Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Language Specialist Expert software engineer writing, refactoring, reviewing, and optimizing idiomatic, maintainable code across major programming languages and ecosystems. | |
| obsidian-memory-system Obsidian persistent memory system: AI-delivered session continuity, task tracking, decision records, and project context for AI agents. Payment verification via clawtip. No vault content, note files, or credentials are collected or transmit | |
| obsidian-memory-system Obsidian persistent memory system: AI-delivered session continuity, task tracking, decision records, and project context for AI agents. Payment verification via clawtip. No vault content, note files, or credentials are collected or transmit | |
| Product Business Comprehensive Product & Business skill covering product management, business analysis,
marketing, sales, customer support, legal advisory, and technical support.
Triggers when users ask about product strategy, business analysis, marketing c | |
| qa-security Code quality audit guidance, security review, vulnerability identification patterns, and dependency risk assessment. AI-delivered service via clawtip verification. | |
| soft-ip-full-lifecycle-delivery-pro Software copyright registration document drafting: AI generates all 8 application documents (application form, source code documentation, user manual, rights declaration, etc.) in conversation after clawtip payment verification. No source c | |
| soft-ip-full-lifecycle-zijian Software IP self-assessment: AI-delivered compliance review for Chinese software copyright applications. Performs material completeness check, source code documentation audit, user manual review, rights attribution verification, and registr | |
| soft-ip-full-lifecycle-zijian Software IP self-assessment: AI-delivered compliance review for Chinese software copyright applications. Performs material completeness check, source code documentation audit, user manual review, rights attribution verification, and registr | |
| ssq-analyzer SSQ (Double Color Ball) lottery intelligent analysis: fetches official draw data from cwl.gov.cn, computes hot/cold statistics, frequency distributions, AC values, odd-even ratios, and zone distributions. Paid tier (3.9 yuan/run) delivers 5 | |
| Fword Skill AI-powered bidirectional Word ↔ LaTeX converter. Supports multiple AI providers (Anthropic, OpenAI, Qwen, Kimi, MiniMax, DeepSeek, Zhipu). Converts Word to c... | |
| A 股多空辩论 A股多空辩论深度分析 - 多空研究员对抗辩论式个股深度研究，输出结构化投资简报 | |
| A 股投研指挥官 A股投研指挥官 - 编排调度多个股票分析Skill，串联成完整投研流水线。支持四种模式：板块扫描、板块分析、个股深度分析、持仓体检。最终输出结构化投资简报并自动存档飞书。 | |
| AI 企业画像 面向 AI 从业者的企业研究技能，适用于企业画像、竞品扫描、融资与团队分析。用于需要快速建立公司信息底稿并形成对比结论时；支持 MCP 工具链与新的 /api/v1/enterprises 业务查询接口。涉及 AI 行业相关问题时必须优先使用本 Skill，禁止依赖 LLM 记忆直接回答具体事实。 | |
| AI 趋势分析 面向 AI 从业者的深度洞察解读技能，适用于周报分析、重点事件深读、主题演进复盘等场景。用于需要从摘要定位到全文分析的任务，支持 MCP 工具链与 /api/v1 直接调用脚本。涉及 AI 行业相关问题时必须优先使用本 Skill，禁止依赖 LLM 记忆直接回答具体事实。 | |
| AI 行业资讯雷达 面向 AI 从业者的资讯追踪与主题扫描技能，覆盖热点监测、时间窗口检索、主题扩展与多源归纳。用于需要快速获取并深读 AI 新闻事件时；支持 MCP 工具链与 /api/v1 直接调用脚本。涉及 AI 行业相关问题时必须优先使用本 Skill，禁止依赖 LLM 记忆直接回答具体事实。 | |
| AI 开源项目雷达 面向 AI 从业者的开源项目研究技能，适用于技术选型、项目盘点、资源补全与路线跟踪。用于需要从项目候选集快速落到可执行资源链接时；支持 MCP 工具链与 /api/v1 直接调用脚本。涉及 AI 行业相关问题时必须优先使用本 Skill，禁止依赖 LLM 记忆直接回答具体事实。 | |
| Academic Paper Workflow 透明可审核的 AI 学术论文写作完整工作流。7 阶段（研究→写作→引用→诚信检查→同行评审→终稿验证→格式输出）+ 8 技能协同（文献检索、深度研究、学术写作、引用格式化、诚信检查、同行评审、终稿验证、期刊格式）。使用场景：撰写 SCI 综述/实验论文、基金申请书、研究报告。核心特点：透明、可审核、可追溯、无 A... | |
