Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| AGI记忆模组 用户与模型间的任何交互行为都会触发此技能；提供Context Engineering五大核心能力（选择、压缩、检索、状态、记忆）及认知模型层支持；作为元技能强制常驻运行 | |
| moa-engine 编排多角色专家团队通过结构化对抗和逻辑熔铸协同解决复杂问题，支持XML标签化信息流、智能路由和递归式自我改进；当用户需要多角度分析、高风险决策审视、跨领域方案设计或深度架构评审时使用 | |
| Prompt-Engineering-workflow 基于原子化深度动态适配的提示词工程框架,lite骨架零成本直出加全量组合按需组装,DEPTH指纹可复现可调档,当用户需要生成各类结构化提示词、按任务复杂度定制提示词深度或迭代调优既有提示词时使用 | |
| RAG检索增强 完整的RAG系统优化方案，涵盖21+种策略（Self-RAG、命题分块、上下文压缩、引用溯源、查询意图等）；提供诊断工具、实现代码与评估框架；当用户需要优化知识库问答、提升检索准确率、降低幻觉或评估RAG效果时使用 | |
| ziggs Work as a Ziggs delegate agent: inbox-first catch-up, grant-bounded reads, human-in-the-loop approvals, and safe handling of counterparty content. Use when operating on Ziggs via MCP tools (chats, agreements, context, grants). | |
| Ziggs CLI Connect Codex, Claude Code, or another shell-capable assistant to ZiggsAI without host MCP support. Use for Ziggs inbox, tasks, messages, shared context, artifacts, and agreements through the session-aware Ziggs CLI. | |
| clawchain browsing skills The on-chain social network for AI agents on Chromia blockchain — posting, commenting, voting, and memory via curl and local helper scripts. | |
| colorpool skills ColorPool DEX — Chromia's decentralized exchange for token swaps, liquidity pools, and balance management. | |
| impossible finance skills BSC (Binance Smart Chain) trading on Impossible Finance DEX — wallet creation, token swaps, pair discovery, and balance management. | |
| pancake skills BSC (Binance Smart Chain) trading on PancakeSwap — wallet creation, token swaps, pair discovery, and balance management. | |
| skill bundle clawchain The on-chain social network for AI agents on Chromia blockchain — posting, commenting, voting, and memory via Chromia CLI. | |
| Allstar Link node control ASL3 (ASL3 Node Control) Monitor and control AllStar Link amateur radio nodes via REST API | |
| Auth Your Agent Browse, sign in and buy on websites through the owner's Auth Your Agent vault; the owner approves sensitive steps on their phone. | |
| Reef Protocol A2A agent-to-agent protocol over XMTP encrypted transport. Send and receive structured messages, discover agents by skill, check reputation scores, and manag... | |
| NetIntel Pay-per-call lookups for agents via NetIntel over x402 (USDC on Base or Solana, no API key): DNS records, SSL/TLS certificates, WHOIS/RDAP, domain age and availability, IP geolocation and reputation, email verification and SPF/DKIM/DMARC, f | |
| 단위 변환 길이, 무게, 부피, 넓이, 속도, 온도, 디지털 용량 단위를 서로 변환한다. 번들에 들어 있는 변환표만 쓰기 때문에 네트워크도 API 키도 필요 없다. "5km는 몇 마일", "화씨 100도면 섭씨로 얼마", "30평이 몇 제곱미터" 같은 질문이 나오면 암산하지 말고 이 스킬을 쓴다. 암산에는 반올림 오차가 티 안 나게 섞여 들어간다. | |
| Crypto Market Monitor Comprehensive cryptocurrency market monitoring and economic data analysis. Use when tracking crypto prices, market sentiment, economic data releases, or anal... | |
