Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Dailytech Daily AI & tech news in 60 seconds — LLM updates, product launches, startup funding, developer tools. Bilingual EN/CN visual card. Morning & evening push. | |
| Deepseek V4 Use DeepSeek V4 (Flash & Pro) from the command line — one-shot Q&A, thinking mode, multi-turn chat. OpenAI-compatible API, no special CLI needed. Supports de... | |
| English Daily Daily English learning with spaced repetition — built-in A1–B2 word bank, new words daily, quiz mode (MCQ/fill-in/spelling), streak tracking, level progression. | |
| Focus Guard Session coherence protocol for Claude — track decisions, resist scope creep, flag drift. Keeps long AI sessions on track without losing what was already deci... | |
| Honest Critic Anti-sycophancy protocol for Claude — surface real flaws, push back when wrong, stop validating bad ideas. Because agreement without honesty is useless. | |
| Learnloop Continuous learning protocol for Claude — captures corrections, errors, and user preferences into native auto-memory so the next session remembers. Stop teac... | |
| Lucky Today 离线每日运势 — 输出幸运方位/颜色/数字/物品/宜忌,支持今日/明日/本周/本月、双人合盘、面试/考试/相亲/上线/出差等场景化运势,中英双语,可定时推送 Telegram/Feishu。Daily luck oracle with bilingual output, multi-horizon (today/... | |
| Yunshi MingLi is your all-in-one Chinese astrology and fortune-telling companion. It combines six ancient divination systems — BaZi (Four Pillars of Destiny), ZiWei... | |
| NewsToday NewsToday solves information overload for users who want to stay informed without spending an hour checking scattered sources. Instead of manually browsing W... | |
| NewsToday Daily news brief in 5 minutes — 10 curated stories with Hero Story deep-dive, financial impact rating (📈📉➡️), 2-hour breaking alerts, morning & evening pus... | |
| Signal First Response calibration for Claude — match answer depth to question complexity. Stop getting 10-paragraph essays for 10-word questions. More signal, less noise. | |
| Story English Learn English through serialized fiction — follow a story you actually want to read, with vocabulary embedded naturally in each episode. Mystery, city life,... | |
| Task Pilot Task decomposition and execution framework for Claude — breaks complex work into verified subtasks, plants context anchors to survive compaction, and never l... | |
| Thinkdeep Structured reasoning protocol for Claude — forces step-by-step analysis, self-critique, and confidence scoring before answering. Reduces wrong answers and ha... | |
| TravelHound TravelHound compares flights and hotels across Google Flights, Skyscanner, Kayak, Booking.com, Agoda, and Trip.com — with book-now-vs-wait timing, OTA coupon... | |
| TrendRadar TrendRadar scans 小红书, 微博, Reddit, Google Trends, and Product Hunt to spot trending products before they peak — assigning a trend direction (surging/rising/st... | |
| Weather Daily Daily weather briefing for any city — morning conditions, what to wear, umbrella forecast, evening preview, extreme weather alerts. No API key. Works worldwide. | |
| Yunshi All-in-one Chinese fortune-telling — BaZi (Four Pillars), ZiWei DouShu, QiMen DunJia, I Ching (Meihua + LiuYao), feng shui, marriage compatibility, plus dail... | |
| Zeyang Strategy Lab Free 用于本地单标的历史数据研究与策略验证，支持 EMA、SMA 或 RSI 的做多/空仓规则，并生成基础 JSON、CSV、Markdown 与图表文件。仅用于历史研究与教育，不用于实盘交易或投资建议。 Run local single-asset historical research with EMA, SMA, or RSI long/cash rules and produce basic JSON, CSV, Markdown, and chart artifacts. | |
| C Disk Cleanup 面向电脑小白的 Windows C 盘清理助手（经真机实战验证）。两种模式：①开荒保洁——C盘已爆满时，先只读体检、用大白话讲清每类文件是什么/删了有啥影响，等用户逐条点头才动手，且一律只搬不删、可恢复；②日常保洁——记住你的清理习惯，定期自动体检或你随时喊一声，只清安全项。绝不自行删除任何文件，任何清理动作前必须取得用户明确同意。实战已验证：微信等聊天数据走官方"更改存储位置"迁移、可重建缓存只搬 Cache/Temp 子目录、软件主程序目录绝不碰、搬前检测进程锁防"半搬走 | |
| Resort Snow Checker A universal skill to check snow conditions, weather, and gear requirements for ANY ski resort globally. | |
| ly-train-12306 12306 官方接口高铁/火车票余票查询（免费、零配置、多日期对比） | |
| aupu-knowledge-base 当用户提及任何与本地文档、知识库、参考资料、历史记录、配置文件、说明文档、内部资料、已有内容、文件创建/读取等相关需求时，必须使用本技能从 /mnt/data 目录中检索或操作文件。 | |
