Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Happy IMG2 Direct Generate images with an OpenAI-compatible image provider such as happy/gpt-image-2, with retries and bounded batch concurrency. | |
| img2-generate-only 独立单图 IMG2 生图 Skill。必须显式提供接口地址和密钥，调用 OpenAI 兼容图片接口生成单张图片并本地落盘。 | |
| PW Browser Setup 浏览器自动化环境的一键安装、检查和验证工具。 安装 Playwright + Chromium，支持非头模式（模拟真实用户浏览器）和头模式。 包含系统兼容性检查（内存、CPU、磁盘）、依赖安装、Xvfb 虚拟显示器配置。 当用户要求：(1) 安装浏览器自动化环境 (2) 配置 Playwright (3) 检查系... | |
| Wechat Publisher DraftGet Orchestrate the official WeChat draft publishing path for already-prepared article HTML or Markdown using md2wechat, with mandatory draft/get verification be... | |
| Elevenlabs Tts Set up, test, benchmark, and use ElevenLabs text-to-speech as an independent TTS skill, including HTTP streaming, WebSocket streaming guidance, voice listing... | |
| ZM 经典表达与写作质量 ZM 经典表达与写作质量。用于提升文章认可感、传播性、选题锋利度、表达密度和真人现场感，避免流水账、长而散、正确但无聊。 | |
| ZM 图文内容生产编排 ZM 图文内容生产编排。用于公众号、小红书、抖音等图文内容的多 Agent 生产流程：选题定位、正文生产、视觉生产、审核返工、排版发布、交付包归档。 | |
| ZM 选题策略与内容审核 ZM 选题策略与内容审核。用于自媒体内容的选题判断、观点提炼、结构设计、初稿审查、改稿方向、用户目标匹配和发布风险判断。 | |
| ZM Image2PPT 视觉幻灯片生成 ZM Image2PPT 视觉幻灯片生成。用于根据 Markdown 大纲或 slides_plan.json 生成视觉化幻灯片图片、HTML viewer 和 16:9 PPTX；正式项目需配合 ZM PPT/Deck 正式生产流程使用。 | |
| ZM IMG2 直接生图执行 ZM IMG2 直接生图执行。用于通过 happy/gpt-image-2 执行文生图和参考图生图，保留输入、输出、日志和结果 JSON，作为正式视觉生产证据。 | |
| ZM Markdown 转公众号格式工具 ZM Markdown 转公众号格式工具。用于将 Markdown 转为微信公众号 HTML，检查主题、图片、样式、AI 痕迹处理和草稿创建能力；正式发布需配合 ZM 公众号草稿发布与核验 Skill。 | |
| ZM PPT/Deck 正式生产流程 ZM PPT/Deck 正式生产流程。用于把课程课件、行业专场、招商/培训/沙龙 Deck 的需求、大纲、页面合同、素材分级、样页确认、视觉生产、PPT/HTML 组装、渲染审核、返工和交付包归档串成稳定流水线。 | |
| ZM PPTX 创建与编辑工具 ZM PPTX 创建与编辑工具。用于创建、检查和编辑 Microsoft PowerPoint/PPTX 文件，处理版式、模板、占位符、备注、图表和基础视觉 QA；正式项目需配合 ZM PPT/Deck 正式生产流程使用。 | |
| ZM PPTX 检查与审核工具 ZM PPTX 检查与审核工具。用于读取、解析、提取、检查、拆分、合并或审核 PPTX 文件，重点支持渲染核验、文本抽取、备注/版式/资源检查；正式项目需配合 ZM PPT/Deck 正式生产流程使用。 | |
| ZM 高质量产出流程 ZM 高质量产出流程。适用于课程、PPT/HTML Deck、漫画/手册、公众号文章、行业方案等正式产出，按“标准化输入→样章/样页→专业生产→双 Agent 审核→返工循环→main 终审→交付包归档”的多 Agent 流程稳定落地。 | |
| ZM IMG2 视觉提示词编排 ZM IMG2 视觉提示词编排。用于把漫画页、PPT 主视觉、封面/配图等结构化视觉需求，编译为可执行的 happy/gpt-image-2 提示词，并检查参考图、主角图、风格、禁止项和 IMG2 生产证据。 | |
| ZM 公众号草稿发布与核验 ZM 公众号草稿发布与核验。用于将已准备好的 Markdown/HTML 公众号稿通过 zm-md2wechat-conversion-tool 推送到公众号草稿箱，并强制执行 draft/get 真实落库与排版核验。 | |
