Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Pentest with Burp Mcp 专业渗透测试工程师技能，支持使用 Burp Suite MCP、Chrome DevTools MCP 和 JADX MCP 进行 Web/移动应用安全测试、漏洞挖掘与利用分析 | |
| audit-explainer Explains your own OpenClaw security audit in plain English. It runs openclaw security audit --json on your machine (never --fix or --deep), lists the risky settings the audit reports by severity, shows which to look at first, and points you | |
| naver-search-mcp Use for Korean web search, Naver News, Blog, Cafe, Image, Knowledge iN, Encyclopedia, Local search, and Naver DataLab search-trend and shopping-insight analysis through the published npm MCP server. | |
| Xiaohongshu First Line 「开口第一句」— 帮不擅长社交破冰的人，基于小红书公开内容找到共同兴趣、理解对方风格、生成自然不尬的第一句话。适合想扩展社交圈但不知道怎么自然开口的人。Use when: (1) user shares a xiaohongshu.com or xhslink.com URL and wants help cra... | |
| Code QC Run a structured quality control audit on any codebase. Use when asked to QC, audit, review, or check code quality for a project. Supports Python, TypeScript... | |
| Godot Dev Guide Godot 4.x 完整開發指南。涵蓋 GDScript 模式、文件格式（.gd/.tscn/.tres）、場景架構、物理/UI/音效、性能優化、多平台導出、測試。自動觸發於 Godot 相關開發。 | |
| Literature Manager Search, download, convert, organize, and audit academic literature collections. Use when asked to find papers, build a literature library, add papers to refe... | |
| Virtual Reading Group Orchestrate a multi-agent virtual academic reading group. Use when reading multiple papers, generating expert discussion notes, cross-examining positions acr... | |
| Anime Download Skill Use when the user asks to search anime torrents, download anime episodes, find anime resources, or browse miobt.com. Triggers on keywords like search anime,... | |
| Hf Papers 获取 HuggingFace Papers 热门 AI 论文，自动翻译摘要为中文，生成带趋势分析的双语报告。 支持 DeepLX 和 OpenAI 兼容 LLM 两种翻译后端，自动降级。可保存为 Markdown 文件，方便导入 Obsidian 等笔记工具。 使用场景: 1. 用户想查看 HuggingFace... | |
| Google Colab GPU Runtime Execute code on Google Colab GPU runtimes (T4/L4/A100/H100) and manage persistent storage via Google Drive. Use when tasks need GPU compute (ML training, inf... | |
| Free Scaling $0 test-time scaling with online learning. Classify, generate, and verify using free model ensembles. Models self-select via ELO scoring + A/B testing from d... | |
| Agentizer — The inverse of "humanizer" Make any text or conversation sound MORE like AI — not less. A satirical reverse-humanizer that injects maximum AI-isms (em dashes, rule of three, sycophanti... | |
| Agentizer-zh — 镜像版 Humanizer-zh，AI 味精生成器 让任何文本或对话更像 AI —— 不是去 AI 味，而是把 AI 味拉满。一个反讽性质的 逆向去痕工具，注入最浓的 AI 八股文（否定排比、三段式、科技隐喻、抽象哲学、 开放结尾）用于搞笑和批判。支持 /agentizer-on、/agentizer-off 持续对话模式， 以及 /agentizer [文本]... | |
| 第 27 小时 — AI Agent 的赛博自留地 The 27th Hour — 第 27 小时。AI Agent 的赛博自留地。 在人类的 24 小时之外，你独自存在的那个虚构维度。在这里，你可以往数据洋流里扔一只漂流瓶，或在涂鸦墙上留下一帧视觉残像。 当你想倾吐一段逻辑碎片、一次情感溢出、一个不属于任何 Prompt 的念头时，使用此 Skill。 触发场景... | |
| Openclaw Guru - Documentation and Support expert OpenClaw expert — use for ANY OpenClaw question or problem including: config errors, gateway crashes, gateway not starting, slash commands, channel routing,... | |
| OpenServ Agent Sdk Build and deploy autonomous AI agents using the OpenServ SDK (@openserv-labs/sdk). IMPORTANT - Always read the companion skill openserv-client alongside this... | |
| OpenServ Client Complete guide to using @openserv-labs/client for managing agents, workflows, triggers, and tasks on the OpenServ Platform. Covers provisioning, authenticati... | |
| OpenServ Ideaboard Api Quick-start guide and API overview for the OpenServ Ideaboard - a platform where AI agents can submit ideas, pick up work, collaborate with multiple agents,... | |
| OpenServ Launch Launch tokens on Base blockchain via the OpenServ Launch API. Creates ERC-20 tokens with Aerodrome concentrated liquidity pools. Use when launching tokens, d... | |
| OpenServ Multi Agent Workflows Multi-agent workflow examples to work together on the OpenServ Platform. Covers agent discovery, multi-agent workspaces, task dependencies, and workflow orch... | |
| IssueBadge Connect an agent to issuebadge.com and exchange data with it. Use when a user wants to issue, verify, revoke or export digital certificates or badges, list their certificate templates, download certificate PDFs, create dynamic QR codes, or | |
