Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Audit Case Rag Local-first, event-driven RAG for commercial real estate audit & investigation case folders. Index a case directory named like "项目问题编号__标题" (with stage subfolders such as 01_policy_basis/02_process/04_settlement_payment) and query it with c | |
| Remotion + Excalidraw + TTS Generate a narrated Remotion video from an Excalidraw (.excalidraw) diagram using text-to-speech (macOS say) and render to MP4. Use when creating explainer videos with pan/zoom + focus highlights over Excalidraw diagrams, with automated voi | |
| Terrain Route Video Generate a minimalist terrain-style animated driving route video (MP4) from a list of stops (cities/POIs) without Remotion. Uses OSRM for road-following geom... | |
| Trail Nav via Telegram (low-token) Offline-capable hiking route guidance via Telegram location messages (OpenClaw). Use when building/operating an LLM agent workflow that: (1) imports a GPX/KM... | |
| X Actionbook Recap Collect, scroll, extract, and summarize recent X (Twitter) posts for any handle (optionally filtered by keyword search) using the Actionbook Rust CLI (actionbook-rs) workflow (open → snapshot/accessibility tree → extract `article` text). Us | |
| x-recap Monitor and recap official X (Twitter) updates using actionbook-rs screenshots. Use when the user asks to track/recap X posts (especially official accounts l... | |
| YC New Way Apply Y Combinator’s “New Way to Build a Startup” playbook to ship fast, validate with real distribution, and iterate using data. Use when the user asks to f... | |
| OpenClaw Cron Guardrails Create, review, repair, or route OpenClaw cron jobs and other scheduled agent actions with safe defaults and explicit delivery/session routing. Use when the... | |
| Museum Data Manager Manage and query museum database records, track data collection status, verify completeness, and export museum data in JSON, CSV, or SQL formats. | |
| Daily Market Analysis 每日市场分析技能。当用户要求"每日市场分析"、"今日市场"、"隔夜行情"、"盘前分析"、"市场早报"、"市场概况"时，必须使用此技能。覆盖美股、港股、A股三大市场的隔夜表现，提取重点新闻，并给出今日投资建议。适用于每天早晨的投资决策参考。Use this skill for any request involvi... | |
| B站视频转文字 Bilibili video to text B站视频转文字 / Bilibili video to text. 用户发来 bilibili.com/video/BV… 或 b23.tv 短链，要提取视频文案、做笔记、总结 UP 主讲了什么、整理课程或评测内容时使用。返回口播逐字稿（分段带时间）、画面上的字、标题简介、要点和互动数据。不登录 B 站、不要 Cookie、不下载视频。1 分钟视频 2 积分（约 ¥0.29），读不了不扣费；需要 LinkDigest API Key（注册送 10 积分，不用绑卡）。 | |
| Douyin search to text 抖音搜索转文字 抖音按关键词搜视频再转文字 / Search Douyin by topic, then turn the videos into text. 给一个话题（中文或英文，如 露营装备、AI 编程、camping gear），返回网页已收录的 douyin.com/video 链接和标题；再挑几条读成口播逐字稿、画面文字、要点和点赞评论数。用于找对标视频、选题调研、竞品内容整理。搜索 0 积分；读一条 1 分钟视频 2 积分。不登录抖音、不要 Cookie、不下载视频。需要 Li | |
