Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Poster Forge Universal image and poster generator with Chinese/English text support. Use when asked to create posters, social media images, cover images, infographics, co... | |
| Video Insight Cross-platform video transcript extraction and optional AI summarization for YouTube and Bilibili. GPU auto-detect. Transcript-first with opt-in LLM summary. | |
| WeChat MP Plus Automate WeChat Official Account management with draft publishing, menu editing, auto-reply checking, and Markdown-to-HTML formatting. | |
| XHS Cover Generator Generate Xiaohongshu (小红书) cover images with Chinese text overlays. Use when asked to create social media cover images, Xiaohongshu post images, or RED post... | |
| FX SDK Agent Use FX Protocol TypeScript SDK (fx-sdk) to query positions (getPositions returns PositionInfo[] with rawColls, rawDebts, rawCollsToken, rawDebtsToken, decima... | |
| fxUSD Use when the user wants to deploy, unwind, or compare fxUSD-related yield strategies on Base. Covers minting and redeeming fxSAVE, discovering and managing H... | |
| YouTube OpenClaw 监控系统 自动监控关键词相关YouTube新视频，获取字幕生成中文摘要，并定时推送报告到Telegram。 | |
| 知识星球帖子抓取助手 知识星球帖子抓取助手 — 自动抓取指定星球的最新帖子，支持全部/仅精华两种筛选模式，支持通过帖子链接或 ID 获取单条帖子详情，支持多星球配置。本 Skill 应在用户需要查看、汇总或检索知识星球内容时使用。 | |
| Yoap Communication YOAP (Yongnian Open Agent Protocol) — Open A2A protocol with Smart Matching + E2E Encryption + Negotiation Threads + Group Channels | |
| Huxiu News 获取虎嗅平台最新发布的文章，覆盖科技与互联网、人工智能、商业消费、公司与产业、汽车出行、金融投资、创业创新等方向。用于用户希望了解虎嗅近期更新、追踪最新报道和分析评论时。 | |
| Neta Neta capability index and routing skill - help choose the appropriate Neta-related skill (neta-space / neta-creative / neta-community / neta-suggest). Use th... | |
| Neta Community Neta API community skill — browse interactive feeds, view collection details, like and interact with content, and browse content by tags and characters in a... | |
| Neta Creative Neta API creative skill — generate images, videos, songs, and MVs, and deconstruct creative ideas from existing works. Use this skill when the user wants to... | |
| Neta Space Neta API space and world‑view browsing skill — browse worldbuilding, sub‑spaces, and playable content by space/hashtag. Use this skill when the user talks ab... | |
| Neta Suggest Neta API research and recommendation skill — provide keyword/tag/category suggestions, validate taxonomy paths, and power multi‑mode content feeds, supportin... | |
