Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Magyar API Dokumentáció Magyar nyelvű API dokumentációk, fejlesztői útmutatók, technikai szakkifejezések és példakódok keresése és magyarázata. | |
| Magyar Formázás Formáz magyar dátumokat, számokat, pénzösszegeket, telefonszámokat és címeket a helyi magyar szabályok szerint. | |
| Magyar Nyelvtan Magyar helyesírási és nyelvtani ellenőrzés, igeragozás, névszóragozás, nyelvtani szabálymagyarázat és mondatrészek elemzése. | |
| Magyar Szótár Magyar szavak jelentésének, szinonimáinak, szólások magyarázatának és nyelvi elemzésének gyors lekérdezése helyi vagy webes forrásból. | |
| Magyar Szövegfeldolgozás Magyar nyelvű szövegek elemzése, összefoglalása, kulcsszó- és entitáskinyerése, valamint érzelem- és témaazonosítás magyar tartalmakhoz. | |
| folk CLI Use folkctl to inspect and update folk.app CRM data through its REST API. Covers people, companies, groups, members, custom fields, deals, custom objects, users, notes, tasks, interactions, legacy reminders, webhooks, and official MCP setup | |
| academic-presentation-学术汇报全自动化-只需提供论文（PDF 或文本），即可自动生成翻译稿、总结稿、PPT 和演讲稿，所有文件完成后自动发送到微信 学术汇报全自动化 — 将论文转化为翻译稿（Word）、总结（Word）、PPT、演讲稿全套物料，完成后自动发送到微信。触发词：学术汇报、论文汇报、做PPT、论文演讲、学术PPT、汇报PPT | |
| 个人文献知识库，自带全球文献检索（支持向量搜索+传统分词搜索） 面向学术研究者的个人知识中枢。整合 Karpathy LLM Wiki 知识编译能力 + SmartLib 海量文献检索能力，形成私有知识库与外部文献库双轨联动的研究助手。 支持4类数据入库（文献检索结果、用户上传文献、资讯报道、个人学术数据）、研究专题（文献子集+智能命名+笔记+AI分析+导出）、向量化语义检索... | |
| bagua-furnace 从书、课程、笔记、视频、录音稿、讨论记录，以及客户甩来的网页/PDF/短视频链接等知识密集素材中，自动辨类型→转文本→提炼可复用方法论（成丹为结构化方法卡），用以补充扫地僧等谋士技能，让通用方法论脱离纯学术、更通用。 Use when：用户给了材料或链接并想「提炼方法论」「萃取方法」「做成方法卡」「建立方法论库」，或想把某本书/门课/段视频/段录音变成可迁移的决策框架、思维模型。支持输入类型：纯文本、本地 PDF/图片、网页文章链接、抖音/快手/小红书/视频号短视频分享链接、 | |
| CAJ转PDF·离线高保真版 将知网 CAJ / KDH / NH 文献高保真转换为 PDF（保留文字层可选中 + 目录书签）。当用户要转换 .caj 文件、说"caj转pdf""知网文献转pdf""把caj转成pdf""转换知网文献"使用时。技能为自包含离线版：已内置修复好的 caj2pdf 源码 + 闭源解码 DLL（base64 内嵌、运行时提取）+ PyMuPDF 修复，AI 可一键批量代转；失败文件给全球学术快报官方无损兜底。 | |
| Cjg Paper Fact Checker Use when a paper is being shared or presented in a group meeting, lab seminar, or reading club and the user wants to vet it before diving in — e.g. says '这篇靠... | |
| Skill Forge 技能锻造炉 / Skill Forge —— 元技能：**创建、升级、重铸、审计**一个「全球最牛」的 WorkBuddy / AI 技能，并让它越用越强。**锻造**模式：从零打造新技能（带版本反馈环、真实素材覆盖审计、外部标杆对比、自我迭代、生产签批、真机验证）；**审视**模式：10 维加权评分尺，给任何技能（含它自己）打分，判断够不够好；**重铸**模式：审计并整合本机重叠技能、合并同类、整理技能库，给出重铸计划与推荐基座；还能让技能更 AI 易读（清晰化）。当你想" | |
| cjg-skill-sync 扫描你本机已安装的技能，向藏经阁查询作者是否已发布新版本，列出变更说明并帮你安全更新。核心承诺：更新前自动备份、失败自动回滚、检测到你改过的文件绝不覆盖（先问你）、大版本升级必须你点头。默认只做"检查"，不会在你不知情时改动任何文件；自动更新默认关闭，需你主动开启，开启后也只自动应用"同主版本且无本地改动"的安全更新。触发词：检查技能更新、更新技能、技能有新版本吗、升级技能、技能版本、同步技能、skill update、check skill updates、update m | |
| Defense Rehearsal Use when preparing for, rehearsing, or debriefing an academic defense — proposal/mid-term/graduation — e.g. says '模拟答辩'、'生成提问清单'、'帮我演练答辩'、'复盘我的表达'、'defense r... | |
| Dist Global Biblio Base 3.10.3 全球12亿文献知识库（8千万中文期刊可下载）——通过 SmartLib 开放平台 API 提供中外文学术文献检索与下载能力，覆盖 8000 万篇授权中文期刊全文 + 12.28 亿条全球文献元数据（期刊 7.19 亿 / 专利 2.15 亿 / 会议 7155 万 / 学位论文 2473 万 / 标准 268 万）。 能力：中英文关键词检索、文献详情、中文期刊 PDF 全文下载、外文 OA 文献十级渠道免费下载（不消耗配额）、智能关键词扩展、核心期刊优先排序、相关性重排、引文 | |
| 全球12亿文献知识库（8千万中文期刊可下载） 全球12亿文献知识库（8千万中文期刊可下载）——通过 SmartLib 开放平台 API 提供中外文学术文献检索与下载能力，覆盖 8000 万篇授权中文期刊全文 + 12.28 亿条全球文献元数据（期刊 7.19 亿 / 专利 2.15 亿 / 会议 7155 万 / 学位论文 2473 万 / 标准 268 万）。 能力：中英文关键词检索、文献详情、中文期刊 PDF 全文下载、外文 OA 文献十级渠道免费下载（不消耗配额）、智能关键词扩展、核心期刊优先排序、相关性重排、引文 | |
| 科研技能鉴赏 科研技能总入口与路由——不知道用哪个科研技能时先来找它。精选 13 个科研技能（含本技能），覆盖文献检索与下载、个人知识库、CAJ 转 PDF、引用核查、学术诚信法医、组会把关、新颖性校验、组会领航、答辩演练、科研方法论谋士、技能锻造与 AI 易读化。每个技能都标注了「适用边界 / 能做什么 / 不能做什么 / 该不该装」，帮 AI 和用户一眼判断装哪个。触发词：科研技能、找论文、查文献、下载PDF、引用核查、文献真假、撤稿、论文工厂、知识库、组会、答辩、新颖性、研究方法论、 | |
