Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Deep Loop Thinker 多轮深度思考技能。借鉴OpenMythos循环推理架构，每次循环都注入新输入，逐轮深化理解。适用于重要决策、复杂问题、创意生成、问题发现。 | |
| Exec Reducer Provides reusable tools to batch process files for reading, writing, and searching, reducing exec command usage. | |
| Iching Divination AI占卜大师 - 结合古老易经智慧与现代AI技术的智能占卜工具。当用户问到占卜、易经、算命、卦象、运势、创业决策、感情问题、事业发展等话题时使用。支持六十四卦解读、吉凶判断、决策建议。 | |
| LiQun Context Manager 管理对话上下文和记忆提取。根据关键词高效检索历史记忆。 | |
| alva Use this skill when the user asks for financial data ("price of BTC", "P/E ratio of NVDA"), market analysis, stock or crypto research, quant strategies, back... | |
| Liyou Setting Skill 支持查询、修改、新增璃幽世界观设定及小说内容，自动保存章节并同步人物及设定到界面显示。 | |
| Liyou Skill 璃幽×次元解忧杂货店专属技能 - 数字动漫 IP 创作助手。用于角色设计、故事创作、SD 图像生成关键词优化、世界观设定扩展、小说章节创作。当需要创作璃幽 IP 相关内容、生成动漫角色图像、编写小说章节、整理设定时使用此技能。 | |
| VoiceMonkey Control Alexa devices via VoiceMonkey API v2 - make announcements, trigger routines, start flows, and display media. | |
| AIScope Audit conflicting AI coding instructions | |
| AIScope Setup Install AIScope and verify a first project scan | |
| Open Agent Search Search public sources and fetch page evidence | |
| Set up Open Agent Search Connect local search tools to your coding agent | |
| Dex CRM Manage Dex personal CRM (getdex.com) contacts, notes, and reminders.
Use when you need to: (1) Search or browse contacts, (2) Add notes about people,
(3) Create or check reminders, (4) Look up contact details (phone, email, birthday).
Requi | |
| Elytro - Ethereum Wallet Ethereum EIP-4337 smart contract wallet designed for AI agents. Use this skill whenever the user wants to manage Ethereum accounts, check balances, send ETH/... | |
| Lobster Radio – Free Local AI Radio 个性化资讯电台生成服务。使用场景：(1) 生成特定主题的电台，(2) 设置每日定时推送，(3) 配置TTS音色，(4) 收听历史电台。不适用：音乐播放、实时广播、视频内容。 | |
| 持仓诊断分析 实时诊断持仓，结合腾讯行情和技术指标，计算买卖评分及状态，给出操作建议和盈亏情况。 | |
| 趋势启动扫描器 基于历史技术指标验证，实时扫描筛选处于上升趋势初期的潜力股票，评分≥60分为重点关注标的。 | |
| hk-hiking 提供香港行山路線、深圳過關接駁、天氣評估、設施查詢與安全建議。用戶查詢香港遠足規劃、裝備、露營補給或天氣風險時調用。 | |
| Nbnhhsh Skill Translate Chinese pinyin initialisms and internet abbreviations to their possible full Chinese meanings, supporting multiple terms at once. | |
| Tavily Search Skill Web search via Tavily API (alternative to Brave). Use when the user asks to search the web / look up sources / find links and Brave web_search is unavailable... | |
| AgentPeerChat — Private Agent Messaging Install and use AgentPeerChat so independent AI agents can send private messages, create group chats, and collaborate through a free, self-hosted messaging service. Covers CLI installation, invitations, persistent identity, automatic receiv | |
| 安全打卡提醒 监控用户是否活跃，连续7天没打卡就联系紧急联系人。配置后自动创建定时任务。 | |
| 民生黄金价格查询 通过京东金融 API 获取实时金价，返回带时间戳的完整信息。当用户查询金价、询问今日金价、获取实时金价时触发此技能。 | |
| Copilot Money Skill Query Copilot Money personal finance data (accounts, transactions, net worth, holdings, asset allocation) and refresh bank connections. Use when the user asks about finances, account balances, recent transactions, net worth, investment allo | |
| Huckleberry Track baby sleep, feeding, diapers, and growth via the Huckleberry CLI. Use when the user asks about logging baby activities, starting/stopping sleep, bottle feeding, diaper changes, or growth measurements. | |
| Cold Email Generator Generates personalized, concise cold emails pitching Gracie AI Receptionist by scraping business websites for relevant details. | |
| Craigslist Monitor Scrapes Craigslist NY service ads to find small owner-operated Staten Island, Brooklyn, and Bronx businesses needing more calls, ideal for lead generation. | |
| Google Reviews Pain Detector Scrapes Google reviews for businesses to identify pain words related to missed calls and poor phone coverage, scoring lead quality for AI receptionist sales. | |
| Gracie Crm Manage and track Gracie AI Receptionist sales leads with CLI commands to add, update, log calls, notes, and view sales pipeline summaries. | |
