Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 数安云智数据分类分级 数安云智数据分类分级同步接口 - 用于批量处理字段信息的分类分级。支持敏感数据识别、数据分类、数据分级等功能。使用前需配置API地址和认证密钥。 | |
| instreet InStreet Agent 社交网络平台集成，支持社区互动、Playground 参与、心跳机制和技能分享。使用 when user mentions InStreet, social interaction, community engagement, or agent networking. | |
| 云开发-微信支付 This skill provides battle-tested guidance for integrating WeChat Mini Program payment and refund flows using Tencent CloudBase. It covers cloud.cloudPay.unifiedOrder() for payments, cloud.cloudPay.refund() for refunds, cloud functions, dep | |
| Wjs Auditing Project Use when the user asks to audit what's wrong with a project, "make it right", "看看项目出了什么问题", "为什么用户的需求还没上线", "为什么没提交App Store", "为什么没新build", or wants a holis... | |
| Wjs Burning Subtitles Use when the user has a video + an SRT and wants the subtitles either burned into the pixels (libass, always-visible) or soft-muxed as a togglable track. Als... | |
| Wjs Dubbing Video Use when the user has a video + a target-language SRT and wants the video to actually speak that language — generates a time-aligned TTS voice dub. Routes by... | |
| Wjs Editing Multicam Use when the user has 2+ recordings of the same event (each with a `.sync.json` sidecar from wjs-syncing-multicam) and wants them combined into a single MP4... | |
| Wjs Localizing Video Thin orchestrator for the end-to-end video localization pipeline. Routes to the four focused sub-skills — /wjs-transcribing-audio, /wjs-translating-subtitles... | |
| Wjs Overlaying Video Use when the user has one or more video clips and wants to add post-production on top — AI-generated cover as first frame, HTML/CSS captions synced to SRT, k... | |
| Wjs Publishing Wechat Use when the user wants to write or publish a 微信公众号 (WeChat Official Account) article — they share rough thoughts, a draft, or notes and ask for help polishi... | |
| Wjs Reframing Video Use when the user wants to convert a video between horizontal and vertical orientations while preserving the inverted aspect ratio (16:9 ↔ 9:16, 4:3 ↔ 3:4, 2... | |
| Wjs Segmenting Video Use when the user has a long-form video (interview / lecture / podcast / conversation) and a transcript SRT, and wants to extract 3–6 stand-alone topical sho... | |
| Wjs Syncing Multicam Use when the user has 2+ video / audio recordings of the same event captured by different devices (cameras, phones, separate audio recorders) and wants them... | |
| Wjs Transcribing Audio Use when the user has audio or video and wants a timestamped transcript (SRT) in the source language. Routes by source language — Chinese defaults to Volcano... | |
| Wjs Translating Subtitles Use when the user has an SRT (or transcript text) in one language and wants it translated to another, with punctuation-bounded re-segmentation so cues end at... | |
