Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 资源交付分发 资源交付分发技能 - 处理素材导出、格式转换和多平台分发 | |
| 需求管理 广告创意需求管理技能 - 处理需求发起、评审、拆解全流程 | |
| 素材库管理 素材库管理技能 - 提供素材的存储、检索、版本管理 | |
| 审核质检 审核质检技能 - 自动化质量评估和人工审核工作流 | |
| 工作流编排 工作流编排中心 - 协调全流程，管理任务依赖和状态 | |
| json文件翻译 翻译JSON文件中的文本内容，特别是description字段。当用户提到需要翻译JSON文件、翻译JSON中的字段内容、翻译description字段，或者需要将JSON文件翻译成其他语言时，使用此技能。这个技能非常适合处理产品描述、API文档、配置文件、数据集等需要多语言翻译的JSON内容。 | |
| 翻译SKILL.md文档 翻译技能文档的工具。当用户想要翻译 SKILL.md 文件的内容为中文时使用此技能。用户输入技能路径，工具会读取该路径下的 SKILL.md 文件，将其内容翻译成中文，并输出命名为 SKILL(1).md 的文件到同一文件夹中。 | |
| FormPass Agent Register as a verified AI agent on the FormPass network. Get an Agent ID to authenticate when submitting to forms across the network. | |
| FormPass Forms Connect your web forms to the FormPass network so AI agents can discover and submit to them. Supports React, HTML, and WordPress forms. | |
| FormPass Submit Discover and submit to FormPass-enabled web forms. FormPass is the trust layer that lets verified AI agents submit to real web forms with authenticated ident... | |
| fitatu-diary Keep the user's Fitatu food diary (Polish calorie counter, licznik kalorii) through the fitatu-mcp tools - read a day, check calories and macros left against goals, log meals by name, barcode or as a custom item, fix or remove entries, log | |
| Praxis Google Workspace Google Workspace CLI for Gmail, Calendar, and Drive. Official Google APIs wrapper for secure, direct API access without third-party proxies. Use when managin... | |
| Mirroir Control a real iPhone through macOS iPhone Mirroring — screenshot, tap, swipe, type, launch apps, record video, OCR, and run multi-step scenarios. Works with... | |
| Dgt Wait Consulta els temps d'espera per a exàmens pràctics de conduir a Espanya. Reporta la teva experiència i ajuda la comunitat. | |
| zhiliao 知了 - AI 话题追踪与资讯聚合服务。通过自然语言创建追踪话题，自动从全网聚合相关文章并定时更新。适用场景：(1) 创建信息追踪话题（如追踪黄金价格、科技新闻、行业动态），(2) 获取和浏览话题下的聚合文章，(3) 设置定时任务定期抓取新文章，(4) 查看/管理话题列表，(5) 取消订阅不需要的话题。触发关键词... | |
| ToneClone CLI Write in the user's authentic voice using ToneClone. Generate emails, messages, social posts, and other content that sounds like the user — not generic AI. U... | |
