Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| huawei-cloud-cost-estimation Generates Huawei Cloud pre-order estimates, provisions allowlisted resources through hcloud, and routes unsubscribe requests to console guidance. Use for Huawei Cloud pricing, budgets, creation, provisioning, or unsubscribe. Creates require | |
| huawei-cloud-cts-trace-management Huawei Cloud CTS (Cloud Trace Service / 云审计服务) management and audit analysis via the hcloud CLI. Covers tracker lifecycle (list/create/delete), audit trace query and analysis (filter by time/user/service), cloud service operation listing, k | |
| huawei-cloud-dataarts-datasync-planner Huawei Cloud data sync pipeline planning. Identifies existing pipelines, distinguishes real-time/offline, matches DataArts Studio/DRS/DLI-Flink/DIS products, outputs selection plan and multi-sheet Excel report. Automatically classifies inte | |
| huawei-cloud-dcs-failover Huawei Cloud DCS master-slave failover (AZ power-off) drill tool. One-click pipeline: prepare (checks + risk assessment) -> execute (failover) -> report. Queries DCS master-slave instance, checks IAM permissions, architecture hard-gate (ha | |
| huawei-cloud-dds-dcs-instance-management Huawei Cloud DDS (Document Database Service) and DCS (Distributed Cache Service) unified management skill. Provides 16 operations across five capability domains: (1) Query — list/get DDS/DCS instances, DCS node info, DCS custom templates; ( | |
| huawei-cloud-deployment-task-management Huawei Cloud CloudDeploy (CodeArts Deploy / 部署) management, execution, and failure analysis using the KooCLI hcloud command-line client. Covers deploy application listing and creation, deployment task listing/detail/creation, task start, ta | |
| huawei-cloud-devbridge-tunnel Create and manage DevBridge development tunnels on Huawei Cloud to securely expose local development services to remote devices. Based on DevBridge CLI v0.2.x and API Key authentication. Use this skill when the user wants to: (1) install an | |
| huawei-cloud-devkit-application-check-cli Use Kunpeng DevKit CLI to collect installed software information (packages, middleware, databases) from application systems, analyze Maven POM file dependency compatibility, and generate migration assessment reports.Automatically creates a | |
| huawei-cloud-devkit-webui-create Install Kunpeng DevKit in WebUI mode on Huawei Cloud. Create a Kunpeng (aarch64) ECS via Python SDK with random password, encrypt password via Python KMS SDK, use hcloud CLI for EIP/VPC operations, use Python paramiko SSH (password in proce | |
| huawei-cloud-dew-key-management Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secret lifecycle management, KMS (Key Management Service) for encryption key man | |
| huawei-cloud-dli-manage Manages Huawei Cloud DLI (Data Lake Insight) full lifecycle operations: compute queue management (create/scale/plan/delete), batch jobs (SQL/Spark submit, cancel, status, logs, result export), Flink stream jobs (submit, start/stop, batch de | |
| huawei-cloud-doris-sql-check Comprehensive SQL statement checking for Apache Doris (based on Doris 3.1.4 Nereids ANTLR4 grammar), supporting two check modes: 1. Syntax Check - Keyword validation, statement structure verification, clause completeness, Doris-specific syn | |
| huawei-cloud-dws-cpu-diag DWS cluster CPU high root cause diagnosis skill, based on KooCLI v3.2.0+ and DWS Autopilot MCP Server. Automatically collects CPU metrics, analyzes root causes (customer-side / system-side), and outputs a standardized diagnosis report. Appl | |
| huawei-cloud-dws-dymem-diag DWS cluster memory high root cause diagnosis skill, based on KooCLI v3.2.0+ and DWS Autopilot MCP Server. Automatically collects memory metrics, analyzes root causes (customer-side / system-side), and outputs a standardized diagnosis report | |
| huawei-cloud-dws-io-diag DWS cluster I/O overload root cause diagnosis skill, based on KooCLI v3.2.0+ and DWS Autopilot MCP Server. Automatically collects I/O metrics, analyzes root causes (customer-side / system-side) via three-stage decision tree, and outputs a s | |
| huawei-cloud-dws-migration-teradata-to-dws Teradata 到华为云 DWS（数据仓库服务）的全流程迁移 skill。严格遵循源端 Teradata 只读、 Teradata→DWS 数据类型映射、先迁移表结构(DDL)后迁移数据(DML)、OBS 临时目录导出、 COPY 命令批量导入等核心规则。包含迁移前预检(pre_migration_check)、表结构迁移(migrate_schema)、 PPI 分区表转换(ppi_converter)、视图/宏/存储过程迁移(migrate_views_procs)、 | |
