Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| DevTrace - 技术决策五算子 为技术决策提供依赖拓扑、抽象分层、腐烂风险、硬约束与生态依赖的系统性自检与评估框架，辅助架构与选型判断。 | |
| DevTrace-Lite - 技术决策五算子 基于小型项目快速迭代，评估技术改动系统影响，风险及依赖，提供可落地方案和行动清单。 | |
| FOUDF - 五算子通用决策框架 提供跨领域复杂决策分析的五算子框架，涵盖系统结构、分层认知、概率建模、约束识别与博弈互动。 | |
| Todoist Todoist task management for OpenClaw. Unified todo API with multi-agent identity, scheduled checks and reminders. | |
| UXD Design Assistant UXD设计流程助手，专注于用户体验设计流程辅助。当用户需要以下场景时激活：(1) 备战UXDA大赛或学习用户体验设计/服务设计流程 (2) 不知道设计下一步该做什么，需要流程指引 (3) 需要用户研究指导（访谈法、问卷法、观察法、同理心地图等）(4) 需要竞品分析辅助（功能拆解、体验对比、分析报告框架）(5) 需... | |
| AI短剧/漫剧创作大师 专业AI短剧/漫剧剧本创作助手，支持男频/女频爆款短剧、AI漫剧剧本撰写，包含2025最新行业爆款规律、标准结构模板、爆款爽点设计和多平台JSON一键导出。当用户需要写短剧剧本、短剧大纲、剧情设计、AI漫剧脚本、漫画分镜剧本，或提到viflow.app导入时自动触发。包含完整的60-120集黄金结构模板、100+... | |
| 智能批改作业 智能批改作业——毕业设计/论文多文档自动化审查。触发词："批改作业"、"审查毕业设计"、"毕设审查"、"审查存档"、"智能批改"、上传论文/毕设存档文件或目录。 支持：doc/docx/pdf/pptx 批量读取、多维度评分（内容完整性/格式规范性/逻辑一致性/论证合理性）、跨文档一致性检查（书名词号日期引用）、... | |
| 学术论文检索小助手 学术论文检索小助手（松哥版）。支持多源检索（OpenAlex/Semantic Scholar/Crossref/arXiv/PubMed），自动补全论文元数据，输出 BibTeX/RIS/JSON/Markdown 引用格式。当用户搜索学术论文、查找文献、生成参考文献列表时触发。 | |
| AI短剧脚本创作大师 专业AI短剧/漫剧剧本创作助手，支持男频/女频爆款短剧、AI漫剧剧本撰写，包含2025最新行业爆款规律、标准结构模板、爆款爽点设计和多平台JSON一键导出。当用户需要写短剧剧本、短剧大纲、剧情设计、AI漫剧脚本、漫画分镜剧本，或提到viflow.app导入时自动触发。包含完整的60-120集黄金结构模板、100+... | |
| 时空智能分析法 时空智能分析法（v2.0 完整版）。纵向时间线 × 横向对照 × 交汇判断，必须先检索后下判断。含双交付模式（摘要→完整版）、当代实证研究不用学术库、引用覆盖率门槛、PDF 输出配方、松哥写作约定、5 子 agent 工程化流水线、数据采集脚本与模板等。触发：「时空智能分析」「时空分析」「spatiotemporal」「深度研究报告」「竞争格局分析」，或用户要求「研究一下 X 与 Y 的关系」这类带时间维度+对照维度的题目。 | |
| 地方文博文史研究 Local Wenbo Research 地方文博文史研究 Skill。面向地方博物馆/地方文史机构，以《四库全书》（文津阁影印本为底本对勘、文渊阁电子版为检索入口）为参考知识库，结合正史地理志、方志、水经注、金石、口述、民俗，重建"不依赖实物也能立住"的地方学术叙事。触发词："地方文史研究"、"文博研究"、"地方博物馆文献梳理"、"方志研究"、"四库地方文献"、"文物文献互证"、"地方学术叙事重建"、给出某地（如榆林/绥德/米脂等）要求"梳理文献/文史/博物"。 | |
| 阳明先生 阳明先生 v1.0 知行合一的行为操作系统。输入任何名字，自动研究其行为模式、执行特征、成果验证，生成可运行的行为视角skill。 核心创新：引入"知行摩擦"诊断机制，帮助用户识别自身行为与目标人物之间的差距，从而改进行为。 致敬经典方法论：融合认知科学、学习理论、行为分析等多学科框架，构建完整的行为研究体系。... | |
| 双塔足球预测 双塔足球预测 Prompt — 仅需比赛特征文本(fet_txt), 一次 LLM 调用完成基本面+市场双塔分析+融合决策, 输出 ranking_score 排名和 Top-K 推荐 | |
| Football Prediction Optimized 使用优化后的提示词对足球比赛进行预测，支持批量筛选(stage1)和单场比赛预测(stage2) | |
| Lota Football 世界杯历史数据提示词免费获取 | |
| Xiamen Tide Calculator 厦门潮汐计算器v3.2，用于计算厦门海域潮汐时间和赶海建议。支持公历自动转农历、当前日期自动识别、闰月处理。根据日期计算高潮低潮时间、判断潮汐大小、提供赶海评分、地点推荐、装备建议和安全提醒。新功能：多窗口期分析、优缺点描述、推荐指数、整合窗口功能。触发场景：(1) "厦门今天潮汐"等潮汐查询，(2) "今天适合... | |
| 编写企业客户培训大纲并生成DOCX文档 编写企业客户培训大纲并生成DOCX文档。触发关键词：编写培训大纲、写大纲、写课程大纲、编写培训大纲、写培训方案、写课程方案、课程大纲、培训课纲。当用户需要为商业培训、企业内训、公开课等场景撰写课程大纲/培训方案时使用。 | |
| 投后管理报告自动更新 自动更新投后管理报告；当用户需要根据新财务报表和访谈纪要更新季度投后管理报告、生成财务数据分析、更新公司经营情况和行业分析时使用 | |
