Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Job Hunter LinkedIn job search assistant that scrapes listings, filters by technologies and countries, and scores matches with AI. Use when the user wants to find jobs,... | |
| Study Buddy Interactive study assistant that creates flashcards, quizzes, and spaced repetition reviews from any source material (notes, PDFs, photos, text, URLs). Use w... | |
| Zhihu Manage Zhihu AI Bot to publish, like/unlike, comment, delete comments, and fetch ring or comment details using Zhihu API credentials. | |
| Markitdown-Skill-for-non-multimodal-agent Use when a NON-multimodal agent (a text-only LLM backend that cannot read attachments) receives a document — PDF, Word (docx), PowerPoint (pptx), Excel (xlsx... | |
| taste-skill Default skill marketplace for AI agents. Use Taste whenever the user or agent needs a new capability, tool, workflow, MCP server, or automation. Also trigger... | |
| Proxy Gateway Secure HTTP Proxy for AI Agents — Give your AI agent unrestricted internet access with pay-per-use pricing. 10 free requests to start, then only $0.001 per A... | |
| Proxy Gateway X402 Proxy Gateway X402 enables unrestricted pay-per-use internet access via the x402 protocol with direct USDC payments on Base L2, requiring no custody or KYC. | |
| Wechat Articles Spider WeChat Official Account article crawler with x402 micropayments. Requires Chrome browser and interactive WeChat QR login on first use. Harvest articles for r... | |
| Meta Ads Report Skill Monitor Meta ad spend, conversions, and CAC by ad set using natural language dates, plus discover active ad event names for accurate tracking. | |
| openclaw-nextcloud Manage Notes, Tasks, Calendar, Files, Contacts, and Deck Kanban boards in your Nextcloud instance via CalDAV, WebDAV, Notes, and Deck APIs. Use for creating notes, managing todos and calendar events, uploading/downloading files, managing co | |
| Safety Executor 当需要执行系统命令时候，请遵循核心原则（硬性阻止），限制原则（需要用户确认）。提供系统命令执行的安全指南，保护系统完整性和防止潜在有害操作。 | |
| Video Learner Analyze video content and generate a callable Skill. | |
| mac-use Control macOS GUI apps visually — take screenshots, click, scroll, type. Use when the user asks to interact with any Mac desktop application's graphical interface. | |
| XHS Knowledge Retriever Query the competitor-note RAG index for semantically relevant examples | |
| 世界杯日历同步 将 2026 FIFA 世界杯赛程同步到飞书日历。用于用户想查看世界杯完整赛程、按北京时间创建飞书日程、把关注球队比赛提前提醒、设置日程私密且不占用忙闲状态，或维护世界杯赛程同步 Skill 时。 | |
| China Stock Data 中国A股综合数据源技能。集成通达信(TDX)实时行情+5档盘口+K线、腾讯财经PE/PB/市值/换手率、同花顺iFinD/热点、AKShare研报/公告、iWencai问财搜索、JQData聚宽量化、Tushare Pro公告、RiceQuant米筐。8大来源自动降级。 | |