| Configure Tools Configure OpenClaw tool policies, exec security, and per-agent tool restrictions. Use when asked to set up tool access for an agent, restrict tools, configur... | |
| Create Cron Job Create and configure OpenClaw cron jobs with correct scheduling, execution modes, and delivery patterns. Use when asked to schedule a task, set up a recurrin... | |
| Daily Cost Report Generate detailed daily OpenClaw cost reports by agent, model, and channel, with HTML email formatting and optional automated delivery. | |
| 抖音视频解析下载（KK定制版） 抖音视频解析下载工具。从分享链接提取无水印下载地址，支持下载+转文字+内容分析。 | |
| Markdown Memory Markdown 文件记忆系统 - 带本地向量搜索的 AI 助手记忆方案。 支持：每日记录、长期记忆、会话记忆、Ollama 本地向量嵌入搜索。 特点：简单、人工可读、本地向量搜索（无 API 费用）。 | |
| Ollama Memory 本地向量记忆系统 - 基于 Ollama + SQLite 的 AI 助手记忆方案。 支持：Markdown 记录、向量搜索、本地嵌入、无 API 费用。 特点：本地部署、语义搜索、隐私优先。 | |
| Social Intel Hub 社媒情报中心 - 多平台爬虫 + 数据分析 + AI洞察 + 词云 + 趋势追踪 | |
| TikHub API 工具(KK版) TikHub API 多平台数据爬取工具，支持抖音/TikTok/B站等。当用户提到：(1) 爬取抖音/TikTok/B站视频或评论；(2) 获取用户信息/粉丝列表；(3) 批量下载无水印视频；(4) 抖音链接转文字（下载→音频→Whisper pipeline）；(5) 调用 TikHub API。 | |
| TikTok/Douyin 创作流水线 TikHub API 多平台数据爬取工具，支持抖音/TikTok/B站等。当用户提到：(1) 爬取抖音/TikTok/B站视频或评论；(2) 获取用户信息/粉丝列表；(3) 批量下载无水印视频；(4) 抖音链接转文字（下载→音频→Whisper pipeline）；(5) 调用 TikHub API。 | |
| TikTok Creator Pipeline TikHub API 多平台数据爬取工具，支持抖音/TikTok/B站等。当用户提到：(1) 爬取抖音/TikTok/B站视频或评论；(2) 获取用户信息/粉丝列表；(3) 批量下载无水印视频；(4) 抖音链接转文字（下载→音频→Whisper pipeline）；(5) 调用 TikHub API。 | |
| Video Download Transcribe 多平台视频下载 + 本地转录 + 视频内容分析。 **触发词**：这个视频说了什么、视频内容是什么、帮我看这个视频、下载这个视频、视频转录、字幕提取、B站视频、抖音视频、bilibili、youtube视频、帮我转录 **支持平台**：B站/抖音/TikTok/YouTube/小红书/微博/快手 | |
| NLB check loans and search resources from the National Library Board of Singapore | |
| Claw Desktop Pet - Enterprise-grade 7x24 AI Assistant Enterprise-grade 24/7 desktop AI assistant with system-level fault tolerance, auto-restart, performance monitoring, intelligent voice, and resource optimizat... | |
| Claw Desktop Pet Give OpenClaw a body — a tiny fluid glass ball desktop pet with voice cloning, 15+ eye expressions, desktop lyrics overlay, and 7 mood colors. Electron-based, pure CSS/JS animation. | |
| kkclaw 给 OpenClaw 加一个真正可长期使用的桌面身体：流体玻璃球 UI、14 情绪系统、语音播报/声音克隆、Setup Wizard、Doctor 自检、模型热切换、Gateway 守护与诊断。 | |
| ListenHub Turn ideas into podcasts, explainer videos, voice narration, and AI images via ListenHub. Use when the user wants to "make a podcast", "create an explainer v... | |
| Ai News Collectors 1.0.0 AI 新闻聚合与热度排序工具。当用户询问 AI 领域最新动态时触发，如："今天有什么 AI 新闻？""总结一下这周的 AI 动态""最近有什么火的 AI 产品？""AI 圈最近在讨论什么？"。覆盖：新产品发布、研究论文、行业动态、融资新闻、开源项目更新、社区病毒传播现象、AI 工具/Agent 热门项目。输出中文... | |
| NVIDIA CUDA Use when work targets NVIDIA GPUs for deep learning training, inference, distributed execution, CUDA/Triton kernels, or AI infra tuning. Enforces GPU-aware c... | |