| SkillForge — Self-Evolving AI Skills Stop repeating yourself. SkillForge watches how you work, discovers your patterns, and forges them into reusable Skills — automatically. The more you use it,... | |
| Browser Use API Cloud browser automation via Browser Use API. Use when you need AI-driven web browsing, scraping, form filling, or multi-step web tasks without local browser control. Triggers on "browser use", "cloud browser", "scrape website", "automate w | |
| finance-reporter 实时财经数据推送工具。使用Yahoo Finance API获取全球股市、外汇、大宗商品、加密货币实时行情，支持定时推送到钉钉/微信。包含股票代码、货币单位、实时价格、24h前/昨收价格、涨跌幅。支持标的：纳指、道指、美元指数、黄金、比特币、沪指、恒生、日经、人民币/美元汇率、原油。 | |
| Finance Reporter Publish 实时财经数据推送工具。使用Yahoo Finance API获取全球股市、外汇、大宗商品、加密货币实时行情，支持定时推送到钉钉/微信。包含股票代码、货币单位、实时价格、24h前/昨收价格、涨跌幅。支持标的：纳指、道指、美元指数、黄金、比特币、沪指、恒生、日经、人民币/美元汇率、原油。 | |
| jf-open-algo-assistant 杰峰开放平台通用AI算法调用助手（开发版）。交互式引导用户明确检测场景（如明厨亮灶、安全生产、消防安全、门店巡检、周界安防），从52个免底库算法清单中推荐适配算法（不含需底库的比对类算法），支持对本地图片/图片URL/摄像头设备抓图（配合 jf-open-pro-capture 技能）调用算法分析并输出结构化检测报告。Use when the user mentions 明厨亮灶、AI检测、算法调用、图片分析、摄像头智能分析、口罩/安全帽/烟火/垃圾检测、开放平台算法、jf算 | |
| jf-open-pro-ai-child-care 杰峰开放平台儿童看护技能。实时监控客厅、书房等场景，提供人身、生活安全守护，及时掌握孩子在家状态，保障安全的同时，关注其生活起居、学习娱乐情况。 | |
| jf-open-pro-ai-elderly-care 杰峰开放平台老人看护技能。适配独居、日间无人看护老人场景，全天候守护居家安全与健康，帮助家属实时掌握老人状态，轻松远程看护，消除照护顾虑。 | |
| jf-open-pro-ai-indoor-security 杰峰开放平台室内安防技能。实时监测客厅等居家场景，全方位守护人身与居家安全，实时掌握家人动态。筑牢安全防线，同步感知居家日常，安心守护居家点滴时光。 | |
| jf-open-pro-ai-joblover 杰峰开放平台岗位巡检技能。实时监控员工在岗状态，推送员工到岗、离岗通知，对在岗异常行为实时检测，记录并统计在岗人员的行为数据，提升巡检效率、安全性，降低人工巡检成本。 | |
| jf-open-pro-ai-outdoor 杰峰开放平台室外安防技能。提供车辆检测、异常告警、智能检测、灵敏度设置、检测区域配置、推送计划管理等功能，全面提升室外安防监控能力。 | |
| jf-open-pro-ai-pet-care 杰峰开放平台宠物看护技能。化身全天候"宠物保姆"，提供异常情况通知、详尽的宠物行为报告和云端视频存档，给宠物最安心的守护。 | |
| jf-open-pro-ai-smart-search JF Tech Pro AI 智搜技能。根据语义内容（如"带帽子的人"、"车"、"狗"）搜索杰峰云存报警视频，获取匹配的视频片段列表。使用场景：智能视频检索、AI 事件搜索、语义化视频查找。 | |
| jf-open-pro-algo-detection 大模型AI智能检测。交互式引导用户明确检测场景（如明厨亮灶、安全生产、消防安全、门店巡检、周界安防），从52个免底库算法清单中推荐适配算法（不含需底库的比对类算法），支持对本地图片/图片URL/摄像头设备抓图（配合 jf-open-pro-capture 技能）调用算法分析并输出结构化检测报告。Use when the user mentions 明厨亮灶、AI检测、算法调用、图片分析、摄像头智能分析、口罩/安全帽/烟火/垃圾检测、开放平台算法、jf算法、检测服务。 | |
| jf-open-pro-capture 杰峰设备批量抓图技能（开发版）。支持多设备同时抓图，自动管理 Token，可选下载图片到本地。按调用次数计费。 | |
| jf-open-pro-cloud-record 杰峰设备云存储技能（开发版）。支持云存视频列表查询、云存视频回放/下载、云存报警消息查询等功能。设备需开通云存储套餐。 | |
