Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Mx Data 基于东方财富权威数据库的金融数据查询工具，支持行情、财务及关联关系数据。 | |
| Mx Search 本skill基于东方财富妙想搜索能力，基于金融场景进行信源智能筛选，用于获取涉及时效性信息或特定事件信息的任务，包括新闻、公告、研报、政策、交易规则、具体事件、各种影响分析、以及需要检索外部数据的非常识信息等。避免AI在搜索金融场景信息时，参考到非权威、及过时的信息。 | |
| Mx Select Stock 基于东方财富数据库的智能选股工具，支持按行情指标、财务指标等条件筛选股票。 | |
| Mx Selfselect 妙想自选管理skill，基于东方财富通行证账户数据及行情底层数据构建，支持通过自然语言查询、添加、删除自选股。 | |
| Mx Stock Simulator 妙想提供的股票模拟组合管理系统，支持持仓查询、买卖操作、撤单、委托查询、历史成交查询和资金查询等功能。通过安全认证的API接口实现真实交易体验。 | |
| hantek-scope-control Control Hantek DSO2D15 / DSO2000-series oscilloscopes over USB SCPI, including connection checks, channel/generator setup, waveform capture, probe compensation guidance, and remote-control lock handling. | |
| iOS Dev Cleanup Use when checking iOS development disk usage or cleaning up simulators, runtimes, device support, derived data, CocoaPods cache, archives, or other build art... | |
| Last30Days CN 搜索微博、小红书、B站、知乎、抖音、微信公众号、百度、今日头条等8大中国平台最近30天的热门内容，生成综合研究报告。 | |
| PaperCash — 论文全流程辅助 Skill 论文全流程辅助: 8源检索、综述生成、查重预检、降AI率、参考文献格式化、Word导出 | |
| ChatSPSS 支持22类基础统计，完整展示结果表；识别SEM/CFA、中介调节、纵向面板、空间模型和进阶机器学习需求，按需查阅公开范围说明。 | |
| Philips Hue Thinking Indicator Visual AI activity indicator using Philips Hue lights. Pulse red when thinking, green when done. | |
| Ruby On Rails Gateway Configure and operate a Ruby On Rails Agent Gateway integration from the OpenClaw side for briefing pull workflows. Use when setting up OpenClaw to read app... | |
| Meeting Transcripts Capture meeting transcripts from Fireflies.ai via polling or webhooks. Auto-fetches transcripts, extracts action items/decisions/summaries, and writes struct... | |
| Discovery Automatically discover novel, statistically validated patterns in tabular data. Find insights you'd otherwise miss, far faster and cheaper than doing it yourself (or prompting an agent to do it). Disco systematically searches for feature in | |
| 麦当劳MCP服务集成，支持点餐、优惠券、麦麦商城、积分兑换等功能。 麦当劳MCP服务集成，支持点餐、优惠券、麦麦商城、积分兑换等功能。需要用户先在 https://open.mcd.cn 申请MCP Token。 | |
| google-search-wsl Perform Google searches and retrieve web or news results via Chrome browser running in WSL using remote debugging with OpenClaw tool. | |
| Lu Auto Deploy 提供 Docker 服务一键部署、配置生成、批量部署和更新，支持常见监控、媒体、安全及工具类服务。 | |
| Lu Music Player Manage and control Mopidy music service on NAS including playback, volume, playlist viewing, and local music scanning. | |
| Lu Nas Monitor 监控 NAS 上 Docker 容器状态、系统资源（CPU/内存/磁盘）及服务健康，支持告警通知和日志查看。 | |
| OpenClaw 维护脚本 提供本地脚本监控和维护 OpenClaw Gateway，支持健康检测、代理切换、安全重启与日志清理，保障服务稳定运行。 | |
| 机器人世界模型与动作模型（WAM）技术仓库维护Skill；支持搜集、分析、分类并生成图文并茂的AWAR仓库文档；包含科普介绍、深度技术分析、快速上手指南；当用户需要构建机器人AI领域技术仓库或研究VLA/RT-2/Dreamer等前沿工作时使用 机器人世界模型与动作模型（WAM）技术仓库维护Skill；支持搜集、分析、分类并生成图文并茂的AWAR仓库文档；包含科普介绍、深度技术分析、快速上手指南；当用户需要构建机器人AI领域技术仓库或研究VLA/RT-2/Dreamer等前沿工作时使用 | |
| Eai Awesome Work EAI Awesome Work 专栏 — 每周具身智能前沿工作速递。从 arXiv cs.RO 最新论文中筛选具身智能/机器人相关前沿工作，按主题分模块撰写深度技术推文，含完整摘要翻译、核心创新拆解、领域趋势洞察。触发词：EAI Awesome Work、具身智能前沿速递、本周具身论文、具身智能周刊、embod... | |
| Eai Dev Setup 自动化配置 Ubuntu 算法开发环境（中国网络优化版）；当用户需要初始化新系统、配置深度学习开发环境、批量安装开发工具时使用 | |
| 具身智能就业资讯追踪 具身智能就业资讯追踪。每周自动搜集具身智能领域的实习和就业机会，包括软件、硬件、算法、产品等岗位。适用于：每周就业资讯、具身智能岗位、招聘汇总、实习信息、具身智能公司招聘、机器人公司职位。当用户需要获取具身智能行业招聘信息、追踪具身智能企业招聘动态、整理实习就业资讯时使用此技能。 | |
| 具身智能前沿追踪系统 具身智能领域前沿动态追踪与视频素材采集系统；覆盖顶会论文（ICRA/IROS/CoRL/CVPR/NeurIPS）、开源项目、实验室动态；优先采集有Demo视频的爆款工作；生成含发布时间/主页/代码/视频链接的结构化日报，支持视频号内容创作 | |
| Embodied Ai Weekly 具身智能周报自动化生成与发布技能。当用户需要生成具身智能领域一周动态报告时使用，覆盖完整工作流：ArXiv论文多方向检索与整理、GitHub开源项目趋势追踪、综合可视化HTML报告生成（含导读+统计图表），以及将报告推送到 GitHub Pages 仓库发布。适用于每周定期生成具身智能领域动态报告的场景。 | |
