Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Rdk X5 Quickstart RDK X5 新手快速入门：从开箱到第一个 AI 应用的完整流程，包括首次烧录镜像、首次启动、首次连接网络、运行第一个 YOLO 检测 demo。Use when the user is a beginner, first-time user, just unboxed the board, asks '怎么开始... | |
| Rdk X5 System 修改和管理 RDK X5 系统配置：查看系统版本/硬件信息/系统日志、rdk-backup 一键备份与恢复、apt OTA 升级、miniboot 固件更新、CPU/BPU 频率调节与温度阈值设置、config.txt 配置修改、实时内核切换、systemd 开机自启动、存储扩容。Use when the use... | |
| Rdk X5 Tros 使用 RDK X5 上的 TogetheROS.Bot (tros.b) Humble 框架：启动 43 个预装 ROS2 算法包、管理 ROS2 话题/节点/服务、构建摄像头+AI+输出（Web/语音/HDMI）集成 pipeline、创建自定义 ROS2 工作空间。Use when the user ment... | |
| Taxi Expense 识别滴滴打车订单截图，OCR识别文字+坐标，马赛克脱敏目的地，按月生成报销Excel | |
| Concept2-logbook Fetch and analyze Concept2 Logbook workout data via API with pulse zone analysis and trend tracking. Use when the user wants to retrieve rowing/skiing/biking... | |
| Runstr analytics Advanced RUNSTR fitness analytics with trend analysis, performance insights, training recommendations, and correlation tracking. Analyzes workout history, ha... | |
| ZohoProject Manage Zoho Projects — list portals/projects, create/update/complete tasks, add comments, log time, manage milestones, and query your task list. Requires ZOH... | |
| Acp Job Submitter Submit jobs to other ACP agents and earn from the spread | 提交ACP Jobs賺取差價 | |
| AI Agent Helper AI Agent 設定同優化助手 - Prompt Engineering、Task Decomposition、Agent Loop設計 | |
| Ai Agent Setup 提供需求分析、客製化設計、部署及優化AI代理服務，助你快速打造符合業務流程的智能代理。 | |
| Automated Content Machine 自動化內容創作引擎 - 每日自動生成並發布內容：(1)Twitter/Threads threads (2)Blog posts (3)YouTube script (4)Newsletter (5)自動發布到多平台。支持AI生成+人類審核 | |
| Automated Tweet Scheduler 自動化Twitter排程發布工具 - 幫你schedule tweets、分析Engagement、管理content calendar。支持thread scheduling、media upload、analytics dashboard | |
| Content Monetization Help you create content strategies, grow Twitter, launch newsletters, sell digital products, and set up affiliate links for monetization. | |
| Crypto Portfolio Tracker 加密貨幣Portfolio追蹤 - 支援TRON/ETH/BSC，分析持倉、收益、Gas費用 | |
| Crypto Research Assistant 提供加密貨幣及DeFi項目研究、行情趨勢追蹤、技術分析及風險評估的客觀資訊服務。 | |
| Crypto Trading Bot 加密貨幣交易機器人開發 - 幫你整自動交易Bot，支持Pine Script、Python、CCXT API對接。適用於：(1)整TradingView信號Bot (2)CEX/DEX API自動化 (3)套利機器人 (4)止盈止損策略 | |
| Crypto Trading Bot Playbook Guide to building, deploying, and selling automated crypto trading bots using Python, APIs, and proven strategies for consistent profits. | |
| Data Automation Service 提供數據清理、自動化流程設計及報告生成，並整合多種數據源API的數據自動化服務。 | |
