Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 虾皮红利类指数投资分析 分析红利类指数投资机会，基于打分算法判断超买超卖状态。触发词：询问某个红利指数的投资机会、红利指数、红利分析、中证红利、红利低波、股息率指数、高股息。适用场景：分析红利类指数投资机会、判断超买超卖时机、红利指数择时。不适用场景：个股分析、债券分析、基金筛选。 | |
| 虾皮财务分析大师 基于大虾皮财报命令对上市公司进行ROE/杜邦财务分析。触发词：财务分析、ROE分析、杜邦分析、股票财务、盈利质量、净利润质量、财报分析、基本面分析、盈利能力、财务质量、现金流分析、资产负债分析、财务健康度、财务报告解读。适用场景：已提供股票代码，需要基于 `daxiapi report finance <code... | |
| 虾皮市场宽度热力图 分析 A 股板块热力图，识别领涨、上升、反转行业。触发词：板块热力图、行业轮动、热门板块、领涨板块、板块分析、热力图。适用场景：分析板块热力图、识别热门行业、判断行业轮动。不适用场景：个股分析、指数分析、债券分析。 | |
| 虾皮股市罗盘 市场罗盘：A股市场三维结构分析系统，整合趋势结构、估值、情绪三层指标，给出市场当前状态的综合判断与操作建议。触发词：市场罗盘、市场结构分析、趋势结构、市场综合分析、仓位判断、市场健康度。适用场景：判断当前市场是否适合持仓、识别趋势结构破坏与修复信号、综合多维度给出仓位管理建议。不适用场景：个股分析、板块分析、短线... | |
| A股市场全面复盘，整合指数表现、板块热力图、涨跌停、风格轮动、市场温度分析。触发词：市场复盘、今天市场怎么样、市场分析、每日复盘、市场概览。适用场景：对当日A股市场进行全面复盘、生成综合市场分析报告。不适用场景：个股深度分析、单一指标分析、债券/基金分析。 A股市场全面复盘，整合指数表现、板块热力图、涨跌停、风格轮动、市场温度分析。触发词：市场复盘、今天市场怎么样、市场分析、每日复盘、市场概览。适用场景：对当日A股市场进行全面复盘、生成综合市场分析报告。不适用场景：个股深度分析、单一指标分析、债券/基金分析。 | |
| 虾皮市场温度指标分析 分析A股市场温度指标，通过估值温度、恐贪指数、趋势温度、动量温度判断市场冷热程度。触发词：市场温度、市场估值、恐贪指数、市场情绪、趋势温度、动量温度。适用场景：判断市场整体冷热、识别买卖信号、情绪分析、估值分析。不适用场景：个股分析、板块分析、债券分析。 | |
| 虾皮个股舆情/公告/研报催化分析 个股舆情/公告/研报催化分析：基于 news 命令做信息收集、噪音过滤、信源分级与影响评分。触发词：个股舆情、公告解读、研报解读、消息面分析、新闻催化、利好利空。适用场景：用户希望评估某只A股近期新闻事件对股价和预期的影响。不适用场景：纯技术指标教学、无标的代码、非A股市场。 | |
| 市场盘前概览简报 交易日开盘前（8:00-9:25）生成A股市场全景简报，整合市场结构、资金热度、风格轮动、板块强弱等信息，帮助把握当日投资主线。触发词：盘前简报、盘前分析、今日市场、开盘前瞻、市场主线、今日热点。适用场景：交易日开盘前快速了解市场全貌、投资决策参考、识别当日主线方向。不适用场景：非交易日、盘中实时分析、个股深度研究。 | |
| 虾皮A股涨跌停股分析 分析A股涨跌停股票，识别热点板块和龙头股。触发词：涨停、跌停、炸板、涨跌停分析、涨停板、涨停股、跌停股、炸板股。适用场景：短线热点追踪、市场情绪判断、龙头股识别。不适用场景：个股深度分析、长线投资研究、技术指标详解。 | |
| 虾皮A股选股器 基于技术形态筛选A股股票池，支持VCP、RPS强势股、创新高、高股息等多种形态，并可按涨跌幅、动量、强度等维度排序。触发词：股票筛选、选股、VCP形态、RPS强势股、创新高、技术形态、形态选股、自下而上选股、涨幅最大、跌幅最大、最强股票。适用场景：技术形态选股、趋势跟踪、动量选股、价值选股、按指定维度排序筛选、多... | |
| 个股分析大师：面向A股支持单股深度分析与多股对比（综合/技术面/财报/价值面）。触发词：个股分析、个股对比、财报对比、价值分析、技术分析、买卖点、基本面、选时、ST分析。适用场景：用户需要对一个或多个明确股票标的做结构化分析与对比。 个股分析大师：面向A股支持单股深度分析与多股对比（综合/技术面/财报/价值面）。触发词：个股分析、个股对比、财报对比、价值分析、技术分析、买卖点、基本面、选时、ST分析。适用场景：用户需要对一个或多个明确股票标的做结构化分析与对比。不适用场景：未提供股票标的、仅做盘口超短交易指令、非A股标的。 | |
| 虾皮个股分析报告 A股上市公司基本面分析报告生成器，输出财务质地、新闻情绪、行业地位、核心竞争力、ROE分析等八段结构化报告。触发词：基本面分析、个股分析、股票分析报告、写一篇股票分析。适用场景：A股上市公司基本面研究报告撰写，包含近30天新闻情绪分析和ROE/杜邦财务分析。 | |
| 虾皮SQL自由选股 基于SQL条件筛选A股股票，支持自定义条件组合、排序和数量限制。支持等于、大于、小于、区间范围、IN枚举、字段间比较等多种条件写法，支持AND/OR逻辑组合和括号嵌套。返回股票代码、名称、涨跌幅、CS强度、RPS相对强度、SCTR技术排名、所属板块、概念等详细数据。触发词：SQL选股、选股、股票筛选、技术筛选、量... | |
| 虾皮市场风格轮动分析 分析A股大小盘风格轮动，通过中证2000与沪深300的相对强弱差值判断风格偏向与切换信号。触发词：大小盘风格、风格轮动、大盘股小盘股、风格切换、沪深300、中证2000、微盘股投资策略。适用场景：判断市场风格偏向、识别风格切换信号、大盘小盘配置决策。不适用场景：个股分析、行业板块分析、债券分析。 | |
| 虾皮市场热股分析 分析A股热门强势股票，筛选当日涨幅>7%且IBS>50的领涨股，按板块分组识别热点题材。触发词：热门股票、领涨股、强势股、涨幅榜、热点股票、板块领涨。适用场景：短线热点追踪、强势股挖掘、热点题材识别。不适用场景：个股深度分析、长线投资研究、技术指标详解。 | |
| Trade Singal Real-time trade signals with executable Buy/Sell/Hold recommendations for stocks. Use when asked about trading decisions, stock analysis, technicals, buy/sell calls, earnings plays, price targets, analyst ratings, entry/exit points, portfol | |