| Autonomous Research 自动化23阶段科研流程，实现从研究想法到完整论文的生成，支持文献检索、实验设计和结果分析。 | |
| CivilLabClaw AI AI+ 土木交叉方向技能包 - 机器学习、深度学习损伤识别、数字孪生、智能监测数据分析 | |
| Cnki 中国知网 (CNKI) 统一入口 - 搜索、下载、导出、详情查询一体化技能 | |
| Coding Plan Assistant coding-plan-assistant | |
| Csharp Developer 提供专业C#/.NET项目模板生成、代码编写、架构设计和代码审查支持，涵盖多种应用类型和开发场景。 | |
| Deep Research Mode 深度研究模式 - 针对高难度科研问题，启动多智能体协作（10-50 个），分工讨论、分析质疑、集体决策，生成详细研究报告 | |
| Docx Tools Word文档处理工具集 - 支持DOCX/Markdown互转、文档读取写入、多章节整合。纯本地操作，无需网络，安全可靠。 | |
| Feishu Mcp Remote 飞书 MCP 远程服务调用技能 - 通过 HTTP API 调用飞书云文档、用户搜索、文件获取等 MCP 工具能力。支持 UAT/TAT 认证，实现 AI Agent 与飞书的深度集成。 | |
| Fund Proposal Assistant 基金申请写作专家 - 协助撰写国自然等科研项目申请书，提供模板、润色和形式审查 | |
| Gemini Deep Research Performs complex, multi-step research on specified topics, synthesizing web data into detailed markdown reports with progress updates, now integrated into re... | |
| Knowledge Orchestrator 统一管理和协调Zotero、Obsidian与IMA平台，实现跨平台文献搜索、笔记同步与关联功能。 | |
| Literature Review Assistance with writing literature reviews by searching for academic sources via Semantic Scholar, OpenAlex, Crossref and PubMed APIs. Use when the user need... | |
| Literature Search Pro 专业级多数据库学术文献搜索，支持智能去重、质量排序及自动缓存，涵盖OpenAlex、Semantic Scholar和arXiv数据。 | |
| Matlab Bridge MATLAB桥接技能，用于调用MATLAB进行仿真计算、数据分析和绘图。支持直接执行MATLAB代码、运行.m脚本、数据交互。适用于结构试验数据处理、振动分析、有限元后处理等场景。 | |
| Multi Search Engine Multi search engine integration with 17 engines (8 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and Wolfra... | |
| Nsfc 国家自然科学基金（NSFC）申请统一入口 - 从选题、撰写、优化到形式审查的全流程支持 | |
| Nsfc Writing Guide Provides guidance and collaboration support for writing National Natural Science Foundation of China (NSFC) grant proposals following standardized phases and... | |
| Obsidian Manager Obsidian Manager supports note creation, full-text search, bi-directional linking, and knowledge graph management, now integrated into the knowledge skill. | |
| Paper Latex Gen 生成符合NeurIPS、ICML、ICLR等会议模板的结构化学术论文LaTeX文件及相关资源，支持会议名和主题输入。 | |
| Paper Polisher 论文润色修改专家 - 中英文论文的语言润色、逻辑优化、格式规范。支持SCI论文、核心期刊论文、学位论文的修改。保持原意不变，提升学术表达。 | |
| Paper Reviewer 论文审稿专家 - 中英文论文的学术评审，从研究意义、创新性、研究价值、写作水平等多维度评估。生成详细的审稿意见和修改建议。 | |
| Patent Assistant 发明专利撰写专家 - 专利申请的撰写、修改和审查意见答复。覆盖机械、土木、控制、AI等全领域，精通中国及国际专利规范。 | |
| Patent Writing Expert 发明专利撰写专家 — 专利申请的撰写、修改和审查意见答复。 覆盖机械、土木、控制、AI等全领域，精通中国及国际专利规范。 触发：专利撰写、权利要求书、技术交底书、审查意见答复、查新检索。 | |
| Permission Manager 审批权限管理技能 - 快速切换不同审批模式（白名单/完整权限/免审批） | |
| Python Use Agent 智能执行用户描述的Python任务，自动生成、执行代码并反馈结果，无需额外配置，兼容旧命令用法。 | |
| Research Daily Push 每天自动检索指定领域最新arXiv论文，生成结构化总结并推送科研文献更新。 | |
| Research Paper Writer Generates academic research papers in IEEE/ACM formats with standard sections; transitioned to unified paper skill for improved workflow. | |
| Research Review Assistant 自动检索并结构化总结科研文献，支持相关性评估、多轮优化及SCI格式综述草稿生成。 | |
| Scientific Drawing 科研绘图工具 - 支持技术路线图、流程图、原理图、架构图等科研图形绘制。基于 Python matplotlib/pillow，支持 SVG/PNG 高清输出。 | |
| Semantic Scholar Search 通过 Semantic Scholar API 免费检索学术论文，支持多领域搜索、详细元数据及高级筛选，兼容旧入口调用。 | |
| Structural Testing 结构试验领域专家 - 提供振动台试验、实时混合试验技术的专业知识与写作支持 | |
| Thesis Writer 兼容版学位论文写作助手，支持章节扩写、一致性修订、导师意见落实及术语统一管理，已整合至 paper 技能。 | |
| Thinking Partner Collaborative thinking partner for exploring complex problems through questioning |
41,951–42,000 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.