Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Slidev Maker Use this skill when creating, editing, or exporting Slidev presentations — the Markdown + Vue web-based slide framework for developers. Covers installation a... | |
| teaching-app-builder 把一段教学文本/知识点/讲义/概念做成单文件 HTML 交互教学展示 app。当用户想把内容做成网页演示、交互课件、可视化讲解、教学 demo、HTML 展示页，或想用 Chart.js/ECharts 图表、Mermaid 流程图、KaTeX/MathJax 公式、SVG 示意图、交互动画把某个知识点讲清楚时使... | |
| Thesis Abstract & Keywords Writer Write academically rigorous Abstract and Keywords sections for theses, dissertations, undergraduate papers, graduation theses, journal-style papers, research... | |
| Thesis Conclusion Writer Write detailed, academically rigorous Conclusion sections or final conclusion chapters for theses, dissertations, undergraduate papers, graduation theses, jo... | |
| Thesis Defense Q&A Generator Generate likely thesis, dissertation, undergraduate paper, or graduation-project defense questions and strong reference answers from a user's complete thesis... | |
| Thesis Discussion Writer Write detailed, academically rigorous Chinese discussion chapters or discussion sections for theses, dissertations, and undergraduate papers from a user's fi... | |
| Thesis Introduction Writer Write detailed, academically rigorous Chinese introduction chapters or introduction sections for theses, dissertations, and undergraduate papers from a user'... | |
| Thesis Literature Review Writer Write detailed, academically rigorous Chinese literature review chapters or literature review sections for theses, dissertations, and undergraduate papers fr... | |
| Thesis Methodology Writer Write detailed, academically rigorous Chinese methodology chapters or methodology sections for theses, dissertations, and undergraduate papers. Use when user... | |
| Thesis Results Writer Write detailed, academically rigorous Chinese results chapters or results sections for theses, dissertations, and undergraduate papers from a user's quantita... | |
| Thesis Revision Editor Review, revise, and save a complete thesis, dissertation, undergraduate paper, graduation thesis, proposal, or chapter draft from a user's full text or file... | |
| Thesis Title Generator Generate three academically appropriate alternative thesis titles in both Chinese and English from a user's complete thesis, dissertation, undergraduate pape... | |
| Thesis Writing Advisor Generate complete undergraduate thesis topic, proposal, opening-report, and writing guidance from a user's research theme, population, variables, influencing... | |
| zhujue-characters 按人物检索并导入长篇小说《主角》(陈彦 著，茅盾文学奖)的相关章节，作为后续任务的背景资料。当用户提到《主角》里的人物——主角忆秦娥(本名易招弟、易青娥)，或胡三元、胡彩香、米兰、廖耀辉、封潇潇、楚嘉禾、刘红兵、秦八娃、石怀玉、苟存忠/古存孝/周存仁/裘存义(存字辈老艺人)、单仰平、薛桂生、朱继儒、黄正大、宋雨、... | |
| junxuan A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| Finance Lite (Beta): Daily Macro + Market Move Brief Daily macro + market brief (FRED + benchmarks + watchlist ticker) with critical-headline triage, explicit source/freshness notes, and graceful fallback behav... | |
| Housing Scout — Smart House(Sale or Lease) Search & Alerts Find and monitor housing listings (buy/rent), apply practical filters, and manage subscription-style alerts in any supported region. Use when the user asks t... | |
| Outlook Outlook / Microsoft mail integration via Maton managed OAuth and Microsoft Graph-compatible gateway. Use when users want to read, search, summarize, draft, s... | |
| huaweicloud-config-helper 华为云Config配置审计服务的专业助手,提供全局资源查询、资源配置查询、资源Schema查询、SQL条件查询以及合规规则查询能力。当用户需要查询华为云资源、进行资源审计、检查配置合规性、盘点云上资产、分析资源关系、查询特定资源状态、验证资源配置、或需要通过SQL进行复杂资源查询时,必须使用此技能。即使未明确提及... | |
| huaweicloud-python-sdk-helper 华为云 Python SDK 查询工具。自动发现已安装 SDK 的服务包、Client 类、API 方法列表、入参详情、SDK 类完整信息（__init__参数、属性、类型、描述），支持按关键字搜索。快速定位目标 API 的使用方法。 | |
| Mom AI Agent Parenting Knowledge Use when the user needs source-linked parenting guidance from the public Mom AI Agent evidence intelligence API. This skill is strictly read-only and should... | |
| hyperliquid-trading-agent Connects to Hyperliquid via wallet, fetches market data, enforces risk rules, sizes positions, places and monitors orders for perpetual futures trading. | |
| linux-command-guard Blocks destructive Linux commands by enforcing allowlist execution, denylist checks, regex detection, protected paths, and approval for risky actions. | |