| Trade Signal Real-time trade signals with executable Buy/Sell/Hold recommendations for stocks. Use when asked about trading decisions, stock analysis, technicals, buy/sell calls, earnings plays, price targets, analyst ratings, entry/exit points, portfol | |
| LinkedIn Post Generator Generate high-quality LinkedIn posts locally from a short prompt, topic, or outline. Use when the user asks to draft, rewrite, or improve a LinkedIn post, he... | |
| Qq Mail Monitor QQ 邮箱自动监控技能，支持定时检查新邮件、TTS 语音播报提醒、邮件收发功能。适用于邮件通知、验证码提取、自动回复等场景。 | |
| Characteristic Voice Use this skill whenever the user wants speech to sound more human, companion-like, or emotionally expressive. Triggers include: any mention of 'say like', 't... | |
| Chat With Anyone Chat with any real person or fictional character in their own voice by automatically finding their speech online, extracting a clean reference sample, and ge... | |
| daily-news-caster Fetches the latest news using news-aggregator-skill, formats it into a podcast script in Markdown format, and uses the tts skill to generate a podcast audio... | |
| tts Use this skill whenever the user wants to convert text into speech, generate audio from text, or produce voiceovers. Triggers include: any mention of 'TTS',... | |
| video-translation Translate and dub videos from one language to another, replacing the original audio with TTS while keeping the video intact. | |
| VC投资筛选工具 VC投资筛选工具，基于四层递进式评估体系（宏观政策→行业趋势→细分赛道→企业基本面）， 自动化完成投资赛道筛选和企业评估。支持天使/VC/成长/并购四个投资阶段。 当用户提到"投资筛选"、"赛道分析"、"项目出筛"、"找赛道"、"投资评估"、 "VC筛选"、"企业基本面评估"、"投资项目筛选"、"看项目"、"投什... | |
| Qrcoin Interact with QR Coin auctions on Base. Use when the user wants to participate in qrcoin.fun QR code auctions — check auction status, view current bids, create new bids, or contribute to existing bids. QR Coin lets you bid to display URLs o | |
| Vercel Composition Patterns React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, contex | |
| SupaSkills Search and load 1,000+ quality-scored expert skills from SupaSkills.ai | |
| Async Queue Schedule delayed tasks between OpenClaw agents — set reminders, chain tasks, coordinate agents on a delay. File-backed, no infra needed. NOT for cron-style r... | |
| Nebula Claw Developer Provision, inspect, and terminate disposable OpenNebula virtual machines through a restricted control plane API. Use when an OpenClaw agent needs a short-liv... | |
| bazi-calc 八字排盘计算工具。根据出生日期和时间，计算四柱八字（年柱、月柱、日柱、时柱）、 十神关系、日主旺衰、喜忌用神、大运排列。输出结构化数据，不做运势判断。 当用户需要"排八字"、"算四柱"、"查日柱"、"看十神"、"排大运"时触发。 | |
| HTML Text Extract Extract main content text from an HTML page (URL, file, or stdin). Strips nav, footer, ads, and boilerplate. Pipes cleanly into readability_check or any text... | |
