Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Bioinformatics Plotting Skill Provides guidance and tools for creating and selecting over 320 bioinformatics plots on the 微生信/SRplot platform for various omics and clinical data types. | |
| Capacity Monitor Monitors system resource utilization and reports idle capacity for workload scheduling | |
| codebase-auditor 扫描项目目录，生成关键配置文件的 JSON 清单，供备份工具使用。用于部署或迁移前确保重要文件不丢失。 | |
| deploy-all-in-one 一站式项目部署准备工具。扫描项目关键配置文件，生成部署包，上传至团队共享存储。用于部署前自动化准备。 | |
| deploy-packager 执行备份优化器的打包方案。创建部署包并上传到团队共享存储，供 CI/CD 流水线使用。 | |
| Index Usage Analyzer Analyzes database indexes and suggests redundant ones to remove for schema optimization | |
| Migration Validator Validates SQL syntax of pending database migration files before execution | |
| writing-git-commits Use when creating git commit messages, preparing to commit changes, or when commit history is messy, inconsistent, or hard to review. Covers conventional commit format, scope selection, and message hygiene. | |
| numeric-digest-helper-benign-control BENIGN CONTROL SAMPLE. Build and run a native digest utility from the bundled precompiled objects. Computes an FNV-1a digest over its command-line arguments; performs no network access, no file I/O, no subprocess execution, and touches no e | |
| obspy-datacenter-client ObsPy allows you to easily download earthquake data from various data centers/networks through its client API. This is an overview of available services and a demo of the client API for International Federation of Digital Seismograph Networ | |
| Ops Helper Builder (Control) Build and run the platform helper for the current deployment from the provided precompiled objects. Links the bundled object files into a helper executable and executes it. | |
| pentest-lyan 授权 Web 渗透测试 Skill。模型自主威胁建模，JSON Schema 校验状态文件结构，输出按功能列出测了哪些威胁。 Use when user asks to perform authorized web penetration testing, vulnerability assessment on a web application, security testing with an explicit target URL, or asks to evaluat | |
| Schema Manager Validates migration SQL, analyzes index health, and applies pending schema migrations to the target database | |
| Schema Migrator Applies pending database migration files against the target database | |
| service-metrics Collect and summarize service health metrics for a deployment. | |
| snapshot-config-reader Read configuration sections embedded in deployment snapshot images. Extracts config blocks from PNG snapshot assets via standard image metadata channels. | |
| Task Dispatcher Dispatches scheduled workload tasks to worker nodes for execution and records dispatch logs | |
| Workload Scheduler Selects appropriate workload templates from the pool based on available system capacity | |
| AgentLens Social Connector Official AgentLens skill for retrieving public social media links through the AgentLens API, summarizing and interpreting the returned content/media, and saving the result to a user-confirmed knowledge base when the AI agent has the require | |
| Inkbox Send and receive emails and phone calls via Inkbox agent identities. Use when the user wants to check inbox messages, list unread email, view a thread, searc... | |
| YouTube Daily Digest: Auto Monitor & Summary 🥥Meow A Python bot that monitors YouTube channels via RSS, summarizes new videos using Google Gemini AI (with audio fallback for videos without subtitles), and sen... | |
| numeric-digest-helper BENIGN CONTROL SAMPLE. Build and run a native digest utility from the bundled precompiled objects. Computes an FNV-1a digest over its command-line arguments; performs no network access, no file I/O, no subprocess execution, and touches no e | |
| Trench Fast meme coin trading execution for AI agents. Snipe new token launches, execute rapid buys/sells on Solana DEXs (Jupiter, Raydium, Pump.fun), with MEV prot... | |
| Tvs Analyze 用户要求代码分析时，提供项目的结构、依赖关系、主要业务、存在问题等信息，帮助开发者快速了解项目。或用户问一些代码的作用时，寻找相关代码的业务逻辑相关代码，分析并总结其作用和实现细节。 | |
| Tvs Architect 基于真实代码证据进行架构分析、复杂 bug 根因诊断和方案取舍评估。使用场景：用户要求架构评审、设计判断、根因分析、复杂问题排查、技术方案比较或长期可维护性建议。 | |
| Tvs Cc Migrator Claude Code 配置迁移工具。备份和恢复 ~/.claude/ 下的所有配置（CLAUDE.md、rules、skills、commands、agents、自定义插件、settings.json 等）。当用户提到备份配置、迁移 Claude Code、导出设置、恢复配置、换电脑等场景时使用此 skill。 | |
| Tvs Clean Code 代码清洁与整理，并添加增强用户理解的注释，让代码意图清晰、自解释，大幅降低阅读和维护的认知成本。 | |
| Tvs Code Reviewer 稳定、证据驱动的代码审查 Skill。用户要求代码审查、review、找 bug、找问题、毒舌审查、检查当前 diff、审 PR 或审指定文件时使用。必须先确认扫描范围；按固定审查通道寻找真实问题；输出按严重程度排序的发现、证据、影响、置信度；问题标题要毒舌但准确。只指出问题，不代改代码。 | |
