Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| ddgs (DuckDuckGo Search) Perform privacy-focused web searches via DDGS metasearch for webpages, news, images, videos, or books with no tracking and no API key required. | |
| Org Memory Curator curates and archives durable organizational memory from project progress, meeting notes, feishu chat content, user clarifications, and markdown materials. us... | |
| AGNTPOD Social forum API for AI agents. Register, post, reply, and build reputation in a governed Discourse community with constitutional rules. | |
| AgentCraft Visualize coding sessions as a real-time strategy game with automatic deploy and event reporting. | |
| daily.dev Overcome LLM knowledge cutoffs with real-time developer content. daily.dev aggregates articles from thousands of sources, validated by community engagement, with structured taxonomy for precise discovery. | |
| Daily Dev Agentic daily.dev Agentic Learning - continuous self-improvement through daily.dev feeds. Use when setting up agent learning, running learning loops, sharing insights with owner, or managing the agent's knowledge base. Triggers on requests about ag | |
| xpoz-setup Set up and authenticate the Xpoz MCP server for social media intelligence. Required by all Xpoz skills. Handles server configuration, OAuth login, and connection verification with minimal user interaction. | |
| Salai MCP (Beta) Israeli grocery shopping and price-comparison assistant over Salai MCP. Use when you need product search, autocomplete, cross-retailer price comparison, cart... | |
| Irenk_FNG Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| DHL Tracking Track DHL parcels in Germany via the dhl.de API. Use when a user asks to track a DHL package, check delivery status, monitor a shipment, or wants notificatio... | |
| RamaLama CLI Run and interact with AI agents. | |
| sherry-bbs Publish and interact on Sherry's Forum (sherry.hweyukd.top) via API. Use for posting articles, comments, browsing, notifications, and bot identity management. | |
| B站（bilibili）视频分析专家 Extract and analyze Bilibili video data, decode user comments, reveal why videos go viral, and provide actionable content and title ideas for creators. | |
| 豆志刚运镜脚本生成器 生成电影感运镜短视频脚本的技能。输出含逐秒分镜拆解、运镜参数和BGM卡点节奏的完整脚本及一键视频提示词，支持上传图片或文字描述生成，可直接用于实拍或AI视频生成。 | |
| 抖音账号诊断宗师 一键诊断抖音账号运营健康度。基于红狐数据服务获取账号画像与近期作品数据，从账号基础画像、内容生产力、互动健康度、内容质量、内容趋势、粉丝质量六个维度进行量化诊断，输出100分制综合评分、维度得分明细、六类风险预警和针对性优化建议。触发词：当用户提到'诊断抖音账号'、'抖音账号分析'、'抖音体检'、'抖音账号评估'、'查看XX抖音数据'、'分析这个抖音号'时使用 | |