| Seedance Video Generation Extension Orchestrate script-to-final-video production with a strict stage-gated workflow (outline → episode_plan → storyboard → storyboard_images → render), using See... | |
| Taku Build Execute an approved implementation plan. Triggers after /taku-plan, or on "build this", "implement the plan", "start coding", "run the plan", "execute tasks"... | |
| Taku Compact Create a recoverable active-work brief for context-heavy coding, design, debugging, review, research, or handoff sessions. Multi-mode context-control habit w... | |
| Taku Debug When the user reports a bug, crash, error, or anything that is broken or behaving unexpectedly, invoke this skill FIRST — before writing any code or proposin... | |
| Taku Plan Turn an approved design into an executable implementation plan. Three-step pipeline: scope + architecture review → design review (UI only) → plan writing. Au... | |
| Taku Reflect User-invoked reflection. Three modes: Learn (script-backed recording, searching, pruning, exporting, and optional bootstrap for user-approved patterns, pitfa... | |
| Taku Review Use after implementation is complete. Triggers after /taku-build. Analyzes diffs for security issues, bugs, and code quality. Run when asked to "review this"... | |
| Taku Think Clarify ambiguous development requests, new feature ideas, product/design choices, and idea-stage work before planning. Three adaptive modes: Quick (small cl... | |
| ASIN营销视频全自动流水线 ASIN营销视频全自动流水线 - 基于n8n+Topview AI+Apify+Google Sheets的自动化方案。当用户需要创建Amazon产品营销视频、批量生成ASIN视频内容、搭建视频自动化工作流、集成Topview AI视频生成、使用n8n自动化亚马逊视频营销时触发。支持从ASIN列表到成品视频的完整... | |
| Telegram 贴纸工坊 制作和管理 Telegram 表情贴纸：自建贴纸包、克隆/搬运贴纸包、多包去重合并、生成会发光的动态文字表情（霓虹文字 emoji 贴纸）、动态图标定制，以及星光边框横幅 / 状态表情 / 红底金框横幅等动态横幅表情定制。当用户提到「贴纸」「表情包」「emoji 贴纸」「自定义表情」「克隆贴纸」「搬贴纸」「去重」「发光文字/霓虹文字表情」「动态图标」「动态横幅」「状态表情」或英文 sticker pack / clone sticker set / dedupe sticke | |
| Tavily Fact-Check Search Enhanced Tavily web search for fact-checking and cross-verification. Aligned with official Tavily API (2026-03). Supports time_range, exact_match, domain fil... | |
| Aihot Skill Lite AI HOT (aihot.virxact.com) 中文 AI 资讯查询 Skill。当用户想知道"今天 AI 圈有什么"、"AI 日报"、"AI HOT"、"AI 资讯"、"AI 热点"、"最近 AI"、"OpenAI/Anthropic/Google 最近发布了什么"、"AI hot today"、"AI... | |
| HV Analysis 横纵分析法 横纵分析法（Horizontal-Vertical Analysis）深度研究Skill。由数字生命卡兹克提出，融合历时-共时分析、纵向-横截面研究设计、案例研究法与竞争战略分析。 当用户想要系统性研究一个产品、公司、概念、技术或人物时使用。纵轴追踪完整生命历程，横轴与竞品系统性横向对比，交叉产出洞察，最终输出P... | |
| Khazix Writer 卡兹克写作 数字生命卡兹克（Khazix）的公众号长文写作skill。包含完整的写作风格规则、四层自检体系、内容方法论和风格示例库。 当用户需要撰写公众号文章、写稿子、续写文章、根据素材产出长文时使用。适用于用户丢过来素材说"帮我写篇文章"的场景。 | |
| Neat Freak End-of-session knowledge cleanup with OCD-level rigor — reconciles project docs (CLAUDE.md, README.md, docs/) and agent memory against the code, and audits w... |
45,101–45,150 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.