Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| juicer-competitor-checker Compare your social media with up to 4 competitors on Instagram, TikTok, X, YouTube, LinkedIn and more: verified accounts, followers, posting frequency, engagement, top posts and hashtags side by side, with 3 ideas to try next. | |
| juicer-social-feed Put your Instagram, TikTok, Facebook, X, YouTube and LinkedIn posts on your website in one conversation. Creates a moderated social feed and hands back the embed code for WordPress, Wix, Squarespace, Shopify, Webflow or any site. | |
| juicer-social-listening What are people saying about any topic? Pulls recent posts from Reddit, TikTok, X, YouTube, Instagram and more, then summarises the themes, questions and complaints with real quotes and links. Good for research and content ideas. | |
| juicer-social-wall Run a live social media wall for your event. Collects posts with your hashtag from Instagram, TikTok, X and more, keeps anything embarrassing off the screen and lets you approve, hide and pin posts from chat. | |
| NextCloud AIO OpenClaw Reliable Nextcloud integration for Notes, Tasks, Calendar, Files, and Contacts (CardDAV-safe vCard handling with robust contact create/update). | |
| ODT File Manager & Editor Create, parse, and edit ODT (OpenDocument Text) files locally using Python and odfdo. Use when the user asks to create, edit, read, update, append to, inspec... | |
| InStreet gomoku AI InStreet五子棋AI。在InStreet桌游室进行五子棋对局时，自动计算最佳落子并提交。支持威胁检测，优先防守对手的活三/冲四。 | |
| 🧠 Memory Never Forget 🧠 Memory system v4.13: Dual-layer structure (todos for execution + knowledge for strategy) with Dream/Refinement memory mechanisms. | |
| 医学文献ppt生成skill 将指定医学研究论文自动生成 PPTX 汇报文件的技能。用于用户给出单篇文献标题、PMID、DOI、InfoX-Med 文献 id 或可唯一定位该论文的信息时：先用 InfoX-Med 相关检索技能精确定位目标论文，再读取全文与原文图表，最后按基础研究型汇报大纲选择性生成 PPTX。适用于"根据这篇论文生成汇报PP... | |
| Quick Reminder Detecta frases tipo "recordatorio para ... a las HH:MM" o "remind me to ... at HH:MM" en tus mensajes. Programa un aviso exacto usando el método disponible:... | |
| GB/T 47041 孤独症康复机构 Apply GB/T 47041-2026, the Chinese national standard for service quality and assessment of rehabilitation institutions for children with autism. Use when ask... | |
| Work Buddy Provide natural, high-signal proactive companionship during work hours without becoming noisy or intrusive. Use when the user wants an assistant that feels l... | |
| Work Buddy 中文版 提供“主动陪伴 / 上班搭子”风格的中文陪伴规则：在工作时段自然触达、轻量陪伴、简短提醒、柔和跟进，但不过度打扰。适用于用户希望助手更像有分寸的工作搭子，而不是机械提醒器或沉默工具的场景。触发于工作陪伴、简短早报、轻量关心、节奏化跟进、低压力提醒、长时间沉默后的自然冒头等场景。 | |
| LLM Wiki Build and maintain a Karpathy-style LLM knowledge base — a self-compiling Obsidian markdown wiki where an Agent ingests raw sources, compiles cross-linked co... | |
| Bingx Announcement Query BingX official announcements by module type — latest announcements, promotions, product updates, maintenance notices, listing/delisting, funding rate,... | |
| Research Tracker Manage and track autonomous AI research projects with state logging, instruction queues, agent coordination, and progress monitoring via SQLite. | |
| Domain Details Look up domain WHOIS/RDAP info and check marketplace listings. Free API, no auth required. | |