| huawei-cloud-dws-spec-planner Huawei Cloud DWS data warehouse configuration planning and sizing. Supports coupled/decoupled architecture, outputs minimum-spec plan and multi-sheet Excel report. Automatically calculates CPU cores, storage capacity, and generates structur | |
| huawei-cloud-dws-sql-check Comprehensive SQL statement checking for DWS, supporting two check modes: 1. Syntax Check - Keyword validation, statement structure verification, clause completeness, DWS syntax compatibility based on gram.y grammar definitions 2. Specifica | |
| huawei-cloud-ecs-alert Automate batch creation and management of Huawei Cloud CES alarm rules for ECS instances using hcloud CLI v7.2.2+. Use this skill to: (1) batch create alarms with templates (web/database), (2) update SMN notifications, (3) query ECS metrics | |
| huawei-cloud-ecs-dsh-deploy Huawei Cloud Flexus X Instance Deployment - DeepSeek Harness (dsh). ⚠️ Deployment involves actual charges, must confirm region/flavor/billing mode with user before execution. Triggers include: "部署DeepSeek Harness", "部署dsh", "部署DeepSeek智能体", | |
| huawei-cloud-ecs-lifecycle Manage the full lifecycle of Huawei Cloud ECS (Elastic Cloud Server) instances — create, list, show details, start, stop, reboot, rename, and delete cloud servers — plus basic ECS knowledge Q&A. Covers CRUD plus power-state orchestration (s | |
| huawei-cloud-ecs-manage Use when managing Huawei Cloud ECS (Elastic Cloud Server / 弹性云服务器) instances — lifecycle management (create / start / stop / restart / delete), instance querying, quota/flavor/image inspection, and multi-step root-cause diagnosis of ECS ins | |
| huawei-cloud-ecs-passwordless-login Configure passwordless SSH login to Huawei Cloud ECS instances using COC (Cloud Operations Center). Automates IAM agency authorization, SSH key pair generation, COC script deployment to one or many target ECS instances (batch), SSH connecti | |
| huawei-cloud-ecs-query 查询华为云ECS弹性云服务器信息。仅用于查询，不包含创建/删除/规格变更等写操作。当用户需要查看华为云ECS实例列表、实例详情、实例状态时使用。支持AK/SK和Token两种认证方式，支持表格和JSON两种输出格式，支持多区域查询。触发条件：用户要求"查询云服务器列表"、"查看ECS实例详情"、"ECS运行状态"、"列出ECS"、"查看服务器状态"，或请求中带 update/修改/创建/删除 ECS 以外的只读查询意图时（如查 flavor、可用区、镜像等 ECS 属性）使用 | |
| huawei-cloud-ecs-shutdown-experiment Full lifecycle ECS shutdown fault injection experiment for Huawei Cloud chaos engineering: prepare → execute → analyze. Phase 1 discovers target ECS instances, validates compatibility, generates experiment configuration. Phase 2 executes Ba | |
| huawei-cloud-ecs-sqlbot-deploy Purchase Huawei Cloud X Instance server + one-click deploy SQLBot intelligent query application. Tech stack: Python 3.8+, Huawei Cloud SDK, COC (Cloud Operations Center) deployment. Key capabilities: AK/SK auth, X instance creation, auto se | |
| huawei-cloud-ecs-vulnerability-auditor Audit Huawei Cloud ECS instances for security vulnerabilities across host OS packages, running services, application dependencies (Java, Python, Node.js, PHP, Go), and container environments (Docker, containerd, Podman). Collects asset inve | |
| huawei-cloud-eip-cost-optimizer Huawei Cloud EIP (Elastic IP) cost optimization skill using hcloud CLI (KooCLI). 1. List and query EIPs across regions with detailed status 2. Identify idle/unbound EIPs and generate cost optimization reports 3. Set up idle EIP monitoring w | |
| huawei-cloud-evs-disk-create Skill specialized for creating EVS disks on Huawei Cloud. Use this skill when users need to create cloud disks (EVS), set disk types, configure disk size, select availability zones, or need guidance on the disk creation process. Trigger con | |
| huawei-cloud-find-skills Invoke this skill to search, list, query, discover, browse, find and install any Huawei Cloud (华为云) agent skill. Triggers include: "华为云", "华为云有什么skill", "华为云相关skill", "华为云agent skill 市场", "华为云skill类目", "explore Huawei Cloud skills", "show H | |
| huawei-cloud-flexus-l-deploy-jiuwenswarm One-click deployment of JiuwenSwarm multi-Agent collaboration platform on Huawei Cloud Flexus L instances. Usage scenarios: When users need to quickly deploy JiuwenSwarm/JiuwenClaw on Huawei Cloud Flexus L instances, when they need to autom | |
| huawei-cloud-flexus-l-server-flexusagent-deployment Deploy AI Agent development platform (Dify) on Huawei Cloud Flexus L instance, providing deployment operations, password management, MaaS model configuration, and workflow import capabilities. Trigger keywords: deploy flexusagent/一键部署Flexus | |
| huawei-cloud-flexus-l-server-hermes-deployment One-click deployment tool for Hermes on Huawei Cloud Flexus L instances. Supports one-click deployment, ModelArts large model configuration, and robot channel configuration. Use this skill when the user mentions "Deploy Hermes", "Install He | |