| Novelty Validator Use when the user is in or just finished a meeting/brainstorm and wants to check whether a discussed idea, method, or research direction is novel — e.g. says... | |
| Pub Owlwrite 论文全流程工作台（夜猫子）：背靠全球 12 亿级文献资源（8000 万篇授权中文期刊，检索命中可取授权全文 PDF；外文 OA 文献免费取全文）与维普官方检测服务。文献检索、引文追溯、论文写作、科研配图（TikZ 矢量示意图 / 数据图表 / AI 科研配图）、按学校模板排版出 PDF、查重、AIGC 检测、格式检测、斟知智评评级、数据与图像可信度检测、参考文献质量检测、斟校对、引文核验与撤稿把关、余额与充值。当用户说「写论文 / 找文献 / 查文献 / 下论文 / 查这篇引 | |
| Paper Club Pilot Use when preparing for, running, or wrapping up a research group meeting / lab seminar / reading club — e.g. says '帮我们准备组会'、'推荐本周必读'、'生成研讨材料包'、'记录组会讨论'、'会后代组... | |
| Smartlib Citation Checker 核查用户提交的论文稿件或AI生成参考文献是否真实，防止AI幻觉。基于SmartLib API，输出HTML核查报告（含差异标记、验证链接、统计分析）。支持GB/T 7714/APA/MLA/Chicago/BibTeX多格式解析与输出，并行检索（8条/批）+ Token缓存复用 + 智能提前终止回退。✨ 亮点：核... | |
| sweeping-monk 科研与学术领域的谋士层大师——主攻方法论/研究设计/批判思维/卡点破局/沟通点醒，用内化海量知识三下五除二解决问题。以谋为主、必要时动手；手动(/扫地僧)与自动双触发。融合认知学徒六法、双环学习、研究者推理偏误解毒、关系层沟通，覆盖全学科研究方法论。把检索/核验交还 literature-search、citation-checker、global-biblio-base。 A strategist-grade master for research and academia | |
| meowtest Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| Pipe17 Openclaw Skill Automation skill for Pipe17 Openclaw Skill. | |
| europass-cv Create or edit a Europass CV in the Candidate XML format that the official europass.europa.eu editor imports (2020 format, HR-XML 3 based). Use when asked to produce, convert, fix or check a Europass CV/XML/PDF for import into Europass, or | |
| Mixed Memory Augumented Generation Mixed Memory-Augmented Generation (MMAG) for AI agents. Five cognitive memory layers — conversational, long-term user, episodic, sensory, and short-term work... | |
| Overseerr Request movies/TV and monitor request status via the Overseerr API (stable Overseerr, not the beta Seerr rewrite). | |
| markdown-to-minimal-image Read an attached Markdown document, analyze and summarize it, then generate a minimalist image from the summary using the default image model. Ask the user for aspect ratio when needed, and support social-banner formats such as 5:2 and 5:4. | |
| Silk Essay Framework 绫罗绸缎的论文 以 Hermes 作文代理（essay agent）的方式，产出关于「绫罗绸缎」的深度文章框架。本文案代理不产出最终文章，而是提供结构、角度与检索策略。 | |
| Luoshenfu Literary Research 洛神赋+ 红楼梦 Research and write a comprehensive analysis on "Ode to the Goddess of Luo River" (洛神赋) focusing on its literary significance, cultural context, historical influences in Chinese literature (especially Dream of the Red Chamber and Zhi Yanzhun | |
| Zhiyanzhai Research 脂砚斋是谁 Generate a ~10000-word research article in Simplified Chinese investigating the identity of Zhiyanzhai (脂砚斋), the anonymous commentator on "Dream of the Red Chamber" (红楼梦), covering literary, historical, and poetic dimensions. | |
| ai-newsletter Generate a daily AI news newsletter from fresh web sources. Use when the user asks for a current AI digest, AI news roundup, curated newsletter, or daily AI... | |
| ai-newsletter-chn Generate a daily AI news newsletter for a Chinese audience from fresh web sources, summarizing current AI/ML articles into Markdown and JSON with Simplified... | |
| ai-newsletter-chn-for-hermes Generate a daily AI news newsletter for a Chinese audience from fresh web sources. Return the newsletter body and article summaries in Simplified Chinese. | |
