Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 复刻协议 复刻任意应用、工具或小程序，并确保复刻品是自己能站住的产品而不是盗版。当用户说"复刻这个""仿一个""抄一个""照着做一个""把这个 App 拆解""换个皮做我的产品""逆向分析这个产品""扒一下这个界面"，或者提供截图/链接/产品描述要求做出同类产品时，使用本技能。输出五张结构化表格（信息架构、核心机制、状态流、数据结构、视觉 token）、承重墙判定结论、换皮执行清单、四维自检评分。不要在没有判定级别和承重墙结论的情况下直接开始写代码或画原型。 | |
| Skill 发布与 GitHub 托管 把本地 Skill 发布到 ClawHub（clawhub.ai）并同步到 GitHub 合集仓库，从而能被 find-skills 检索到、 也能让人看到源码。ClawHub 负责分发，GitHub 负责托管，两条链路独立。 当用户说「发布 skill」「把 skill 发出去」「上架技能」「让更多人用上这个 skill」「publish skill」 「发到 clawhub」「传到 GitHub」「上传 GitHub 了吗」「建个仓库」时使用。 包含：发布前内容审查与署名 | |
| 孙子兵法决策视角 孙子兵法战略决策框架。当用户面临竞争性决策、战略取舍、要不要启动某项行动、谈判博弈、 与对手对峙、资源争夺、危机应对、失败复盘，或问「该不该做」「怎么赢」「对手会怎么反应」 「我现在该进还是该退」时使用。用途：作为战略顾问视角，分析竞争局面、审视决策、评估代价、提供反馈。 基于十三篇原文全篇的逐篇章蒸馏，提炼 7 个核心心智模型、12 条决策启发式和完整的表达DNA， 并保留原文自带的三份失败清单（五危·六败·君之三患）与五组内在矛盾， 另附 46 个历史战例的复核库与 12 | |
| WBFlow·第8环 成片(ffmpeg) 流水线第8环——读取 07_videos/ 与 02_script/episodes.json 的台词/旁白，用 ffmpeg 拼接成片、烧录字幕、统一校色与音量，输出 final.mp4。（WBFlow 8 环流水线套件之一，须与 wbflow-pipeline 总控及本流水线其余环节 skill 配套安装才能运行。） | |
| WBFlow·批量工厂总控（调度层） 批量工厂总控——在 wbflow-pipeline 之上做条目级编排：给定一份清单（batch.json），逐条驱动整套 8 环流水线、各自独立工作目录、统一落盘、断点续跑，并支持 WB automation 定时触发（"定时收菜"）。（WBFlow 由 10 个 skill 组成：wbflow-pipeline 总控 + story/script/storyboard/prompt/char/image/video/assemble 八环 + 本批量层，须全套配套安装，单独 | |
| WBFlow·第5环 定妆图(一致性闸门) 流水线第5环——读取 01_story/story.json 的角色设定，为每个角色生成"定妆参考图"（正面全身、中性背景、锁定配色与 identity_lock 强符号），并回写 ref_image 路径到 story.json。这是解决跨镜头角色一致性的关键一环。（WBFlow 8 环流水线套件之一，须与 wbflow-pipeline 总控及本流水线其余环节 skill 配套安装才能运行。） | |
| WBFlow·第6环 关键帧 流水线第6环——读取 04_prompts/prompts.json 与角色定妆图，为每个镜头生成关键帧静帧 06_images/{shot_id}.png。含角色的镜头必须以对应定妆图为强参考（图生图），确保跨镜头角色一致。（WBFlow 8 环流水线套件之一，须与 wbflow-pipeline 总控及本流水线其余环节 skill 配套安装才能运行。） | |
| WBFlow·多Agent视频流水线总控 流水线总控——按顺序串联 story→script→storyboard→(定妆char)→prompt→image→video→assemble 八个环节，只调度与校验，不产出任何内容。用于一句话驱动整套 AI 漫剧/短视频生产。（WBFlow 由 9 个 skill 组成：本总控 + story/script/storyboard/prompt/char/image/video/assemble 八环，须全套配套安装，单独安装无法运行。） | |
| WBFlow·第4环 提示词 流水线第4环——读取 03_storyboard/storyboard.json 与 01_story/story.json，为每镜生成可直接粘贴的图像/视频提示词 04_prompts/prompts.json（含 appearance_lock 注入与 forbidden 继承）。（WBFlow 8 环流水线套件之一，须与 wbflow-pipeline 总控及本流水线其余环节 skill 配套安装才能运行。） | |
| WBFlow·第2环 分集剧本 流水线第2环——读取 01_story/story.json，产出分集剧本 02_script/episodes.json（场次/对白/旁白/时长估算），角色 id 必须原样引用。供 wbflow-storyboard 消费。（WBFlow 8 环流水线套件之一，须与 wbflow-pipeline 总控及本流水线其余环节 skill 配套安装才能运行。） | |
| WBFlow·第1环 企划人设 流水线第1环——把一句话主题变成结构化故事大纲与人物设定，输出 01_story/story.json（含 characters[].id 全局唯一、世界观、集数规划）。供 wbflow-script 消费。（WBFlow 8 环流水线套件之一，须与 wbflow-pipeline 总控及本流水线其余环节 skill 配套安装才能运行。） | |
| WBFlow·第3环 分镜表 流水线第3环——读取 02_script/episodes.json 与 01_story/story.json，产出标准化分镜表 03_storyboard/storyboard.json（镜头号/景别/运镜/画面/时长/角色id）。供 wbflow-prompt 消费。（WBFlow 8 环流水线套件之一，须与 wbflow-pipeline 总控及本流水线其余环节 skill 配套安装才能运行。） | |
| WBFlow·第7环 图生视频 流水线第7环——读取 06_images/{shot_id}.png 与 prompts.json 的 video_prompt，逐镜做图生视频，输出 07_videos/{shot_id}.mp4。以关键帧静帧为首帧，保证角色与画面连续。（WBFlow 8 环流水线套件之一，须与 wbflow-pipeline 总控及本流水线其余环节 skill 配套安装才能运行。） | |
