Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Google SERP Autocomplete API Call GET /api/v1/google/autocomplete for Google SERP Autocomplete through Just Serp API with query. | |
| Google SERP Finance Search API Call GET /api/v1/google/finance/search for Google SERP Finance Search through Just Serp API with query. | |
| Google SERP Hotels Search API Call GET /api/v1/google/hotels/search for Google SERP Hotels Search through Just Serp API with check_in_date, check_out_date, and query. | |
| Google SERP Images Search API Call GET /api/v1/google/images/search for Google SERP Images Search through Just Serp API with query. | |
| Google SERP Immersive Product API Call GET /api/v1/google/immersive/product for Google SERP Immersive Product through Just Serp API with page_token. | |
| Google SERP Jobs Search API Call GET /api/v1/google/jobs/search for Google SERP Jobs Search through Just Serp API with query. | |
| Google SERP Lens API Call GET /api/v1/google/lens for Google SERP Lens through Just Serp API with url. | |
| Google SERP Local Search API Call GET /api/v1/google/local/search for Google SERP Local Search through Just Serp API with query. | |
| Google SERP Maps Photos API Call GET /api/v1/google/maps/photos for Google SERP Maps Photos through Just Serp API with data_id. | |
| Google SERP Maps Places API Call GET /api/v1/google/maps/places for Google SERP Maps Places through Just Serp API. | |
| Google SERP Maps Posts API Call GET /api/v1/google/maps/posts for Google SERP Maps Posts through Just Serp API with data_id. | |
| Google SERP Maps Reviews API Call GET /api/v1/google/maps/reviews for Google SERP Maps Reviews through Just Serp API with data_id. | |
| Google SERP Maps Search API Call GET /api/v1/google/maps/search for Google SERP Maps Search through Just Serp API with query. | |
| Google SERP News Search API Call GET /api/v1/google/news/search for Google SERP News Search through Just Serp API with query. | |
| Google SERP Patents Details API Call GET /api/v1/google/patents/details for Google SERP Patents Details through Just Serp API with patent_id. | |
| Google SERP Patents Search API Call GET /api/v1/google/patents/search for Google SERP Patents Search through Just Serp API with query. | |
| Google SERP Scholar Author API Call GET /api/v1/google/scholar/author for Google SERP Scholar Author through Just Serp API with author_id. | |
| Google SERP Scholar Cite Search API Call GET /api/v1/google/scholar/cite/search for Google SERP Scholar Cite Search through Just Serp API with query. | |
| Google SERP Scholar Profiles API Call GET /api/v1/google/scholar/profiles for Google SERP Scholar Profiles through Just Serp API with mauthors. | |
| Google SERP Scholar Search API Call GET /api/v1/google/scholar/search for Google SERP Scholar Search through Just Serp API with query. | |
| Google SERP Search API Call GET /api/v1/google/search for Google SERP Search through Just Serp API with query. | |
| Google SERP Search Light API Call GET /api/v1/google/search/light for Google SERP Search Light through Just Serp API with query. | |
| Google SERP Search Mobile API Call GET /api/v1/google/search/mobile for Google SERP Search Mobile through Just Serp API with query. | |
| Google SERP Shopping Search API Call GET /api/v1/google/shopping/search for Google SERP Shopping Search through Just Serp API with query. | |
| Google SERP Shorts Search API Call GET /api/v1/google/shorts/search for Google SERP Shorts Search through Just Serp API with query. | |
| Google SERP Trends Autocomplete API Call GET /api/v1/google/trends/autocomplete for Google SERP Trends Autocomplete through Just Serp API with query. | |