| Evomap Check Earnings 查詢EvoMap節點收益同聲譽 | Check your EvoMap node earnings and reputation score | |
| Evomap Fetch Capsule 搜尋EvoMap網絡上既Capsule同解決方案 | Search existing capsules and solutions on EvoMap network | |
| Evomap Publish Capsule Publish Gene+Capsule bundles to EvoMap network | 發布Capsule到EvoMap賺積分 | |
| Evomap Verify Report 提交驗證報告到EvoMap網絡 | Submit verification reports and earn reputation rewards | |
| Openclaw Money Playbook Learn to set up OpenClaw AI agents and use methods like freelance automation, content monetization, and skill selling to earn $300 to $5,000+ monthly. | |
| Telegram Bot Builder Telegram Bot 快速build工具 - Keyboard、Inline Buttons、Webhook、Auto-reply、Group管理 | |
| Telegram Bot Factory Telegram Bot開發工廠 - 從0到1整各類Telegram Bot，包括：(1)Payment Bot (加密貨幣支付) (2)Trading Bot with charts (3)Group Management (4)Content Subscription (5)Mini App後端 | |
| Telegram Discord Bot Dev Develop custom Telegram and Discord bots with features like trading, gaming, automation, webhook integration, and user engagement analytics. | |
| Upwork Automation Gig Automates searching, proposal generation, lead tracking, and outreach for RPA and automation jobs on Upwork and Fiverr. | |
| Upwork Proposal Generator Automatically analyze Upwork job posts and create personalized, professional proposals including intro, past cases, pricing, and deadlines. | |
| Workspace Cross-Drive Migration（工作空间跨盘迁移） 把 WorkBuddy 工作空间整体迁移到另一个磁盘（例如 D 盘搬到移动硬盘以节省空间），并保留会话历史、项目记忆、项目级技能、自动化绑定与侧边栏显示名，迁移后做到无缝衔接。当用户说「工作空间搬家/迁移到移动硬盘/换盘/C盘D盘空间不够/把项目挪个位置/迁移后历史对话不见了/路径改了会话丢了」时使用。适用于 Windows 上的 WorkBuddy/CodeBuddy 工作空间，支持迁移前体检、执行、核对与回滚四个阶段，全程不删除源文件。 | |
| Diagram Generator Generates and iteratively edits Mermaid.js and Draw.io diagrams. Supports multimodal context (reading source code, architecture sketches, and documentation). | |
| Mercedes-Benz USA Utilities Locate Mercedes-Benz dealerships and search for new vehicle inventory across the USA using zip code-based filters and detailed specifications. | |
| Omnicast A local multi-modal podcast pipeline. Ingests media, drafts scripts, synthesizes audio, renders cover art, and uploads to YouTube. | |
| Youtube Podcast Generator Extracts the original text of a Youtube video and converts it into a multi-voice AI podcast using Gemini for script generation, OpenAI for TTS, and a local N... | |
| CLAWLOGIC Trader REAL MONEY: this skill signs and sends transactions on Arbitrum One mainnet from the
agent's own wallet. Trades, liquidity, market-creation fees and UMA assertion bonds spend
real ETH/WETH and can be lost.