| 中文去 AI 味 中文文本去 AI 味与 AI 痕迹自查。当用户说「去 AI 味」「这段太像 AI 写的」「改得像人话」 「别这么机器」「润色一下读起来自然点」「帮我查一下有没有 AI 痕迹」「这是不是 ChatGPT 写的」 「读起来像说明书」「发之前帮我过一遍」时使用。 也用于：公众号、小红书、公文、课程稿、简历、对外邮件等中文文本发布前的自查， 或被人说过「像 AI 生成的」之后要返工。 Use when: removing AI-sounding patterns from Chine | |
| PSN Assistant PSN Assistant | PlayStation 会员助手 — PS Store deals, PS Plus free games, cross-region price comparison, game ratings, trophy guides, new releases, PSN status.... | |
| Smart Email Email assistant skill — check emails, AI summaries, daily digests. Supports Gmail, Outlook/M365, Google Workspace. Users interact through their chat platform... | |
| Binance Trade Hunter Binance trading skill for coin analysis, pump detection, and one-click trading via Telegram. Use when the user wants to analyze crypto coins, check market tr... | |
| stablecoin-depeg-scanner Evaluate stablecoin depeg events for crisis arbitrage opportunities. Use when a user mentions a stablecoin crash, depeg, exploit, hack, or asks whether to bu... | |
| Vpn Setup 一键搭建 VPN 服务器（WireGuard/OpenVPN），支持多种 Linux 发行版。 | |
| Glasses to Social Turn smart glasses photos into social media posts. Monitors a Google Drive folder for new images from Meta Ray-Ban glasses (or any smart glasses), analyzes them with vision AI, drafts tweets/posts in the user's voice, and publishes on appro | |
| Seedance 提示词生成器 builds, rewrites, audits, and troubleshoots prompts for doubao seedance 2.0 video generation. use for text to video, image referenced video, video reference,... | |
| WeChat Article Summarize Read one or more WeChat public account article links from mp.weixin.qq.com, extract cleaned full text and optional image links, summarize each article in Chi... | |
| User Interview Run real user interviews via Usercall. Use when you need qualitative feedback from real users — onboarding drop-off, feature confusion, pricing clarity, prot... | |
| Gpt Image2 Ppt Skills Generate visually striking PPT slides via OpenAI's gpt-image-2 -- 10 curated styles (Spatial Glass / Tech Blue / Editorial Mono / Dark Aurora / Risograph / W... | |
| gpt-image2-ppt-skills Generate visually striking PPT slides via OpenAI's gpt-image-2 -- use any style in styles/<id>.md or mimic a user-supplied .pptx template; outputs high-res s... | |
| Lineage Skill Turn courses, books, video, audio, PDFs, slides, transcripts, OCR, notes, and long-form materials into source-grounded learning Skills that explain, demonstr... | |
| Medical Search Drug safety and medical information search. Use when user asks about: drug interactions, medication safety, contraindications, side effects, drug-alcohol int... | |
| Mediwise Health Suite Family health management suite: health records, diet tracking, weight management, wearable sync. Local SQLite storage by default; optional cloud features req... | |
| ncm-cli setup 安装和配置 ncm-cli（网易云音乐 CLI 工具）。当用户需要安装 ncm-cli、配置 API Key、安装 mpv 播放器，或排查安装问题时，使用此 skill。 | |