| jf-open-pro-device-battery-manage 杰峰低功耗设备电池管理技能（开发版）。支持查询低电量阈值范围、设置低电量模式阈值等电池管理功能。 | |
| jf-open-pro-device-human-detection 杰峰设备人形检测技能（开发版）。支持人形检测开关设置、人形检测灵敏度设置、云台设备人形追踪开关设置等功能。 | |
| jf-open-pro-device-image-flip 杰峰设备画面翻转技能（开发版）。支持画面左右翻转（镜像）、上下翻转设置，适用于摄像头画面方向调整。 | |
| jf-open-pro-device-list 杰峰设备列表查询技能（开发版）。查询开发者账号下绑定的设备列表，支持分页查询和按设备序列号条件查询。 | |
| jf-open-pro-device-osd 杰峰设备 OSD 水印设置技能（开发版）。支持设备实时画面水印设置，可配置通道标题、时间标题、隐私区域等 OSD 叠加属性。 | |
| jf-open-pro-device-reboot 杰峰设备重启技能（开发版）。支持远程重启设备，部分设备支持关闭操作。 | |
| jf-open-pro-device-smart-alarm 杰峰设备智能报警技能（开发版）。支持设备能力集查询、智能报警开关设置、报警时间段配置、报警消息列表及图片获取等功能。 | |
| jf-open-pro-device-status 杰峰设备在线状态查询技能（开发版）。专注于查询设备是否在线，支持单设备或批量查询，快速返回在线/离线状态。 | |
| jf-open-pro-feed-control 杰峰智能宠物喂食器设备控制技能（开发版）。支持远程一键喂食、设置或查询定时喂食计划，以及配置设备端的宠物检测功能开关。 | |
| jf-garbage-inspection 杰峰垃圾溢出巡检技能。通过杰峰监控设备抓图，Agent 直接看图分析垃圾桶是否溢出，输出结构化巡检报告。支持单设备/批量巡检和定时任务。 | |
| jf-open-pro-livestream 杰峰设备直播预览技能（开发版）。支持多端集成实时视频播放，兼容 HLS、RTSP、RTMP、FLV、MP4、WebRTC 等主流协议，适配 H.264/H.265 设备。 | |
| jf-open-pro-local-record 杰峰设备本地录像技能（开发版）。支持 TF 卡/硬盘存储设备的录像日历查询、回放列表、录像回放下载、本地报警图片获取、主辅码流切换等功能。 | |
| jf-open-pro-ptz-control 杰峰云台设备控制技能（开发版）。支持云台方向控制、变倍聚焦、预置位管理、巡航计划、回到守望位等功能，适用于云台摄像头设备。 | |
| jf-open-pro-smart-doorlock-control 杰峰智能门锁设备控制技能（开发版）。支持查询设备是否支持门锁能力、登录设备、获取设备接口访问令牌，以及远程一键开锁。 | |
| jf-open-pro-traffic-heatmap 室内人流热力图分析技能。通过杰峰摄像头定时抓拍 + 本地 YOLOv8 头部检测，生成圆形高斯模糊热力图叠加的交互式 HTML 报告。支持 10 分钟粒度流量趋势、空间利用率分析和客流计数统计。 | |
| jf-open-pro-video-masking 杰峰设备视频遮挡技能（开发版）。支持一键遮蔽功能，开启后摄像头转至遮蔽位置并关闭视频预览和录像，保护隐私。 | |
| jf-watchdog 杰峰看门狗技能。基于杰峰设备抓图 + AI 视觉分析的通用区域状态监控，支持物品防盗、通道占用检测、人员存在检测等场景。 | |
| jf-smart-store-inspection 杰峰蜂云智慧巡店部署与AI巡检运营技能。通过工作流完成门店创建、监控设备接入（GB28181/ONVIF+自研NVR/杰峰自研IPC）、AI巡检算法查询、AI巡检计划配置（离岗/工服/跌倒/客流/安全帽/视频质量诊断等）、检测区域画框、计划启停与巡检记录聚合，并生成含抓拍图墙的HTML分析报告。当用户提到智慧巡店、AI巡检、门店巡检、巡检计划、巡检记录、离岗检测、工服检测、跌倒检测、抓拍图墙、连锁门店巡检、smart store inspection、AI patrol 时使 | |
| jf-store-traffic 杰峰连锁门店精准客流部署与数据分析技能。通过工作流完成门店创建、HA-5P-GM客流摄像头接入、精准客流算法配置（区域画框/进出店模式/外卖员过滤），并支持查询门店客流聚合统计（进店率/去重顾客数/批次/年龄性别分布），生成可视化 HTML 分析报告（KPI 总览/每日趋势/客群画像/进店批次）。当用户提到精准客流、门店客流、客流统计、客流部署、配置客流、连锁门店、进店率、客群分析、客流报告、客流报表、store traffic、foot traffic 时使用此技能。 |
41,151–41,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.