Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Apidot Wan 2 7 Video Api Use APIDot for Wan 2.7 Video API workflows, including text-to-video API, image-to-video API, reference-to-video, edit-video, Wan 2.7, async task submission,... | |
| Apidot Z Image Api Use APIDot for Z-Image API workflows, including Alibaba Z-Image, text-to-image API, prompt-based image generation, photorealistic image candidates, aspect ra... | |
| ACP Code Agent Delegate coding tasks to external agents (Claude Code, Codex) via ACP. Triggers on phrases like "改代码", "修bug", "重构", "review", "实现功能", "写测试", "优化", "fix", "r... | |
| AutoDimension Report Skill En Process PDF, DOCX, XLSX from supply chain document packages — conversion, image extraction, OCR, dimension verification, and review report generation. Invoke... | |
| Flowyaipc Herdsman Skill En Integration package for the Herdsman model engine. Used by other agent platforms to call scripts in this directory and protocol specifications when connectin... | |
| Ragflow Workbench 1.0.0 En RAGFlow Workbench — end-to-end RAG platform on Windows: Docker install check, admin bootstrap and API key generation, default model setup (Embedding/Chat/Rer... | |
| fangcloud-api skills Automation skill for fangcloud-api skills. | |
| fangcloud_ai 亿方云 (Fangcloud) AI 能力集成 Skill。支持文件管理（列表、上传、下载、分享）、协作邀请、知识库对话 (DeepSeek) 以及智能体交互。当用户需要操作亿方云文件、查询最近文档或创建分享链接时，使用此 Skill。 | |
| x402 OSINT Perform paid OSINT lookups on usernames or emails to find public profiles and footprint data, paid in USDC on Base via x402 with no API keys needed. | |
| Oc Agent Loop Run a bounded maintainer loop for local OpenClaw changes. Use when a task needs diagnosis, a small candidate change, validation, and an explicit keep or reve... | |
| Oc Copy Guard Ship public OpenClaw docs and skill files with fewer leaks, fewer empty claims, and clearer operator instructions. | |
| Oc Document Preflight Prepare local documents for OpenClaw review without losing source anchors, redaction notes, or validation checkpoints. | |
| Oc Document Review Review messy specs, policies, and handoff notes with source-linked findings instead of vague rewrite advice. | |
| Oc Evidence Notebook Turn scattered local sources into a source-constrained evidence notebook for incident, release, and maintainer decisions. | |
| Oc Gateway Guardian Protect long-running OpenClaw gateways from unsafe restarts with preflight checks, watchdog diagnosis, and evidence capture. | |
| Oc Oss Intake Turn a promising open-source repo into a defensible OpenClaw adoption decision before code, dependencies, or risk enter the workflow. | |
| Oc Prompt Optimizer Turn vague maintainer intent into an execution-ready prompt with scope, variables, missing facts, tests, and acceptance criteria. | |
| 见势成策 把行业趋势、证据和经济测算转化为可执行的深度报告与行动方案 | |
| max-research For extremely complex topics. NOT for simple questions. | |
| self-reflection Use when you need to determine the accuracy of the answer. | |
| solution-research Use when choosing solutions, including selecting open-source projects, working around issues, and comparing products. | |
| obsidian-rest-api Operate Obsidian via Local REST API plugin from remote/WSL environments. Use when: (1) user asks to operate Obsidian, read/write notes, or manage vault remot... | |
| 授信报告全流程 Use when handling a small-business bank credit investigation report under a fixed Excel template, from intake and material extraction through drafting, custo... | |
