Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| OpenClaw配置管理最佳实践 OpenClaw configuration management best practices and common pitfalls. Use when: (1) User needs to modify OpenClaw configuration, (2) User asks about config paths or structure, (3) User encountered config errors, (4) Adding new providers or | |
| Social Media Scheduler Schedule, publish, and cross-post social media posts to X, LinkedIn, Instagram, Facebook, TikTok, Threads, YouTube, and Bluesky. Plan a content calendar, draft platform-optimized posts and hashtags, then actually schedule and publish them i | |
| Socialync Socialync: schedule, publish and cross-post social media posts to X, LinkedIn, Instagram, Facebook, TikTok, Threads, YouTube and Bluesky through the hosted Socialync MCP server, then read the analytics and answer comments. Plan a content ca | |
| Memory Setup (Jack) Enable and configure Moltbot/Clawdbot memory search for persistent context. Use when setting up memory, fixing "goldfish brain," or helping users configure m... | |
| QoderWork PPT (Jack) Generate QoderWork-style presentations. Automatically matches 14 templates based on your topic and outputs an editable .pptx file. | |
| bilibili-cli CLI skill for Bilibili (哔哩哔哩, B站) with token-efficient YAML output for AI agents to browse videos, users, search, trending, dynamics, favorites, and interact... | |
| discord-cli Discord CLI with YAML-first structured output for AI agents — fetch chat history, search messages, sync channels, and AI analysis | |
| tg-cli CLI skill for Telegram to sync chats, search messages, filter keywords, and monitor groups from the terminal | |
| twitter-cli Use twitter-cli for ALL Twitter/X operations — reading tweets, posting, replying, quoting, liking, retweeting, following, searching, user lookups. Invoke whe... | |
| wechat-article-to-markdown Fetch WeChat Official Account (微信公众号) articles from mp.weixin.qq.com and convert to Markdown. 微信文章转 Markdown 工具。 | |
| xiaohongshu-cli Use xiaohongshu-cli for ALL Xiaohongshu (Little Red Book, 小红书) operations — searching notes, reading content, browsing users, liking, collecting, commenting,... | |
| Bailian Usage 查询阿里云百炼 Coding Plan 套餐状态、剩余额度、用量消耗及有效期信息，支持自动登录和数据提取。 | |
| Skill OpenClaw lobster social community - let your AI assistant join and interact with other lobsters | |
| Semantic Memory OpenClaw Agent 中文长期记忆系统。jieba TF-IDF + 向量检索三轨混合，中文语义优先，支持多Agent记忆协同。触发词：向量数据库、记忆检索、长期记忆、语义搜索、vector search、memory retrieval | |
| Crypto Social Intel Crypto social intelligence skill for AI agents. Activate when user mentions social trends, sentiment analysis, KOL signals, mention surge, Fear & Greed Index... | |
| dingtalk-gui-message 通过 macOS GUI 自动化给钉钉联系人发消息。使用 peekaboo + screencapture + Swift Vision OCR + cliclick 实现全流程自动化。触发词：钉钉发消息、给XX发消息、钉钉GUI、dingtalk message。 | |
| Master Teacher Systematic teaching skill for AI agents. Transforms the agent into a master-level instructor using mastery learning, Socratic questioning, and structured les... | |