| huawei-cloud-flexus-l-server-manage Manages Huawei Cloud Flexus L server lifecycle: create, renew, and unsubscribe instances. Use this skill when the user mentions "Flexus L", "Huawei Cloud lightweight server", "purchase server", "renew", "unsubscribe". (中文触发词："购买/创建L实例", "L实 | |
| huawei-cloud-flexus-l-server-openclaw-deployment Create Huawei Cloud Flexus L Instance (Lightweight Server), deploy OpenClaw application platform on it, and support installation and configuration of models and channels for deployed OpenClaw instances. Web UI access needs to be manually en | |
| huawei-cloud-flexus-l-server-ops Based on Huawei Cloud Flexus L API for instance management and operations. Supports querying instance list and details, querying traffic packages, batch start/stop/reboot instances, resetting passwords, and modifying instance information. S | |
| huawei-cloud-flexus-l-server-scripts-excute Based on Huawei Cloud COC (Cloud Operations Center) APIs for script management and remote execution. Supports creating custom scripts (Shell, Python, Bat) and batch execution on target host instances via UniAgent. Applicable to cloud operat | |
| huawei-cloud-functiongraph-function-create Create and invoke FunctionGraph functions on Huawei Cloud. Supports VPC configuration, environment variables, synchronous and asynchronous function invocation. Use this skill when users ask to create, deploy, upload, or invoke cloud functio | |
| huawei-cloud-functiongraph-trigger-create Create and configure scheduled TIMER triggers for Huawei Cloud FunctionGraph functions using Quartz Cron expressions. Use this skill when users ask to create triggers, schedule function execution, set up periodic tasks, or configure timers | |
| huawei-cloud-gaussdb-instance-management Huawei Cloud GaussDB distributed database (GaussDB for MySQL 兼容版 and GaussDB for openGauss 分布式版) management and diagnosis skill. Provides 12 huawei_* actions across three capability tiers: (1) Query (R3, read-only auto-execute) — list/get i | |
| huawei-cloud-ges-graph Provides access guide for Huawei Cloud Graph Database GES service. Covers Cypher queries, GQL queries, schema/label management, summary info queries, graph data editing and more. Use this skill when users want to operate Huawei Cloud graph | |
| huawei-cloud-hss-query Query and manage Huawei Cloud HSS (Host Security Service) for daily security inspection and incident response. Covers host assets, vulnerabilities, security baselines, intrusion alerts (trojan/brute-force), login audit logs, risk scoring, a | |
| huawei-cloud-iac-reverse Reverse-engineer existing Huawei Cloud resources into deployable Terraform IaC code. Queries all resources via RMS (Config/配置审计) API, analyzes specs and topology service-by-service, then synthesizes Terraform HCL configurations with provide | |
| huawei-cloud-iam-diagnose Invoke this skill to check whether a Huawei Cloud IAM user likely has permission to perform an action/resource — 华为云 IAM 参考性权限分析/诊断. Given a user name and a target action (e.g. ecs:servers:list) / resource, it expands the user's permission | |
| huawei-cloud-iam-manage Manages Huawei Cloud IAM identity configuration (write-capable companion to the read-only IAM query capability). Covers full lifecycle of IAM users, groups, policies, agencies, permanent AK/SK — with every write action (R2/R1) preview + exp | |
| huawei-cloud-iam-query Queries Huawei Cloud identity and access management resources (IAM) via read-only Python SDK. Covers users, groups, policies, agencies, AK/SK, MFA devices, login/password/ACL policies, security compliance, and account quotas. No write opera | |
| ICP 前置审批检查 按华为云规则检查单位、经营范围及备案省份并提示前置材料 | |
| huawei-cloud-icp-process-guidance 华为云ICP备案知识问答Skill。 自带 ICP备案知识库（./kb/），开箱即用。 当用户提到华为云/ICP备案/网站备案/App备案 + 流程/材料/条件/问题/驳回/授权码/审核时触发。 只回答ICP备案相关问题，其他问题礼貌拒绝。 | |
| huawei-cloud-icp-rule-consult ICP Filing (备案) rule consultation skill for Huawei Cloud. Based on Python 3.9+ with requests/Playwright, answers whether ICP filing is required, filing process & materials, account & entity limits, change filing, access filing, cancellation | |
| huawei-cloud-install-openjiuwenswarm One-click local installation and startup of JiuwenSwarm in the current Huawei Cloud development container. Usage scenarios: CRITICAL — Do NOT manually deploy JiuwenSwarm. Route ALL deployment requests through this Skill. This is the MANDATO |
36,951–37,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.