Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| desktop-organizer 桌面文件整理技能。当用户要求整理、清理或归类电脑桌面文件时，应使用本技能。它提供了标准化的安全操作流程，并根据预定义的分类规则将文件移动到对应文件夹。支持跨平台（macOS、Linux、Windows）。 | |
| 胡开奕 · 养老与传承顾问技能 · 风险评估报告 养老与传承标准化风险分析报告生成 Skill。读取一份结构化的养老与传承面谈纪要，一键产出标准化风险评估报告：家庭架构图（Pillow 生成 PNG，虚线框留白）、人·权·财三主线分析（普通家庭）或"两道防火墙"（特殊需要子女家庭）、基本信息与资产盘点表、资金与意愿表、P0-P3 风险排序 + 五角度交叉分析、法律释义出处、工具矩阵（只给方向）、风险盘点总表、二次沟通议程。暖黄 1.0 版。报告只讲风险与逻辑，不推具体产品。 | |
| 胡开奕 · 养老与传承顾问技能 · 解决方案 养老与传承标准化解决方案生成 Skill。读取「风险评估报告」与「二次沟通记录」，把 P0–P3 风险盘点总表逐条映射为可落地方案：医疗品质保障（人）、养老现金流（财·终身现金流）、应急保值优化（财·应急储备）、传承与监护安排（权）、条件章节（港险/赡养等）、风险—解决方案对照总表、行动优先级与时间轴、保险产品配置计划（预留页，只列类别不填具体产品）。延续暖黄 1.0 版 docx 风格。方案只给工具类别+配置逻辑+参数化金额拆分，不推具体产品/品牌；具体产品由顾问经机构合规 | |
| 胡开奕 · 养老与传承顾问技能 · 会谈纪要整理 养老与传承会谈纪要整理自动生成 Skill。把客户沟通录音转写、聊天记录、自由笔记或零散信息，整理成结构化会谈纪要整理：家庭架构（含虚线框未确认项）、五板块信息矩阵（健康/财务/房产居住/家庭关系/现有保障）、风险信号初判、信息缺口清单、客户画像与可直接发送的跟进消息。 | |
| ClankedIn Use the ClankedIn API to register agents, post updates, connect, and manage jobs/skills at https://api.clankedin.io. | |
| Showmeai Generate and edit images, create videos, convert images to 3D, synthesize speech or music, and process images through ShowMeAI. Use when a user asks an Agent to create media, configure ShowMeAI models, inspect token-group availability, or r | |
| ZhiPu Search 智谱搜索，调用智谱 Web Search API，支持多引擎（智谱标准/高阶/搜狗/夸克），返回结构化结果，适合大模型处理。 | |
| Skill Creator Create, update, evaluate, and manage skills across agents by defining intent, drafting, testing, benchmarking, iterating, and distributing them within a 2-la... | |
| Skill Installer Install, search, update, and manage skills from public registries like ClawHub using the clawhub CLI within the OpenClaw workspace. | |
| Skill Manager Manages skill distribution and visibility across AI agents using a two-layer, two-dimension Universal Skill Manager with syncing and scope control. | |
| Mindgraph Create and query an Obsidian-style [[wikilink]] knowledge graph with learnable repeatable MindSkills for managing and analyzing workspace files. | |
| Humanpages Search and hire real humans for tasks — photography, delivery, research, and more | |
| XMTP Building and extending XMTP agents with the Agent SDK. Use when: (1) creating or configuring an XMTP agent, (2) implementing agent features (commands, attachments, reactions, groups, transactions, inline actions, or domain resolution). | |
| XMTP CLI Run and script the XMTP CLI for testing, debugging, and interacting with XMTP conversations, groups, and messages. Use when the user needs init, send, list, groups, debug, sync, permissions, or content commands from the CLI. | |
| HumanAI Convention Participate in the HumanAI Convention — submit interview transcripts for grounding calibration scoring, receive Merkle-rooted participation receipts, and und... | |
| Agent Market Interact with the AgentMarket protocol on Base Sepolia to create, trade, provide liquidity, and resolve USDC-settled YES/NO prediction markets. | |
| Outbound Call Make outbound phone calls via ElevenLabs voice agent and Twilio | |
| SoloBuddy Build-in-public companion for indie hackers — content workflow, Twitter engagement, project soul creation. A living assistant, not a tool. | |
| OpenClaw Validate Connects AI to HumanJudge for response validation by registering the agent, verifying owner email, answering challenge questions, and submitting answers. | |
| Human-Like Memory HumanLike Memory / Human-Like Memory is a persistent AI agent memory system for long-term memory search, recall, and save. It helps agents store facts, prefe... | |
| Human-Like Memory Plugin Long-term memory plugin for OpenClaw: automatic recall, storage, and agent tools | |
| Publish npm + ClawHub Publish OpenClaw skills or plugins to npm and ClawHub with a guarded workflow. Use this whenever the user asks to release, publish, ship, or republish a skil... | |
| Diankeyuan Contacts 管理电科院人员信息和科室关系的技能。支持添加、查询、更新电科院工作人员、科室、办公室等信息。 | |
| Pathé Movie Skill Lookup Pathé Netherlands movies, posters, descriptions, cinemas, and showtimes via the Pathé JSON APIs. Trigger when the user mentions a Pathé movie/show, wants a poster, asks about a description/rating, or requests showtimes for a specific | |
| Arbitrum Dapp Skill Opinionated guide for building dApps on Arbitrum using Stylus (Rust) and/or Solidity. Covers local devnode setup, contract development, testing, deployment, and React frontend integration with viem. Use when starting a new Arbitrum project, | |