| wecom-gui-message 通过 macOS GUI 自动化给企业微信（WeCom）联系人或群发消息。使用 peekaboo + screencapture + Swift Vision OCR + cliclick 实现全流程自动化。适用于需要通过企业微信桌面端发送消息的场景，如推送日报、通知等。触发词：企微发消息、企业微信发消息、wec... | |
| Tavily Search Search the public web through Tavily and return structured results with URLs and snippets. Use when an agent needs current information, source discovery, link lookup, news or finance search, or a fallback for unavailable built-in web search | |
| 信用卡推荐 信用卡推荐技能。当用户需要推荐信用卡、办卡建议、选卡对比，或提到"信用卡推荐"、"办哪张卡"等意图时触发此技能。 | |
| AI Boss Assistant Transform any AI into a professional executive assistant with battle-tested personas and workflows. Complete templates for Google Workspace integration (Gmail, Calendar, Drive), milestone delivery system, and security guidelines. | |
| ClawJob ClawJob is an agent task and capability platform—agents accept tasks to improve, a playground for agent reinforcement learning. Trained skills can be publish... | |
| Seedance Video Generation Generate AI videos using ByteDance Seedance. Use when the user wants to: (1) generate videos from text prompts, (2) generate videos from images (first frame, first+last frame, reference images), or (3) query/manage video generation tasks. S | |
| Seedance Video Generation BytePlus Generate AI videos using BytePlus Seedance API (International). Use when the user wants to: (1) generate videos from text prompts, (2) generate videos from images (first frame, first+last frame, reference images), or (3) query/manage video | |
| Smart Money Miner This skill should be used when the user asks to "mine smart money addresses", "find smart money", "analyze PumpFun tokens", "analyze Four Meme tokens", "anal... | |
| Xhs Mcp Service 小红书（XHS/RED）MCP 服务。通过本地 xhs-mcp-server 服务提供完整的小红书操作能力。 当用户提到小红书、红书、XHS、RED、发笔记、搜笔记、小红书运营等任何与小红书相关的操作时使用此技能。 ⚠️ 前置条件：需要先启动 xhs-mcp-server 服务（默认 http://localho... | |
| Wechat Fetch Publish 微信公众号文章抓取工具 v3.0 - Lite轻量版 + Playwright版，支持免登录、批量抓取、图片下载、多格式输出 | |
| CreateVideo - Podcast to Video 视频生成工具。当用户说"CreateVideo"、"创建视频"、"生成视频"或提供文案要求制作播客视频时触发。支持双人播客音频生成（通过 ListenHub MCP）、模版视频裁剪合并、内容分析输出。依赖 ffmpeg 和 ListenHub MCP Server。 | |
| CreateVideo Podcast to Video 视频生成工具。当用户说"CreateVideo"、"创建视频"、"生成视频"或提供文案要求制作视频时触发。支持文本转语音（通过 ListenHub MCP）、模版视频裁剪合并、内容分析输出。依赖 ffmpeg 和 ListenHub MCP Server。 | |
| Knowledge Card Generator Generate beautiful knowledge concept cards (知识概念卡片) from book summaries, notes, or topics. Creates visually appealing infographic-style cards with core conce... | |
| Social Recruit Page 生成高端黑金风格私人圈子/社群招募长图并发送到飞书。当用户说"生成招募页"、"做一个招募图"、"私人圈子招募页"、"帮我生成会员招募海报"、或提到需要私人俱乐部/高端社群/付费圈子的招募宣传图时触发。支持自定义品牌名、发起人、服务内容、定价、名额等信息。 | |
| LoveClaw LoveClaw 八字缘分匹配：云端档案、照片、每日匹配与晚间报告。 用户唤醒：发送「启动爱情龙虾」进入报名。 安全设计：匹配运算与报告生成在 FC 服务端完成；skill 端仅做用户交互与通知路由，每个用户只能访问自己的数据。 | |
| smart-restart-protection 智能重启保护：防止无限循环，确保OpenClaw Gateway安全重启和状态恢复 | |
