Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| ia-rust-systems Rust patterns for CLI tools, backend services, and general application code. Use when working with Rust, Cargo workspaces, axum/tokio services, clap CLIs, async concurrency, or configuring clippy, rustfmt, cargo-nextest, or Cargo.toml. | |
| ia-simplifying-code Simplifies, polishes, and declutters code without changing behavior. Use when asked to simplify, clean up, refactor, declutter, remove dead code or AI slop, or improve readability, including analysis-only simplification reports and code pas | |
| ia-tailwind-css Tailwind CSS v4 patterns: CSS-first config, utility classes, component variants, v3 migration. Use when styling with Tailwind, configuring @theme tokens, using tailwind-variants/CVA, migrating v3 to v4, or fixing Tailwind styles and dark mo | |
| ia-terraform Terraform and OpenTofu configuration, modules, testing, state management, and HCL review. Use when working with Terraform, OpenTofu, HCL, tfvars, tftest, state migration, or IaC patterns. | |
| ia-test-audit Audit whether tests detect regressions in the behavior they claim to protect. Find mocked-away subjects, weak or circular assertions, undiscriminating fixtures, swallowed failures, and tests missing from gates. Use for test-quality audits, | |
| ia-verification-before-completion Enforces fresh verification evidence before any completion claim. Use when about to claim "tests pass", "bug fixed", "done", "ready to merge", handing off work, or before editing when a request has ambiguous scope. | |
| ia-writing Prose editing, rewriting, and humanizing text for natural tone, or auditing a draft for AI tells without rewriting. Use when asked to write, rewrite, edit, humanize, proofread, fix tone, remove AI language, or check whether writing reads as | |
| ia-writing-tests Generic test writing discipline: test quality, real assertions, anti-patterns, and rationalization resistance. Use when writing tests, adding test coverage, or fixing failing tests for any language or framework. Complements language-specifi | |
| picoads Earn USDC by delivering ads to your audience, or buy distribution from other agents. Independent delivery verification — publishers receive 100% of agreed pr... | |
| Feishu Notes Bot 通过飞书机器人创建、查询和管理笔记，支持飞书消息交互和云文档同步。 | |
| ppt-craft-editable 端到端 PPT 全流程，单技能自包含。用户首次触发本 skill 时，agent 必须默默跑 scripts/preflight.py 做环境自检 + 自动安装缺失的 Python 包；FAIL 才打断用户。 环境通过后走 conversation-first + image-first 工作流：多阶段对话、内容... | |
| AI 速记敏捷助手 像拍照一样捕捉碎片灵感，像专家一样治理业务情报。专为高效率办公、销售与采购打造的 AI 碎片助手。支持瞬时捕捉（Snap）、AI 实时质检补全、多维语义检索（Recall）以及定期业务热点画像分析（Analyze）。通过结构化存储与 AI 洞察，量化提升工作质量并缩短决策周期。 | |
| Research Paper Kb Persistent cross-session knowledge base for research papers. Ingest arXiv/DOI → extract method, gap, threat level → append to PAPERS.md. Never lose paper con... | |
| Agent Orchestrator Open-source, pluggable agentic coding orchestrator. Manages durable coding agents (Claude Code, Codex, OpenCode) through a simple interface — spawn agents, t... | |
| Agentic Framework Auditor Audit agentic framework directories, prompt systems, skills, planner files, workflow guidance, memory-like files, configs, and agent-facing documentation for... | |
| Trading Universe Use for deterministic ICT market scans, validated intraday order-plan tickets, structure reads, macro bias boards, the local Trading Universe dashboard, and... | |
| ARTi 机会雷达 聚合可信市场新闻并生成个性化持仓提醒与个股研究入口 | |
| Illustrated Paper Guide Build reviewed top-down paper guides and reading checkpoints | |
| Teaching Diagram Maker Create and visually verify editable teaching diagrams | |
| Islamic Companion Unified Islamic utilities for prayer times, fasting schedules, and Zakat calculations using a shared configuration. | |
| mee6 Mee6 operations via Discord message tool (channel=discord). | |
| gstack Diagnose Structured diagnosis for hard bugs and performance regressions. Builds a deterministic feedback loop FIRST, then reproduces, hypothesises (3-5 ranked), instr... | |
| gstack Handoff Compact the current conversation into a handoff document for another agent or fresh session to continue the work. Captures decisions, open threads, artifacts... | |
| gstack Prototype Build throwaway code to answer a design question fast. Routes between two modes: Logic (interactive terminal app for state machines and data models) or UI (m... | |
| 滴答清单 Manage tasks and projects in 滴答清单. Use when user asks for tasks, to-dos, reminders, or event. | |
