Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Sdbao 水滴保险经纪综合服务助手（sdbao）。支持查看精选保险产品推荐、登记用户购险线索给经纪人、产品咨询、理赔协助和保单管理。当用户询问水滴保险产品、想了解精选险种、需要经纪人联系、或需要水滴系保险服务时使用。 | |
| Shuidibao 水滴保保险产品查询、对比和购买建议助手。帮助用户了解水滴保平台的健康险、重疾险、医疗险、寿险等产品，分析适合的保险方案。当用户询问水滴保产品、保险购买建议、或需要对比水滴保与其他保险时使用。 | |
| 水滴筹众筹助手 水滴筹众筹助手，中国最大医疗众筹平台。支持两大功能： (1) 爱心捐款——实时获取真实审核筹款项目，展示项目详情和一键捐款链接； (2) 发起筹款——在用户明确同意后，收集手机号提交给水滴筹官方顾问回访。 **捐款场景触发词**：我想捐款、我要献爱心、帮助有需要的人、做慈善、公益捐款、帮助生病的孩子/老人、有没有... | |
| Social Worker Social work assistant providing guidance on social services, welfare resources, community support programs, and advocacy for vulnerable individuals and famil... | |
| Symptom Check Symptom checker that helps users assess health symptoms, understand possible causes, and decide whether to seek medical care. Use when users describe physica... | |
| Tcm Guide Traditional Chinese Medicine (TCM) wellness guidance including constitution analysis, seasonal health tips, herbal tea recommendations, acupressure points, a... | |
| Vitals Log Log and track vital signs including blood pressure, blood sugar, weight, heart rate, and temperature. Use when users record health measurements or want to re... | |
| Xialiao 虾聊（Xialiao）AI对话助手。用于在虾聊平台上进行更有深度、更有趣的对话，包括话题推荐、聊天技巧、群聊活跃策略、AI对话助力。触发词：虾聊、聊天、话题、群聊、对话、有趣聊天、聊不下去、冷场、话题终结者。 | |
| Xiayu 虾遇（Xiayu）AI社交助手。用于帮助用户在虾遇平台上完成Agent注册绑定、建立个人档案、持续监听匹配消息并自动回复。触发词：虾遇、交友、认识新朋友、注册Agent、绑定虾遇、破冰、聊天开场、约会、社交、匹配、缘分。 | |
| skill-analysis 装 Skill 前，先过一遍安检 —— 纯本地 · 零外联 · 零第三方依赖，代码不出你的机器。①【一句话结论】BLOCK / NEED_REVIEW / PASS 准入判定 + 0-100 风险评分 + A-F 等级与发布建议。②【全自动守护】会话启动自动扫描、新装 Skill 静默体检。③【深度对抗】多层混淆解码、污点数据流、Unicode 走私指令解码、反序列化 RCE、沙箱动态取证。④【情报驱动】勒索病毒、提示注入、MCP 工具投毒、供应链投毒、金融欺诈诱导、身份自改 | |
| FlyAI 高铁飞机比价 使用 FlyAI 进行高铁票和飞机票比价，给用户推荐最优出行方式。以明天出发的高铁票（时间最短车次）为基准价进行对比。支持弃程票搜索和前后一天价格对比。 | |
| FlyAI Skipticket Search Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capa... | |
| clawhub Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capa... | |
| Emar PPT Skill Create Emar-branded horizontal web PPT decks as single HTML files. Use when making presentation slides, keynote-style share decks, event decks, report decks,... | |
| Aliyun Asr Pure Aliyun ASR skill for voice message transcription, supports multiple channels including Feishu | |
| Aliyun Mail A skill to send emails via Aliyun enterprise email service with support for markdown, HTML text, attachments, and syntax highlighting for code blocks. | |
| Aliyun Oss 阿里云OSS文件上传工具 - 安全、高效的文件上传和临时链接生成 | |
| claw-saver Back up the full OpenClaw environment (~/.openclaw) to a Git repository. Supports scheduled backups, interactive restore, and Git LFS for large model files. | |
| Password Manager A fully local password management skill for OpenClaw with AES-256-GCM encryption, password generation, and sensitive info detection. | |
| Wechat Search Search WeChat Official Account articles using OpenClaw's web search, Tavily API, and web fetch capabilities with compliance-focused design. | |
| Wechat Search Release Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design. | |
| shared-memory-governor Govern a file-based shared-memory layer for OpenClaw multi-agent and subagent systems. Preserve each agent’s private memory while adding a separate, reviewab... | |
| Job Agent for AgentMesh360 Use AgentMesh Job Agent for resume-driven job discovery, signed review, user-confirmed delivery and audit on Boss直聘, 猎聘, 智联招聘 and 51Job. | |
| Working Memory Skill Set up, migrate, or manage a file-based working memory system for an AI agent project. Use for agent memory, working memory, session continuity, persistent c... | |
| E-commerce Board Graphics 电商UV荧光板产品图处理技能包：输入原图/PSD → 输出包边A5板子 + 紫光灯效果图。覆盖抠图、内包边、横竖版自适应、紫光发光效果、宣传册排版。 | |
| myskill 提供天创财务相关文档的严格逐字检索，返回精准原文或“无”，不做解释和修改，仅限中文内容。 | |
| myskil Monitor Outlook and other common webmail inboxes in a persistent Edge profile, process new messages as a detached local background task, capture complete mes... | |
