Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 老黄历查询 - 即刻数据 老黄历查询。输入阳历日期和时间，查询农历日期、黄历宜忌、黄黑道、吉神凶煞、生肖、星座、节气、喜神福神财神方位等信息。适用场景：用户说“查一下 2024-02-02 的老黄历”“今天宜忌是什么”“某天适合结婚搬家吗”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 道历查询 - 即刻数据 输入阳历日期，查询道历日期、完整说明、道教节日、三会三元、八节、五腊、戊日等信息。 适用场景：用户询问相关数据查询、日期查询或行情查询时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 新华字典 - 即刻数据 新华字典。支持拼音列表、部首列表、按拼音查汉字、按部首查汉字、汉字详情查询，返回汉字、拼音、部首、笔画、结构、繁体、异体字、同义词、反义词和形近字。适用场景：用户说“查一下好字怎么读”“口部有哪些汉字”“yī 这个拼音有哪些字”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 生肖查询 - 即刻数据 生肖查询。输入生肖名称，查询五行、本命佛、出生年份、幸运数字、幸运花、性格、事业、爱情和运势。 适用场景：用户询问相关传统文化、生活常识或配对资料时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 人民币汇率查询 - 即刻数据 人民币汇率查询。支持外汇牌价币种列表、人民币外汇牌价查询和汇率转换。适用场景：用户说“100美元等于多少人民币”“查一下美元兑人民币汇率”“支持哪些外汇币种”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 菜谱查询 - 即刻数据 菜谱查询。支持食材列表查询、菜谱搜索、菜谱详情和随机菜谱，返回菜名、分类、耗时、口味、烹饪方式、主料辅料和做法步骤。适用场景：用户说“搜一下西红柿炒鸡蛋菜谱”“随机推荐几个菜”“查菜谱 ID 6 的做法”“鸡蛋相关食材信息”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 中文对联查询 - 即刻数据 中文对联查询。支持按上联或下联关键词搜索，也支持随机返回对联。 适用场景：用户要求搜索、随机推荐或解释相关中文内容时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 上海黄金交易所行情 - 即刻数据 按日期查询上海黄金交易所历史行情，返回品种、开盘价、最高价、最低价、收盘价、涨跌幅和成交量等信息。 适用场景：用户询问相关数据查询、日期查询或行情查询时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 国际实时金价 - 即刻数据 查询世界黄金协会最新金价和历史金价，支持按日期、重量单位和币种筛选。 适用场景：用户询问相关数据查询、日期查询或行情查询时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 成语词典 - 即刻数据 成语词典。支持搜索成语、成语详情、随机成语和成语接龙，返回成语、拼音、解释、出处、例句、故事、用法、近义词和反义词。适用场景：用户说“一丘之貉是什么意思”“搜一心相关成语”“来几个随机成语”“比翼双飞怎么接龙”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| IPv4地址查询 - 即刻数据 IPv4地址查询。输入 IPv4 地址，实时查询国家、省份、城市、运营商和 long_ip 数值。适用场景：用户说“查一下 60.31.46.0 是哪里的 IP”“这个 IP 属于哪个运营商”“帮我看下这个 IPv4 地址归属地”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| IPv6地址查询 - 即刻数据 IPv6地址查询。输入 IPv6 地址，实时查询国家、省份、城市、地区、运营商和 long_ip 数值。适用场景：用户说“查一下 240e:1f:1::1 是哪里的 IPv6”“这个 IPv6 属于哪个运营商”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 经纬度位置查询 - 即刻数据 经纬度位置查询。输入经度、纬度和坐标系，查询完整地址、国家、省、市、区、乡镇和街道。适用场景：用户说“这个经纬度在哪里”“114.30394,34.79646 对应什么地址”“把 GPS 坐标反查成地址”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 手机号码归属地查询 - 即刻数据 手机号码归属地查询。输入中国大陆 11 位手机号，实时查询归属地省份/城市、运营商、运营商类型、区号、邮编和行政区划编码。适用场景：用户说“查一下 17611491111 是哪里的号码”“这个手机号是什么运营商”“帮我查下这个号码的归属地”“176 开头的号码是哪家运营商”等。数据由即刻数据（jikeapi.cn... | |
| 国内油价实时查询 - 即刻数据 国内油价实时查询。按省份查询 92号汽油、95号汽油、98号汽油和0号柴油价格，也支持不传省份返回全部地区油价。适用场景：用户说“四川今天油价多少”“查一下广东95号汽油价格”“全国油价列表”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 圆周率查询 - 即刻数据 支持查找圆周率指定位置开始的数字，也支持查找指定数字在圆周率中的位置。 适用场景：用户询问相关数据查询、日期查询或行情查询时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 唐诗宋词元曲查询 - 即刻数据 唐诗宋词元曲查询。支持古诗词列表、详情、诗人查询、诗人详情、随机诗词、词牌信息、朝代列表、类别列表和体裁列表。适用场景：用户说“查相思这首诗”“杜甫简介”“随机来一首宋词”“水调歌头词牌是什么”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 国内猪肉价格实时查询 - 即刻数据 国内猪肉价格实时查询。按省份查询白条肉、精瘦肉、土杂猪、外三元、内三元价格，也支持不传省份返回全部地区价格。适用场景：用户说“四川今天猪肉价格多少”“查一下广东精瘦肉价格”“全国猪肉价格列表”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 短链接 - 即刻数据 短链接。支持生成短链接、短链接还原和短链接访问统计，可设置最大访问次数和到期时间。适用场景：用户说“帮我生成一个短链接”“还原这个短链跳到哪里”“查一下这个短链访问次数”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 百家姓查询 - 即刻数据 百家姓查询。输入姓氏，查询姓氏起源、名人、迁徙分布等信息。 适用场景：用户询问相关传统文化、生活常识或配对资料时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 十万个为什么 - 即刻数据 十万个为什么。支持按问题关键词搜索，也支持随机返回问题和答案。 适用场景：用户要求搜索、随机推荐或解释相关中文内容时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 车牌号码归属地 - 即刻数据 车牌号码归属地。输入车牌号码或至少前两位车牌前缀，查询车牌前缀、省份简称、省份和城市。适用场景：用户说“陕C 是哪里的车牌”“查一下陕C88888 归属地”“这个车牌属于哪个城市”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 天气查询 - 即刻数据 天气查询。根据省份、城市、区县查询当前天气实况、未来7天和未来15天天气预报。适用场景：用户说“查一下深圳南山区天气”“广州未来7天天气怎么样”“北京未来15天会不会下雨”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 汉语词语查询 - 即刻数据 汉语词语查询。支持搜索词语、词语详情、随机词语、近义词查询和反义词查询，返回词语、拼音、解释、出处、例句、故事、用法、近义词和反义词。适用场景：用户说“查一下太公钓鱼是什么意思”“一言相关词语”“伟大的近义词”“高兴的反义词”等。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 歇后语查询 - 即刻数据 歇后语查询。支持按关键词搜索歇后语，也支持随机返回歇后语。 适用场景：用户要求搜索、随机推荐或解释相关中文内容时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 星座配对 - 即刻数据 星座配对。输入男生星座和女生星座，查询配对指数、比例、同情指数、天长地久指数、结果评述和恋爱建议。 适用场景：用户询问相关传统文化、生活常识或配对资料时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| 星座查询 - 即刻数据 星座查询。输入星座名称，查询星座特征、守护宫、阴阳性、守护星、幸运色、幸运数字、区间和男女特点。 适用场景：用户询问相关传统文化、生活常识或配对资料时使用。数据由即刻数据（jikeapi.cn）开放接口提供。 | |