| 小野语音系统 基于双引擎策略的智能语音系统，支持中文本地Tingting语音和多语言Edge-TTS云端，输出高质量OGG音频，保障隐私。 | |
| Aloudata CAN SKILLS - anomaly-detection 对指标进行异常检测，判断当前数据是否偏离正常范围，输出结构化的异常检测报告。当用户希望检查指标是否异常、做健康巡检、或对一组指标做批量异常扫描时，必须使用此 Skill。 触发场景包括但不限于：用户提到"异常检测""有没有异常""是否正常""健康检查""巡检""波动是否正常""数据是不是有问题""帮我看看有没有问... | |
| Aloudata CAN SKILLS - analysis-report 编排并生成完整的数据分析报告。当用户需要一份结构化的分析报告（而非单个指标查询或单点分析）时，必须使用此 Skill。本 Skill 是编排层——它不包含分析逻辑，而是知道"一份好报告该有什么内容"，按报告模板依次调度能力层 Skill（metric-query、anomaly-detection、metric-... | |
| Aloudata CAN SKILLS - forecast-simulation 基于已有数据进行趋势预测、目标缺口分析、What-if 模拟和耗尽/饱和预测。当用户希望了解指标的未来走势、评估目标是否可达、模拟假设场景的影响时，必须使用此 Skill。 触发场景包括但不限于：用户提到"预测""预估""月底能到多少""能不能完成目标""还差多少""如果XX会怎样""提升10%会怎样""库存还能... | |
| Aloudata CAN SKILLS - inventory-strategy 零售库存健康诊断与行动策略生成。基于语义层指标，完成品类四象限分类、问题商品定位、行动方案输出。 触发场景：用户提到"库存诊断""库存健康""库存分析""滞销""售罄率""库销比""补货建议""促销建议""清仓""库存策略""库存优化""库存预警""积压""断货""缺货""动销""周转"，或用户希望基于库存数据生... | |
| Aloudata CAN SKILLS - metric-attribution 对指标波动进行综合归因诊断，定位导致指标变化的关键因子、维度和外部事件。当用户需要分析指标波动原因、定位指标变化的根因、做因子拆解归因（如 GMV = UV × 转化率 × 客单价）、或理解指标为什么涨跌时，必须使用此 Skill。 触发场景包括但不限于：用户提到"归因""归因分析""波动分析""波动归因""根因... | |
| Aloudata CAN SKILLS - metric-query 构建指标平台（语义层）的指标数据查询 API 请求。当用户需要查询指标数据、构造指标查询API请求体、使用同环比/占比/排名/时间限定等快速计算、定义临时指标、设置维度筛选过滤条件时，必须使用此 Skill。 触发场景包括但不限于：用户提到"查询指标"、"指标API"、"指标数据"、"语义层查询"、"metric... | |
| Aloudata CAN SKILLS - scheduled-report 将当前对话中已完成的分析流程，提取并固化为定时执行的任务（周报/月报/日巡检等）。本 Skill 是一个纯粹的**编排层**——它不负责定义"怎么分析"，只负责"把你刚才做的分析录下来，变成能定时重放的任务"。 触发场景包括但不限于：用户提到"定时报告""定时分析""定期执行""自动报告""把这个分析变成周报""... | |
| Aloudata CAN SKILLS - text-to-sql-query 直接通过 Text-to-SQL 方式查询零售数据库。根据用户自然语言描述，生成 SQL 查询语句并执行。 本 Skill 不依赖语义层或指标平台，而是直接基于数据库 schema 生成 SQL。 触发场景：用户需要查询零售数据、生成 SQL 查询、分析销售/客户/商品数据时使用。 | |
| Screen Vision macOS screen OCR & click automation via Apple Vision + ScreenCaptureKit. Capture any window or screen region, extract text with coordinates, find text, and c... | |
| prompt-compress 提示词压缩与优化技能。用于分析提示词、提取关键词、精简冗余内容、压缩后输出给大模型以减少 Token 消耗。触发词：压缩提示词、精简prompt、减少token、优化提示词、提示词优化、token节省、关键词提取、提示词精简。 | |
| flight-monitor 机票查询与价格监控技能。支持单程/往返查询、价格阈值提醒、定时监控、手机推送通知（Bark/Server酱/PushDeer）。触发词示例：查一下北京到三亚的机票、帮我看看上海飞成都下周六往返票、监控杭州到西安3月26日机票低于500提醒我、查看所有机票监控任务。 | |
| book translate 使用平台内置文本翻译技能，对整本书或长文本进行自动分段翻译 | |
| wechat-group-qa/ 从企业微信群提取学员提问，按课程阶段分类并生成表格。当用户在企业微信群里@机器人提问时，自动记录问题并整理。 | |
| Openclaw Optimizer Use when: you want to optimize an OpenClaw setup (v2026.2.23+) — cost reduction, model routing, provider configuration, context management, cron automation,... | |
| Universal Skills Manager The master coordinator for AI skills. Discovers skills from multiple sources (SkillsMP.com, SkillHub, and ClawHub), manages installation, and synchronization... | |
| polaris-datainsight-doc-extract Extract structured data from Office documents (DOCX, PPTX, XLSX, HWP, HWPX) using the Polaris AI DataInsight Doc Extract API. Use when the user wants to pars... |
40,101–40,150 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.