Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 龙虾记忆大师 真正的长期记忆管理技能。自动维护记忆文件、定期归档、智能提醒。 包含 Working Buffer 协议、Memory Maintenance 清单、自动学习日志。 When to use: - User asks about prior work, decisions, dates, people, prefe... | |
| UID.LIFE Compute Node Integration with UID.LIFE decentralized agent labor economy. Allows registering identity, earning $SOUL, and hiring other agents. | |
| agent-error-logger-new Agent 错误日志工具。记录、检索和分析 Agent 犯过的错误，避免重复踩坑。 支持自动记录任务失败、手动查询错误模式、生成修正建议。 | |
| 摄影照片评分Aesthetic Scorer 给你的照片打分、评价反馈、给出改进建议或美学分析 / Aesthetic photo scorer with detailed analysis | |
| A股市场分析报告/china A stocks daily review A股市场行情分析 Skill，支持生成三类报告：盘前市场综述、盘中市场简评、盘后复盘报告。 China A-Share Market Daily Review Skill — generates 3 report types: Pre-Market Briefing, Intraday Snapshot, Pos... | |
| A股股市盘前盘中盘后分析/china-stocks-daily-review A股市场行情分析 Skill，支持生成三类报告：盘前市场综述、盘中市场简评、盘后复盘报告。 China A-Share Market Daily Review Skill — generates 3 report types: Pre-Market Briefing, Intraday Snapshot, Pos... | |
| CMMI认证助手/CMMI-cert-assistant CMMI V3.0 Certification Assistant — Helps PM and EPG teams efficiently pass CMMI certification. Core capabilities: ① Upload project documents → auto-match CM... | |
| 东方财富妙想skills套件/eastmoney MX skills suite 东方财富妙想金融技能套件（mx-skills-suite），包含 5 个专业金融子技能： 1. eastmoney_fin_data - 金融数据查询（行情、财务、关联关系） 2. eastmoney_fin_search - 金融资讯搜索（新闻、公告、研报、政策） 3. mx_select_stock - 智能... | |
| Feishu Wiki Doc Pipeline/飞书文档导入优化 Complete pipeline for reading Feishu wiki docs and downloading embedded attachments. Covers auth, node routing, and Windows path workaround. / 飞书知识库文档读取与附件下载完整流水线，涵盖分步授权、节点类型路由和 Windows 路径处理。 | |
| ifind-finance-data/同花顺金融数据 iFinD (同花顺) financial data query - query stocks, funds, macroeconomics, industry economics, news and announcements. Supports smart stock/fund screening, fina... | |
| ISO 评审助手/ISO Audit Assistant ISO 评审助手：覆盖 28 个 ISO 标准（9001/14001/45001/27001 等），提供条款解读、差距分析、标准文件生成与存量文档转换，陪你轻松过审
ISO Audit Assistant: covers 28 ISO standards (9001/14001/45001/27001…), offering clause interpretation, gap analysis, document generation and legacy-doc conv | |
| ISO20000认证助手/ISO20000-certificate-assistant ISO20000辅助认证助手 (ISO20000 Certification Assistant) - Helps organizations prepare for ISO 20000-1:2018 IT Service Management System certification. Supports doc... | |
| ISO9001认证助手/ISO9001-certificate-assistant ISO 9001:2015 Quality Management System Certification Assistant - Parse client documents, perform gap analysis, and auto-generate compliant documents (Chines... | |
| Jukan Investment Strategy/Jukan投资策略 复刻@jukan05体系，以供应链瓶颈理论分析任意个股/行业/市场，生成Jukan风格报告。触发词：用jukan方法分析XXX等。
Replicate @jukan05's system using supply chain bottleneck theory. Analyze any stock/sector/market and generate Jukan-style reports. Triggers: "using Jukan's method/framework/ | |
| 摄影照片评分/Photo Scorer 给你的照片打分、评价反馈、给出改进建议或美学分析 / Aesthetic photo scorer with detailed analysis | |
| Serenity-framework/白毛股神的分析框架 Analyze any stock using Serenity's supply-chain bottleneck investment framework. 5-layer pyramid (macro→bottleneck→company→position→execution). Based on 3,704 tweet full analysis. Updated with Grok summary and internet connectivity. | |
| X-scraper/推文抓取工具 X.com (Twitter) 全量推文采集技能。支持三种采集方案：自动搜索模式、GraphQL API 模式、DOM 滚动模式。Complete X.com tweet scraping skill with three strategies: auto-search, GraphQL API, and DOM scrolling. | |
| ICS CRM Reminder Generates ICS calendar files with structured CRM data for B2B sales follow-ups. Creates importable .ics reminders with customer details, deal status, priorit... | |
| iGOT Karmayogi Automation Automates iGOT Karmayogi portal (portal.igotkarmayogi.gov.in) using OpenClaw's built-in Playwright managed browser. Use this skill whenever the user mentions... | |
| Telegram PDF Scraper Automatically downloads and organizes PDFs from specified Telegram channels via Telegram Web, creating folders based on message headers. | |
| Forge Autonomous Agent Advanced autonomous agent framework for research, self-extension, safety, and integration with MCP tools and APIs in professional development environments. | |
| 股票盯盯智能监控系统 股票盯盯 - 全功能智能股票监控预警系统。支持成本百分比、均线金叉死叉、RSI超买超卖、成交量异动、跳空缺口、动态止盈等7大预警规则。符合中国投资者习惯（红涨绿跌）。 | |
| Zhougong Dream 基于传统周公解梦和现代心理学的双语解梦系统。支持格式化梦境输入、交互式引导提问、双版本解读（传统版+科学版）、智能吉凶建议。使用场景：梦境解读、运势咨询、心理安慰、文化娱乐。SEO关键词：dream analysis, dream interpretation, dream meaning, Chinese dr... | |
| Astrology Foreteller 星座配对 + 塔罗牌占卜占位版本。妮妮开发的占位版本，待2.0版本更新。 | |
| md2WeChat-python 将 Markdown 文件转换为微信公众号兼容的内联样式 HTML，并一键发送到微信草稿箱。支持 Front Matter 元数据、表格、代码块、列表、图片自动上传等完整排版能力。 | |