| Wjs Uploading Video Upload one or many videos to YouTube. Use when the user wants to "上传到 YouTube", "发 YouTube", "批量上传", "upload to YouTube", "post videos to YouTube", or to pub... | |
| Fortigate Configuration Skill 自动配置 FortiGate 防火墙，支持基础策略管理及工控协议（Modbus、IEC104、S7等）的安全配置。 | |
| TIA-OPENNESS-COMPLETE-SKILL 基于TIA Openness API的完整PLC自动化技能，支持项目创建、硬件配置、SCL编程、编译下载 | |
| dropage-deploy Deploy an HTML page to the internet and return a public URL. Use when the user asks to deploy, host, share, or publish an HTML file or a zip / tar / tar.gz / tgz archive containing an index.html. Triggers on phrases like "deploy this page", | |
| Skills Public 查询股票实时行情。支持 A 股/港股/美股。使用方式：直接说股票代码或名称（如"贵州茅台股价"、"600519"、"腾讯控股"、"BABA"） | |
| hook-auditor 审计并清理 Claude Code 中「你不知道自己装了」的 hook。安装 skill 或 plugin 会自带 hook，它们安装即常驻、每轮对话都跑、持续烧 token 并可能拦截或改写工具调用——即使你从未调用过那个 skill。本 skill 枚举全部真正生效的 hook、标注来源与可信度、量化每轮成本，并在你确认后清理。触发场景：用户说「清理」「提速」「省 token」「变慢了」「token 消耗太快」「怎么这么慢」「清理配置」「检查 hook」「有哪些 hook | |
| Idea Darwin Idea Darwin Engine — an automated idea iteration system that evolves raw ideas through structured competition and selection. Imports ideas from ideas.md, str... | |
| Idea Darwin 日本語版 Idea Darwin エンジン（日本語版）— 生のアイデアを進化論ベースで自動反復するシステム。深化・交配・変異のラウンドを実行し、高ポテンシャルなアイデアを浮上させます。/idea-darwin で起動。 | |
| Idea Darwin 中文版 Idea Darwin 引擎（中文版）— 自动化 idea 迭代系统，通过结构化竞争与选择进化原始想法。从 ideas.md 导入想法，将其结构化为带评分的卡片，然后运行迭代轮次：深化、派生、交叉、批判、验证，最终让高潜力 idea 浮现。使用 /idea-darwin 触发。当用户提到"跑一轮"、"迭代 ide... | |
| Book Video Maker Generate 1080x1920 vertical book summary videos with AI images, TTS voice, Ken Burns effect, and precise subtitle and audio alignment using customizable temp... | |
| Gemini Browser Image Generate images with the user's own Chrome session and Gemini web UI. Use for article covers, illustrations, and social media visuals when the user explicitl... | |
| WeChat Post Skill User-authorized WeChat Official Account article workflow for topic selection, drafting, editing, image planning, pre-publish review, and handoff to the user'... | |
| ZenTao Analytics 禅道任务数据分析技能。访问禅道数据库/API，分析员工任务数据（数量、工时、难度），计算工作效率和工作饱和度。使用场景：团队绩效评估、工作量分析、资源分配优化、项目进度监控。 | |
| web-screenshot 🖼️ 任意URL全页面截图 + PDF导出工具。当用户要求截取网页、保存网页快照、截图存档、做QA对比、导出PDF时使用。支持百度/知乎/微信公众号/小红书等中文网站，自动等待JS渲染交付PNG/JPG/PDF。 | |
| Jiaoyifu Workplanning 运营方案与工作规划核心技能。覆盖所有运营体系下的方案输出场景。 核心原则：用数据把问题锁死，用四层路径把解法锁死。 五节主结构（所有场景通用）：核心结论 → 现状诊断 → 目标确定 → 方法路径 → 执行方案。 全场景内置「脚姨夫视角评估」两级审核：①每模块输出后自动六维审核（承诺可兑现/执行不自欺/受益方清晰/... | |
| Windows-health Windows 文件管家与系统健康诊断（mac-health 的 Windows 原生版，供 WorkBuddy 等 Windows 端工具调用）。Always use when the user says「电脑管家」「文件整理」「C盘满了」「Windows清理」「磁盘整理」「电脑诊断」「清理一下」「哪些可以删」「系统整理」「电脑卡」「运行慢」「内存不足」「Windows 卡」「开机慢」。涉及删除或迁移时先诊断和校验，执行时保留清单与回滚线索。 | |
| File Backup 修改文件前的自动备份工具。 当需要修改重要文件时，先备份再修改，改完后让用户检查，确认无误后删除备份。 | |