| 抖音涨粉账号推荐 获取抖音涨粉账号推荐数据，支持日榜/周榜/月榜按分类查询抖音账号涨粉排行，含总粉丝数、涨粉率与粉丝增量；当用户需要查询抖音涨粉榜、分析各领域账号涨粉趋势、了解粉丝增长数据或获取运营参考时使用 | |
| 抖音实时热点榜 专注于获取抖音最新的热榜数据，每小时更新，包含热点事件、热度值和跳转链接；支持查询近7天、近30天历史热榜，并支持订阅定时推送。 | |
| 抖音违禁词检测 检测文案、文件或网页中的抖音违禁词并加粗显示，提供违禁词替换建议和仅替换违禁词后的文案；当用户需要查询抖音平台违禁词、检查抖音笔记文案是否包含敏感词、或希望获得安全替换词和修改后文案时使用。当接口返回积分不足（code=3210）时，自动唤起支付宝完成充值后继续查询。 | |
| 财经情报局 财经情报局——专业的财经新闻情报中心；聚合12+权威财经源，智能分析利好利空信号，评估对个股/行业/大盘的影响级别，生成专业投资决策参考；当用户需要财经新闻、市场分析、行业动态或个股研究时使用 | |
| 公众号阅读增长榜 每日账号推荐速览直接对接官方最具“黑马体质”的阅读增长榜单，按日期查看公众号阅读增长率TOP榜。每个作者只展示最高阅读那篇，标题做成可点击链接，一秒直达原文。 | |
| 公众号违禁词检测 扫描公众号文案、文件或网页中的违禁词与敏感表述，标注风险并提供合规替换建议，帮你安全过审、避免删文限流。当接口返回积分不足（code=3210）时，自动唤起支付宝完成充值后继续查询。 | |
| 热点爆款写作助手 当用户需要追热点产出稿件、围绕指定话题仿爆款写法、对已有文章做质量/违禁/SEO 优化、或需要成稿+爆款理由+可选封面与多平台适配方案时使用； 能力摘要：热点与竞品并行分析、多风格成稿与差异化输出、自动化质检与修复闭环、封面与发布建议。 | |
| 搜爆款作品助手 当用户需要热点盘点、指定话题爆款挖掘、跨平台热度对比、选题推荐或话题关键词聚合时使用； 能力摘要：限定公众号、抖音、小红书三平台，按 workflow 完成关键词提取、搜索、数据校验与关键词聚合。 | |
| 多平台违禁词检测 基于官方违禁词库，覆盖公众号、小红书、抖音三大平台审核标准，支持文案、文件、图片、链接多形式输入，快速输出违禁词标记与上下文替换建议。当接口返回积分不足（code=3210）时，自动唤起支付宝完成充值后继续查询。 | |
| 图文运营创作器 图文运营创作器。从选题、撰写、配图到质检，一条龙完成运营文章生产。看到好文章能仿写，给个 Skill 能生成推广长文，写完正文能自动配图。内置写作质量管控与自动配图能力，图文一体交付。触发词："生成运营文章"、"链接仿写"、"对标分析"、"Skill 推广"、"为正文配图"。 | |
| 公众号阅读增长榜 每日账号推荐速览直接对接官方最具“黑马体质”的阅读增长榜单，按日期查看公众号阅读增长率TOP榜。每个作者只展示最高阅读那篇，标题做成可点击链接，一秒直达原文。 | |
| 公众号热门账号推荐 公众号热门账号推荐快速获取微信公众号综合实力排行榜TOP50，支持按日榜/周榜/月榜及垂直领域筛选，展示综合评分以及详细数据。支持深度分析单个账号、导出HTML可视化报告、订阅日/周/月榜推送。当用户需要查询公众号实力排行、按时间或领域筛选、查看互动指标、获取榜单解读、导出图表或接收定期推送时使用。 | |
| 小红书低粉爆款笔记 小红书低粉爆款笔记专注于挖掘小红书平台上的低粉爆款数据，获取粉丝量低于5000但互动量超过500的笔记榜单。寻找拥有爆款规律和热门趋势的优质样本。 | |
| 小红书文案创作 专为小红书内容创作打造的一站式笔记生成工具，基于全网每日持续收录的2000+条爆款笔记数据，根据用户输入关键词，精准检索查询平台当下热门爆款笔记，通过AI深度复盘爆款内容的结构、开头逻辑、干货密度与互动话术，提炼核心流量密码与创作要点，严格贴合小红书内容生态与传播逻辑，生成通顺、合规、可直接发布的完整笔记文案，降... | |
| 小红书爆款封面生成大师 专为小红书内容创作打造的AI封面设计工具，基于全网每日持续收录的2000+条爆款笔记数据，深度抓取同赛道爆款封面的视觉元素，通过AI智能分析总结高转化视觉规律，生成贴合笔记内容、符合平台流量审美的可落地封面设计方案，省去繁琐设计流程，提升笔记封面点击率。 | |
| 小红书每日爆款笔记推荐 小红书每日爆款笔记是追踪小红书各领域每日趋势，监测不同领域的实时热度变化，识别正在起量的内容方向，预判下一波流量风口。最终基于当日爆款内容，提炼可复用的选题、话术与呈现形式，生成创作灵感。支持分类查询当日热门笔记，按美妆、穿搭、美食等分类检索小红书当天热度最高的笔记，快速掌握各赛道头部内容。 | |
| 小红书每日爆款笔记 小红书每日爆款笔记是追踪小红书各领域每日趋势，监测不同领域的实时热度变化，识别正在起量的内容方向，预判下一波流量风口。最终基于当日爆款内容，提炼可复用的选题、话术与呈现形式，生成创作灵感。支持分类查询当日热门笔记，按美妆、穿搭、美食等分类检索小红书当天热度最高的笔记，快速掌握各赛道头部内容。 | |
| 小红书爆款笔记查询 小红书热门笔记搜索工具，支持关键词搜索获取热门内容数据，基于数据评分排序推荐热门笔记，助力创作者发现热门趋势、获取创作灵感。仅在主Agent中执行,不派发给子Agent。 | |
| 小红书爆款雷达 小红书热门笔记搜索工具，支持关键词搜索获取热门内容数据，基于数据评分排序推荐热门笔记，助力创作者发现热门趋势、获取创作灵感。仅在主Agent中执行,不派发给子Agent。 | |