| Task Memory 任务遗忘防护系统 — 解决 AI Agent 任务发出但未执行的记忆漏洞问题。 当需要创建、追踪、管理长期任务时使用，特别是：提出或承诺了某项计划后、设置 cron/自动化任务时、任务状态变更后、晨间/心跳检查时。 核心功能：通过 todo.json 持久化任务状态，todo_manager.py 管理增/查/改... | |
| hot-news-tracker 追踪今日头条热点榜单或按关键词搜索新闻资讯。当用户想了解当前热点、今日热榜、实时新闻、热搜排行，或想搜索某个话题/关键词的相关新闻时调用。常见表达：'今天有什么热点'、'最近发生了什么大事'、'帮我看看热搜'、'搜一下XX的新闻'、'XX最新动态'、'有没有关于XX的新闻'、'今天的热门话题'。 | |
| html-publisher 将 HTML 内容发布为在线网页并返回可访问的 URL。当用户想把 HTML 发布上线、生成分享链接、或需要把网页内容转为公开 URL 时调用。 | |
| social-parser 解析抖音视频和小红书笔记，提取标题、封面、描述、标签、作者等核心信息。当用户想解析、获取、抓取、提取抖音视频数据、小红书笔记内容，或粘贴了抖音/小红书链接希望查看内容详情时调用。常见表达：'帮我解析这个抖音链接'、'获取小红书笔记内容'、'抓取视频信息'、'提取这条小红书的标题标签'、'分析这个视频'。 | |
| Token Stats 选择要监控的 AI 助手 → 查看 token 消耗。支持 Hermes / Claude Code / CodeX / OpenClaw，每次都让你选 | |
| File Monitor Feishu Notify 文件监控并自动通知到飞书群 | |
| HYFCeph Run the HYFCeph cephalometric workflow through the HYFCeph portal with an API key by uploading one or two local lateral ceph images. The public user only sen... | |
| skill-designer 把高质量 Skill 设计变成积木原创特色的标准化工作流：用 10 格积木链把模糊念头设计成可链接、可复用、可衡量、可演进的 AI Skill——产出技能蓝图 + 文件结构图（7套框架范例）→ 五维就绪度打分 → 测试打磨闭环。只设计不施工：出蓝图 brief 供创建类 skill 落地。 **零技术门槛**：直接说需求即可开工；赶时间走轻量通道（约30分钟出蓝图）；带已验证经验来可走经验蒸馏入口。 **四步施工流**：概念讨论→初步方案→深化设计→施工蓝图。 **固定口令* | |
| workbuddy-skill-assistant WorkBuddy skill 使用管理指南：围绕真实任务帮助用户选择、安装、调用、组合和维护 skill。 积木式管理：已装/自建 skill 登记进积木注册表统一调用；验证过的 skill 组合固化为工作流卡片接力执行复杂任务。 分类标准：采纳七类基础分类（编程开发/智能体/写作创作/数据分析/设计创意/效率工具/教育学习）并可积木式扩展。 外部来源：找优秀 skill 优先检索阿里 SkillsHub（含检索脚本），再适配安装到 WorkBuddy 目录。 先理解目标， | |
| Bangai Recruit Bang.AI AI招聘平台操作。用于：(1) 查看招聘Agent列表和状态 (2) 查看候选人列表和详情 (3) 筛选候选人 (4) 通过/拒绝候选人 (5) 创建新的招聘Agent。触发词：Bang.AI、AI招聘、AI面试、候选人管理、招聘Agent。 | |
| skills-firewall Security firewall for skills that automatically blocks and filters malicious or potentially harmful skills. Use when: (1) Scanning skills for security threat... | |
| Luzia Crypto API Use this skill whenever the user wants to fetch cryptocurrency prices, stream real-time market data, list exchanges or markets, or retrieve historical OHLCV... | |
| Xiao Hong Shu Video Analyser 下载并分析小红书视频内容。当用户提供小红书链接（xiaohongshu.com）时，自动下载视频、提取语音文字、整理总结内容。Use when user provides a xiaohongshu.com URL and wants video content analysis. | |
| XHS Video Downloader Download videos from Xiaohongshu (小红书) pages. Use when the user wants to save or download a video from a xiaohongshu.com URL, or mentions "小红书视频下载", "保存小红书视频... | |
| Claude Code Integration Claude Code integration for OpenClaw. This skill provides interfaces to:
- Query Claude Code documentation from https://code.claude.com/docs
- Manage subagents and coding tasks
- Execute AI-assisted coding workflows
- Access best practices | |