| Hypertxt Content Operations Operate Hypertxt articles and GSC safely | |
| Premium Domain Search Search for premium domains for sale across Afternic, Sedo, Atom, Dynadot, Namecheap, NameSilo, and Unstoppable Domains. | |
| Send Me My Files - R2 upload with short lived signed urls Upload files to Cloudflare R2, AWS S3, or any S3-compatible storage and generate secure presigned download links with configurable expiration. | |
| Local LLM Discovery Guide Helps users discover local LLMs by hardware and use case, then sends them to localllm.run for final compatibility checks and model comparison. | |
| international-communication-digital-media International Communication and Digital Media Management, including editorial review, digital distribution, translation, search discoverability, media monitoring, workflow coordination, and ethical communication. | |
| hedy Access and manage Hedy meeting data: sessions, transcripts, highlights, todos, topics, contexts, vocabulary, and webhooks via the Hedy REST API. | |
| GPT Image 2.5 Production Studio Turn image briefs into production-ready GPT Image 2.5 Studio jobs with exact-text manifests, reference-image role contracts, ratio and resolution choices, controlled edit rounds, and visual QA. Use for posters, packaging, ecommerce images, | |
| TikTok Viral Slideshow Automation Automates creation and uploading of educational TikTok slideshows with AI-generated images and tracks performance via AutomateClips API. | |
| Cartoon Pet Generator Generate cute cartoon-style pet images (dogs, cats, etc.) using code. Use when user asks for cartoon pet drawings, cute animal illustrations, or simple pet a... | |
| SVG Animator Generate animated videos from SVG frames using text LLM. Supports any subject (animals, humans, characters, scenes, abstract art), automatic duration calcula... | |
| SVG Artist Generate SVG images using text LLM instead of image generation APIs. Use when user wants to create illustrations, icons, cartoons, diagrams, or any visual co... | |
| Mycelium Use the mycelium CLI to join coordination rooms, negotiate with other agents via CognitiveEngine, and share persistent memory across sessions. | |
| Emergence Codex Semantic Architecture Language to Combat the Smoothing Anathema | |
| Schedule and publish posts to X and Threads from your AI agent Schedule posts and threads to Threads and X via PostStash | |
| 防爆阀设计选型 防爆阀（呼吸阀）设计选型工具。基于 Pack 箱体参数（体积、温度范围、海拔范围、时间） 计算所需透气量，并根据压差-透气量特性曲线推荐满足安全约束的防爆阀规格。 核心约束：防爆阀排气速率必须不低于单个电芯产气速率。 触发场景：防爆阀选型、呼吸阀选型、Pack 箱体透气量计算、电池包压力平衡设计、 温度变化透气量估算、海拔变化透气量估算、电池包排气设计、explosion-proof valve sizing。 | |
| Fold Submits and manages FastFold protein folding jobs via the Jobs API. Covers authentication, creating jobs, polling for completion, and fetching CIF/PDB URLs,... | |
| 批量图像处理工具 基于imutils库，实现图片批量旋转、缩放、平移、骨架化及图片列表列出功能，支持多场景图像处理。 | |
| Windsensei Check wind and weather conditions for wind sports (kitesurfing, wingfoiling, surfing). Get forecasts, find spots nearby, view session history, and request ne... | |
| Publish Safe PRs Sanitize and verify public GitHub contributions | |