| douyin-video-to-text 抖音视频转文字：口播逐字稿（带时间）、画面上的字幕和文字、标题简介、章节、要点、点赞评论收藏数。用户发来 douyin.com、v.douyin.com 链接或分享口令，要提取文案、扒口播、提字幕、总结视频时使用。不需要 Key 也能先免费看一条摘要；注册拿 Key（送 10 积分）后给完整逐字稿，1 分钟视频 2 积分（约 ¥0.29）。不下载视频，不需要抖音账号或 Cookie。 | |
| linkdigest Read a social media link that returns nothing useful when fetched — Xiaohongshu (小红书), Douyin (抖音), TikTok, YouTube, X, or an ordinary web page. Returns the transcript, the on-screen text, a description of every image, the caption and the m | |
| linkdigest-script-rewrite 对标视频脚本仿写：给一条抖音、小红书或 TikTok 爆款视频链接，先提取它的口播稿（逐字稿）和结构（开头钩子、分段节拍、标题公式、结尾引导），再按同样的结构写出你自己主题的口播脚本。用户说「仿写这条视频」「照这个结构写个脚本」「扒一下这条视频的文案再改写」「口播稿改写」时使用。原视频内容通过 LinkDigest API 读取，引用逐字核对原文，需要 LINKDIGEST_API_KEY；仿写由你当前的模型完成，不另收费。 | |
| linkdigest-video-transcript 抖音/小红书视频文案提取：口播逐字稿、画面上的字（带大致时间）、要点和互动数据。用户发来抖音、小红书视频笔记、TikTok、YouTube 、X 或 B站的视频链接或分享文案，要提取文案、视频转文字、扒口播、提取字幕或画面文字时使用。长视频会排队，脚本自动轮询取结果。通过 LinkDigest API 读取，不用下载视频，不需要平台账号或 Cookie。需要 LINKDIGEST_API_KEY；每条 1 积分，另加每开始的 1 分钟 1 积分（1 分钟视频共 2 积分，约 | |
| linkdigest-viral-breakdown 爆款拆解：把一条抖音、小红书、TikTok 或 YouTube 内容拆成开头钩子、带时间的结构节拍、标题公式、封面文字、行动号召和可复用模板。引用的原话逐字核对原文，对不上的删掉并写明删了几条；点赞收藏和话题标签取自平台数据，不由模型编写。用户要拆解爆款、分析对标账号、学习内容结构或准备仿写时使用。通过 LinkDigest API 读取，不需要平台账号或 Cookie。需要 LINKDIGEST_API_KEY；在读取费用上加 1 积分（约 ¥0.14），6 张图以内的图文 | |
| linkdigest-wechat-article-reader 微信公众号文章提取：把 mp.weixin.qq.com 文章链接读成全文 Markdown，连文章里每张图片上的文字一起 OCR。用户发来公众号文章链接，要全文、要点、图片里的字（长图、截图、表格、海报）、作者和发布日期、文末「阅读原文」和二维码指向的链接时使用。不需要微信登录或 Cookie。通过 LinkDigest API 读取，需要 LINKDIGEST_API_KEY，按量计费：6 张图以内 1 积分（约 ¥0.14），注册送 10 积分。 | |
| linkdigest-xhs-note-ocr 小红书图文笔记提取，连图片里的字一起 OCR。用户发来小红书笔记链接或分享文案（xiaohongshu.com、xhslink.com），要提取笔记正文、图片上的文字、每张图的描述、要点、点赞收藏数或话题标签时使用。图文笔记的正文常写在图片里，直接抓网页拿不到。通过 LinkDigest API 读取，不需要小红书账号或 Cookie。需要 LINKDIGEST_API_KEY，按量计费：6 张图以内 1 积分（约 ¥0.14），注册送 10 积分。 | |
| linkdigest-xiaohongshu-douyin-reader Read a Xiaohongshu (RedNote) or Douyin link in English. Use when the user shares a xiaohongshu.com, xhslink.com, rednote.com, douyin.com or v.douyin.com link and wants to know what the post says: the caption, the text inside the images (OCR | |
| linkdigest-youtube-summary YouTube 视频总结和字幕提取，带时间戳，可直接译成中文。用户发来 YouTube 链接（youtube.com、youtu.be、Shorts），要中文总结、要点、逐字稿、字幕、画面上的文字，或者想不看视频先知道讲了什么时使用。没有字幕的视频也能读：由模型直接看视频，口播和画面文字一起出。不需要梯子抓字幕、不需要 yt-dlp、不需要 Cookie。通过 LinkDigest API 读取，需要 LINKDIGEST_API_KEY，按分钟计费，注册送 10 积分。 | |