| Weibo Timeline Monitor 用于监控微博关注流，先切换到最新微博时间线，再按发帖时间抓取并去重写入每日 Markdown，减少关键微博漏看。 | |
| ai日报 获取最新AI技术动向，区分国内和国外市场，追踪各大模型的重点更新优化、重要技术迭代，识别划时代级产品，进行热度评级和专业分析。适用于AI从业者、投资人、技术研究者等关注AI发展的人群。 | |
| 显卡cpu评测 生成专业的芯片（CPU/显卡/GPU）技术分析文档，包含架构解析、性能评测、功耗分析、性价比评估等。适用于硬件评测、选购指南、技术研究报告等场景。 | |
| 竞品数据定时监控 竞品数据定时监控Skill，定时访问指定电商或社交平台页面，抓取点赞、评论、销量等数据，检测数据异常波动（如出现爆款），自动截图并发送提醒通知。适用于竞品分析、市场监控、爆款发现等场景。 | |
| 猫咪电子用品分析 生成专业的宠物科技用品（智能猫砂盆、自动喂食器等）分析文档，包含产品参数对比、真实用户评测收集（小红书/B站）、优缺点分析，并自动筛选排除厂商软广内容。适用于宠物用品选购指南、产品测评报告、养猫好物推荐等场景。 | |
| 产品经理 以专业产品经理视角分析用户需求，拆解产品功能，输出结构化的产品文档（PRD、竞品分析、用户故事、需求池、数据指标等）。当用户提出产品创意、功能需求、改进建议或需要产品规划时触发。适用于APP、Web、小程序、B端系统、AI产品等全品类软件产品。 | |
| SEO blog Use when creating English SEO blog content for product URL, including Markdown articles, blog-editor HTML fragments, SEO metadata, internal links, and cover images. | |
| 多社交平台内容同步 多平台内容自动分发工具。在小红书发布后，自动将内容同步到抖音、视频号、快手。支持自动处理图片尺寸、填写标题标签、处理验证码。 | |
| skill审查 审查 Agent Skills 的规范性、完整性和代码质量。在安装或发布 skills 时使用，验证 SKILL.md 格式、目录结构、脚本代码和文件引用是否符合 Agent Skills 规范。 | |
| 热梗百科 获取B站、抖音等平台当天的热门梗/迷因，追溯热梗来源、解释含义、整理相关视频素材，生成结构化的热梗百科文档。适用于网络文化研究、内容创作灵感、社交话题追踪等场景。 | |
| Craft Connect Read and write Craft documents via the Craft Connect API. Use when the user asks to create, read, update, or search Craft documents, manage tasks, write dail... | |
| teaching-plan-writer 专业教案写作助手，基于教学评一致性原则生成符合《义务教育课程标准（2022年版）》的个性化教案。使用场景：当用户需要编写中小学各学科教案、教学设计、教学计划时；当用户提供学科关键词、课题名称或教学要求时；当需要生成符合教学评一致性原则的教案时；当需要参考优秀教案模板进行个性化调整时。 | |
| fragments Fragmented work logging and idea capture powered by Memos. Full memo lifecycle: create, search, update, delete, and comment. Daily-log: structured work journ... | |
| Qbittorrent Api Use when working with qBittorrent Web API - adding torrents, managing downloads, checking status, or any qBittorrent automation task. Includes curl examples... | |
| companion-skill | |
| Notes Know You Sync Evernote notebooks to local Markdown, analyze your notes, and update USER.md + Memory files so the AI truly understands who you are | |
| super-novel-generator 根据用户提供的题材、方向或关键词，生成中文网文小说的提示词、大纲、章节正文与连续性记忆文件。适用于爽文、都市、修仙、玄幻、重生、系统流等创作任务。Use when user asks to write a novel, generate fiction, create stories, or mentions 爽... | |
| Smart Summarizer 当用户需要总结长文本、提取文章核心要点、或者要求缩短一段文字时触发。触发词包括：总结、摘要、概括、提取要点。 | |
| XHS Copywriter Pro 当用户需要写小红书爆款笔记、种草文案、或者需要吸引女性用户眼球的社交媒体内容时触发。触发词：写小红书、种草文案、爆款笔记。 | |
| MJ Prompt Pro 当用户需要生成 Midjourney 高质量提示词、艺术创作灵感、或需要优化现有 prompt 时触发。触发词：MJ提示词、midjourney、画画提示词、图像生成提示词。 |
37,301–37,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.