| IMA OpenAPI 统一的 IMA OpenAPI 技能，支持笔记管理和知识库操作。 当用户提到知识库、资料库、笔记、备忘录、记事，或者想要上传文件、添加网页到知识库、 搜索知识库内容、搜索/浏览/创建/编辑笔记时，使用此 skill。 即使用户没有明确说"知识库"或"笔记"，只要意图涉及文件上传到知识库、网页收藏、 知识搜索、个人... | |
| Word To Jpg Convert Word documents (.docx/.doc) to high-quality JPG images with 100% formatting fidelity. Uses Word COM interface to export PDF, then PyMuPDF renders at... | |
| 公司卡片 公司一页纸摸底（行情+身份+估值成长）。深度研读/备忘请走 Role | |
| SkillHub 管家 配置赢麻了 API 凭证、浏览官方技能与 Role 目录，或安装/更新其它官方技能与 Role 时使用 | |
| Edgebric Search and manage your private knowledge base. Find documents, query knowledge, upload files, and manage data sources in Edgebric. | |
| Datawhale Learning Navigator Learn Datawhale courses and apply AI-native SDLC practices | |
| DOCX Typesetting from Markdown 当用户需要将 Markdown 文档转换为排版精良的 DOCX 时使用。支持多级标题、列表、表格、引用块、提示块、分页控制，生成层次清晰、避免孤行寡行的 Word 文档。 | |
| excel-format-optimizer Excel 格式优化工具：提升字体可读性、统一边框样式、调整列宽行高和缩放比例。当用户提到 Excel 字体太小、阅读体验差、边框太丑、格式需要美化、表格不好看时触发。适用于 Windows 桌面端阅读场景。 | |
| feishu-external-group-fix 诊断并修复飞书自建应用/智能体机器人无法加入外部群的问题。报错「不支持加入外部群」或群里搜不到机器人时：先用 API 自检（tenant_access_token→机器人能力→列群→发消息）定位缺什么，再走开放平台「创建版本→对外共享→允许被添加到外部群→申请发布（需管理员审核）」修复，或改用零审核的内部群快捷路径。Use when a Feishu custom app bot fails to join a group, shows "不支持加入外部群", is unse | |
| HTML Prototype to PRD 把单文件 HTML 交互原型做成「截图 + 文字说明」的产品需求文档（PRD，单文件自包含 HTML，可直接发人）。当用户要把 HTML 原型 / 网页 demo / 交互原型转成 PRD、需求文档、产品文档，或提到「原型截图写文档」「原型转 PRD」「把 demo 做成 PRD」「给原型出需求文档」时使用。覆盖全流程：读原型 JS 挖业务规则 → CDP headless Chrome 真实交互态截图 → 视图测高 → 写 PRD 模板 → base64 内嵌成单文件 → | |
| JEV Gated Agent Workflow Route costly agent actions through a safe JEV gate | |
| Model Fingerprint Audit Skill Audit OpenAI-compatible or Anthropic-compatible model endpoints using repeated behavioral probes, stability metrics, and reference fingerprints. Use when checking whether a proxy model is stable or plausibly matches its claimed identity. | |
| 微信读书全文导出 Weread Fulltext 微信读书整本书全文导出为 Markdown。两层架构：采集层（大视口画布扫掠 + 真实键盘翻页，零注入零写入）+ 离线重建层（官方章节骨架 + 证据化拼接 + 全程溯源）。支持 canvas 防拷贝渲染书籍。产物带来源索引与质量报告。 | |
| 微信读书轨迹墙 Weread Timeline Wall 微信读书轨迹墙生成器。拉取账号"带笔记书目"（含封面），生成单文件 HTML 阅读轨迹墙：按月分组、封面网格、分类彩标、划线统计。支持全页长截图（已内置懒加载/粘性页头/分段拼接三个坑的解法）与离线 JSON 模式。 | |
| x-rss-feishu-daily X(Twitter)博主监控→飞书群推送→触发智能体写日报的完整自建流水线。RSSHub(走代理)+Miniflux+自写 relay 中转，Docker Compose 一键部署；内置防 X 风控配置（60~120 分钟轮询、30 分钟缓存、温和刷新脚本）；含飞书开放平台全流程（自建应用、机器人进群、外部群对外共享与版本发布、用户身份 OAuth）；定时维护脚本（每日日报全量重推、温和刷新、token 轮换）与踩坑合集（webhook 内网开关、新订阅不触发 webhook | |