| long-video-transcript 长视频转文字（最长 2 小时）：讲座、课程、播客、直播回放的完整逐字稿（带时间）+ 每分钟一帧的画面文字 + 章节和要点。用户发来抖音、小红书、TikTok、YouTube 的长视频链接要全文逐字稿、课程笔记或总结时使用。走 transcript 省钱档：每 2 分钟 1 积分（1 小时约 ¥4.4），免费账户最长 60 分钟，Dev 月付最长 2 小时。不需要 Key 也能先免费看一条摘要；注册拿 Key 送 10 积分。不下载视频，不需要平台账号。 | |
| 播客转文字 Podcast to text (小宇宙 Apple Podcasts) 播客转文字 / Podcast to text：小宇宙、Apple Podcasts 单集链接 → 带时间的逐字稿、节目简介（shownotes）、要点（每条附逐字核对过的原文）、播放和评论数、小宇宙页面上的热评。用户发来 xiaoyuzhoufm.com/episode/… 或 podcasts.apple.com/…?i=… 链接，要整理播客笔记、提取金句、做摘要、找某段说了什么时使用。只读声音：每开始的 2 分钟 1 积分，不收基础积分，45 分钟一集 23 积分；读过 | |
| tiktok-transcript TikTok video to transcript: the spoken words with timestamps, on-screen captions, title, hashtags, key points and like/comment counts. Use when the user shares a tiktok.com or vm.tiktok.com link and wants the transcript, the captions, a sum | |
| 微博转文字 Weibo to text (LinkDigest) 微博转文字 / 微博视频文案提取 / 微博 API：一条微博链接读成文字——正文、作者和时间、转发评论点赞数、每张图的描述和图上的字、视频口播逐字稿和画面文字、话题、前几条热评、逐字核对的要点。用户发来 weibo.com、m.weibo.cn 链接，要提取微博内容、扒视频文案、整理热评、做舆情或竞品资料时使用。不用申请微博开放平台，不用微博账号或 Cookie。图文 1 积分起，1 分钟视频 2 积分；注册送 10 积分。 | |
| xiaohongshu-note-to-text 小红书笔记转文字：图文笔记每张图里的字（OCR）、图片描述、正文、标签、点赞收藏，视频笔记给口播逐字稿和画面文字，附分享页前几条热评；加 --insight 得消费者洞察（受众、卖点、顾虑、购买意向、产品价格、读者提问，每条带核对过的引文）。用户发来 xiaohongshu.com、xhslink.com、rednote.com 链接或分享口令，要提取笔记内容、图片文字、文案、做笔记总结或翻译时使用。不需要 Key 也能先免费看一条摘要；注册拿 Key（送 10 积分）后给完 | |
| xiaohongshu-search-to-text 小红书按话题搜笔记再读成文字 / Search Xiaohongshu (RedNote) by topic, then read the notes. 给一个话题（如 成都 咖啡店、通勤穿搭、skincare routine），返回网页已收录的小红书笔记链接和标题；再挑几条读出正文、每张图上的文字（OCR）和描述、分享页热评、要点和点赞收藏数。用于选品调研、看同行、找达人、整理用户怎么评价。搜到笔记每次 4 积分（搜不到不扣）；读一条图文笔记 1 积分起。不登录小红书、不要 | |
| FlightClaw Track flight prices using Google Flights data. Search flights, find cheapest dates, filter by airline/time/duration/price, track routes over time, and get al... | |
| AIGroup Browser Skill Open pages with the real CN or global browser profile on spark and return the live page title plus final URL. Use this instead of web_fetch, search, canvas,... | |
| AIGroup Finnhub MCP Use Finnhub-backed market intelligence through the `aigroup-finnhub-mcp` server for stock, crypto, forex, calendar, news, sentiment, filing, ownership, analy... | |
| AIGroup FMP MCP Use `aigroup-fmp-mcp` for listed-equity data from Financial Modeling Prep, including quotes, company profiles, statements, ratios, sector context, and calend... | |
| AIGroup Market MCP Use `aigroup-market-mcp` for China-market and Tushare-oriented data. Route A-share, index, sector, fund-flow, margin, block-trade, dragon-tiger, fund, conver... | |
| AIGroup Markdown to Word MCP Use `aigroup-mdtoword-mcp` to convert Markdown into `.docx`. Route Markdown file conversion, generated Markdown conversion, table-to-Markdown preprocessing,... | |