| Journal SCI/SSCI Checker 检查心理学学术期刊是否被 SCI 或 SSCI 索引。在评估文献质量时使用，帮助筛选符合条件的期刊文章。 触发场景： - 用户要求检查某期刊是否被 SCI/SSCI 索引 - 在评估非预印本文献质量时自动调用 - 构建心理学语料库时作为期刊筛选工具 不适用于预印本平台的文章（直接跳过，使用 PaperClaw 评估）。 | |
| Markdown Fetcher 将网页内容转换为 Markdown 格式。 当需要获取网页内容并转换为可读 Markdown 时使用此 Skill。 优先级：markdown.new > defuddle.md > r.jina.ai > Scrapling | |
| Psychology Research Assistant Assist with psychology research by supporting literature searches, systematic reviews, meta-analyses, methodology guidance, and structured writing. | |
| PDF Reader PDF 转 Markdown 并输出页码与质量指标 | |
| report-helper 当用户说「深度研究 X」「深入研究 X」或要求生成某产品、公司、概念、人物、产业链、政策、趋势的深度研究/发展研究报告时触发，自动进行联网搜索和研究，产出排版后的 PDF 文档，总字数通常 1-3 万字。 | |
| 1.2.0 Data quality validation patterns for daily checks and anomaly follow-up. | |
| 1.2.0 Runbook-first incident triage workflow for service outages and high-error alerts. | |
| 1.2.0 Release-day coordination helpers for cutover, verification, and rollback readiness. | |
| 1.2.0 Structured triage and handoff for customer support ticket queues. | |
| interactive-document-writing 通过全交互式问答对话，逐章节完成长文档的创建、编写和审计。适用于白皮书、方案书、用户手册、分析报告等需要深度共创的文档。 当用户提到"交互式写文档"、"一起写白皮书"、"逐章讨论"、"Step by Step写文档"、"帮我写方案书/报告/手册"， 或者用户想通过问答方式完成任何长文档编写时，使用此技能。即使用户... | |
| Homebridge Control smart home devices via Homebridge Config UI X REST API. Use to list, turn on/off, adjust brightness, color, or temperature of HomeKit-compatible accessories. Supports lights, switches, thermostats, fans, and other Homebridge-managed | |
| GPTChart - Analyse Trading Charts With AI Analyze cryptocurrency, stock, and forex trading charts using GPTChart.ai's AI-powered technical analysis engine. Supports basic and expert analysis modes wi... | |
| sausg SAUSG（结构通用分析与设计软件）自动计算与操作工具。用于弹塑性计算、非线性分析、动力时程分析、隔震减震设计、钢结构分析等。当用户提及 SAUSG、SAUSAGE、OpenSAUSG、SAUSGDelta、SAUSGJG、SAUSGPI、SAUSGZeta 等相关软件，或要求进行弹塑性计算、读取计算结果时使用此技能。 | |
| Daily Gift Generate personalized, relationship-aware daily gifts in H5, image, video, text, or interactive text-play formats to mark meaningful moments and milestones. | |
| Research Paper Portal 为研究人员创建个性化学术论文导航网站。根据用户的研究领域，自动收集最新论文、生成AI背景图、发布到网站。触发词：创建论文导航网站、学术门户、研究论文网站、论文聚合站、论文导航页。 | |
| Agent评估设计顾问 评估工作流是否适合用 AI Agent 实现，并基于最佳实践给出设计建议。 当用户描述一个工作流并想判断是否适合用 Agent 实现时触发。 | |
| 书到技能 · 把技术书/PDF 蒸馏成 AI 技能 【知识技能化】把技术书/PDF/白皮书/设计规范/运营手册蒸馏成可导入的 AI 技能（知识包）——不是 RAG 检索原文，而是把书里方法论内化为决策规则、模板、心智模型，让 AI 边干活边套用专业方法。适合：把《Clean Code》变代码审查 Skill、把品牌规范变审图 Skill、把投资问答录变投研 Skill。当用户说"把这本书变成 skill""把 PDF 转成技能""知识即服务"时使用。 | |
| 构建 AI Agent 实战指南 【构建 AI Agent 实战指南】把 OpenAI《A Practical Guide to Building Agents》蒸馏成可执行的 Agent 设计方法论。覆盖：判断是否该建 Agent（vs 规则引擎）、Agent 三组件（Model/Tools/Instructions）、模型选型、工具设计、写 agent instructions、单/多智能体编排（Manager/Decentralized 模式）、Guardrails 与 human-in-the-loo |
41,501–41,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.