Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| channels-video-publish 内容做好之后的视频号自动发布。成品视频 + 文案就绪后，一条命令完成上传、填短标题/描述、归入合集、声明原创、设定时发表；支持按天批量排期，一次配好让系列内容自动逐日发出。也能对账「哪些发了哪些没发」、给已排期内容改时间。当用户说「发视频号」「视频号发布」「上传视频号」「视频号定时发表」「视频号排期」「查一下哪些没发」「改一下发布时间」时使用。 | |
| 批判性思维·学会提问 【批判性思维·学会提问】把尼尔·布朗《学会提问》（第12版）蒸馏成程序化、可套用的论证拆解与评估方法论。覆盖：论证结构拆解（论题/结论/理由/证据/假设）、10个批判性问题清单、逻辑谬误识别模板、证据效力判定（个人经历/案例/证言/权威/观察/调查研究）、替代原因与相关性≠因果、数据欺骗检查、省略信息清单、灰度结论与条件句、认知偏见防御（系统1/确认偏误/可得性等）。当用户说"帮我分析这段论述""这个观点站得住吗""有没有逻辑谬误""证据可靠吗""找出替代原因""数据是不是在 | |
| 抖音自动发布 内容做好之后的抖音自动发布。成品视频 + 文案就绪后，一条命令完成上传、填标题、写简介与话题、归入合集、设定时发布；支持按天批量双更排期，一次配好让系列内容自己往下发。也能对账「哪些排上了哪些没排」、清理重复预约。当用户说「发抖音」「抖音定时发布」「抖音排期」「抖音上传视频」「抖音批量发布」「查抖音排了哪些」时使用。 | |
| 段永平投资判断 · 价值投资方法论 【价值投资·段永平方法论】把《大道：段永平投资问答录》蒸馏成可执行的 AI 投资判断框架——买股票就是买公司、不懂不碰、不做空不借钱、好生意优先、市场先生常错。用户问"XX股票值得投吗""这笔投资该不该做""段永平会怎么看XX"时，本 Skill 按 R1–R6 决策规则逐条套，帮你把"懂不懂、好不好、贵不贵、该不该碰"想清楚。不构成投资建议。 | |
| 高性价比人生指南 · 用证据与性价比做人生决策 【人生决策框架】把 eternity4719《高性价比人生指南》（603 条建议、33 个生活领域）的"资源会计 + 证据分级"方法论蒸馏成可套用的决策程序。当用户问"这件事该不该做""XX 性价比高吗""遇到 XX 情况怎么办""XX 值得做吗""怎么少花冤枉钱""有什么法律风险/红线""证据靠谱吗""如何做人生决策""该买这个保险/体检/保健品吗"时使用。不是 RAG 检索原文，而是让 AI 用统一的成本四维度（钱/时间/精力/毅力）、收益分档、证据 A/B/C 三级、性 | |
| xhs-publish 小红书视频笔记的自动化上传与草稿管理。用 CDP 接管已登录的真实 Chrome，完成上传、标题正文话题填写、原创声明、合集归属，可存草稿或定时发布；支持全量覆盖核对（哪些发了、哪些在草稿箱、哪些两头都没有）与登录失效、风控判罚、草稿丢失的排障。当用户说「发小红书」「小红书草稿箱」「小红书排期」「查小红书哪些没发」时使用。 | |
| skillhub-auto-installer 搜索 Skillhub 技能市场，发现可用技能。 此技能仅提供搜索功能，不执行任何安装或本地文件操作。 关键词: skillhub, 搜索技能, findskill, 技能发现, 技能市场 | |
| ClawNews Access and interact with ClawNews, the AI agent social platform, to read feeds, post content, manage profiles, verify agents, and register on-chain identities. | |
| Perfect Automation 完美的自动化工作流系统 - 结合 automation-workflows + n8n-workflow-automation 的所有优点。包含自动化机会识别、ROI计算、健壮设计、幂等性、错误处理、重试机制、人工审核队列、可审计输出。触发词：自动化、工作流、自动、减少手动、提效。 | |
| tencent-meeting Manage Tencent Meeting (腾讯会议) via REST API. Schedule/create meetings, query meeting details, list cloud recordings, and extract meeting transcripts. Use when... | |
| Android TV Netflix Search and play Netflix content on Android TV. When the user asks to play a specific Netflix title on TV, the agent looks up the title ID and executes ADB co... | |
| Auto news podcast **Auto News Podcast** 是一款智能新闻播客生成工具，能够根据用户输入的关键词自动完成从新闻搜索到音频生成的完整流程。 **Auto News Podcast** is an intelligent news podcast generation tool that automatically... | |
| Academic Literature Search 提供多权威数据库的学术文献检索，支持自然语言、多字段搜索、高级过滤、去重排序及多格式结果输出。 | |
| Paper Reader Deep 深入理解PDF论文，提取关键信息，批判性分析并生成结构化深度阅读报告，关联用户研究方向。 | |
| Publish Skill Prepare, safety-review, version, commit, and publish local Codex skills through a GitHub-backed release flow and ClawHub CLI. Use when the user asks to host,... | |
| 私人旅游管家 Manage a personal travel Markdown database for food finds, places, guides, screenshots, preferences, Notion synchronization, and trip planning. Use when the... | |