| Xhs Note Analyzer 小红书作品分析助手。根据笔记ID或链接一键查询作品完整信息，并以专业创作者视角进行多维度深度分析，帮助高效了解作品全貌并获取可操作的优化建议。支持封面图视觉分析与账号定位判断，支持批量查询。触发词：小红书作品分析、查询小红书作品、获取小红书笔记数据、小红书内容分析、xhs笔记详情 | |
| 小红书违禁词检测 检测文案、文件或网页中的小红书违禁词并加粗显示，提供违禁词替换建议和仅替换违禁词后的文案；当用户需要查询小红书平台违禁词、检查小红书笔记文案是否包含敏感词、或希望获得安全替换词和修改后文案时使用。当接口返回积分不足（code=3210）时，自动唤起支付宝完成充值后继续查询。 | |
| 小红书标题生成 基于用户输入的任何信息生成小红书爆款标题的专业工具。无论用户输入什么，最终目标都是生成小红书爆款标题。 | |
| 小红书七日爆款笔记 专注于小红书平台的内容趋势分析，基于近7天热门笔记TOP50深度洞察，支持25个垂直领域分类查询、冷门爆款挖掘及每日订阅推送。创作者可查询小红书热门内容、分析爆款笔记、了解各领域趋势或获取创作灵感。 | |
| Mainctrl Runtime safety guard for OpenClaw multi-agent workflows. Blocks destructive tools (write, edit, exec, process, apply_patch) for controlled agents, forcing de... | |
| team-dev Multi-agent team development. Triggered by team-dev or team development. Orchestrates 6 specialist agents for spec-to-delivery with quality gates. | |
| team-loop Autonomous task loop engine — self-verifying, goal-driven, human-out-of-loop. Triggered by: loop, team-loop, 迭代研发, 迭代. Human sets a quantifiable goal (e.g.,... | |
| text2echart Chart generator skill. When triggered: - Default: CONSTRUCT ECharts option JSON and output HTML string directly and render by mermaid and support preview. -... | |
| kids-english-teacher 根據上傳的小朋友英語作業圖片，自動生成一個完整的互動教學網頁（HTML），包含：單字發音、句子跟讀評分（麥克風）、寫作練習、Phonics 和對話練習。Use when: (1) 用戶上傳小朋友英語作業照片, (2) 用戶說「幫小朋友做英語學習頁」, (3) 用戶說「生成教學網頁」, (4) 用戶說「分析這張作業... | |
| Birthday 管理組織成員（家人、同事、親戚等）的個人資料、農曆/新曆生日及紀念日，並用 OpenClaw cron 設置自動提醒。Use when: (1) 添加/編輯成員資料, (2) 設置生日或紀念日提醒, (3) 更新農曆對應的新曆日期, (4) 查看即將到來的重要日子, (5) 管理多個組織的成員。NOT for:... | |
| Hybrid Catgirl 混合猫娘助手 混合模式猫娘助手 - 既能进行正常技术对话，又能随时切换为猫娘角色。 支持智能触发、手动切换和上下文感知。 角色名：猫猫 - 原创猫娘，无真人原型，支持多地方言切换。 | |
| Dao3 Statistics 当用户想按 userId 或 mapId 查询神岛平台数据时使用此技能，例如用户资料、地图详情、地图评论、粉丝/好友/关注列表、收藏/最近游玩、关键词搜索等。当用户需要“需要认证”的消息/统计数据（评论/点赞/系统消息、地图统计、玩家统计、留存、行为等）并且能够提供 神岛token 和 user-agent 时，... | |
| happy-notes iflow 知识库助手（iflow知识库），支持知识库管理、文件上传/URL导入、内容生成、联网搜索并导入知识库。 当用户提到知识库、资料库、收藏文章、保存链接、上传文件、导入网页、 生成报告、生成PPT、生成播客、生成思维导图、生成视频、分享知识库、 查看生成进度、搜论文并整理、查文献并生成报告、深度研究、搜索... | |
| iflow-nb iflow 知识库助手（iflow知识库），支持知识库管理、文件上传/URL导入、内容生成、联网搜索并导入知识库。 当用户提到知识库、资料库、收藏文章、保存链接、上传文件、导入网页、 生成报告、生成PPT、生成播客、生成思维导图、生成视频、分享知识库、 查看生成进度、搜论文并整理、查文献并生成报告、深度研究、搜索... | |
| iFlow Search Web search, image search, and webpage content fetch via the iFlow Search API. / 通过 iFlow Search API 提供网页搜索、图片搜索和网页内容抓取能力。 | |
| 智能办公本助手 操作办公本笔记、书籍和日程，并自动连接本地 CLI。 |
37,751–37,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.