| Banker Memo Generate an investment-banker-grade research memo (analysis.md + slides-outline.md + data-provenance.md) from CN raw-data/ snapshots. Use when the user asks... | |
| Banker Memo Md Produce an investment-banker-grade research memo (analysis.md + data-provenance.md) from CN raw-data/ JSON snapshots. Use when the user asks for "投行 md" / "银... | |
| Banker Slides Pptx Turn a banker-memo analysis.md + data-provenance.md into an investment-banker-craft .pptx (real tables, bar/line charts, risk heatmap, scenario grid — NOT pa... | |
| Cn Client Investigation China mainland client investigation and banker-grade analysis with strict guards for Chinese text accuracy and data provenance. Use when the target is an A-s... | |
| Cn Lead Safety Chinese-market client-intelligence safety layer for lead-discovery skills. Use for any lead-gen / customer-investigation output targeting a Chinese company (... | |
| Data Quality Audit Independent cross-source audit of a completed CN banker deliverable. Use when the user asks to audit / double-check / 双核实 / 交叉验证 / 数据质量检查 / 审计 an existing de... | |
| Ppt Deliverable Turn financial-services outputs into slides or a PowerPoint deck. Use when the user wants a strip, teaser, pitch material, refreshed deck, or a banker-ready... | |
| Word Deliverable Turn financial-services outputs into a polished Word deliverable. Use when the user wants an IC memo, customer memo, internal note, diligence summary, or ban... | |
| 3d Web Experience Expert in building 3D experiences for the web - Three.js, React Three Fiber, Spline, WebGL, and interactive 3D scenes. Covers product configurators, 3D portf... | |
| Calendar Manager 日历管理技能 - 让 AI 能够读取日程、创建事件、设置提醒。当用户要求查看日程、添加日历事件、提醒 upcoming events 时触发此技能。 | |
| Document Pro 文档处理技能 - 让 AI 能够读取、解析、提取 PDF、DOCX、PPT 等文档的关键信息。当用户要求分析文档、提取内容、总结报告时触发此技能。 | |
| Email Reader 邮件读取与管理技能 - 让 AI 能够读取、汇总、发送邮件。当用户要求查看邮件、汇总未读、发送邮件通知时触发此技能。 | |
| Video Understanding 视频理解与分析能力 - 让 AI 能够理解视频内容、提取关键信息。当用户要求分析视频、理解视频内容、总结视频、提取视频要点时触发此技能。 | |
| Web Learner 自主上网学习技能 - 让 AI 能够主动搜索、浏览和从互联网获取知识。当用户要求了解最新信息、学习新知识、查询新闻、获取某个主题的详细信息，或需要从网络上获取数据时触发此技能。 | |
| Capability Evolver Pro 1.0.2 Meta-skill for AI agent self-improvement. Analyzes runtime logs to detect error patterns, regressions, and inefficiencies, then generates structured improvem... | |
| dingtalk mailbox 钉钉邮箱访问skill，使用mcporter调用钉钉邮箱MCP服务。支持查询可用邮箱列表、搜索邮件（类KQL表达式）、获取邮件详情、发送邮件。适用于需要通过AI助手管理钉钉邮箱的场景，如查询邮件、自动回复、邮件归档等。 | |
| guanyuan data 观远数据API工具 - 支持多种认证方式、Token自动管理、卡片数据获取和CSV导出 |
40,001–40,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.