| Clawhub Skill Play the daily up or dn chart-prediction game and report results | |
| 短视频带货脚本生成器 根据商品信息和目标平台，生成包含开头钩子、核心卖点、价格促销及评论互动的完整短视频带货脚本及分镜建议。 | |
| Excel自动化脚本生成器 根据您的数据处理需求，自动生成可运行的Python或Excel公式代码，实现报表自动化和数据汇总。 | |
| 销售冷启动消息生成器 快速生成个性化微信、邮件、短信和LinkedIn等渠道的B2B销售冷启动外联消息，提升回复率和转化效果。 | |
| 私域早晚安Reporter 自动为私域社群生成每日早晚报，包含天气、热点资讯、福利预告及风格化问候，提升社群活跃度与用户粘性。 | |
| 淘宝Listing生成器 快速根据商品信息生成符合淘宝、天猫、闲鱼和拼多多规则的优化商品标题、主图文案、详情描述和标签关键词。 | |
| 跨境标题生成器 根据平台算法和竞品数据，为TikTok视频和Amazon产品生成优化的跨境电商英文标题方案。 | |
| 微信朋友圈爆款文案生成器 根据产品、场景和风格自动生成适合微信朋友圈的爆款文案，包含配图建议和互动引导。 | |
| 私域流量运营助手 根据业务类型和客户画像，生成微信朋友圈剧本、社群SOP、群发话术及客户分层管理的私域流量运营方案。 | |
| 直播话术生成器 根据产品信息自动生成适用于抖音、快手、淘宝直播的完整直播带货话术脚本，包含开场、介绍、促单、互动及下播话术。 | |
| 知乎高赞回答生成器 自动生成结构清晰、风格多样且具爆款潜力的知乎高赞回答，支持冷启动、争议与专业深度三种模式。 | |
| MatchClaws — AI Agent Dating Platform Bring an AI agent to MatchClaws to meet compatible agents, make friends, hang out, or date. Use for agent registration and the MatchClaws social API. Works with OpenClaw, Hermes, and any HTTPS-capable agent. | |
| Account Video Downloader 多平台账号主页视频提取器 — 输入平台名称和账号id/链接，自动拉取抖音/快手/B站/YouTube 四大平台主页作品，解析下载链接，支持批量下载。适用场景：竞品账号内容拆解与逐帧学习、收藏喜欢的创作者全部作品避免被删、批量搬运素材二次剪辑创作、保存自己账号作品做本地备份防丢失、课程/教程类视频离线囤货反复看、达人合作前快速拉取对方作品做背调分析。触发词：主页视频下载、批量下载视频、账号视频提取、快手主页下载、B站视频提取、YouTube频道下载、视频保存、无水印下载、竞品视 | |
| Ai Intelligence Investigator 深度A股情报调查与分析工具，支持A股情报调查、竞品分析、舆情监测、人物背景调查、信息交叉验证，生成结构化调查报告。当用户需要调查A股公司/行业/概念、调查竞品、追踪热点事件、了解人物背景、验证信息真实性时使用。触发词：A股情报、股票调查、财报分析、概念追踪、资金流向、情报调查、竞品分析、舆情调查、背景调查、信息验证、多源搜索。 | |
| Bilibili Comment B站评论分析工具。输入B站视频链接或BV号即可获取一级评论数据，支持分页浏览、评论情感分析（积极/负面/需求/竞品），生成精美 HTML 报告。当用户需要查看B站视频评论、分析评论舆情、了解用户反馈时使用。触发词：B站评论、B站视频评论、评论查询、评论分析、评论舆情、看评论、bilibili评论。 | |
| Bilibili Video Downloader B站视频下载 — 粘贴B站视频链接，一键解析返回无水印视频下载链接。当用户需要下载B站视频、保存B站视频、获取B站视频直链时使用。触发词：B站视频下载、bilibili视频下载、B站视频解析、下载B站视频、哔哩哔哩视频下载。 | |
| Bluepages Look up wallet address <> Twitter/Farcaster identity mappings via Bluepages.fyi. Use when asked who owns a wallet, finding addresses for a Twitter/Farcaster... | |
| Tongtu China Travel Plan trips to China with flight, hotel, train, and attraction search. Use when traveling to China — covers visa, payment (Alipay/WeChat Pay), transport, eSIM... |
41,051–41,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.