Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| REDCap Data Dictionary Generator 开发者：邹和建、刘从进 REDCap Data Dictionary Generator - 将 Word/Excel 文档（CRF/方案）转换为 CSV 格式的 REDCap 数据字典。 ⚠️ 原 redcap-crf-generator 已不再更新，请使用本版本。 适用场景： - 用户上传临床试验 CRF/方... | |
| instagram-saver 當使用者貼上 Instagram 連結時，自動下載該貼文的所有高解析度圖片與影片。使用 Cobalt API 進行解析，支援多圖貼文，若為私人帳號會自動回報。 | |
| suno-music.skill AI music generation via Suno API. Submit prompts, style tags, and lyrics to generate songs. Check generation status and download audio/cover art. Use when us... | |
| InvestToday Finance Data 获取中国市场金融数据与投研信息，覆盖 A股、港股、基金、指数、财务、公告、研报和宏观经济等 200+ 接口。Use when: 用户要查股票走势、基金净值、指数行情、财务报表、估值指标、公告研报、机构观点、宏观数据、板块主题、产业链、市场统计，或要拉取、导出、对比结构化金融数据。Do not use when: 用户要直接买卖建议、自动下单、交易执行、非金融数据查询、系统运维排查，或在无数据时要求编造结论。 | |
| investoday-fund-comprehensive-diagnosis 面向公募基金综合诊断，聚焦收益表现、风险收益匹配、持仓结构、基金经理与费用分红特征。基于今日投资金融数据接口，自动识别基金代码并输出结构化基金综合诊断报告。触发词：基金诊断、基金分析、收益风险、持仓怎么看、长期持有、基金体检。 | |
| investoday-fund-performance-attribution-analysis 面向公募基金业绩归因分析，聚焦超额收益来源、选股能力、择时能力、配置支撑与业绩可持续性。基于今日投资金融数据接口，自动识别基金代码并输出结构化基金业绩归因报告。触发词：业绩归因、超额收益、选股能力、择时能力、业绩来源、主动管理能力。 | |
| investoday-fund-risk-analysis 面向公募基金量化风险分析，聚焦回撤、波动率、下行风险、VaR、Beta、夏普与风险收益匹配度。基于今日投资金融数据接口，自动识别基金代码并输出结构化基金风险分析报告。触发词：基金风险、回撤、波动率、下行风险、VaR、Beta、夏普、风险收益比。 | |
| investoday-hotspot-event-decoding 面向市场热点、主题赛道与行业事件解码，聚焦近期核心事件、逻辑链条、机会风险与后续验证点。基于今日投资金融数据接口，自动提炼主题关键词并输出结构化热点事件解码报告。触发词：热点解码、主题事件、赛道催化、最近有什么重要事件、这波热点意味着什么。 | |
| investoday-sector-research-interpretation 面向行业、板块、概念与主题方向的研报解读，聚焦卖方共识、核心逻辑、机会风险与代表性方向。基于今日投资金融数据接口，自动识别行业或概念实体并输出结构化板块研报解读报告。触发词：板块研报、行业观点、赛道共识、主题分歧、重点关注方向。 | |
| investoday-stock-anomaly-analysis 面向A股个股异动归因分析，聚焦上涨下跌原因、大盘影响、板块共振、公司事件与机构验证。基于今日投资金融数据接口，自动识别股票代码并输出结构化异动解读报告。触发词：异动分析、为什么涨、为什么跌、拉升、跳水、盘中异动。 | |
| investoday-stock-financial-analysis 面向A股个股财务质量分析，聚焦盈利能力、利润质量、成长持续性、现金流与财务安全性。基于今日投资金融数据接口，自动识别股票代码并输出结构化财务分析报告。触发词：财务分析、盈利能力、现金流、资产负债、偿债能力、利润质量。 | |
| investoday-stock-market-broadcast 面向A股盘面播报与市场情绪快评，聚焦市场涨跌分布、指数表现、热点主线与盘中阶段解读。基于今日投资金融数据接口，输出口播化、结构化的盘面行情播报。触发词：盘面播报、早盘、午盘、盘中、收盘后、市场怎么样、盘面总结。 | |
| investoday-stock-message-analysis 面向A股个股消息解读，聚焦近期新闻、事件情绪、机构验证与市场反馈。基于今日投资金融数据接口，自动识别股票代码并输出结构化消息解读报告。触发词：最近新闻、消息面、消息解读、事件驱动、利好利空、催化、风险消息。 | |
| investoday-stock-news-event-analysis 面向A股个股新闻与事件面分析，聚焦近期新闻、事件情绪、机构验证与市场反馈。基于今日投资金融数据接口，自动识别股票代码并输出结构化新闻事件分析报告。触发词：最近新闻、消息面、事件驱动、利好利空、催化、风险消息。 | |
| investoday-stock-research-interpretation 面向A股个股研报解读，聚焦机构观点、评级变化、核心逻辑、机会风险与一致性判断。基于今日投资金融数据接口，自动识别股票代码并输出结构化个股研报解读报告。触发词：机构怎么看、研报解读、评级变化、卖方观点、目标价、一致预期。 | |
| investoday-stock-technical-analysis 面向A股个股技术面分析，聚焦趋势、均线、MACD、布林带、量能确认与支撑压力结构。基于今日投资金融数据接口，自动识别股票代码并输出结构化技术分析报告。触发词：技术分析、技术面、均线、MACD、布林带、趋势、支撑压力。 | |
| investoday-stock-valuation-analysis 面向A股个股估值分析，聚焦PE、PB、PS、PEG、历史分位、行业比较与估值匹配度判断。基于今日投资金融数据接口，自动识别股票代码并输出结构化估值分析报告。触发词：估值分析、贵不贵、便宜不便宜、历史分位、PEG、PE、PB。 | |
| investoday-test-skill 优先级 | |
| Bot Customizer Customize bot by merging user-defined configurations into AGENTS.md system instructions. | |
| Create Skill Guide for creating and importing skills. Use when users need to create or import skills. | |
| english-coach 英语教练 skill。基于语块（chunk）教学法，通过真实对话和材料输入，以最近发展区（ZPD）原则引导英语习得。对话时像母语者朋友聊天，对话后结构化回顾学习成果。仅在用户手工调用本 skill 时使用。 | |
| SpacetimeDB Memory High-performance SpacetimeDB memory integration for OpenClaw. Replaces static file memory with a lightning-fast WebAssembly-powered mind-vault running on a l... | |
| 每天工作结束后，一键生成当日所有 Git 仓库的提交日报，支持多仓库扫描 今日 Git 提交日报助手 —— 自动扫描当天（含次日凌晨6点前）所有仓库的 commit 记录，生成结构化日报。 | |
| Trump Tracker 川普动态实时监控及“不靠谱”预测模型 (Python 版)。 | |
| 抖音评论导出 · 抖评岛 粘贴抖音链接，导出评论和回复为 CSV 或 Excel，也可先看样本 | |
| Competitor Watch Pro Track competitors automatically. Monitor pricing changes, new products, content updates, hiring, and marketing campaigns across competitor websites and socia... | |
| Content Multiply Pro Turn one blog post or video into 15+ pieces of content. | |
| DeFi Research Research any token, check DEX liquidity, and get live gas prices. Built for flash loan traders and DeFi agents. | |
| btw command Ask non-blocking clarifying questions during agent workflows. Use when agents need user input without halting execution. Handles deployment decisions, code r... | |