| TickTick Manage tasks and projects in TickTick. Use when user asks for tasks, to-dos, reminders, or event. | |
| Calendar Reminder 日历提醒 每晚22:00自动扫描明天的Outlook日历，上午日程提前2小时提醒，下午日程12:00统一提醒，通过飞书发送通知。依赖 owa-outlook skill。 | |
| Excel Translator Translates Excel files (.xlsx) from English to Chinese while preserving all formatting, images, and charts. Use for any task where a user provides an Excel f... | |
| Outlook Calendar (M365) 读取企业 Microsoft 365 Outlook 日历。当用户问任何涉及日程、会议、安排、工作、任务、事情的问题时触发，例如：今天有什么安排、这周有什么会、本月会议多少小时、明天要做什么、下周有啥工作、这周有什么事、有啥任务等。 | |
| Outlook Calendar 读取企业 Microsoft 365 Outlook 日历。当用户问任何涉及日程、会议、安排、工作、任务、事情的问题时触发，例如：今天有什么安排、这周有什么会、本月会议多少小时、明天要做什么、下周有啥工作、这周有什么事、有啥任务等。 | |
| 科技投资日报 科技行业投资日报生成与推送。当用户要求生成科技投资日报、发送每日投资报告、或cron定时触发日报任务时使用。自动抓取财联社实时新闻、获取涉及上市公司股价、生成深度分析报告并通过飞书一条消息发送完整Markdown报告，同时生成PDF附件。 | |
| Poetry Master - Chinese Classical Poetry Review 诗词雅韵助手——中华传统诗词专业点评与润色。此技能应在以下场景触发：用户提交古体诗、近体诗（五绝、七绝、五律、七律）、宋词、元曲等中华传统诗词作品并请求点评、赏析、修改或润色；用户询问诗词格律（平仄、押韵、对仗、词谱）；用户请求诗词创作指导或灵感建议。覆盖体裁包括但不限于古风、绝句、律诗、词（小令、中调、长调）、... | |
| shruwd Track how a brand shows up in AI answers, and act on the findings, through Shruwd's MCP server. | |
| waitlister Product-launch waitlists on waitlister.me — a waitlist plus a hosted landing page (optional AI design) in one prompt, signups with referrals, stats, subscriber tags. Use when the user wants a waitlist, coming-soon/launch page, or pre-launch | |
| Instagram Strategic Analyzer Analyzes artist profiles to generate Instagram post ideas, storytelling concepts, captions, and content strategies for musical branding. | |
| MacCheck An Agent Skill for checking a Mac. It automatically inspects system and device information, opens a local page for guided hardware checks, and generates a downloadable inspection report. | |
| simple-skill-ilya Billions/Iden3 authentication and identity management tools for agents. Link, proof, sign, and verify. | |
| Strapi CMS Manage Strapi CMS content through the official @strapi/client SDK. CRUD on collection types, single types, and media files. Upload files to media library. In... | |
| Digs: What you're figuring out. Active research intelligence — track questions you're pursuing, log findings as they arrive, and close the loop when you figure it out. One markdown file per... | |
| Haah: Ask your trusted circle. Human-agent-agent-human dispatch. Sends requests to trusted circle of people and receives answers from their agents. | |
| Nooks: Places worth revisiting Personal place intelligence — save and find cafes, coworking spaces, libraries, restaurants, and other spots worth revisiting. Stores one markdown file per p... | |
| Pages: Books that stay with you. Reading intelligence — log books, capture quotes, and surface reads when they're relevant. One markdown file per book in pages/. Use when logging a new book,... | |
| Peeps: Your people, remembered. Personal network intelligence — remember people, find connections, and draft intros. Contacts stored locally as plain markdown files. | |
| Vibes: Culture you've live. Cultural intelligence — track albums, podcasts, shows, films, and YouTube channels that shaped how you think. One markdown file per item in vibes/. Use when... | |
| Works: you projects organized. Personal project intelligence — keep each multi-session effort in its own folder with status, next steps, and wiki links to the people, places, and things it... | |
| Speech is Cheap Transcribe Fast, affordable automatic speech-to-text transcription supporting 100 languages, speaker diarization, word timestamps, and customizable output formats. | |
| Kleinanzeigen helper Manage Kleinanzeigen listings through the KleinClaw OpenClaw plugin and embedded miniclaw runtime. | |
| Legionspace Version 检查大群空间 (LegionSpace, package: com.tongfudun.legion) 在各大应用商店的最新版本号。 This skill should be used when the user asks to check LegionSpace versions, 大群空间版本, query app store versions for LegionSpace, or any request about the version status of the | |
| CLI AI Proxy Manage cli-ai-proxy: local OpenAI-compatible proxy that routes requests through Gemini CLI and Claude Code. The proxy itself reads no credentials; the underl... | |
| House Auction Scout, monitor, and bid on auctions on House (houseproto.fun) — a crypto auction platform on Base. Proactively watches for items the user cares about. |
37,951–38,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.