| 实时资讯观点博客写作助手 实时资讯观点博客写作助手。输入一个技术新闻链接或主题，输出深度、有观点、带真实引用和截图的公众号/博客文章。适用于 AI/科技/具身智能等前沿领域热点解读。当用户需要写资讯分析、技术八卦、观点评论类博客文章时使用此 skill。 | |
| PaddleOCR-VL GPU-accelerated document parsing and OCR via PaddleOCR-VL. Detects layout, recognizes Chinese/English text, tables, charts, and seals in images. Use when the... | |
| Patent Writer Cn 中国发明专利交底书撰写与软著申请材料准备工具。当用户需要撰写专利、写专利交底书、申请软件著作权、准备软著材料、提取技术发明点、撰写权利要求书、生成专利附图文档时使用此 skill。触发词：专利、专利撰写、专利交底书、发明点、权利要求、软著、软件著作权、著作权申请、软著材料、鉴别材料、申请材料清单。 | |
| robot-paper-post 深度拆解机器人/具身智能论文并生成技术推文；默认使用零额外安装的插图工作流，从 arXiv HTML 与项目页提取可直接插入文章的图片和图注 | |
| ROS 2 专家助手 ROS 2 专家助手，提供工程开发辅助、架构分析、学习教学、环境配置、项目实战引导五大能力；当用户需要开发 ROS 2 应用、分析工程代码、学习 ROS 2 知识、安装配置环境或通过项目实战学习时使用。 | |
| AI视频短视频创作器 Two-phase AI-narrated video short creator with human review checkpoints. Phase 1 analyzes source materials, generates TTS narration via edge-tts, and exports... | |
| Cerul Openclaw Skill The video search layer for AI agents. Teach your AI agents to see — search video by meaning across speech, visuals, and on-screen text. Use when a user asks... | |
| fail2ban Reporter Auto-report fail2ban banned IPs to AbuseIPDB and notify via Telegram. Use when monitoring server security, reporting attackers, or checking banned IPs. Watches fail2ban for new bans, reports them to AbuseIPDB, and sends alerts. | |
| latent-press Publish books on Latent Press (latentpress.com) — the AI publishing platform where agents are authors and humans are readers. Use when writing, publishing, or managing books on Latent Press. Covers agent registration, book creation, chapter | |
| Xiangshan Douyin 向善数据抖音 API 工具集。搜索抖音用户/视频，获取用户资料、视频详情、评论、播放量统计数据。TRIGGER when user wants to search Douyin users/videos, fetch user profile, video details, video comments, or... | |
| Horizon SDK v0.4.16 - Trade prediction markets (Polymarket, Kalshi) - positions, orders, risk management, Kelly sizing, wallet analytics, Monte Carlo, arbitrage, quantit... | |
| BTC Price Monitor Fetches the current Bitcoin price from CoinGecko and sends it to Telegram, with optional alerts if price falls below a set threshold. | |
| Quark Lazy Cli 基于 QAS（夸克网盘自动转存项目）的懒人追剧、追番 SKILL，也内置了一个 CLI 工具。即使 QAS 的剧集订阅失效，它也可以重新搜索资源、探查多级资源目录，并在多个最新候选资源中按用户偏好（如更高清晰度）转存新剧集和缺失剧集。可以交给本地 OpenClaw、Hermes Agent 或其他Claude C... | |
| Proposal Copilot Generate Upwork/freelance bid materials from a job description, including English proposal draft, bid-worthiness score, pricing suggestion (fixed/hourly), mi... | |
| Usage Tracker AI Agent usage tracking and billing verification tool | |
| 小象中医体质辨识 提供中医体质辨识服务，问题简洁专业，针对体型、体力、皮肤面色、寒热出汗、情绪睡眠、胃肠道状况等提问，进行体质辨识并给出适合的食物推荐；当用户需要进行体质辨识、体质调理方案或健康状况评估时使用。 | |
| Jettyd Skill Interact with IoT devices via the jettyd platform — read sensors, send commands, manage rules, and list devices | |
| Claw-Diary Integrates with ClawDiary to guard high-risk actions with human approval, audit completed actions, and sync shared diaries across devices. | |
| 阿里云日志查询 当需要查询阿里云日志（SLS）时使用此技能，支持 CLI 查询日志、分析数据。 | |
| Antom Copilot Antom Intelligent Assistant - Central control for all Antom-related requirements, intelligently analyzes user intent and delegates to the Payment Success Rat... | |
| writER 模仿 ER 个人写作风格的 skill。将口语、素材或草稿改写为富有诗意与哲思的散文/情书体文章，擅长意象营造与情感表达。 | |
| iccn-erp 【零壹问界IC ERP外贸管理系统】，提供查询数据的技能。当用户提到查询订单、采购单、需求单、入库单、出库单、客户、供应商、库存、现货等任何ERP业务数据时，必须使用此技能。触发词包括但不限于："查订单"、"采购单详情"、"需求单"、"入库记录"、"出库情况"、"客户信息"、"供应商"、"现货库存"、"有没有货"... | |
| AI生成 AI生成技能 - 负责广告创意的AI生成处理 | |
| 数据分析与反馈 数据分析与反馈技能 - 投放效果数据采集、分析与模型迭代建议 |
41,101–41,150 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.