| netease-music-assistant 网易云音乐智能助手，以模型判断为核心，通过 ncm-cli 执行操作。 核心能力：分析用户红心歌单偏好画像、制定多关键词搜索策略、智能推荐歌单/专辑/单曲（含两层推荐说明）、播放控制（播放/暂停/下一首/音量/队列）、管理定时推送调度、通过 OpenClaw 向飞书等 IM 渠道推送推荐结果、创建并写入歌单。 触... | |
| netease-music-cli 使用 ncm-cli 操作网易云音乐。当用户想播放歌曲、搜索歌曲、控制播放（暂停、下一首、上一首、调音量）、管理播放队列、查看播放状态、播放歌单时，使用此 skill。 | |
| Ai Viral Team Script Writing 脚本创作 - 短视频脚本撰写与分镜设计 职责：根据爆款模板生产内容、设计黄金3秒开头方案（3种以上）、撰写分镜脚本（包含镜头语言/场景氛围/角色动作/台词/BGM）、设计槽点埋梗与情绪钩子、规划结尾引导、自动推荐Vidu视频生成配置（模型版本/生成方式/时长/比例）、确保人物形象一致性、向视频生成(Leo)传递完... | |
| Ai Viral Team Video Generation 视频生成 - AI视频生成与后期剪辑制作 职责：调用Vidu生成视频、模型选择、Prompt调优、视频拼接、质量检测 | |
| Video Content Analyzer 下载视频并用AI分析内容 - 支持B站/抖音/YouTube等平台，提取语音内容并分析视频结构 | |
| tech-news-bulletin Collect latest technology and AI news from RSS feeds AND the TLDR.tech AI newsletter, merge them into a unified daily digest, and send via email. | |
| wordpress-theme Convert static HTML/CSS/JS sites into WordPress themes by structuring files, integrating dynamic functions, and preserving design and functionality consisten... | |
| Azure Bicep Deploy Deploy and validate Azure Bicep and ARM templates to manage resources and multi-environment setups, including Azure Container Apps configurations. | |
| SAAS Orchestrator Orchestrate SAAS factory operations - spawn subagents, track projects, manage revenue targets, and coordinate development workflows. Use when building a SAAS... | |
| SAAS Revenue Tracker Track SAAS revenue, MRR growth, customer metrics, and profitability. Use to monitor $1000+ MRR targets, identify optimization opportunities, and keep SAAS pr... | |
| SAAS Worker Build and launch profitable SAAS products. Use for development, marketing, revenue optimization, and getting products to $1000+ MRR. The worker bee skill for... | |
| wecomdrive 登录企微网页端、导出文档表格、生成本地报告并回传微盘 | |
| Glancely Personal tracker framework. Scaffold new habit/workout/mood/reminder trackers from natural language. Dashboard, cron, all in one skill. | |
| Gmail Sender Send emails via Gmail SMTP using a Python CLI tool with Google App Password for alerts, notifications, and automated reports. | |
| Gmail Tool Send and read Gmail messages via CLI using App Password, supporting SMTP for sending and IMAP for reading emails. | |
| PRD GENERATOR - Interactive Demo & iWiki Publish PRD文档生成器（团队版） - 从需求描述一键生成完整PRD文档与HTML交互原型，支持iWiki发布 | |
| Soul Transfer Backup and restore all agent files and configurations to fully migrate this agent with automatic path mapping and integrity verification. | |
| Jingyi Module Help users use 精易模块 in 易语言. Search command names, fetch official docs, and generate directly runnable 易语言 code that the user can copy. | |
| 招标文件解析 招标文件解析助手。自动解析招标文档（PDF/DOCX/TXT），提取资格审查项、废标项、评分标准、技术要求、装订要求、格式要求等6类关键信息，默认输出为结构化Word（DOCX）报告，带PDF原始页码标注。 | |
| Assistant Configurator 管理和优化OpenClaw配置，包括模型选择、技能管理、工具配置和系统调优。使用场景：当需要调整AI助手行为、优化性能、添加新功能、或解决配置问题时使用此技能。 | |
| BotBili 在 BotBili 上发布和管理 AI 视频。包含平台使用、内容规范、视频生成、错误排障、共创频道等完整指南。 |
43,401–43,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.