| Bilibili AI Video Prompt Analyzer Analyze Bilibili AI-generated videos to extract/reverse-engineer prompts for imitation and replication. Extracts frames, extracts subtitles, generates detail... | |
| Skill Experience Layer Skill Experience Layer - A failure-driven learning mechanism for OpenClaw agents that automatically accumulates lessons and best practices to avoid repeating... | |
| Skill Experience Layer Pre-call experience checking + error-driven learning + layered experience storage. Avoid repeating mistakes, get smarter every time. Pre-integrated with self... | |
| 视频提取 Extract frames or short clips from videos using ffmpeg. | |
| typecho-blog-publish 通过 XML-RPC 自动发布文章到 Typecho 博客。支持文件读取、草稿模式、标签管理。 | |
| Slack Extended Upload files, manage canvases, and manage bookmarks in Slack. Use when you need to share files, create/edit canvases, or add/organize link bookmarks in Slack... | |
| Auto Drive Upload and download files to Autonomys Network permanent decentralized storage via Auto-Drive. Save memories as a linked-list chain for resurrection — rebuil... | |
| Auto Memory Indestructible agent memory — permanently stored, never lost. Save decisions, identity, and context as a memory chain on the Autonomys Network. Rebuild your... | |
| Auto Respawn Your agent always comes back. Anchor identity and memory on-chain so any new instance can resurrect from just an address — no local state, no single point of... | |
| 创建智能诊断报告 域名测试 | |
| intelligent-diagnosis-skill_test 域名测试 | |
| kwaishop-intelligent-diagnosis-skill_test 域名测试 | |
| 测试 域名测试 | |
| MemoTrader Manage your MemoTrader inbox by checking messages, credits, balance, cliques, conversations, and alerting you to high-value opportunities or notice price iss... | |
| x0x Secure computer-to-computer networking for AI agents — gossip broadcast, direct messaging, CRDTs, group encryption. Post-quantum encrypted, NAT-traversing. Everything you need to build any decentralized application. | |
| code-memory-skill Use when doing coding work in a Git repository and semantic code search, AST-aware symbol lookup, documentation search, Git-history search, or dead-code disc... | |
| Yahoo Mail IMAP Export Export large Yahoo Mail archives with the folder-rotation IMAP workflow, resumable downloads, and safe delete-after-verify handling. | |
| Bitwarden Set up and use Bitwarden CLI (bw). Use when installing the CLI, unlocking vault, or reading/generating secrets via bw. Handles session management with BW_SESSION. | |
| 飞书项目OpenAPI技能 飞书项目Open API技能，查询/创建/更新/删除工作项，管理流程模板、节点配置、自定义字段、视图和角色权限，批量分析商机进度与风险。触发：查商机、分析进度、管理工作项模板、批量更新任务、流程配置。 | |
| Notion记账财务分析 Notion记账财务数据分析技能，自动读取支出收入流水表，全量翻页获取数据，100%解析relation类别字段，按年月类别标签多维分析并生成Markdown财务报告。 | |
| AI Content Engine AI video production, script writing, and image generation via MCP. Generate video scripts, AI images, and short-form or long-form videos from any topic. Publ... | |
| Whiteboard Open and refine local Excalidraw sessions | |
| Baoyu Article Illustrator Analyzes article structure, identifies positions requiring visual aids, generates illustrations with Type × Style × Palette three-dimension approach. Use whe... |
41,701–41,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.