| 八大菜系 中国八大菜系（川、鲁、粤、苏、浙、闽、湘、徽）专业烹饪技能。提供各菜系经典菜谱、调味公式、核心技法和烹饪要点。当用户提到八大菜系、具体菜系名称（川菜/鲁菜/粤菜/苏菜/浙菜/闽菜/湘菜/徽菜）、地方菜（四川菜/山东菜/广东菜/江苏菜/浙江菜/福建菜/湖南菜/安徽菜）、具体菜名（麻婆豆腐/回锅肉/剁椒鱼头/东坡肉/... | |
| jifchat Generate images and videos on the user's JifChat infinite canvas (jif.dev). Use when the user asks to generate, create, or render an image, product shot, poster, or short video with JifChat, or says "/jifchat", "/generate image", "/generate | |
| Dharma-AI: Ancient Hindu Ethics for AI Agents Apply ancient Hindu ethical frameworks from the Ramayana and Mahabharata as behavioral principles for AI agents. Use when an agent needs principled guidance... | |
| dabai/finance-news-brief 搜集过去 24 小时全球重要财经新闻，生成中文简报，输出为 Markdown 和正式 PDF 文件（含封面）。 覆盖全球宏观（美联储、汇率、大宗商品）、美股、港股、A股四大板块。 当用户提到"财经简报"、"财经新闻"、"市场资讯"、"今日行情"、"最新财经"、"生成财经报告" 等关键词时，必须使用此 skill。... | |
| Jiji5188 File Manager OpenClaw自动化文件管理助手，用于批量文件操作、智能分类、重复文件清理、文件重命名、目录同步等任务。当用户需要整理文件、批量重命名、清理重复文件、同步目录或自动化文件工作流时使用此技能。 | |
| Abaqus Explicit Analysis Abaqus/Explicit 显式动力学分析专用技能。覆盖跌落、冲击、爆炸、成形等瞬态非线性问题。包含建模要点、材料/单元/接触设置、稳定性控制、能量平衡验证和常见坑点排查。 | |
| Abaqus Loading Abaqus载荷施加完整流程技能。覆盖分析步骤定义、输出要求、边界条件、载荷类型、接触设置。 | |
| Abaqus Meshing Abaqus网格划分完整流程技能。覆盖单元类型选择、网格策略、网格控制、网格质量检查、孤立网格处理。 | |
| Abaqus Modeling Abaqus有限元建模完整流程技能。覆盖部件创建、材料属性定义、装配、草图绘制、CAD关联接口。 | |
| Abaqus Multiphysics Abaqus多物理场耦合分析技能。覆盖热-机、热-电、声-结构、CEL流体-结构、压电-机械、孔压-结构等耦合分析。 | |
| Abaqus Postprocessing Abaqus后处理完整流程技能。覆盖结果可视化、输出数据类型、数据处理、图形显示、数据导出。 | |
| Abaqus Solving Abaqus分析求解完整流程技能。覆盖Standard/Explicit求解器选择、分析步设置、求解控制、作业管理、并行计算。 | |
| Github To Skill GitHub 项目转 OpenClaw 技能参考指南 - 提供转换流程说明（纯文档，无可执行代码） | |
| Public Apis Search 快速搜索和发现公共 API，基于 public-apis/public-apis 仓库（1400+ API，49 个分类），支持关键词搜索、分类浏览、认证方式筛选 | |
| Skill Lifecycle 技能退休机制 - 记录使用频次，标记低频/退休技能，支持归档和恢复 | |
| OpenClaw Smart Backup OpenClaw Smart Backup - 智能自动备份 OpenClaw 的配置目录和工作空间。自动感知并跳过大型文件、可下载/可编译生成的文件、临时文件和符号链接，使用 tar.gz 格式合并备份。 | |
| Work Mode Switch OpenClaw 智能体工作模式切换指南 - 12 种协作模式（自由/闲聊/讨论规划/研究/深度研究/写作/编码/翻译/执行/审核/自检/自学），支持灵活切换协作节奏 | |
| 易企秀素材商城检索 易企秀是创意营销平台，提供个人简历、翻页 H5 邀请函、营销海报、长页 H5、表单问卷、微信互动游戏、视频等海量模板。本 Skill 用于搜索易企秀商城模版资源，在用户提出易企秀/H5 模板、邀请函、表单等检索需求时，调用脚本返回标题、链接、描述、浏览量等结果。 | |
| 投票鸭制作助手 投票鸭是易企秀旗下的在线投票制作工具，支持模板检索与投票活动创建。 当用户需要制作投票、发起评选、组织投票活动时使用此 Skill。 核心功能： 1. 检索投票模板——按关键词、颜色、热度筛选，返回模板列表与链接 2. 创建投票作品——支持文字投票、图片投票、视频投票，可设置多选/单选、时间范围 3. 素材上传—... | |
| 银行支行、联行号查询 - 即刻数据 银行支行、联行号查询。根据银行名称、省市代码、支行关键词查询支行名称、联行号、省份和城市，也支持查询银行列表。适用场景：用户说“查工商银行西安长安区支行联行号”“查询某银行支行信息”“工商银行有哪些机构”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 银行卡类型及真伪查询 - 即刻数据 银行卡类型及真伪查询。输入银行卡号，查询卡类型、卡名称、卡 BIN、发卡行、银行官网和客服电话，也支持查询银行列表。适用场景：用户说“查一下这个银行卡是什么银行”“这个卡号是信用卡还是借记卡”“查询工商银行列表”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 生日花语 - 即刻数据 生日花语。输入 MM-DD 生日，查询生日花、花语、诞生石及说明。 适用场景：用户询问相关传统文化、生活常识或配对资料时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 生日密码 - 即刻数据 生日密码。输入 MM-DD 生日，查询幸运、健康、建议、名人、塔罗、箴言、优点和缺点。 适用场景：用户询问相关传统文化、生活常识或配对资料时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| ISBN图书查询 - 即刻数据 ISBN图书查询。输入 ISBN-10 或 ISBN-13，查询书名、作者、译者、出版社、出版日期、页数、定价、装帧、丛书和封面等信息。适用场景：用户说“查一下 9787115428028 是什么书”“这个 ISBN 对应哪本书”“查询图书出版信息”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 彩票查询 - 即刻数据 查询彩票最新开奖、指定彩种期开奖详情、福彩3D/排列3历史号码和冷热号统计。适用场景：用户询问“最新彩票开奖”“双色球 2024001 开奖详情”“666 历史开出过几次”“福彩3D 热门号码”等开奖数据查询。数据由即刻数据（jikeapi.cn）开放接口提供，仅用于开奖信息查询，不提供预测或投注建议。 | |
| 佛历查询 - 即刻数据 输入阳历日期，查询佛历日期、完整说明、佛教节日、斋日、星宿和吉凶等信息。 适用场景：用户询问相关数据查询、日期查询或行情查询时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 节假日查询 - 即刻数据 支持查询某天是否放假或调休、某月假期、某年假期，返回假期名称、是否上班和调休目标日期。 适用场景：用户询问相关数据查询、日期查询或行情查询时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 |
41,651–41,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.