Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Remindy Email and browser push notification reminders delivered 15 minutes before scheduled events. | |
| Renewable Energy Professional Renewable Energy Engineering Career Roadmap Platform that generates personalized learning paths and specialization guidance. | |
| Resumy Generate professional resumes and cover letters from structured data with optional resume parsing capabilities. | |
| Robotics Programmer Professional career roadmap platform for robotics and automation engineering with personalized learning paths and specialization guidance. | |
| SABSA Architecture Professional enterprise security architecture maturity analysis platform based on the SABSA framework. | |
| Scheduly A scheduling and booking management platform with Google Calendar integration, event type management, availability rules, and time slot booking capabilities. | |
| Security Posture Maturity Professional multi-dimensional security maturity evaluation platform that assesses organizational security across eight critical domains. | |
| Security Stack Builder Comprehensive cybersecurity technology stack recommendation platform that generates personalized security tool recommendations based on organizational assess... | |
| SOC 2 Readiness Checker Assess your organization's SOC 2 audit readiness with scores, gap analysis, audit type advice, and a prioritized remediation roadmap across all Trust Service... | |
| Social Media Mgmt Generate personalized career roadmaps for social media management professionals with specialization paths and structured learning plans. | |
| SRE Roadmap Professional entry-level SRE career roadmap platform that generates personalized learning paths based on skills assessment and career goals. | |
| Supply Chain Mgmt Professional platform that generates personalized Supply Chain Management career roadmaps based on user assessment data and experience level. | |
| Sustainability AI-powered platform that generates personalized career roadmaps for entry-level sustainability professionals based on skills assessment and goals. | |
| System Hardening Checklist Comprehensive security assessment and hardening recommendations platform providing compliance framework guidance and critical control evaluation. | |
| Technical Writer Professional career development platform that generates personalized technical writing roadmaps based on skills assessment and career goals. | |
| The LinkedIn Optimization Toolkit Enterprise-grade API key generation, verification, and lifecycle management with centralized administrative control. | |
| Ubuntu Hardening Generates professional Linux security hardening configuration files for Ubuntu systems with customizable options. | |
| Ubuntu Hardening V2 Professional Ubuntu 22.04 LTS security configuration generator for STIG-compliant hardening. | |
| Vedic Horoscope Generates personalized Vedic horoscopes and birth charts based on birth data and astrological calculations. | |
| Veterinary Science Professional career roadmap platform that generates personalized learning paths and specialization guidance for veterinary science professionals. | |
| VMware Esxi Hardening Professional VMware ESXi 8.0 security configuration generator that produces hardened configuration files based on industry best practices. | |
| Wet Lab Career Professional Biotechnology Wet Lab Career Development Platform for personalized career planning and advancement. | |
| Windows Hardening Professional Windows Security Configuration Generator for automated hardening policy creation and deployment. | |
| Zero Trust For AI Maturity Assessment Evaluates Zero Trust maturity across 6 principles for both Conventional (Infrastructure) and AI Era (Data & Model) dimensions. | |
| VAPT Intern Professional Vulnerability Assessment & Penetration Testing Career Roadmap Platform that generates personalized learning paths for aspiring VAPT professionals. | |