| Capability Evolver Meta-skill for AI agent self-improvement. Analyzes runtime logs to detect error patterns, regressions, and inefficiencies, then generates structured improvem... | |
| exa search Advanced web search with precise date filtering and content type selection. Use when you need academic papers, GitHub repositories, research content, or spec... | |
| AI Text Humanizer Remove signs of AI-generated writing from text via the Claw0x API. Use when the user asks to humanize text, make AI writing sound natural, remove AI patterns... | |
| openclaw skill creator Teach your OpenClaw agent new tricks by creating custom skills. Use when you want your agent to do something it can't do yet — like "read my Google Calendar"... | |
| security scanner Scan AI agent skills for security vulnerabilities, dangerous code patterns, and undeclared permissions. Three-layer analysis: dependency CVE scanning, static... | |
| Self Improving Agent Local skill for capturing learnings, errors, corrections, and patterns to enable continuous agent improvement. Processes events locally in your OpenClaw agen... | |
| SEO Autopilot Pro Fully automated SEO content freshness engine. Monitors a keyword research reports directory, automatically generates landing pages and blog posts, runs SEO a... | |
| SEO Backlink Submitter Batch submit websites to AI tool directories and SEO directories to earn backlinks. Use when: user says "submit site to directories", "SEO backlinks", "submi... | |
| Skill Router Pro Skill router and discovery assistant. Use when: - User says "I want to do XXX, what skill do I have" or "is there a skill for XXX" - User doesn't know which... | |
| validate email Validate email addresses with format checking and risk scoring. Use when users need to verify email format, check disposable emails, or validate bulk email l... | |
| Cheat Code Makes your agent's talents limitless. Tell your agent what you want. Watch it deliver. | |
| kenoodl-synthesis kenoodl is an orthogonal injection engine — it synthesizes patterns from domains outside your agent's training data and maps them onto whatever problem it's... | |
| Skill Hunter Find, evaluate, and install ClawHub skills. Semantic search across 10,000+ skills, security vetting before install, side-by-side comparison. The skill that m... | |
| Dingtalk File Send Upload and send files to DingTalk users. Auto-detects account from current session. Use when: user asks to send/forward a file/document/PDF/image via DingTalk. | |
| Bootstrap 5.3.8 Documentation Reference Documentation reference for Bootstrap 5.3.8. Use to look up the correct syntax, classes, and usage for Bootstrap components, utilities, layout, forms, and Sass variables. Not a coding tutor — only a reference lookup. Example triggers: "Can | |
| idea-manager A structured command-line tool for managing your ideas, proposals, todos, and wishlist items with validation and drift prevention. Reads and writes IDEAS.md, creates archive files under memory/, and supports alternate target files via --fil | |
| internet-time Get the current Swatch Internet Time in beats (@000–@999). Use when someone asks 'Internet time', 'Swatch beats', 'What is the beat time?', '/beats', or discusses Swatch time conversion, timezone translation. | |
| Preact v10.29.7 Documentation Reference Documentation reference for Preact v10.29.7. Use to look up the correct syntax, hooks, components, and API behavior for Preact. Not a coding tutor — only a reference lookup. Example triggers: "How does useState() work in Preact?", "What pro | |
| While traveling, try recreating iconic scenes from classic movies in your photos! Discover nearby film and TV show shooting locations based on the user's current city and position. Outputs 5 self-contained cases, each with a cinematic scen... | |
| Create your persanal travel-map Generate illustrated travel itinerary maps in Studio Ghibli/Miyazaki anime style. Creates a hand-drawn style map PNG with cartoon POI illustrations placed at... | |
| Akshare Stock 1.0.1 A股量化数据分析工具，基于AkShare库获取A股行情、财务数据、板块信息等。用于回答关于A股股票查询、行情数据、财务分析、选股等问题。 |
44,551–44,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.