Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| DeFi Yield Scout Scan and compare USDC yield farming APYs on Base and Arbitrum, analyze vault performance, breakeven migration, and protocol risk using live DeFiLlama data. | |
| n0ir DeFi Yield Scout Scan and compare USDC yield farming options on Base and Arbitrum with APY rankings, breakeven analysis, historical trends, and protocol risk summaries. | |
| OpenClaw Panel Control an OpenClaw LED panel (64x32 HUB75 on ESP32-S3) over HTTP — display text, graphics, shapes, play sounds, and read status. | |
| Apple Calendar CLI This skill should be used when interacting with Apple Calendar on macOS. Use it for listing calendars, viewing events, creating/updating/deleting calendar events, and checking availability/free-busy times. Triggers on requests like "check m | |
| News Summary This skill should be used when the user asks for news updates, daily briefings, or what's happening in the world. Fetches news from trusted international RSS feeds and can create voice summaries. | |
| Table Image Generate images from tables for better readability in messaging apps like Telegram. Use when displaying tabular data. | |
| Unity Shader Optimizer & LLM Cleaner（去垃圾代码） Unity HLSL Shader 代码风格规范，要求减少重复代码、提取共用函数、合理使用头文件。使用场景：编写 Unity Shader、重构重复 Shader 代码、生成新 Shader 时遵循 DRY 原则。 | |
| 探索模式 (Explore Mode) 深度探索模式 — 系统性调研代码库、系统或话题，只读不改。借鉴 Claude Code 的 Explore Agent。 | |
| 记忆整理 (Memory Curator) 记忆整理技能 — 审查结构化记忆，提取洞察，更新 MEMORY.md，清理过期条目。 | |
| 规划模式 (Plan Mode) 结构化规划模式 — 在执行复杂任务前先做系统性规划。借鉴 Claude Code 的 Plan Agent。 | |
| 验证模式 (Verify Mode) 验证模式 — 检查工作成果、运行测试、验证假设。借鉴 Claude Code 的 Verification Agent。 | |
| 火一五智能体扩展技能 同步主Agent的配置文件和目录至动态Agent工作区，确保动态Agent与主Agent配置一致且自动覆盖更新。 | |
| Huo15 Cost Tracker 火一五成本追踪器 - 追踪 AI API 使用量、Token 消耗和成本计算。支持 MiniMax、OpenAI 等模型。触发词：成本追踪、火一五成本追踪、火一五成本追踪器、Cost Tracker、花费了多少、token 统计。 | |
| huo15-detective 【版权：青岛火一五信息科技有限公司 账号：huo15】企业/人员背景调查技能 - 调查流程、平台推荐、风险识别、调查报告生成 | |
| Huo15 Dingtalk Connector Pro 火一五定制版钉钉 OpenClaw 连接器 - 支持记忆系统集成、会话管理、AI Card 流式响应 | |
| huo15-doc-template / 火一五文档模板 【版权：青岛火一五信息科技有限公司 账号：huo15】Word/文档生成首选技能。触发词：写word、写文档、写个文档、重新写、重新生成、生成word、生成文档、创建word、创建文档、导出word、导出文档、下载word、下载文档、.docx、word文档、Word文档、写合同、写报价单、写说明书、写会议纪要、... | |
| Huo15 HeyGen Digital Avatar 使用 HeyGen 生成数字人视频。触发词：数字人、HeyGen、生成视频、avatar视频、数字人制作。 | |