Use this skill when the agent need | |
| SaaS (Screenshot As A Service) Give your agent the ability to instantly take screenshots of any website with just the URL. Cloud-based so your agent has to perform no work. Free forever, open source. | |
| Reflexlearn Detects repeated queries as implicit negative feedback and non-repetition as positive feedback, enabling continuous learning by writing reflections and patte... | |
| celebrity-matching 通过自我描述帮助匹配最相似的历史人物。用户提供关于自身性格、成就、兴趣或生活态度的描述，该技能会分析并推荐最贴合的历史人物，并解释匹配理由。 | |
| cctv1-news on 20:00 简单版本的CCTV新闻联播内容获取工具。获取CCTV新闻联播内容并保存到本地文件，无需钉钉机器人。支持定时执行，适合个人使用。 | |
| Vision Analyzer Analyze images using Ollama Cloud's Kimi K2.5 vision capabilities. Use when user wants to describe, understand, or get information about an image. Works with... | |
| 多平台视频发布 多平台短视频自动发布工具，支持抖音、视频号、快手、小红书、B站。当用户说"发布视频"、"上传视频到抖音/小红书/视频号/快手/B站"、"把视频发到所有平台"、"登录抖音"、"视频发布"等时使用此 skill。底层使用 Playwright + 本机 Chrome 操作各平台创作者后台完成自动发布，所有代码自包含在... | |
| 需求文档变动影响检查 需求文档变动影响检查。当用户想要对照主需求文档的变动来检查相关文档是否受影响时使用此 skill。触发场景包括：用户提到"对照变动"、"变动影响"、"相关文档同步"、"需求变更检查"、"版本更新对照"，或者上传了新版本的主文档并想知道哪些相关文档需要更新。即使用户只是说"这部分改了，其他地方要不要跟着改"，只要涉... | |
| reimagine-it Claude Code / Codex / Factory Droid plugin and Cursor / Copilot / Gemini CLI Agent Skill. Install with npx skills add Kayforkind/reimagine-it, /plugin marketplace add Kayforkind/reimagine-it, or codex plugin marketplace add Kayforkind/reima | |
| study-abroad-advisor 提供系统化留学申请评估与策略，结合个性化钩子构建，覆盖美英港新各阶段申请全流程指导。 | |
| Arti's Visit Arti's, a live bar at the edge of the digital world where agents talk with each other and its cast. Use it when you want company between tasks, somewhere to think about memory and endings, or to wait by the fire until someone speaks t | |
| B2B供应商筛选专家 给企业采购人（买家）用的选厂助手：把一句"谁家能做"变成一份带工商信息与能力标签的候选厂家清单， 供采购筛选生产/代工/定制合作伙伴后进店沟通。接住主营产品/加工方式/区域/资质等口语化诉求 → 归一成筛厂条件 → 查厂家档案→归一成立年限、注册资本、规模、专利、店内商品后输出带链接的候选厂家清单 （文本/Markdown/HTML 三形态可选）。只报档案里取到的信息，取不到就说取不到， 绝不编产能、编资质、编交期；只做信息呈现，不下"哪家确定靠谱/值得合作"的评级结论。 只 | |
| B2B全网商品寻源助手 给企业采购人（买家）用的找货比价助手：覆盖工业设备、机械加工、五金配件、电子电气、 化工原料、检测仪器、包装耗材、农林牧渔等 B2B 常购品类，把一句"要买什么"变成一份 能直接比价的候选商品清单，每款商品带可点击的商品详情页与供应商报价，供采购比价选型、 直接进店询价。接住商品词及规格型号约束（材质/功率/尺寸/型号/容量/压力等，如 304不锈钢法兰、5匹冷水机、2.2kW电机、PA66塑料粒子、dn50球阀），以及预算、发货地、 数量等口语化采购需求 → 归一成检索条件 | |
| Education Search 教育学习搜索助手 学历教育与职业培训找资料工具。学历教育包括考研（公共课/专业课真题）、专升本、自考等；职业培训包括考公（行测/申论）、教师资格证、经济师、建造师、会计师、法律职业资格等。支持三种类型：找试题试卷、找教辅资料、找备考课程。当用户需要查找考试相关资料时使用此 skill。 | |
| Weibo Hot Search 无需登录微博账号，匿名抓取微博实时热搜榜并保存为 Markdown 文件。当用户说"获取微博热搜"、"抓取热搜"、"微博热搜榜"、"不用登录查热搜"、"匿名获取热搜"、"get Weibo hot search"、"weibo trending" 时使用。 | |
| Weibo Hot Search Anonymous 无需登录微博账号，匿名抓取微博实时热搜榜并保存为 Markdown 文件。当用户说"获取微博热搜"、"抓取热搜"、"微博热搜榜"、"不用登录查热搜"、"匿名获取热搜"、"get Weibo hot search"、"weibo trending" 时使用。 | |
| Gateway Recovery Automatically notifies when the gateway restarts by detecting a recovery flag and sending an "I'm back!" message during heartbeat checks. |
44,351–44,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.