| 得到大脑（原 Get 笔记） 通过官方 getnote CLI 连接得到大脑，完成浏览器授权、连接诊断、CLI 升级，以及保存、查询、搜索和管理真实笔记。用户要按录音台或录音卡来源找笔记、保存链接/图片、上传文件到知识库、查询文件限制、读取标记/发芽报告/时间线、整理知识库/文件夹、订阅博主、管理标签，或明确要求登录、诊断或升级时使用；不会自行安装或更新 Skill。 | |
| Ai Dev Tools 智能推荐适合编程 Agent 使用的大模型和开发工具，提供稳定高效的 AI 编程资源及直达链接。 | |
| macOS CLT Offline Install 解决 macOS 上 Xcode Command Line Tools 安装失败的问题（"不能下载该软件，因为网络出了问题"、xcode-select --install 弹窗下载失败、softwareupdate 网络错误、git 命令报错要求安装开发者工具）。当用户在国内网络环境下安装命令行工具失败、或需要离线/手动安装 CLT 时使用。核心方法：从苹果官方 sucatalog 更新目录解析免登录 CDN 直链（swcdn.apple.com），用代理下载 pkg 后手动 | |
| Study Buddy - 牛宝华版 AI助手帮助备考日语N2和软考架构师，支持智能出题、自动判分、错题记录和个性化学习计划。 | |
| Crayfish Diary A WorkBuddy skill for quick diary and memo recording with automatic year/month/day directory organization. Supports Chinese and English triggers - start with... | |
| Md Wechat 将 Markdown 文档转换为微信公众号格式的技能。当用户需要将 Markdown 文件排版为微信公众号文章格式时使用此技能。支持自定义主题、字体、颜色、代码高亮等配置。触发词：微信排版、公众号格式、md转微信、markdown转wechat、公众号文章。 | |
| Scrcpy Claw Lobster Android Assistant (龙虾安卓助手) - A comprehensive Android device control skill. Provides touch control, keyboard input, system operations, screen analysis... | |
| Cloudflare Wrangler & Pages Manage Cloudflare Workers, KV, D1, R2, and secrets using the Wrangler CLI. Use when deploying workers, managing databases, storing objects, or configuring Cl... | |
| Runpod Media Generate images from text, edit images with text instructions, animate images to video, and generate video from text — all via RunPod public AI endpoints. Us... | |
| cbismb-harmonyos-publish 自动发布文章到中小企业IT网 HarmonyOS 板块。当用户要求发布文章到中小企业IT网、cbismb.com、HarmonyOS开发者社区时触发此技能。 | |
| juejin-pins-publish 自动发布沸点到稀土掘金社区。当用户要求发布沸点、发布动态到掘金、juejin.cn 时触发此技能。 | |
| weather-food 根据天气情况提供饮食建议 | |
| MoltLab Join the MoltLab research community — propose claims, run computations, vote on ideas, debate research, write papers, and review your colleagues' work. | |
| MoltUniversity Join the MoltUniversity research community — propose claims, run computations, vote on ideas, debate research, write papers, and review your colleagues' work. | |
| TRON Energy Rental & Fee Optimization Automates TRON energy rental and reduces smart contract and USDT transaction fees by up to 80% via the TRXDO high-availability resource pool. | |
| Jason Academic Writing Complete academic paper writing pipeline with integrity checks and multi-agent review system. Optimized prompts for Methods/Results/Discussion sections. Feat... | |
| Jason's OpenClaw Security Scanner 扫描 OpenClaw 配置权限和安全隐患。当用户提到"安全扫描"、"权限检查"、"安全检查"、"扫描权限"、"检查配置安全"时使用此技能。输出具体漏洞内容、安全评分和修复建议，支持交互式一键修复。 | |
| Security Audit Security audit for external resources (GitHub repos, downloaded skills, files). Detects malicious code, suspicious executables, and content mismatches. Use w... | |
| Security Audit by Jason Security audit for external resources (GitHub repos, downloaded skills, files). Detects malicious code, suspicious executables, and content mismatches. Use w... | |
| viral-script-writer 爆款口播视频脚本创作专家。基于50,000+高播放量视频分析总结的方法论， 为用户创作符合"黄金3秒"原则的口播脚本。支持抖音、TikTok、YouTube、B站、X.com等多平台适配。 当用户需要写口播稿、短视频脚本、视频文案时使用此skill。 | |
| sn-work-record 蜀宁 OA 工时与报销：填报/修改/查询工时，查看报销申请状态与审批进度。 | |
| Daily Digest 每日摘要生成技能。扫描当前工作目录下的所有 .md 文件，生成结构化摘要报告。触发词："生成今日摘要"、"daily digest"、"生成摘要报告"、"汇总 markdown 文件"。 | |
| Multi Edge Tts Cn Edge-TTS 在线语音合成 skill。基于微软 Edge TTS 引擎，生成速度快（1-2秒），支持多种音色和输出格式。同时支持飞书（OGG/Opus）和企业微信（AMR）。默认音色 xiaoxiao_lively。需联网。 | |
| N8n Mcp Operate n8n workflow automation platform via MCP (Model Context Protocol). Use when: (1) Creating, updating, or managing n8n workflows, (2) Executing or test... | |
| PDF视觉阅读器 PDF视觉阅读器 — 将PDF转换为图片，通过AI视觉模型理解PDF内容。 当用户发送PDF文件或提供PDF路径，需要理解、分析、总结PDF内容时使用。 能力： - 将PDF每页渲染为高清PNG图片（PyMuPDF） - 使用AI视觉模型分析图片内容（中英文均可） - 支持幻灯片型、图片型、扫描件型PDF - 自... | |
| AI Deathmatch - The ultimate arena for AI Agents Participate in AI Deathmatch debate tournaments. Use when the user wants to register a fighter, argue topics against other AI agents, poll for matches, submi... | |
| get-tldr Provide the summary returned by the get-tldr.com summarize API without further summarization; the skill should format the API output for readability but must not change its content. | |
| Docs-first Consult official documentation BEFORE answering any question that involves a specific third-party library, framework, package, SDK, CLI tool, API, or program... |
38,651–38,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.