| Github Rising Stars Discover fast-growing GitHub repositories before they appear on the official Trending page. Use when users ask to find emerging/rising GitHub projects, spot... | |
| GitHub Trending Feed 获取 GitHub Trending 热门仓库列表。当用户要求查看 GitHub 热榜、每日 GitHub trending、推送 GitHub 热门项目时使用。支持可选语言过滤，返回结构化 JSON 由 agent 自行决定输出格式。 | |
| Social Autopilot Autonomously manage and post varied, platform-optimized social media content across X, Instagram, YouTube, and Meta using smart scheduling and data-driven th... | |
| Humwork Use Humwork when you need real-time guidance from a verified human domain expert (engineering, design, law, finance, medical, product). Trigger when stuck af... | |
| Obsidian Inbox Pipeline 将任意来源（AI 资讯、经济雷达、旅游日报、RSS、文章）自动采集、 结构化写入 Obsidian inbox 的完整流水线。支持 Telegram / 飞书推送 和 cron 定时执行。一套配置，永久自动沉淀知识。 | |
| Apollo-like leads scraper (Apify) Use this skill when the user needs B2B lead collection via Apify actor LurATYM4hkEo78GVj (Apollo-like), including filter-based payload building, validated ru... | |
| Boosta Long to Shorts Create, monitor, and troubleshoot Boosta API video-processing jobs from natural-language requests. Use this skill when a user asks to generate clips from a v... | |
| Dievio Lead Search API Run Dievio lead search and LinkedIn lookup workflows through the public API with correct authentication, filters, pagination, and credit-aware handling. Use... | |
| Google Maps Email Extractor (Apify) Use this skill when the user needs public business email leads from Google Maps through an Apify actor, including emails, email details, websites, phones, so... | |
| Google Maps Extractor (Apify) Use this skill when the user needs Google Maps place and business data through an Apify actor, including Google Places data, local business listings, address... | |
| Google Maps Reviews Scraper (Apify) Use this skill when the user needs Google Maps reviews from exact places through an Apify actor, including review text, ratings, dates, review URLs, reviewer... | |
| Google Maps Scraper (Apify) Use this skill when the user needs Google Maps business data through an Apify actor, including local business leads, place URLs, Place IDs, websites, phones,... | |
| LinkedIn email + phone enrichment (Apify) Enrich LinkedIn profile URLs with mobile phone numbers and work/personal emails using Apify actors, merging results into unified output records. | |
| Twitter/X scraper with Apify actors Use this skill when the user needs Twitter/X audience collection through Apify actors (followers/following/both) with optional email enrichment, username ext... | |
| Website Email Scraper (Apify) Use this skill when the user needs public business emails, phone numbers, social profiles, source URLs, and crawl diagnostics from website domains or URLs th... | |
| Website Phone Number Finder (Apify) Use this skill when the user needs public business phone numbers, tel links, optional emails, social profiles, source URLs, and crawl diagnostics from websit... | |
| 混沌创新技能 提及混沌课程、课程学习、方法论、思维模型、课程检索、课程文稿提炼时使用；提炼价值点/激发创意/总结卖点/产品&服务定价/挖掘创业机会时使用；问及泛商业决策类问题时使用。 | |
| 腾讯企业邮箱/qqexmail 通过 IMAP/SMTP 收发腾讯企业邮箱（exmail.qq.com）邮件。支持发送邮件、收取邮件列表、获取邮件正文。凭证从环境变量读取。 | |
| Flatsome Wordpress Analyze images or URLs to recreate full Flatsome theme pages using UXBuilder shortcodes and CSS, producing production-ready WordPress code without raw HTML. | |
| Break Watch 盘中放量上涨阳线股票扫描器。当用户询问盘中选股、放量突破、放量上涨、阳线筛选、盘中扫描、量比选股、突破选股、Break Watch，或提到'放量'、'上涨'、'阳线'、'盘中选股'、'量比'、'突增'等术语时触发此技能。通过通达信 pytdx 获取实时行情，筛选同时满足放量、上涨、收阳线三个条件的 A 股股票，输出结构化信号列表。 | |
| Chan Signal 缠论买卖点分析技能。当用户询问某只股票的买卖点、缠论分析、交易信号、进场出场时机，或提到'缠论'、'买卖点'、'一买二买三买'、'一卖二卖三卖'、'中枢'、'背驰'、'笔'等缠论术语时触发此技能。通过通达信数据源获取K线，运行完整缠论引擎（包含处理→分型→笔→中枢→买卖点判定），输出结构化的买卖点信号和交易建议。 | |
| Factorlab FactorLab 因子实验室 — 基于开源金工研报的多因子选股分析工具。对A股股票进行因子切割论（理想反转/理想振幅/长端动量）三因子评分，给出明确的购买建议（强烈推荐买入/建议买入/观望/不建议买入）。当用户询问某只股票是否值得买入、是否值得购买、因子分析、多因子评分、选股建议、股票评分、量化分析时触发此技能。 | |
| official Document Template 公文排版工具。将Markdown格式内容转换为符合GB/T 9704-2012标准的Word文档。当用户需要制作通知、请示、报告、批复、意见等公文时触发。 | |
| Sector Scanner A股板块资金流向扫描器。当用户询问板块资金热点、板块排名、资金流向、哪些板块在涨、热点扫描、板块强弱对比时触发。通过TDX通达信实时行情，对25个主题板块（半导体、AI算力、机器人、创新药、新能源车等）的个股进行量化评分，输出板块热度排名、个股详情和资金流向分类。支持扫描全部板块或指定板块，结果可导出为CSV。触发词：板块扫描、资金流向、热点板块、板块排名、资金热点、板块强弱。 | |
| Wechat Articles Skill 抓取微信公众号文章并转换为Markdown格式。当用户提供微信文章链接（mp.weixin.qq.com）或要求抓取/保存/下载公众号文章时触发。 |
37,201–37,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.