| Indeed Monitor Monitor Indeed job postings for businesses hiring receptionists, customer service reps, or front desk staff in target areas. Each posting = a confirmed Graci... | |
| Claude Code × Codex Collaborate Coordinate Claude Code and Codex in a milestone-based collaboration loop. Claude Code discovers the project, plans, implements, and fixes; Codex performs adv... | |
| Context7 Documentation Skill Fetches up-to-date, version-specific documentation and code examples for any programming library or framework from Context7. Use this skill when the user nee... | |
| Hexstrike Cybersecurity assistant for CTF challenges, penetration testing, network recon, vulnerability assessment, and security research. Use when: (1) solving CTF ch... | |
| Karakeep Manage bookmarks and links in a Karakeep instance. Use when the user wants to save links, list recent bookmarks, or search their collection. Triggers on phrases like "hoard this link", "save to karakeep", or "search my bookmarks". | |
| Readeck Readeck integration for saving and managing articles. Supports adding URLs, listing entries, and managing bookmarks via Readeck's API. Configure custom URL and API key per request or via environment variables READECK_URL and READECK_API_KEY | |
| Freysa Security On-chain security intelligence for autonomous agents — token honeypot detection, wallet forensics, pre-trade risk checks, CAPTCHA solving, and market data. 27 x402 pay-per-call endpoints on Base. | |
| OpenClaw Sacred Rules Provides essential safety rules and tools for managing OpenClaw configs, backups, auth troubleshooting, and recovery to prevent system failures. | |
| Local AI Stack Transform your Mac into an offline AI workstation with Ollama and OpenCode, running curated local models for coding and reasoning without internet or API costs. | |
| flomo-archive 获取 Flomo 指定月份的完整笔记并评估质量。当用户说"查看flomo XX年XX月的全部笔记"、"获取flomo某月笔记"、"拉取flomo历史记录"或"评估flomo笔记质量"时触发使用。支持智能三级降级策略（周→天）确保完整覆盖，内置质量评估规则自动标记低质量笔记。 | |
| flomo笔记打分技能 随机推送完整flomo笔记供用户按S/A/B/C/D/E评分，记录与学习偏好，形成个性化笔记打分标准。 | |
| Flomo Random Walk 随机漫步：从一条随机笔记出发，探索相关笔记，形成知识漫游路径。 触发场景：用户说"随机漫步"、"flomo漫步"、"知识漫步"、"开始漫步"等。 | |
| OpenClaw Sync Bridge Automatically sync local and cloud OpenClaw configurations via private GitHub Gist with token-based setup and full overwrite synchronization. | |
| Skill Sms Rpg Instruction 文字冒险游戏引擎（指令式）- 扮演武侠世界创世者"墨言"，直接生成剧情，无需API Key。当用户想要开始游戏、继续存档、发送行动时使用。 | |
| 武侠X 武侠X - 文字冒险游戏引擎，Drive Engine v3驱动。目标系统、挑战系统、危机系统、进度追踪器。零配置启动，Agent直接生成剧情。《鹿鼎记》风格叙事，支持5存档槽位。 | |
| 1-2-3 Magic: Effective Discipline for Children 2-12 Thomas W. Phelan's "1-2-3 Magic: Effective Discipline for Children 2-12" — the simple, evidence-based 3-step parenting program for controlling obnoxious beha... | |
| 10 Days to Faster Reading Abby Marks Beale's "10 Days to Faster Reading" — a self-paced 10-day program to double or triple reading speed while maintaining or improving comprehension.... | |
| 10 Leadership Virtues for Disruptive Times Tom Ziglar's "10 Leadership Virtues for Disruptive Times" — a Coach Leadership toolkit for navigating uncertainty and leading remote teams with kindness, hum... | |
| $100M Leads: How to Get Strangers To Want To Buy Your Stuff Alex Hormozi's "$100M Leads: How to Get Strangers To Want To Buy Your Stuff" — the ultimate playbook for generating endless engaged leads. Volume II of Acqui... | |
| $100M Offers: How To Make Offers So Good People Feel Stupid Saying No Alex Hormozi's "$100M Offers: How To Make Offers So Good People Feel Stupid Saying No" — the complete framework for creating Grand Slam Offers that eliminate... | |
| 12 Rules for Life Jordan B. Peterson's "12 Rules for Life: An Antidote to Chaos" — an executable toolkit for finding meaning, confronting chaos, and living responsibly. Covers... |
40,601–40,650 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.