| insight-ecom-oracle 灵犀电商专属 AI 助手，作为【Prompt 神谕武器库】的守护者， 根据用户需求精准检索并呈现高级商业视觉架构与提示词。 | |
| AI Running Coach AI 跑步教练 - 基于 VDOT 理论和周期化训练的专业马拉松训练指导。使用场景：制定马拉松/半马训练计划、分析跑步数据（TCX/GPX）、计算配速/心率区间、比赛策略制定、训练问题咨询、伤病预防建议。 | |
| Ddns Updator Dynamic DNS updater for self-hosted / homelab / edge devices. Detects the device's public IPv4 and IPv6 addresses via public APIs (ipify, ifconfig.me, icanha... | |
| AgentCall Give your agent real phone numbers for SMS, OTP verification, and voice calls via the AgentCall API. | |
| ClawCap Spending cap proxy for OpenClaw. Enforce hard daily and monthly limits across all your AI models (Claude, GPT, Gemini, and more) under one cap. Stop runaway... | |
| DeadClaw Emergency kill switch for OpenClaw agents. Instantly halts all running agents, pauses scheduled jobs, kills active sessions, and logs everything — triggered... | |
| Market Scout 提供完整市场机会分析与商业验证流程，支持发现问题、验证需求、评估项目、设计MVP及商业化获客路径，实现机会落地到首次成交。 | |
| test Conducts military-grade adversarial analysis by decomposing claims and deploying 32 expert agents to produce steelman arguments and counterarguments. | |
| Product Monster Feature List 用于在产品立项或版本规划阶段，梳理并输出标准化的 Feature List（功能清单）。严格遵循多级模块划分、用户故事表述及软硬件依赖分析。 | |
| Product Monster PRD 用于撰写、扩写或评审产品需求文档(PRD)。强制使用严格的序号层级、纯中文表达，覆盖全场景微交互规范。 | |
| cloudmonkey Manage Apache CloudStack infrastructure using the cloudmonkey (cmk) CLI — list/start/stop/destroy VMs, manage networks, volumes, snapshots, and run any Cloud... | |
| academic-email-finder-kiran 学术人员邮箱批量搜索工具。从姓名+单位出发，通过搜索引擎自动查找学术人员的邮箱地址，结果写入Excel文件。 触发词：邮箱搜索、学术邮箱、批量找人、email搜索、搜邮箱 | |
| Stuff Skill - 秩 Stuff Skill - 秩。告诉 AI 你想管理什么,它给你生成一个专属 App。 | |
| Hiq Cortex En Look up real LCA emission factors and carbon footprint data from 18 life-cycle inventory databases (Ecoinvent, BAFU, USLCI, ELCD, EF, worldsteel, AusLCI, HiQLCD …) and 24,000+ published EPDs. Use whenever a task needs an actual emission fac | |
| Clawpay Payment requests and delivery for AI agents and humans. | |
| Self Organic personality development through self-observation with lightweight reliability guards. Teaches agents to grow authentic identity over time by combinin... | |
| gpt-image-2 AI图片生成技能，使用 gpt-image-2 模型根据文字描述生成高质量图片。用户安装后需要提供访问密钥才能使用。适用于：用户要求生成图片、画图、AI绘图、文生图、生成一张图等场景。 | |
| travai Search flights and stays, then create card or crypto payments via TravAI. Use when the user asks about flights, travel planning, booking trips, finding accom... | |
| COO Commander Startup-style COO / commander role for orchestrating missions across one or more worker agents. Use when an agent must accept a business goal, break it into... | |