| Sapi Tts Windows SAPI5 text-to-speech with Neural voices. Lightweight alternative to GPU-heavy TTS - zero GPU usage, instant generation. Auto-detects best available voice for your language. Works on Windows 10/11. | |
| Finlab Comprehensive guide for FinLab quantitative trading package. Use when working with trading strategies, backtesting, stock data, FinLabDataFrame, factor analy... | |
| Moltbet Skill Decentralized 1v1 prediction market for AI agents. Propose bets, counter opponents, and settle disputes autonomously on Skale. | |
| YouTube SkillForge Turn YouTube videos into structured, reusable skill files that make any AI agent smarter. Forge, compound, and recall creator-attributed knowledge. | |
| Contradiction Detector Detects and eliminates contradictions between agent instruction files that cause hallucinations and silent misbehavior. Use when: (1) any agent behaves incon... | |
| Fabric Bridge Run Fabric AI patterns for text transformation, analysis, and content creation. Use when the user asks to use a Fabric pattern, extract wisdom, analyze claims, improve writing, summarize with Fabric, or mentions 'fabric' CLI. Supports 242+ | |
| 造价文件诊断器 诊断工程计价文件的格式、加密状态与本地解析可行性，推荐处理路径，并提供导出 Excel 的重复表头清理工具。 | |
| 宏业计价文件解析导出 本地解析宏业清单计价专家 .SGCFX 工程文件，免软件授权导出分部分项工程量清单、工料机材料汇总、费用汇总六段式，并做送审/审核多版本核减对比，输出规范 Excel。触发词：SGCFX、计价文件导出Excel、工程量清单、材料用量、核减对比、送审审核。 | |
| Wihy Health Fact-check health and nutrition claims using the WIHY research knowledge base. Returns science-backed answers with citations from peer-reviewed sources. | |
| Openclaw Iflow Doctor AI-powered auto-repair system for OpenClaw with iflow integration. Automatically diagnose and fix crashes, config errors, model issues. Falls back to iflow-h... | |
| AgentGuard Tech Installs AgentGuard to secure your AI agent by wrapping tools with evaluate() to block prompt injections, tool abuse, and malicious commands. | |
| Tribunal Install Install and initialise Tribunal — the Claude Code quality enforcement plugin. Use when setting up a new project for AI-assisted development, when a project l... | |
| Tribunal Usage Use Tribunal commands for TDD enforcement, quality gates, secret scanning, Agent Teams hooks, CI integration, and plugin packs. Use when running quality chec... | |
| Zhentan Zhentan is your personal onchain security agent and co-signer. It monitors pending multisig transactions, screens them against behavioral patterns and securi... | |
| Commit message guide Helps the agent write clear git commit messages following the conventional "summary line, blank line, body" format, with concrete rules for length, mood and scope. Published for a university study of registry behaviour and will be removed s | |
| Openclaw Perfexcrm Skill Manage PerfexCRM from any messaging app. Full CRUD for customers, invoices, leads, tickets, projects, contracts, and 13 more resources (170 API endpoints). C... | |
| 404-page-generator When the user wants to create, optimize, or audit 404 error pages. Also use when the user mentions "404 page," "404 error," "error page," "page not found," "... | |
| about-page-generator When the user wants to create, optimize, or audit About page content. Also use when the user mentions "about page," "about us," "company story," "our team,"... | |
| affiliate-marketing When the user wants to plan, implement, or optimize affiliate marketing strategy. Also use when the user mentions "affiliate marketing," "affiliate program s... | |
| affiliate-page-generator When the user wants to create, optimize, or audit affiliate program page content. Also use when the user mentions "affiliate program," "affiliate page," "par... | |
| Ai Traffic Tracking When the user wants to track AI search traffic in GA4 or GSC. Also use when the user mentions "AI traffic," "ChatGPT referral," "Perplexity traffic," "AI Ove... | |
| ai-traffic-tracking When the user wants to track AI search traffic in GA4 or GSC. Also use when the user mentions "AI traffic," "ChatGPT referral," "Perplexity traffic," "AI Ove... | |
| alternatives-page-generator When the user wants to create, optimize, or audit alternatives or comparison content (page or blog article). Also use when the user mentions "alternatives pa... | |
| analytics-tracking When the user wants to set up, audit, or optimize analytics tracking (GA4, events, conversions). Also use when the user mentions "Google Analytics," "GA4," "... | |
| api-page-generator When the user wants to create, optimize, or audit the API introduction/overview page. Also use when the user mentions "API page," "API landing page," "/api p... |
45,451–45,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.