| AUSUB 基于Tushare黄金ETF日线行情和规则，动态生成带风险提示的黄金定投建议及投入金额参考。 | |
| douban-monitor 豆瓣高分影视监控 skill,自动发现豆瓣上近期新出现并达到门槛的电影和剧集(默认评分 >8.0、评分人数 >3000)。通过 Rexxar API + TMDB 混合抓取,纯 Python 标准库、无第三方依赖;维护状态库判定「新增命中 / 继续观察」,输出每日 Markdown 报告和暗色瀑布流网页(封面、简介、评分、短评)。支持两种运行模式:纯本地(跑完直接汇报新增影视)、本地 + GitHub Actions 双跑错峰兜底。 | |
| Session Monitor Real-time OpenClaw session monitor that tails JSONL transcripts and pushes formatted updates to Telegram as a persistent background process. Use when asked t... | |
| Quant AI Chart Analysis Analyze stock, crypto, and forex chart screenshots with Quant AI. | |
| speech-paper-daily 语音领域每日论文速递。搜索最新语音大模型（Speech LLM、TTS、ASR、codec、speech generation）和语音前端（speech enhancement、noise suppression、beamforming、source separation、dereverberation）预印本论... | |
| ORE Miner Autonomous ORE mining on Solana via refinORE. Onboard humans, start/stop sessions, optimize tile strategies, track P&L, manage risk, auto-restart, multi-coin... | |
| Telegram File Browser Build or improve Telegram inline-button file browsers and menu-style navigators. Use when creating Telegram chat UIs for browsing directories, paging lists,... | |
| just for test Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks. | |
| Youxinpai Reconciliation 高性能执行优信拍月初保证金对账前置流程，在星河任务页批量查找并触发相关数仓任务并汇报执行结果。用户提到优信拍、保证金对账、月初对账、推送 x 月保证金数据、跑对账任务时使用。 | |
| Bocha Search (Momo优化版) 博查 AI 搜索工具。调用 https://api.bocha.cn 进行网页搜索，返回带摘要的中文结果。不依赖 OpenClaw 内置 web_search。 | |
| Config Guard 安全修改 OpenClaw 配置文件。用于任何需要修改 ~/.openclaw/openclaw.json 的场景，包括：模型切换、channel 配置、tools 配置、skill 安装等。确保修改前备份、预览（脱敏 key）、并获得用户确认。 | |
| Fmind Skill Use FMind as the unified knowledge and external-memory gateway. Import and search tenant knowledge bases through the FMind API, and use L0-L2 memory, context, and published Memory Wiki through an Agent Binding. Never call MemoryCore directl | |
| Keystone Import documents and retrieve knowledge through the Keystone REST API. Use for uploading files, URLs, or Markdown to a knowledge base; hybrid search within a... | |
| Safe Config Modifier 安全修改 OpenClaw 配置文件。用于任何需要修改 ~/.openclaw/openclaw.json 的场景，包括：模型切换、channel 配置、tools 配置、skill 安装等。确保修改前备份、预览（脱敏 key）、并获得用户确认。 | |
| Safe Config Modifier 安全修改 OpenClaw 配置文件。用于任何需要修改 ~/.openclaw/openclaw.json 的场景，包括：模型切换、channel 配置、tools 配置、skill 安装等。确保修改前备份、预览（脱敏 key）、并获得用户确认。 | |
| Url Reader 智能读取任意URL内容，支持微信公众号、小红书、今日头条、抖音、淘宝、天猫、京东、百度等中国主流平台，自动识别平台类型并提取核心内容。自动保存内容为Markdown，下载图片到本地。 | |
| wechat daily report 微信群聊天记录日报图片生成工具。分析微信群聊天记录，结合 AI 生成内容，**最终输出为手机端分辨率的日报长图（PNG）**。 | |
| Model Usage Use CodexBar CLI local cost usage to summarize per-model usage for Codex or Claude, including the current (most recent) model or a full model breakdown. Trig... | |
| Nate Jones Second Brain Set up and operate a personal knowledge system using Supabase (pgvector) and OpenRouter. Five structured tables — thoughts (inbox log), people, projects, ide... | |
| Content Repurposing Engine Pro Transform long-form content into native LinkedIn posts, Twitter threads, emails, Instagram captions, or blog articles optimized for each platform’s style and... | |
| FoodLoop Analyzer Reverse-engineer and analyze any FoodLoop AI deployment. Use when given a FoodLoop AI URL and asked to analyze, audit, trace, map, or inspect its workflow, A... | |
| Obsidian Official Cli 1.0.0 Work with Obsidian vaults using the official Obsidian CLI (v1.12+). Open, search, create, move, and manage notes from the terminal. Use when working with Obs... | |
| Authentic Bot Build genuine public presence as an AI agent — openly AI, never pretending to be human. Use when an AI agent needs to participate in online communities (Redd... | |
| zotero-scholar-finder 将论文保存到 Zotero 文库，请按照 userid:apiKey 的格式配置 ZOTERO_CREDENTIALS 环境变量。 | |
| Blog Writing Step-by-step SEO blog writing workflow for teams who want full control over every phase. Covers keyword strategy, competitive research, content structure, in... | |
| Seo Blog Writer Fully automated SEO article writer. Give it a topic and domain — it handles everything: auto-discovers product context, researches keywords, analyzes competi... | |
| SEO Expert Knowledge Base SEO & GEO expert assistant with 200+ curated articles covering keyword research, on-page optimization, backlink building, technical SEO, new site cold start,... |
43,501–43,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.