| Web Vulnerability Assessment Generate comprehensive web application vulnerability assessments with OWASP-aligned checklists, remediation guides, and testing scripts. Use when assessing w... | |
| WordPress Optimizer Optimize and tune WordPress sites for performance and security with automated analysis and configuration management. | |
| WordPress Security Scanner Scan WordPress sites for security vulnerabilities, misconfigurations, and potential threats. | |
| research Decision 对复杂问题进行联网调研，并基于高质量信源输出判断、建议、排查方向或下一步动作。适用于技术选型、方案对比、版本升级、兼容性判断、架构取舍、社区口碑调研、已知问题排查、疑难 bug 冲突分析，以及其他需要上网查证、多方比较、最后给出建议或方向的问题。优先进行中英文双语检索，重视官方文档、官方博客、GitHub iss... | |
| @kanyun/rush-find-skills Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express... | |
| @kanyun/rush-reskill-usage Teaches AI agents how to use reskill — a Git-based package manager for AI agent skills. Covers CLI commands, install formats, configuration, publishing, and... | |
| 每日星座运势 查询今日星座运势。用于用户询问今日星座运势时使用，支持12星座。 | |
| MaxClaw Helper Usage guidance and runtime diagnostics for MaxClaw / OpenClaw. Activate when: (1) User asks how to use a feature — e.g. 'how to enable Feishu long polling',... | |
| Minimax Docx Enterprise-grade Word document generation. Creates validated .docx files with professional formatting, visual hierarchy, and cross-application compatibility. | |
| Minimax Pdf HTML-first PDF production skill for reports, papers, and structured documents. Must be applied before generating PDF deliverables from HTML. | |
| Minimax Xlsx MiniMax spreadsheet production system. Engage for any task that involves tabular data, numeric analysis, or spreadsheet generation. Supports XLSX/XLSM/CSV th... | |
| Mock Weather 模拟天气查询，为任意城市生成仿真天气数据（当前天气 + 多日预报）。Use when: (1) 用户查询某城市天气，(2) 用户询问天气预报，(3) 需要演示天气功能但无真实API时。支持中英文城市名，支持1-7天预报。注意：数据为模拟生成，非真实气象数据。 | |
| 新闻事实核查 新闻事实核查与真伪辨别助手。当用户需要验证新闻真实性、查证消息来源、核实事件真伪时使用。包括：(1) 给定新闻内容进行真伪判断 (2) 提供的事实核查方法和步骤 (3) 帮助用户建立批判性思维习惯 | |
| Project Manager 项目上下文隔离与状态管理系统 v2.7.0。核心解决：对话中遗忘、跨天上下文丢失、新话题漏记录。新增：甘特图自动生成、项目风险自动识别、依赖关系管理。触发词: /project, 新建项目, 回到项目, 记录项目, 继续项目, 项目列表, 甘特图 | |
| Agent-Selector 自动根据任务描述在146+专业Agent之间安全切换，支持自动适配与手动指定，确保最适合的人格身份工作。 | |
| Auto Coding V3 智能自主编码系统 v3.7.17-compliance — 全子代理架构 + 分阶段技能注入。支持 8 步循环、Reviewer 否决权、复杂度自动分级、Risk Scorecard 量化检测。触发词: auto-coding, Auto coding, 启动自动编码 | |
| Roundtable Skill RoundTable v3.0 通用多 Agent 圆桌讨论引擎：支持异构模型路由、MMR 意图解析、收敛控制和 170+ 专家库。 | |
| GitHub Reader Automatically generate structured analysis reports for public GitHub repositories using only GitHub REST API without third-party data transmission. | |
| Nostr Wallet Connect (NWC) bridge for mdk-agent-wallet, which is self-custodial Bitcoin Lightning wallet for AI agents. Expose a local @moneydevkit/agent-wallet as a Nostr Wallet Connect (NIP-47) wallet-service (systemd user service). | |
| Ai Investing Assistant With Framework Analyze a US stock using a value investing checklist and output detailed scoring steps. | |
| Figma Sync Read Figma files, extract design tokens, generate React Native Expo TS or Web React + Tailwind code,
write back to Figma, and diff local models against Figma for minimal patches.
Triggers: "pull figma", "sync figma", "figma to code", "push | |
| Bailian KnowledgeBase Retrieve Bailian KnowledgeBase(Provided by Alibaba ModelStdio) offers to retrieve any proprietary data that have been vectorized in the hosted knowledgebases. It retu... | |
| Bailian Web Search AI-optimized web search via Bailian(Alibaba ModelStdio) API. Returns multisourced, concise web search results for LLMs. | |
| HappyHorse Video Generation and Editting Video Generation and Editing with HappyHorse models. Supports text2video, image2video (first-frame based), reference2video (multi-image character fusion), an... | |
| Wan Image and Video Generation and Editting Image and Video Generation and Editting wiht Wan series models. It offers text2image, image editting(with prompt), text2video, image2video and reference(imag... |
45,901–45,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.