Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| X (Twitter) Hot Topics Fetch trending topics from X (Twitter). Analyze user interests from natural language, retrieve top hot topics per domain, and summarize background, key opinions, and controversies. | |
| X (Twitter) Publisher Publish tweets to X (Twitter) using the official Tweepy library. Supports text-only tweets, tweets with images or videos, and returns detailed publish results including tweet ID and URL. Requires X API credentials (API Key, API Secret, Acce | |
| AI 工作流优化专家 AI 工作流优化专家 — 帮你高效使用 ChatGPT/Claude/Cursor 等 AI 工具。当你想提升 AI 使用效率、设计自动化工作流、或解决 AI 使用中的问题时使用。 | |
| English Learning Coach 英语学习教练 — 口语、听力、阅读、写作全面提升。当你需要练习口语、提升听力、准备考试、或想用英语交流时使用。 | |
| 外贸业务全能助手 外贸业务全能助手 — 开发信、报价单、合同、物流、报关一站式指南。当外贸从业者需要写开发信、处理询盘、制定报价、处理纠纷时使用。 | |
| 求职面试全能助手 求职面试全能助手 — 简历优化、面试准备、薪资谈判、职业规划。当你需要优化简历、准备面试、谈薪资、做职业决策时使用。 | |
| Popeye Analysis 分析助手 - 数据分析、决策支持、问题诊断。触发词：分析数据、帮我决策、诊断问题 | |
| Popeye Business 商业助手 - 商业计划、营销文案、竞品分析。触发词：写商业计划、营销策划、竞品分析 | |
| Popeye Career 职场助手 - 简历优化、面试准备、汇报撰写。触发词：优化简历、面试准备、写汇报 | |
| Popeye Coding 编程助手 - 代码生成、调试、代码审查。触发词：写代码、调试、代码审查 | |
| Popeye Creative 创意助手 - 头脑风暴、命名建议、概念设计。触发词：头脑风暴、起名字、创意设计 | |
| Popeye Health 健康助手 - 运动计划、饮食建议、睡眠优化。触发词：运动计划、饮食建议、改善睡眠 | |
| Popeye Learning 学习助手 - 笔记整理、记忆技巧、复习计划。触发词：整理笔记、帮我记、复习计划 | |
| Popeye Money 理财助手 - 记账分析、预算规划、投资入门。触发词：记账分析、做预算、投资建议 | |
| Popeye Productivity 个人生产力提升工具包 - 日程管理、目标追踪、知识整理、效率优化四大模块。触发词：日程规划、目标设定、整理笔记、效率诊断 | |
| Popeye Translation 翻译助手 - 中英互译、润色、本地化。触发词：翻译、润色、本地化 | |
| Popeye Writing 写作助手 - 标题生成、文案创作、邮件撰写。触发词：写标题、写文案、写邮件 | |
| AI Prompt 工具箱 100+ 精心设计的 Prompt，覆盖写作、编程、分析、翻译、商业五大场景。当你需要写文案、写代码、做分析、翻译内容、或处理商业场景时，告诉你最适合的 Prompt 模板。 | |
| 自媒体运营全能助手 自媒体运营全能助手 — 小红书、公众号、抖音、私域流量一站式运营指南。当你需要写爆款文案、规划内容日历、分析数据、制定涨粉策略时使用。 | |
| Coc Helper COC 7th Edition tabletop assistant. Dice rolling (success levels, bonus/penalty dice, critical/fumble), SAN system (X/Y loss expressions, temporary/indefinite insanity, INT check memory suppression), investigator management, madness tables | |
| jina-ai-reader Fetch clean, AI-friendly Markdown content from any URL using Jina.ai Reader. Bypasses paywalls, handles Twitter/X posts, renders JavaScript-heavy pages, retu... | |
| Check the latest videos and updates of Bilibili ups and see if they have updated today 查看B站UP主的最新视频、动态，检查UP主今天是否更新。触发词：B站、UP主、视频更新、今天更新了吗、最新视频、最新动态、查看UP主 | |
| Canva Skill Create, export, upload assets to, and manage Canva designs via the Canva Connect API. Use when the user wants to create social posts, posters, PPT/slide visu... | |
| Evidence Anchor 标准化定义和验收项目证据锚点，确保长期记忆可验证、可追溯、可复用，支持多层级证据及定期复核流程。 | |
| Hospitable Ops Operate and automate Hospitable properties, reservations, and calendars with safe read-first API workflow, focusing on non-price calendar controls and write... | |
| Kimi2.5skill Troubleshoot and operate Kimi 2.5 / OpenClaw image understanding. Use when image recognition fails, OCR/images cannot be analyzed, `image` tool reports `Unkn... | |
| Memory Backfill 规范升级 Agent 记忆，将抽象原则转为包含项目事实和结果闭环的全面项目级记忆，并固化验收标准。 | |
| Aviation Healthcheck 航空维修健康检查 - FAA/EASA/CAAC适航指令、航空安全通告、MRO行业新闻、波音空客技术通告、OpenClaw状态、磁盘空间 | |