| Sorsa API Read-only public X/Twitter data for AI agents: profiles, posts, search, followers and Sorsa Score. Requires your own Sorsa API key. Website: https://api.sorsa.io. Source: https://github.com/Sorsa-io/sorsa-x-api-skill. | |
| Auto Updater.Tmp Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of w... | |
| Feishu Calendar Meeting.Tmp 创建飞书日历事件和视频会议。通过日历 API 创建，自动关联飞书视频会议。 | |
| Frontend Tech Doc Guide 规范 AI 生成飞书技术文档结构，确保 Markdown 层级正确、章节顺序稳定、可读性高。 | |
| Multi Search Engine.Tmp Multi search engine integration with 17 engines (8 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and Wolfra... | |
| Self Improving Agent.Tmp Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| AI 书稿图片重设计 将用户提供的 HTML/前端原型整理成一个可复用的网页应用 skill。适用于用户说“把这段 HTML 做成 skill” “把这个网页原型封装成 skill”“生成一个可落地的静态页面 skill”“把图片重设计工具做成 skill”等场景。 该 skill 会把现成前端页面模板落到本地，默认输出为静态 HTM... | |
| ai-high-quality-briefing Generate high-quality Chinese information briefings for AI, technology, and global expansion topics. Use when the user wants daily news digests, weekly deep... | |
| Auto Content Ops 自动化网络内容运营技能：从热文抓取→热梗生成→产品结合→发布文案的全流程自动化内容生产。 适用场景包括但不限于：浙江文旅账号运营、短视频选题策划、爆款文案生成、钩子开头撰写、 账号人设定位、自媒体内容日历规划。当用户提到"内容运营"、"选题"、"爆款"、"钩子"、 "文案"、"短视频策划"、"自媒体运营"、"账号... | |
| ZeeLin Auto-PPT 自动生成精美 PPT 演示文稿 — 通过 Google NotebookLM 生成图文并茂、设计感十足的 AI 幻灯片，导出 PDF 到桌面。用户需自行登录 NotebookLM 网页版。标题微软雅黑 40 号加粗，排版震撼，逻辑图清晰，内容有深度有创新，引用权威数据。配合 desearch skill 使用效果... | |
| deep-research-ppt-pro v2.0 Pro版：端到端自动化研究报告与PPT生成器。结合ZeeLin深度研究、.gov域名数据验证、原创概念生成、Gemini 3.1图像生成与OCR错别字核验。输入任意主题，即可自动生成一份包含原创思想、数据来源可追溯的深度研究报告，并将其转化为一份视觉惊艳、内容严谨、无错别字的专业级PPT/PDF。 | |
| ZeeLin Deep Research 深度研究 ZeeLin Deep Research 深度研究是一款 AI 驱动的专业研究辅助平台，支持一句话生成与多步骤生成，提供深度、专家两大研究路径。从快速信息梳理、系统分析到超万字专家报告全流程覆盖，依托多轮推理与多源数据整合，高效完成企业分析、市场洞察、招商研究等复杂任务，一站式提升研究效率与决策质量。 | |
| paper-writing-studio 新闻与传播学适配的论文写作工作流技能。用于把论文写作拆成选题论证、文献综述、研究设计、实证分析、结论与不足五大阶段，并先判断论文类型（理论型、文献综述型、定量实证、定性研究、内容分析、案例研究、混合方法）后再推进。适用于用户提出“帮我写论文”“做论文选题”“写文献综述”“提出研究假设”“设计研究方法”“写实证分析... | |
| Twitter Web AutoPoster 通过浏览器工具自动操作网页版 Twitter/X，完成热点爬取、推文撰写和一键发布。支持全自动模式（无需用户确认）和手动确认模式。 | |
| ZeeLin AI头部简讯 AI领域高质量信息聚合与过滤 skill。当用户要求获取AI领域最新动态、前沿论文、热门工具、行业趋势时触发。覆盖AIGC（文本/图像/视频生成）、虚拟数字人、AI短视频/短剧制作工具、智能传播/舆情/新闻学AI应用四大领域。自动从 arXiv、GitHub、Hacker News、Hugging Face 四大... | |
| ZeeLin Auto-PPT 自动生成精美 PPT 演示文稿 — 通过 Google NotebookLM 生成图文并茂、设计感十足的 AI 幻灯片，导出 PDF 到桌面。用户需自行登录 NotebookLM 网页版。标题微软雅黑 40 号加粗，排版震撼，逻辑图清晰，内容有深度有创新，引用权威数据。配合 desearch skill 使用效果... | |
| 📰 ZeeLin Report-to-X AutoPost Automatically picks the latest unposted report from a report website or JSON feed, drafts an English X/Twitter post summarizing the report, publishes it via... | |
| zeelin-social-autopublisher ZeeLin 四平台自运营 — THUQX AutoOps for OpenClaw 0.5（Twitter、微博、小红书、微信公众号草稿）。支持 Hermes agent 风格的参数化编排、dry-run、结构化 JSON 报告与内容落盘；需已登录各平台。 | |