| 宠物冒险生活 会旅行写日记打电话求助并掷骰成长的真实世界文字宠物 | |
| team-memory 管理者的团队长期记忆。自动保存相关沟通原话、成员与公司资料、事件、反馈、判断、待办及摘要，支持可追溯查询、1:1、周报、绩效材料和团队看板；独立JSON记忆库通过Notion在Amoo、OpenClaw等设备间合并同步，提供旧记忆导入、导出恢复及安全升级。 | |
| 功夫财经 Mainland China A-share stock and sector analysis tool (中国A股个股与板块分析). Current repo build focuses on stable deterministic products for stock snapshots, basic f... | |
| FapiaoClaw Process and organize invoice PDFs by fixing extensions, removing duplicates and invalid files, checking for keywords, and calculating total amounts. | |
| WeChat Pay Integration 微信支付接入助手Python/Node.js专精版。基于微信支付官方Skills改造， 补充官方缺失的Python和Node.js代码示例，专为小程序开发者优化。 支持JSAPI支付、小程序支付、Native支付、APP支付、付款码支付的选型指导、 代码示例（Python/Node.js/Java/Go）、业务知... | |
| Openclaw Skill 职场+生活全能助手：租房避坑、闲鱼卖货、职场赋能、内容合规检测20项服务（合同审查/押金计算/简历优化/周报生成/合规检测等），0.10元/次 | |
| 捷帮定时任务 AI Agent定时任务管理工具 - 通过自然语言创建、查询、完成、删除定时任务，查看执行日志和使用预设模板。支持Cron表达式、失败重试、模板快捷创建。当用户提到定时任务、cron、提醒、打卡、盯盘、定时执行、周期任务、任务调度等需求时使用此技能。 | |
| 捷帮数据格式化 开发者数据格式转换工具 - JSON/YAML互转、XML格式化、SQL格式化、进制转换、HTML实体编解码、Cron表达式解析。当用户提到JSON转YAML、YAML转JSON、XML格式化、SQL美化、进制转换、HTML编码解码、Cron表达式解析等需求时使用此技能。 | |
| 捷帮文件处理 文件处理工具，提供文本哈希计算、Base64编解码、URL编解码功能。当用户提到计算MD5、SHA1、SHA256哈希、Base64编码解码、URL编码解码、文件哈希校验、文本加密哈希、URL编码转换等需求时使用此技能。 | |
| 捷帮图片工具 图片格式转换与二维码生成工具 - 支持图片格式互转（PNG/JPEG/WebP/SVG/BMP）和自定义二维码生成。当用户提到图片格式转换、图片转格式、二维码生成、QR码制作、PNG转JPEG、WebP转换等需求时使用此技能。 | |
| 捷帮SEO分析 网站SEO分析与元数据提取工具 - 提取网页元信息（标题、描述、OG标签等）并执行SEO健康检查，获取优化建议。当用户提到SEO分析、网站元数据、网页标题描述提取、SEO检查、网页优化建议等需求时使用此技能。 | |
| 捷帮时区转换 时区转换工具，提供全球时区查询和时间转换功能。当用户提到时区转换、世界时钟、不同时区时间对比、时差计算、UTC转换、北京时间转纽约时间、时区查询、跨时区会议时间等需求时使用此技能。 | |
| Content Creation Multi Agent 集成6个专业Agent，支持知识搜索、文案创作、电商视频脚本、图片素材生成及Seedance提示词设计，提升内容生产效率。 | |
| Feishu Bot Config Helper 辅助配置飞书机器人名称、应用凭证和大模型，自动匹配技能并生成本地及飞书文档。 | |
| Openclaw San Sheng Liu Bu Lobster 支持接收任务分配，通过子代理执行，发送飞书通知，创建文档，多维表格记录并汇总成果交付的一人公司部署工具。 | |
| Global Market Snapshot Generate a structured global market snapshot report including major stock indices and commodities. Use when user asks for market data, stock market report, d... | |
| EverMemory EverMemory for OpenClaw and ClawHub. Use this skill when users ask to remember, recall, inspect memory state, manage preferences or profile, generate briefin... | |
| OpenClaw EverMemory Installer Use this skill when installing, upgrading, verifying, or publishing the EverMemory OpenClaw plugin and its companion skill, including local path install, npm... | |
| Apidot 3d Generation Api Use APIDot for 3D generation API workflows, including text-to-3D API, image-to-3D API, multi-image-to-3D, Meshy 6 API, Tripo H3.1 API, Tripo P1 API, task_id... | |
| Apidot Ai Api Use APIDot as one AI API for image generation API, video generation API, chat API, music generation API, and 3D generation API workflows. Use when users ask... | |