| 善起名 · 国学命名助手 易学命名专家「善起名」技能。当用户需要为新生儿或儿童起正式名+小名、为现有姓名做八字五行评析、或结合父母与子女生辰八字做家族五行合参调衡时使用。触发词包括：起名、改名、宝宝起名、小孩名字、五行缺什么、补五行、生辰八字、八字、周易起名、易经起名、风水起名、合参父母八字等。 | |
| IP地址归属、信誉、风控查询 在本地或经确认的外部查询中核查单个已授权公网IP的归属、路由与网络风险信号 | |
| IP Intelligence Fusion 多源核查公网IP归属、信誉与代理风控，覆盖跨境电商与社媒矩阵、广告投放、本地SEO、调研比价、品牌网站测试、AI账号、直播、多环境及代理运维 | |
| Index Optimization Support full/single-query mode with index confirmation workflow | |
| 九赋产品溯源评级 九赋产品溯源评级 - 查询产品消费信任指数（CTI）。当用户提到产品溯源、产品评级、产品安全性验证、消费信任、产品质量核查、品牌背景调查、SC许可证验证、3C认证查询、企业工商验证时使用此技能。支持全品类消费品（食品、日化、化妆品、电子产品、宠物食品等）。 | |
| OpenClaw Agent Control Skill Deploy and start OpenClaw Agent Control with one command (backend + frontend) using skill-based workflow. | |
| OpenClaw Tailscale Remote Access Configure or repair OpenClaw remote access over Tailscale with a directly executable workflow: inspect state, apply the gateway config, enable Tailscale Serv... | |
| HTS全岗位通用AI助理生成器，支持管理、技术、业务、职能等各类岗位，自动生成负责人画像、助理规范及OpenClaw完整配置文件，实现一岗一AI助手。 HTS全岗位通用AI助理生成器，支持管理、技术、业务、职能等各类岗位，自动生成负责人画像、助理规范及OpenClaw完整配置文件，实现一岗一AI助手。 | |
| Instant Report 一键生成专业产业研究报告。当用户请求行业研究、市场分析、竞品调研、公司研究报告时触发。适用场景包括但不限于："写一份XXX行业研究报告"、"生成市场分析报告"、"调研一下XXX公司"、"做个行业对比分析"、"./instant-report XXX"等任何需要输出专业报告格式的研究任务。接收中文或英文请求，自动匹... | |
| Self-Improving Agent 三层记忆自优化Agent框架：短期会话记忆、中期任务摘要、长期永久知识库。任务失败自动复盘记录根因与修正方案，重复问题自动调取历史经验避免踩坑，定期压缩过期记忆节省Token，自动提取高频流程生成子Skill。当用户提到记忆、记住、复盘、优化、之前的经验、上次出错、长期记录、自我改进、self-improving... | |
| Sys Speek Display a compact ASCII dashboard showing system uptime, CPU load, memory, disk usage, and top open network ports. | |
| Guided Learning Guided learning skill — one concept at a time, gentle guidance, comprehension checks, chapter review | |
| Study Tutor Study Tutor — a science-based learning assistant for diagnosis, guided teaching, practice, review, spaced repetition, and concise study notes under memory/{s... | |
| VMamba Env Doctor Guide for setting up a stable VMamba environment and resolving common CUDA, PyTorch, MMCV, and compilation errors. Use when users encounter issues like "unsu... | |
| hub-oss-file-upload 对用户只说简体中文短句。用户要拿到工作区里已有的文件，或要一个能在外面下载、打开、转发给别人的地址时触发。包括：要文件、把文件给我、发我一份、传给我、附件给我、文件地址、文件链接、下载、帮我下载、下载链接、下载地址、给我链接、分享这个文件、发个链接、外链、公网地址、访问地址、打开地址、OSS 链接、传到 OSS、上传一下给我地址。文件刚生成且同时要求给我或给地址时，写完再调 upload-file.sh。把 ossUrl 原文写进回复。禁止手写 curl，禁止 hub-art | |
| Claw Body Give your Claw a body! Turn your AI Claw into a real-time digital avatar with face, voice, and expressions. Talk face-to-face with your Claw — not just text.... | |
| Claw Presenter 准备PPT/PDF讲解稿。将幻灯片转为图片并生成逐页演讲词。触发词：准备PPT讲解稿、准备演讲稿、生成演讲词、prepare presentation narration. | |
| Digital Singer Turn your NuwaAI digital avatar into a singing performer! The avatar sings with lip-synced mouth movements driven by vocal audio, with synchronized backgroun... | |
| Session Relay Automatic session continuity and task handoff across context window boundaries. Use when: (1) context token usage exceeds 70% of the model's context window,... | |
| 裁判者办案指引 为法官和仲裁员提供适用邹碧华“要件审判九步法”的民商事案件庭前准备、庭审驾驭、心证形成、文书核验及释明指导。 | |
| 律师全案攻防实战推演 This skill should be used when a lawyer handling civil or commercial cases (民商事律师) needs to analyze a case, build litigation strategy, review pleadings, prepare for trial, or predict judicial outcomes. It is a six-phase lawyer's full-lifecy | |
| holmes skill holmes skill | |
| Task Planner 任务规划与执行引导工具。当用户提出需要多步骤完成的复杂任务、请求帮忙规划工作、说"帮我规划"、"拆解任务"、"怎么完成这个"时触发。也适用于用户描述了一个大目标但不确定从哪里开始的场景。即使用户没有明确说"规划"，只要任务明显涉及3个以上步骤、多个依赖关系、或需要分阶段完成，都应该使用此 skill。覆盖场景包括... | |
| 游戏王日版新闻每日总结 每天自动搜索并中文总结前一天的游戏王日版新闻，包括新卡、规则、赛事及产品发售信息，推送至当前对话。 | |
| Code Wiki Trigger a one-shot workflow that clones (or pulls) a Git repository, generates a structured wiki from it using the `codewiki` CLI, and optionally renders the... | |
| seedance Generate videos with the doubao-seedance-2.0 model (text-to-video, image-to-video, first/last-frame-to-video). Use when the user asks to "generate a video", mentions "seedance", or wants AI video generation from text and/or images. Wraps th | |
| Sync Notes Sync the local Obsidian vault with a Cloudflare R2 bucket using rclone (S3 + crypt). Triggered by `/sync-notes`. Defaults to bidirectional sync; understands... |
41,401–41,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.