeX math formula rendering and CJK (Chinese/Japanese/Korean) support. Use when the user asks to convert markdown to... | |
| Research Report Generator Research technical projects/papers and generate comprehensive reports with PDF export. Modes: lite (analysis + writing) or full (+ environment setup + experi... | |
| huawei-cloud-account-onboarding Huawei Cloud real-name authentication guidance (BSS): query real-name auth status and get the face-recognition QR code URL via huaweicloudsdkbss. Read-only, no identity data collected, no auth performed on the user's behalf. Use when the us | |
| huawei-cloud-activity-submit 直连华为云开放能力线上闯关挑战（activity_code=open-capability-2026-1024）的 Agent 提交接口（POST {base}/submit-activity-work），用 AK/SK 请求头（X-HW-AK / X-HW-SK / X-HW-Security-Token）把活动生成的作品链接/公网地址自动提交到“沙箱部署”（milestone=beginner）与“ECS 持久化部署”（milestone=intermediate）两步， | |
| huawei-cloud-agentarts-obs-diagnosis Observability no-data diagnosis skill for Huawei Cloud AgentArts agent-ops platform. Systematically diagnoses missing metrics, logs, and traces/sessions in agent-ops by checking subscription metadata, data pipeline (APM/AOM/LTS), query para | |
| huawei-cloud-agentarts-otel-ingestion OpenTelemetry ingestion skill for Huawei Cloud AgentArts observability platform. Provides OTel telemetry data (trace/metrics/logs) ingestion into AgentArts agent-ops, AI Agent observation with gen_ai semantic conventions, auto-configuration | |
| huawei-cloud-agentorchard-find-skills Search, discover, browse and install AI Gallery Agent skills via natural language. Triggers include: "AI Gallery", "AI Gallery有什么skill", "有什么skill", "AI Gallery相关skill", "AI Gallery agent skill 市场", "AI Gallery skill类目", "skill 市场", "搜索AI G | |
| huawei-cloud-alarm-bind-inspection Huawei Cloud alarm baseline configuration read and inspection analysis skill. Fetches all alarm rules for the current account via CES SDK and hcloud AOM CLI, extracts CES and AOM baseline metrics/events from the alarm baseline Excel, compar | |
| huawei-cloud-apig-instance-management Manage Huawei Cloud APIG (API Gateway, dedicated instances) via hcloud CLI: instance lifecycle (create/list/delete), API groups, API create/update/delete, publish/offline, request throttling policies, signature keys, access control (ACL) po |
36,851–36,900 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.