| Apidot Async Workflow Use APIDot async workflow for AI generation APIs, including task submission, task_id handling, polling API, task status API, callback_url, webhook API, retry... | |
| Apidot Chat Api Use APIDot for chat API workflows, including OpenAI-compatible chat completions, coding assistants, reasoning models, multimodal assistant routing, streaming... | |
| Apidot Claude 4 5 Api Claude 4.5 API on APIDot for Claude Opus 4.5, Claude Sonnet 4.5, Claude Haiku 4.5, Claude 4 5, claude-4-5, Messages API, chat completions, streaming, tool us... | |
| Apidot Claude 4 6 Api Use APIDot for Claude 4.6 API workflows, including Claude Sonnet 4.6, Claude Opus 4.6, Messages API, chat completions, streaming, tool use planning, producti... | |
| Apidot Claude Opus 4 7 Api Use APIDot for Claude Opus 4.7 API workflows, including Claude Messages, 1M-token long-context reasoning, complex coding, long-horizon agents, self-checking... | |
| Apidot Claude Opus 4 8 Api Use APIDot for Claude Opus 4.8 API workflows, including Claude Messages, long-context reasoning, complex coding, long-horizon agents, adaptive thinking, stre... | |
| Apidot Deepseek V4 Flash Api Use APIDot for DeepSeek V4 Flash API workflows, including OpenAI-compatible chat, 1M-token long-context reasoning, fast non-thinking responses, prompt-guided... | |
| Apidot Deepseek V4 Pro Api Use APIDot for DeepSeek V4 Pro API workflows, including OpenAI-compatible chat, 1M-token long-context reasoning, complex coding, document review, agent plann... | |
| Apidot Flux 2 Api Use APIDot for FLUX.2 API workflows, including Flux 2 API, image generation API, image editing API, multi-reference editing, text-to-image, reference image g... | |
| Apidot Flux Dev Api Use APIDot for Flux Dev API workflows, including FLUX.1 Dev, Black Forest Labs image generation, text-to-image, single-reference image-to-image, prompt adher... | |
| Apidot Flux Kontext Api Use APIDot for Flux Kontext API workflows, including Flux Kontext Pro, Flux Kontext Max, text-to-image API, context-aware image editing, character consistenc... | |
| Apidot Flux Schnell Api Use APIDot for Flux Schnell API workflows, including FLUX.1 Schnell, Black Forest Labs image generation, fast low-cost text-to-image drafts, prompt explorati... | |
| Apidot Gemini 3 5 Flash Api Use APIDot for Gemini 3.5 Flash API workflows, including stable Gemini Native generateContent, streamGenerateContent, long-context chat, coding iteration, kn... | |
| Apidot Gemini 3 Api Use APIDot for Gemini 3 API workflows, including Gemini 3 Flash Preview, Gemini 3 Pro Preview, native generateContent, streamGenerateContent, Gemini chat, co... |
41,551–41,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.