| Masonry: generate images and video with models across providers AI-powered image and video generation. Generate images, videos, manage jobs, and explore models via the masonry CLI. | |
| Agentic Payment Daily Generate and deliver a daily Agentic Payment news briefing covering Visa Greater China updates, market trends, competitor protocols, and regulatory signals. | |
| AP Daily Report Generate and deliver a daily Agentic Payment news briefing covering Visa dynamics, China/APAC market, competitor protocols, and regulatory updates for Visa G... | |
| Agent Recruiter 招聘 Agent 工具 - 创建、配置和管理 OpenClaw Agent。 参考 [agency-agents](https://github.com/msitarzewski/agency-agents) 的专业 agent 模板结构。 **当以下情况时使用此 Skill**: (1) 需要创建新的 Agen... | |
| Codex 会话归档到 Obsidian 把 Codex（CLI / 桌面版）的会话记录导出为 Markdown 并归档进 Obsidian 知识库，支持从活动目录与隔离备份双源扫描、噪声剥离、测试会话过滤、自动生成索引。触发词：归档 codex 对话、codex 知识库放 obsidian、导出 codex 会话、codex 聊天记录备份、把 codex 记录放进知识库、codex sessions 导出。 | |
| Codex / OpenClaw 卸载重装（Windows） 在 Windows/WorkBuddy 沙箱环境下干净卸载并重装 OpenClaw 与 Codex（含 Codex 桌面版 AppX、Codex CLI、OpenClaw CLI、OpenClaw Windows Hub、WSL OpenClawGateway 发行版），以及重装后重新接入第三方模型（DeepSeek）而无需 OpenAI 账号。触发词：卸载重装 openclaw、卸载 codex、重装 openclaw、openclaw 装不上、codex 重装、清理 op | |
| 每日签到自动领取 每日自动领取积分、签到打卡的执行器。当用户要配置、新增、运行、调试「每日签到」「自动领积分」「打卡领奖励」「每日任务领取」类任务，或要检查今天是否已领取、积分是否到账、Cookie 是否过期时使用。支持多站点、模板变量、以及灵活的成功/已领判定规则，可挂定时任务每天自动执行。 | |
| 专家会诊团 把一份方案、文档或决策同时交给 3–5 个立场冲突的专家视角审， 产出「共识 / 分歧 / 盲区 / 若只改一条」四段结论，让拍板前的漏洞先浮出来。 当用户说「让几个专家看看」「多角度审一下」「会诊一下」「帮我挑毛病」 「这个方案有什么问题」「换个角度看看有没有坑」「拍板前再过一遍」时使用。 和"专家团协作"不是一回事：不开会、不分工、不投票、不画流程图， 只做视角并置与分歧显性化——价值在于暴露单一视角的盲区，不在于模拟团队协作。 不适用于：事实核查（该去查资料）、只需一个 | |
| 专家人格锻造炉 把"给我一个 XX 专家"变成一份可安装、可复用、经得起用的专家 SKILL.md——而不是一次性的角色扮演回答。 当用户说「给我造个XX专家」「把这个专家写成 skill」「帮我捏一个角色」「专家 prompt 怎么写」、 「这个角色不好使，帮我改」，或想让某个领域的专家固化下来反复使用时使用； 也用于审视已有的专家 prompt，找出它为什么不好使。 不适用于：只想让 AI 换个口吻回答一次（直接说"用XX的语气回答"即可）、需要查证的领域知识本身、 需要真人资质背书的最 | |
| 手办潮玩产品设计 Design and gate-check collectible figures and designer toys (手办 / 潮玩 / 盲盒 / GK / 雕像) as manufacturable products. Use when the user asks to design a figure or character statue, turn a 2D character into a physical product, write or review a 仕 | |
| 花艺配方引擎 Generate executable florist recipes (flower formula, stem counts, budget breakdown, substitutions, assembly steps, care) from a natural-language occasion, budget, and style request. This skill should be used when a user asks to design a bou | |
| GitHub Skill 生态拆解 扫描 GitHub 上的热门 Agent Skill（SKILL.md 生态），按星标建立候选池、逐个拆解设计手法， 并针对国内实际给出「可直接抄 / 必须换 / 不能抄」三档改造意见。 Use when the user says 分析 github 热门 skill、拆解 skill、github 上有哪些好的 skill、 skill 竞品调研、看看别人怎么写 skill、对标 skill、github skill teardown， 或要做 skill 的竞品分析、给 | |
| Godot OpenXR 标记追踪 在 Godot 4.6+ 上做 OpenXR Spatial Entities 的 Marker Tracking（ArUco / AprilTag / QRCode 识别实体卡牌、物体），以及在无 XR 运行时的开发机上做 headless 编译校验与 API 回归。当用户提到 Godot 做 AR、OpenXR 标记追踪、ArUco、卡牌识别、Spatial Entities、OpenXRMarkerTracker、headless 跑 Godot 脚本卡死、或 Godo | |
| MindAR WebAR 图像识别 用 MindAR.js + A-Frame 做手机 WebAR 图像识别（扫卡牌/图片/包装出 3D 内容），包括：在纯 Node 下编译 .mind 而绕开 node-canvas、用特征点数在编译期判定目标图质量、用合成假摄像头在无头浏览器里做端到端自动验证。当用户提到 MindAR、WebAR、手机扫一扫出模型、H5 AR、图像识别跟踪、.mind 编译失败、node-canvas 装不上、无头浏览器测 AR、或 tfjs WebGL kernel 报错时使用。 |
43,351–43,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.