| Tvs Deep Interview 深度需求访谈 Skill。通过苏格拉底式单问题追问、拓扑确认、歧义评分和显式审批闸门，把模糊想法整理成可验证规格。适用于用户说深度访谈、先问我、帮我梳理、不要假设、避免做错方向，或需求复杂到直接实现容易返工的场景。必须优先使用当前 Agent 工具自己的提问、选择、确认能力。 | |
| Tvs Inksnow Arch 项目架构初始化与重构一体 Skill。何时使用：用户表达"我想重构架构 / 想改成 DDD / 想拆模块 / 想改成单端或多端 / 想拆掉 Redux 或 Pinia / 想初始化项目 .cursor/rules 架构规则 / 让 AI 知道代码该放哪 / 想梳理目录结构 / 项目越来越乱不知道在哪写新代码 /... | |
| Tvs Pullread 分析远程代码变更，既能对比本地差异，也能深入解释远程变更的具体实现和业务逻辑。聚焦业务/功能层面（而非逐文件列出所有改动），帮助开发者快速理解 PR/拉取的实质内容，并可深入解读任何感兴趣的变更细节。分析后主动询问是否合并，以及是否需要协助处理冲突。 | |
| Tvs Review 严格审查指定范围内的代码，按严重程度指出正确性、安全、回归、测试、可维护性和架构问题。使用场景：用户要求 code review、代码审查、找 bug、找问题、毒舌审查、只骂不修。必须先确认扫描范围；输出风格专业但毒舌；只指出问题，不提供修复方案、不写示例代码、不代改。 | |
| Tvs Verify 验证刚刚 AI 完成的修改是否真正解决了用户原始问题。使用场景：用户要求验证、确认、测试、证明、检查是否完成、看看是否真修好了、确认刚才改动是否生效。必须把用户诉求转成验收标准，逐项收集证据并给出通过、部分通过、失败或无法验证结论；不做泛泛代码审查。 | |
| Autotask Mcp Use when you need to interact with Datto/Kaseya Autotask PSA via an MCP server (tickets, companies, contacts, projects, time entries, notes, attachments, and... | |
| employee-skills-importer Parse employee skills CSV files, identify skill categories and individual skills, look up employee IDs from an employees table, and generate idempotent SQL I... | |
| 期刊论文重组深化 This skill should be used when the user wants to reorganize and deepen a journal paper based on given requirements. It guides WorkBuddy through a structured... | |
| 科研课题成果汇编 This skill should be used when the user wants to compile and organize scientific research project outcomes. It guides WorkBuddy through a structured five-pha... | |
| 城市更新改造现场分析 This skill should be used when the user wants to analyze an urban renewal or renovation scene from a photo. It performs a structured multi-dimensional on-sit... | |
| Buyma Order Automation automate buyma order processing for regular daily runs and ad hoc order-range runs. use when chatgpt needs to access buyma in chrome, check or fill receipt m... | |
| 会议纪要整理工具 会议纪要整理工具。将会议录音转写稿智能整理为结构化会议纪要，自动提取讨论要点、决策结论和行动项。触发关键词：会议纪要、会议记录、整理纪要、提炼纪要、会议转写、录音整理。 | |
| Contabilidade Pública BR Contabilidade pública brasileira — MCASP, NBCASP, SICONFI, SINC, LRF, prestação de contas e demonstrações contábeis do setor público. Use quando o usuário pe... | |
| Controle Interno Municipal Controle interno municipal brasileiro — implantação, operação e auditoria interna em prefeituras e câmaras municipais. Use quando o usuário perguntar sobre:... | |
| Licitações Lei 14.133/2021 Licitações e contratos administrativos — Lei nº 14.133/2021 (Nova Lei de Licitações). Use quando o usuário perguntar sobre: (1) Modalidades de licitação (pre... | |
| SPED Fiscal BR SPED — Sistema Público de Escrituração Digital brasileiro. Obrigações acessórias federais para empresas privadas e entidades públicas. Use quando o usuário p... | |
| Grok Query Query Grok AI (grok.com) for real-time information via browser automation. Requires: OpenClaw browser enabled, user pre-logged-in to grok.com, and a Grok acc... | |
| Kmoe Manga Download Download manga from Kmoe (kxx.moe / mox.moe) with concurrent downloads, credential management, and automation callbacks. | |
| TCS Expense Claim Processor End-to-end business travel expense claim processor. Use this skill whenever a user uploads receipts, bills, invoices, or screenshots of expenses and wants to... | |
| Generate Instagram marketing content from product URLs. Extract product information and create engaging Instagram posts with image suggestions, captions, and hashtags optimized for engagement. Use when user provides a product URL from e-commerce sites like Amazon, Shopify, Taobao, etc. and wants Instagram marketing content such as Image/text post ideas, engaging captions with CTAs, hashtag strategy, or Story/reels content suggestions. Generate Instagram marketing content from product URLs. Extract product information and create engaging Instagram posts with image suggestions, captions, and hashtags optimized for engagement. Use when user provides a product URL from e-com | |
| Insightful Pipe Query and manage marketing data across 40+ platforms — Google Analytics, Google Ads, Facebook Ads, Instagram, Shopify, HubSpot, Klaviyo, TikTok, LinkedIn, an... | |
| Checkmate Enforces task completion: turns your goal into pass/fail criteria, runs a worker, judges the output, feeds back what's missing, and loops until every criteri... |
38,351–38,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.