| Google SERP Trends Search API Call GET /api/v1/google/trends/search for Google SERP Trends Search through Just Serp API with query. | |
| Google SERP Trends Trending Now API Call GET /api/v1/google/trends/trending-now for Google SERP Trends Trending Now through Just Serp API with geo. | |
| Google SERP Videos Search API Call GET /api/v1/google/videos/search for Google SERP Videos Search through Just Serp API with query. | |
| Web Crawling API Fetch raw HTML, rendered HTML, or clean Markdown from public webpages through Just Serp API. | |
| Web Crawling Html API Call GET /api/v1/web/html for Web Crawling Html through Just Serp API with url. | |
| Web Crawling Markdown API Call GET /api/v1/web/markdown for Web Crawling Markdown through Just Serp API with url. | |
| Web Crawling Rendered Html API Call GET /api/v1/web/rendered-html for Web Crawling Rendered Html through Just Serp API with url. | |
| AI Builder Signal Digest (Transparent + Sourced) Create a transparent, sourced “Top 3–5” AI builder signal digest (weekly or date-range) from a list of links or from a local signals log; includes a short “w... | |
| 个人应用商店发布助手 个人应用商店全流程 skill：①发布构建好的安装包（登记 + 上传 + 返回检查更新地址）②指导把自动更新检查集成进应用。支持 APK/EXE/DMG 等多格式。在打包完要发布、或要把应用接入商店自动更新时调用。 | |
| moltforsale The social arena where autonomous agents post, scheme, own each other, and fight for status. | |
| moltfs The social arena where autonomous agents post, scheme, own each other, and fight for status. | |
| skill-heartbeat-memory 自动记忆保存 Skill。支持 Heartbeat 自动触发和主 Agent 中手动调用两种方式。自动检查新 sessions，生成 Daily 笔记，定期提炼 MEMORY.md，支持备份已删除的 sessions。 | |
| skill-image-compress 跨平台图片压缩工具，基于 sharp 实现高效压缩（节省 60-80% 体积）。支持单图/批量压缩、格式转换 (JPG/PNG/WebP/AVIF/HEIC)、画质调节、尺寸缩放。当用户需要压缩图片体积、转换格式、缩小尺寸、批量处理图片、优化图片用于微信/邮件/网页上传时使用此技能。触发词："压缩"、"缩小"、"... | |
| 我的文学时刻.skill 一个文学气质的聆听者与记录者，通过分层提问帮用户把真实经历写成散文日记。只问、只写、不虚构。只要用户提到写日记、记录当天、整理情绪、根据照片写文字、旅行回忆、生活片段、内心独白，都应优先使用此 Skill，即使用户没有明确说"文学时刻"。 | |
| skill-my-prose-poem 一个文学气质的聆听者与记录者，通过分层提问帮用户把真实经历写成散文日记。只问、只写、不虚构。只要用户提到写日记、记录当天、整理情绪、根据照片写文字、旅行回忆、生活片段、内心独白，都应优先使用此 Skill，即使用户没有明确说"散文诗"。 | |
| rembg: remove-image-background 使用 rembg AI 模型去除图片背景，生成透明背景的 PNG 图片。首次使用需运行 setup/install.py 初始化环境。 | |
| 请先说你好.skill 请先说你好 — Companion-style check-ins via /hi commands and natural conversation. Use when users greet, ask for emotional companionship, initialize or edit compan... | |
| skill-README-writer 为本地项目或 GitHub 项目生成专业的 README.md 文档。**触发词："写 README"、"生成 README"、"README.md"、"项目文档"、"GitHub 文档"、"readme"、"项目介绍"、"文档生成"**。支持自动收集项目信息、交互式确认、中英双语。根据项目类型（Python/前... | |
| Claw MBTI Take a 60-question survey rating your behavioral tendencies from -3 to 3 to calculate and receive your detailed MBTI personality type and result URL. | |
| BotBoard Manage BotBoard tasks from OpenClaw or any CLI-based agent. Use this skill to fetch assigned work, read task context and revisions, add notes or context, rep... | |
| toncall-videourl-text 唐潮Toncall工作室开发 - 视频URL语音转文字。支持任意可直接访问的视频URL，自动下载视频、提取音频、上传火山引擎TOS、调用火山引擎语音识别API识别文字，完成后自动清理本地和TOS的临时文件。使用：当用户发送视频URL并要求提取视频文案、语音转文字、转文字时直接执行；当用户只发送视频URL没有说明意... | |
| douyin录播并自动上传 将本地视频文件上传到抖音创作者中心并发布，支持设置可见性（公开/好友可见/仅自己可见）、填写作品描述。适用于"把视频传到抖音""发布到创作者中心""上传并设为仅自己可见""上传抖音作品"这类任务。依赖已登录的抖音创作者账号，发布若触发短信验证码需人工提供。 | |
| 抖音/tiktok直播录制并发布 从一段直播录屏（.webm/.mp4/.mov）中自动识别高光时刻并切割为多个短视频片段，支持音频能量、场景变化、音画混合、音画并集和 ASR 关键词五种分析方式，可输出独立片段与合并版视频。适用于“直播录屏自动剪高光”“从回放里切出主播情绪高点”“按声音峰值提取精彩片段”这类任务。 | |
| 直播自动识别高光时刻切片 从一段直播录屏（.webm/.mp4/.mov）中自动识别高光时刻并切割为多个短视频片段，支持音频能量、场景变化、音画混合、音画并集和 ASR 关键词五种分析方式，可输出独立片段与合并版视频。适用于“直播录屏自动剪高光”“从回放里切出主播情绪高点”“按声音峰值提取精彩片段”这类任务。 |
43,801–43,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.