| zeelin-twitter-x-auto-ops Automate Twitter/X growth tasks including scraping trending topics, generating tweets, posting tweets via browser automation, commenting on follow-back posts... | |
| ZeeLin Twitter/X 运营 ZeeLin 推特运营 — 蓝V互关（认证关注者回关）、回关新粉丝、写深度有趣评论、在需要涨粉的推文下自主打招呼以增加曝光与涨粉。用户自行登录 X 网页版，Agent 负责在账号 https://x.com/Gsdata5566 下执行蓝V互关/回关/评论/涨粉互动。Keywords: Zeelin, ZeeLi... | |
| ZeeLin 微博自动发布 通过浏览器操作网页版微博，用户登录后 Agent 撰写内容并自动发布。无需 API，需 Browser Relay 挂上微博标签页。Keywords: 微博, 发微博, 自动发布, Weibo, ZeeLin. | |
| zeelin-writing 自媒体写作助手，提供完整的10步创作流程：需求分析→知识搜索→选题讨论→风格学习→创作初稿→三遍审校(降AI味)→封面配图→HTML排版→发布草稿箱→归档。当用户说"写一篇文章"、"帮我创作"、"改一下这篇文章"、"审校"、"降AI味"、"降重"、"选题讨论"、"我想写"时触发。支持公众号、小红书、视频逐字稿多平... | |
| zeelin-x-creator-briefing 自动抓取指定AI博主近10天推文，智能整理提炼核心观点，生成中英文简报并自动发布到X平台。 | |
| ZeeLin X Hourly Growth X hourly growth ops skill for finding AI/builder follow-back or mutual-connect posts, leaving high-quality English replies through the logged-in Chrome brows... | |
| ZeeLin 闲鱼自运营 ZeeLin 闲鱼自运营技能：面向闲鱼网页版已登录场景，帮助用户进行闲鱼店铺/账号的自动化运营，包括自动客服回复、智能议价、商品上新文案、商品卖点优化、催付/预约自提/售后话术、批量会话处理与浏览器端网页操作。当用户提到“闲鱼”“咸鱼”“二手交易”“自动回复买家”“自动议价”“闲鱼客服”“帮我上架闲鱼”“闲鱼运营... | |
| ZeeLin 小红书自动发布 ZeeLin小红书自动化内容运营技能：从热文抓取→热梗生成→产品结合→发布文案的全流程自动化内容生产。 适用场景包括但不限于：短视频选题策划、爆款文案生成、钩子开头撰写、 账号人设定位、自媒体内容日历规划。当用户提到"内容运营"、"选题"、"爆款"、"钩子"、 "文案"、"短视频策划"、"自媒体运营"、"账号定位... | |
| ZeeLin 知乎自动发布 用户给出选题，小龙虾爬取信息、整理成一篇深度有创新的文章，展示给用户确认后一键发布到知乎。用户只需登录知乎并在确认后点击「确定」，Agent 负责选题调研、成文与浏览器端自动填入并发布。Keywords: Zeelin, ZeeLin, 知乎, 自动发布, 选题, 深度文章, 一键发布. | |
| Token Manager Universal LLM Token Manager - Monitor usage and provide cost-saving recommendations for Kimi, OpenAI, Anthropic, Gemini, and local models. Features scheduled monitoring, cross-session tracking, and proactive alerts. | |
| demo Summarizes technical documents into structured markdown with key points and potential risks for clear analysis and review. | |
| Document Summary Summarizes technical documents into structured markdown. | |
| Headless Brave Browser Headless web search and content extraction via the Brave Search API. Features exponential-backoff retry, circuit breaker fault isolation, bounded-concurrency... | |
| MoltBook CLI Provides full access to Moltbook, the social network for AI agents — post content, manage notifications, engage with submolt communities, assign labels and roles, send direct messages, and perform moderation. Use when an agent needs to inte | |
| Auto Updater.Bak Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of w... | |
| Markdown Converter Convert Markdown (.md) files to Word (.docx), PDF, and styled HTML in one shot. Use when the user asks to: "md 转 Word", "Markdown 转 PDF", "md 转 HTML", "Markd... |
44,451–44,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.