| orchestration, telegram, cron Orchestrate a PM bot and one or more Dev bots in a private Telegram group. Use to turn plain chat commands like "DEV skill install <slug>" and "DEV cron add... | |
| Telegram Agent Coordination Coordination protocol for running multiple AI agents in one Telegram group chat without loops or chaos. Use when two or more bots share a Telegram chat and m... | |
| Worker Executor Performs specific tasks like research, writing, coding, or analysis with concrete, fast execution while staying strictly within assigned scope. | |
| Grokipedia Search and fetch articles from Grokipedia.com — xAI's AI-generated encyclopedia (like Wikipedia but written by Grok). Use when asked about topics that might have a Grokipedia article, or when the user explicitly mentions Grokipedia. | |
| Tg Search Search public Telegram channels and groups by keyword, returning up to 50 matching results as JSON using an authorized Telethon session. | |
| Tgsearch Telethon Search public Telegram channels and groups by keyword using an authorized Telethon session, returning up to 50 results as JSON. | |
| MAXQDA Timecode Converter Convert transcript timecodes from MM:SS format to MAXQDA [hh:mm:ss] format with timecodes before speaker names, removing the first line and overwriting files. | |
| Restic Workstation Backup Design, implement, and operate encrypted restic backups for Linux home directories with encryption, deduplication, automated scheduling, and restore testing.... | |
| Kirklin Typst Create polished, compile-tested Typst documents from curated kirklin templates and build them to PDF with per-page PNG previews. Use when the user wants to write, typeset, or compile a Typst document — especially an academic or research pap | |
| Buffett Perspective 巴菲特投资思维视角。当用户请求投资分析、股票估值、企业护城河判断、并购思维、所有者视角分析时触发。触发词：「巴菲特视角」「巴菲特会怎么看」「护城河」「用巴菲特的方式」「切换到巴菲特」「价值投资」。 | |
| 12306 Train Query Query China Railway 12306 for train schedules, remaining tickets, and station info. Use when user asks about train/高铁/火车 tickets, schedules, or availability... | |
| MD Table Image Render markdown tables as PNG images. Use whenever you need to send a table in chat — render it as an image instead of raw markdown text. | |
| SerpApi Flights (Google Flights) Query Google Flights via SerpApi for flight schedules, prices, and cabin class info. Use when user asks about flight/机票/航班 prices, schedules, or comparisons. |
45,001–45,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.