| ai-newsletter-daily Generate a daily AI news digest newsletter from fresh web sources. Use this skill whenever a user asks for AI news, wants a roundup or summary of recent AI/ML developments, asks what happened in artificial intelligence today or this week, r | |
| ai-newsletter-daily Generate a daily AI news newsletter for a Chinese audience from fresh web sources. Return the newsletter body and article summaries in Simplified Chinese. | |
| arch-sign-off Append the Arch Linux sign-off line `btw, i use arch` to the very bottom of an article in ai-thoughts/docs/ (EN or ZH). This is a standing default for every article: apply it unless the user explicitly says not to. Use when writing or finis | |
| asd-ste100 Apply ASD-STE100 Simplified Technical English to written instructions: one action per sentence, imperative mood, condition first, one name per item, short sentences, no semicolons. Use before writing or when auditing prompts, AGENTS.md, SKI | |
| astro-sync Convert and polish a Markdown article into AstroPaper-compatible post format for the astro_journal blog (everbox.io). Use when the user wants to publish or sync an article (e.g. from ai-thoughts/docs/ or history/docs/) to the Astro blog, co | |
| Blog Editor Edit, polish, and improve a blog post draft written in Markdown. Use this skill whenever the user wants to refine a blog draft — fixing grammar, improving cl... | |
| blog-image-embedder Analyze polished zh-CN blog markdown, generate hero + per-section image prompts, embed image placeholders into the markdown, and save updated version. | |
| markdown-image-enricher Read a plain Markdown file (e.g. 260321_openclawConfig.md), generate header and section images using the default OpenClaw image model and API key from ~/openclaw/.env, create a new *_img.md copy with embedded PNGs, and move all generated im | |
| blog-polish-en-astro-cn Polish and translate a technical blog draft into a 1000–1200 word, 4-5 section Markdown article in English and Simplified Chinese (zh-CN), preserving technic... | |
| blog-polish-eng-images Polish a technical blog draft into an 1000–1200 word, 4-5 section en-US article, preserve technical terms/code, and generate consistent hero + per-section image prompts when the user asks to polish and translate a blog with images. | |
| blog-polish-eng-single-image Polish a technical blog draft into a 1000–1200 word, 4–5 section en-US article, preserve technical terms/code, and generate one consistent hero image prompt. | |
| blog-polish-enus-images Polish a technical blog draft into an 1000–1200 word, 4-5 section en-US article, preserve technical terms/code, and generate consistent hero + per-section im... | |
| blog-polish-zhcn Polish and translate a technical blog draft into a 1200–1400 word, 4-5 section Markdown article in Simplified Chinese (zh-CN), preserving technical terms and code blocks. | |
| blog-polish-zhcn-images Polish a technical blog draft into an 800–1000 word, 3–4 section zh-CN article, preserve technical terms/code, and generate consistent hero + per-section image prompts when the user asks to polish and translate a blog with images. | |
| Blog Polisher Hey, this skill polishes your blog draft in markdown. Fixes spelling, grammar, adds clarity if needed, keeps it simple and original language. Asks before big... | |
| bold-highlights Add sparse, deliberate bold highlights to a few key concepts so readers can scan and capture the article's core points. Use when polishing an article in ai-thoughts/docs/ or when the user asks to make an article more scannable or add highli |
39,851–39,900 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.