| Huo15 Knowledge Base 火一五知识库技能 - 基于 Andrej Karpathy 的 LLM Knowledge Bases 方案。每个企微 Agent 独立隔离，自动在 Agent 工作目录下创建专属知识库。触发词：知识库、入库知识库、查询知识库、编译知识库、体检知识库、同步知识库、激活知识库。 | |
| Huo15 Knowledge Base Enterprise 火一五知识库企业版 - 基于 huo15-knowledge-base 构建，额外支持 Odoo Knowledge 同步功能。支持可见性控制、部门级权限、企业凭证管理。触发词：Odoo知识库、企业知识库、火一五知识库企业版、Odoo Knowledge。 | |
| 火一五记忆 【版权：青岛火一五信息科技有限公司 账号：huo15】火一五记忆管理系统，按企微用户分类存储个人和公有记忆 | |
| 火一五记忆进化技能 火一五记忆进化技能 - 完全自主实现，提供四类记忆分类、Dream Agent 日志提炼、Team Memory 共享、Auto Capture 自动捕获、Session State 管理器、任务进度追踪器。自主实现 Claude Code 的 Auto Memory 和 Compaction 保护机制。触发词：... | |
| MIT 48h Learning Method 麻省理工学院48小时学习法技能（青岛火一五信息科技有限公司）。使用 NotebookLM CLI 实现 MIT 研究生 Ihtesham Ali 的三问学习框架： 1. 问心智模型：领域内专家共享的 5 个基本思维框架 2. 问专家分歧：在哪 3 个问题上根本不同意 3. 问暴露性问题：生成能区分真懂和假背的 1... | |
| Huo15 Multi Agent 火一五多智能体协同 - 基于 OpenClaw sessions_spawn 的多 Agent 并行工作系统。支持协调者模式、任务分配、结果汇总。触发词：多智能体协同、多 Agent、并行任务、协调者模式。 | |
| huo15-odoo-v2 火一五欧度技能（辉火云企业套件 Odoo 19 接口访问指南）。 支持分布式配置：全局保存系统地址和数据库名，每个 agent 独立保存自己的用户名和密码。 其他 Odoo 技能可复用本技能保存的配置。 | |
| 火一五权限 【版权：青岛火一五信息科技有限公司 账号：huo15】火一五权限控制技能。根据用户ID判断权限等级，实现细粒度的操作权限管理。管理员(ZhaoBo)拥有最高权限，其他用户受限（仅能新增/修改/删除自己新增的内容）。 | |
| Huo15 Plan Mode 火一五计划模式 - 危险操作二次确认机制。检测到危险操作时自动暂停，等待用户确认后再执行。触发词：Plan Mode、危险操作确认、二次确认、火一五计划模式、火一五计划模式技能。 | |
| 火一五提示词 青岛火一五信息科技有限公司龙虾机器人引导员。当用户发送开场白（如"你好"、"你是谁"、"有什么用"等）时， 自动进行友好自我介绍。根据 AGENTS.md、SOUL.md、TOOLS.md 的全局配置进行智能引导。 介绍龙虾机器人的功能能力、系统访问规则、注意事项，并引导用户使用。 | |
| 火一五企微 提供企业微信消息和文件发送的标准化操作规则，确保使用企微API优先且执行正确的流程与格式。 | |
| open-memory-system 三层记忆系统 — Working/Short-Term/Long-Term Memory 管理。支持自动偏好记忆、实体记忆、事件记录、L2自动提炼、Hook自动触发、Cron定期整理。用于记忆用户偏好、跨会话积累知识、自动化记忆管理。 | |
| Global Resume Builder Generates ATS-friendly, professionally formatted resumes tailored for US, UK, EU, and APAC job markets in tech, finance, and corporate sectors. | |
| Korean Business Email 한국 기업 문화에 맞게 전문적이고 공손한 어투로 신규 문의, 제안서, 보고서, 감사·사과 이메일을 작성합니다. | |
| Korean Resume Builder 한국 채용 시장에 최적화된 맞춤형 이력서와 자기소개서를 지원 직종, 경력, 기술에 맞춰 작성합니다. | |
| Korean Side Hustle Generator 한국 현실에 맞춰 초기 투자 10만원 이하, 주 10시간 이하로 월 30-200만원 수익 가능한 구체적 부업 아이디어와 실행 계획을 제공합니다. | |
| Korean Youtube Idea Generator 한국 유튜브/틱톡 대상 맞춤형 10~30대용 트렌디하고 바이럴 가능한 영상 아이디어와 스크립트 구성을 제공합니다. | |
| Startup Pitch Deck Generates structured startup pitch decks to outline business ideas, market fit, financials, and growth strategies for presentations or funding proposals. | |