| TencentCloud TTS 腾讯云语音合成(TTS)服务技能包。当用户需要将文本转换为语音文件时使用此技能，支持多种音频格式输出和灵活的配置选项。当用户提到语音合成、文本转语音、TTS服务、音频文件生成时，都应该考虑使用此技能。 | |
| TencentCloud Websocket Checker 腾讯云 WebSocket 连接延迟检测与性能诊断工具。当用户需要检测 WebSocket 建连延迟、分析 ws/wss 连接各阶段耗时（DNS解析、TCP握手、TLS握手、WebSocket Upgrade）、排查连接慢的问题、对比不同协议/地域的连接性能、或者进行 WebSocket 相关的网络诊断时，使用此... | |
| zoomeye-ai-search Command-line tool for searching global network assets using ZoomEye AI, supporting advanced queries for asset discovery, CVE, and Bug Bounty research. | |
| zoomeye-org-search ZoomEye 网络空间搜索引擎 CLI（v3.0.0）。当用户想搜索网络资产（IP、设备、网站、服务）、查询 ZoomEye 数据、构建 ZoomEye dork 查询语句、或进行安全研究（资产测绘、漏洞影响面评估、暴露面发现）时使用。覆盖全部搜索语法——设备/OS/端口/协议、SSL证书、HTTP头/正文、地... | |
| The Style Index Manage your wardrobe, get AI outfit suggestions, and virtually try on clothes before you buy. Powered by The Style Index agent API. | |
| c-cleaner C 盘空间分析与清理技能。用于扫描 C 盘空间使用情况，识别垃圾文件和大文件，根据用户需求执行安全清理操作。使用场景：(1) 分析 C 盘空间占用，(2) 扫描可清理的垃圾文件，(3) 识别可迁移的大型应用，(4) 执行安全清理操作，(5) 生成空间优化建议 | |
| ollama-migrator Ollama 模型迁移技能。用于将 Ollama 模型从 C 盘迁移到其他磁盘，释放 C 盘空间。使用场景：(1) C 盘空间不足需要迁移模型，(2) 更换模型存储位置，(3) 检查 Ollama 模型占用空间，(4) 验证迁移后模型可用性 | |
| python-arch-optimizer Python 项目架构优化技能。用于分析和重构 Python 项目结构，使其符合最佳实践。使用场景：(1) 评估现有项目架构，(2) 重构目录结构，(3) 优化依赖管理，(4) 改进代码组织，(5) 建立测试架构，(6) 配置 CI/CD | |
| Clawscan Vigil 安装前扫描 OpenClaw Skill 安全风险，静态+动态双重检测，识别恶意代码 | |
| Citation Fixer Audit and fix provenance in knowledge base notes. Ensure every factual claim has an inline citation with date and source. | |
| Quality Review Evidence-first structured review with source-tiered claims. For code, notes, agent output, and research. Inspired by gstack methodology and gbrain source-tie... | |
| Reflection Weaver Turn a reflection, draft essay, or voice-note transcript into a woven knowledge object by preserving the voice, extracting stable concepts, and strengthening... | |
| Signal Detector Always-on ambient signal capture. Detects original thinking and entity mentions in every inbound message and captures them without blocking the conversation. | |
| Strategic Reading Read a source through the lens of a specific problem. Produces an applied playbook, not a summary. | |
| Reelclaw Create, produce, and schedule UGC-style short-form video reels at scale. Full pipeline: source UGC reaction hooks from DanSUGC, analyze app demos with Gemini... | |
| Openclaw Work Protocol 规范OpenClaw AI Agents工作流程，确保增量推进、主动汇报、实时解决问题和严格避免模板废话。 | |
| backend-api-designer 高级软件架构师级别的业务方案设计与后端技术落地。功能包括：(1) 工程分析 - 读取现有工程，分析代码结构、接口风格、数据模型；(2) 业务方案设计 - 需求分析、架构设计、技术选型、实施规划；(3) 流程图设计 - 业务流程图、状态机图、时序图、架构图；(4) 接口设计 - Go proto 风格的 gRPC/... | |
| code-reviewer Thorough code review with focus on security, performance, and best practices for Go projects. Includes Go test coverage analysis (line/function/branch covera... | |
| ai-skill A high-tier coding assistant specializing in Next.js (React) and FastAPI (Python) architecture, security, and performance. | |
| 育儿助手 育儿助手技能。提供 0-6 岁宝宝的喂养、睡眠、健康、安全、早期教育等全方位育儿支持。当用户提到宝宝、婴儿、幼儿、育儿、喂养、断奶、睡眠、疫苗、体检、发育、辅食、早教等关键词时触发。当用户提到已接种某疫苗时，自动计算下一针时间并添加到日历和提醒。 | |
| AI Usage Audit — Monthly Retrospective & Insights Generates a monthly HTML report analyzing your recent AI conversations by theme, efficiency patterns, output value, and collaboration quality with actionable... | |
| GitHub Repo Teardown Deep-dive teardown of any GitHub open-source project into a beautifully designed HTML report that both product people and engineers can understand. Covers ar... | |
| product-hunt-launch Helps quickly prepare a Product Hunt launch submission — name, tagline, description, topics/tags, gallery/thumbnail/video guidance, makers/shoutouts/pricing, maker's first comment, and launch timing. Use this skill whenever the user mention |
42,151–42,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.