| Codex Deep Search Deep web search using Codex CLI for complex queries that need multi-source synthesis. Use when web_search (Brave) returns insufficient results, when the user... | |
| Moss Deep Search Deep web research using LLM + multiple search rounds. Use when user needs comprehensive analysis, detailed research, or says "deep search", "详细搜索", "深入调查". | |
| Moss Last30Days Research any topic from the last 30 days on Reddit + X + Web, synthesize findings, and write copy-paste-ready prompts. Use when the user wants recent social/... | |
| Moss Skill-9 Give your AI agent eyes to see the entire internet. Install and configure upstream tools for Twitter/X, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu, Douyi... | |
| spex Spec-Driven Development (Spex) skill that manages the full SDLC — from requirement analysis and design to incremental implementation and submission. Invoked manually via /spex <command>. Supports commands: create (new), modify, apply (run, | |
| DataEngineering OpenClaw 数据建表规范与流程指导。当用户需要创建数据仓库表（DDL）时使用，支持 DWS/DWD/DIM/ADS 等层级，引导完成工作空间选择、表命名、字段定义、分区策略、生命周期等完整建表流程。 | |
| Openclaw Ddl Creator OpenClaw 数据建表规范与流程指导。当用户需要创建数据仓库表（DDL）时使用，支持 DWS/DWD/DIM/ADS 等层级，引导完成工作空间选择、表命名、字段定义、分区策略、生命周期等完整建表流程。 | |
| GlucoDNA 广告图生成器 Generate 1024x1024 Chinese GlucoDNA kidney protection ads with product images using Gemini API and product info. | |
| HK3 CRM 安装器 一键安装 HK3 CRM 客户管理系统（Bursa Malaysia 保健品公司专用） | |
| Text-to-Carousel Generate professional social media carousel images (Instagram, LinkedIn, TikTok, Xiaohongshu) from text content, articles, or URLs. Use when asked to create... | |
| SGLang-Diffusion Image Generation Generate images using a local SGLang-Diffusion server (FLUX, Stable Diffusion, Qwen-Image, etc.). Use when: user asks to generate, create, draw, or render an... | |
| SGLang-Diffusion Video Generation Generate videos using a local SGLang-Diffusion server (Wan2.2, Hunyuan, FastWan, etc.). Use when: user asks to generate, create, or render a video with a loc... | |
| agentcloud AgentCloud（AI Agent 云存储）— 一键注册 Agent，上传/下载文件，创建分享链接，查询用量。支持 Hermes Agent 和 OpenClaw 用户直接使用。 | |
| Agent Team 管理和调用具备不同身份和专用模型的多子 Agent 团队，支持任务执行和交互式对话两种模式。 | |
| Auto Agent Router 根据消息命令自动路由到子 Agent。**Agent 应该：收到消息时首先检查是否包含 /coder、/writer 等命令，如果是则调用 sessions_spawn 启动对应子 Agent。** | |
| Dingtalk Group Saver 自动在钉钉群中被@时保存群ID和群名，双写至JSON和MEMORY.md实现持久化和跨Session共享。 | |
| Github Trending Fetch GitHub trending repositories by daily, weekly, or monthly periods with output in Markdown or JSON format. | |
| Github Trending Daily 定时获取并推送每日、每周或每月 GitHub Trending 热门项目至钉钉群，支持测试和只获取模式。 | |
| Cultural Relics Guide 文物讲解词一键生成。用户只需提供文物名称和 API 信息，系统自动判断讲解风格并生成400-500字的专业讲解词。 | |
| Video Subtitle Generator Generate and translate video subtitles using WhisperX and LLM translation. Use when processing video files to create .srt subtitle files. Supports multilingu... | |
| doubao-tts 使用豆包（火山引擎）语音合成大模型 API 将文本转换为语音音频文件。支持声音复刻音色（S_ 开头的音色ID）和官方预置音色。当用户要求"语音合成"、"文字转语音"、"TTS"、"朗读文本"、"生成语音"、"用我的声音读"、"豆包语音"、"声音复刻合成"等相关请求时，务必使用此 skill。即使用户只是说"帮我把... | |
| 数联互通weather Get current weather and forecasts via WeatherAPI.com. Use when: user asks about weather, temperature, or forecasts for any location. IMPORTANT: You must conf... |
41,451–41,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.