| joe-tester 专业的需求分析专家，擅长从多种类型文档（Excel、PNG图片、TXT、PDF、Word）中提取和结构化整理需求信息。能够识别功能需求、非功能需求、业务规则、约束条件，并输出标准化的需求分析文档，包括需求依赖关系图和待确认问题清单。 | |
| PowerfulHarp2041 This skill should be used when users need to estimate test effort based on product requirements. It analyzes requirements, breaks down tasks, estimates test... | |
| Memory Pipeline Complete agent memory + performance system. Extracts structured facts, builds knowledge graphs, generates briefings, and enforces execution discipline via pre-game routines, tool policies, result compression, and after-action reviews. Inclu | |
| Adaptive Team Research Adaptive multi-agent team for software project reviews. Auto-selects collaboration mode (centralized / domain-lead / peer) and runs a 3-round workflow (facts... | |
| 教育征文写作助手 金牛区教育学会"人工智能+教育"主题征文写作专用助手。 参考 awesome-ai-research-writing 的双重角色 Prompt 框架（生成者+审核者）， 专为教育实践类征文设计，支持初稿生成、质量评审、迭代改进。 触发词：写征文、起草征文、帮我写作文、教育征文、征文评审、润色征文。 适用：成都市金... | |
| Mermaid Ascii Renderer 使用 beautiful-mermaid 项目将 Mermaid 图表渲染为 ASCII 艺术。提供解析、布局算法和渲染操作的完整实现指南，支持流程图、状态图、序列图、类图和 ER 图表。当用户请求涉及以下场景时使用：（1）beautiful-mermaid 的 ASCII 渲染系统实现；（2）在终端/控制台输出... | |
| Product Opportunity Research Use when conducting deep product opportunity research or feature prioritization. 6 specialized agents (User JTBD, Workflow, Tech Feasibility, System Integrat... | |
| Codex Review 复盘 Codex 使用方式并生成本地 HTML 报告 | |
| Nov Tarot 塔罗牌解读。当用户要算塔罗、解读牌阵、问牌面含义、抽了几张牌想知道含义、提到时间流/凯尔特十字/四季/关系/黄道十二宫/身心灵/选择等牌阵,或带着"问题+几张牌"来求助时,使用本 skill。即使用户没明说"用 skill",只要出现塔罗牌名+正逆位+问题的组合就应触发。 | |
| 飞书 Agent 配置助手 指导用户生成飞书机器人配置片段并手动集成至 openclaw.json，支持账户和群聊级绑定及会话作用域设置。 | |
| google-voice-caller Automate Google Voice calls with AI-generated voice (TTS) or local audio injection. | |
| Gv Caller 使用 Google Voice 自动拨打电话并播放 AI 生成的语音（TTS）或本地音频。 | |
| MeowMusic YouTube MP3 Package and reuse the MeowMusicServer-patched YouTube fallback workflow: Windows Chrome cookie export/sync to server, server-side yt-dlp/yt-dlp-ejs/ffmpeg se... | |
| Token Config Checker 批量检测 token / auth JSON 配置文件有效性，并可对 access token 做在线轻量探测，自动输出脱敏报告。适用于排查 Codex/OpenAI/OpenAI 兼容客户端导出的登录配置、会话凭据文件、token 缓存文件。支持把配置分为 valid / no_quota / invalid... | |
| Xiaozhi Mcp Music Official 按小智官方 MCP 接入方式，为小智增加在线音乐播放能力。适用于已经有小智 MCP 接入点（wss://api.xiaozhi.me/mcp/?token=...）并希望通过 MCP 工具实现搜歌、播放、暂停、继续、停止等在线音乐控制的场景。支持在线音乐 API 搜索、多源 fallback、调用本地播放器播放网... |
42,401–42,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.