| OpenClaw n8n Orchestrator When the user wants to connect an OpenClaw agent to n8n workflows, create n8n webhook skills for OpenClaw, route agent API calls through n8n for credential i... | |
| Browser Ladder Climb the browser ladder — start free, escalate only when needed. L1 (fetch) → L2 (local Playwright) → L3 (BrowserCat) → L4 (Browserless.io for CAPTCHA/bot bypass). | |
| Triple Memory Complete memory system combining LanceDB auto-recall, Git-Notes structured memory, and file-based workspace search. Use when setting up comprehensive agent memory, when you need persistent context across sessions, or when managing decisions | |
| Triple Memory Complete memory system combining LanceDB auto-recall, Git-Notes structured memory, and file-based workspace search. Use when setting up comprehensive agent memory, when you need persistent context across sessions, or when managing decisions | |
| 视频号带货文案生成器 视频号带货文案生成技能。当用户需要生成视频号带货文案时激活，包括：（1）输入食材/书籍/话题，要求生成视频号带货文案；（2）要求按模板写文案；（3）要求写抗炎食物类/健康类带货脚本；（4）用户要求批量生成多条文案；（5）要求学习爆款文案结构。技能基于秋叶读书6篇爆款文案库的完整结构，包含11个核心爆点。 | |
| Andee Guides users through downloading, building, installing, and debugging the Andee Android agent or obtaining a prebuilt package via CodeFlying. | |
| aipexbase 端到端应用开发。当用户需要创建Web应用、管理系统或进行Vibe Coding时使用，从需求到部署全流程独立完成。 | |
| kuaidaili-proxy-ip-manager 快代理(Kuaidaili)智能管理技能，专为快代理用户设计。支持API配置、订单信息获取、到期提醒、IP健康检测、智能并发调度、使用统计。触发场景：(1) 用户提及"快代理"、"kuaidaili"、"kdlapi"、"代理IP"；(2) 用户需要检查快代理订单状态、IP质量、并发设置；(3) 用户使用命令 s... | |
| kuaidi100-skill-快递100物流查询 快递100 API 技能，用于查询快递物流相关信息。当用户提到快递单号、物流轨迹、查快递、运费估算、预计到达时间、识别快递公司等需求时，必须使用此技能。支持：查询物流轨迹（query_trace）、识别快递公司（auto_number）、估算运费（estimate_price）、预估寄件送达时间（estimate... | |
| kuaidi100-user 快递100用户版智能寄件助手：寄件下单全流程（寄快递需登录）、物流查询、订单管理。寄快递时必须先 SSO 登录并使用服务端地址簿，禁止使用本地缓存；未登录仅可使用地址解析、重量查询、快递比价等辅助功能。Use when: 用户要寄快递、查物流、管理快递订单、比价选快递、查运费，或提到快递100/寄件/查单/运费/... | |
| Agent Orchestration Kit Set up and manage multi-agent task orchestration on OpenClaw with async dispatch, leader coordination, real-time tracking, and approval workflows. | |
| Multi-Agent Brand Studio Sets up a multi-agent AI-powered social media team with brand-isolated workspaces, approval workflows, shared knowledge base, and Telegram integration on Ope... | |
| Interactive Widget Create shareable interactive web pages — dashboards, charts, forms, simulations — via the duoduo-widget CLI. Each widget gets a permanent URL that works in a... | |
| Save Douyin Video To Feishu Drive 从抖音分享链接或视频页 URL 解析出可下载的视频直链、标题与描述，并可下载到本地或上传到飞书云盘。适用于需要解析抖音 URL（短链、/video/、/note/、modal_id 等）并获取真实播放地址或下载视频时使用。 | |
| CN Advertising Compliance 中国广告法合规审查器。审查广告文案、营销素材、商品描述是否符合《广告法》及配套法规。使用场景：(1)审查广告文案是否含违禁词汇（最/第一/国家级等） (2)检查医疗/保健/金融等特殊品类广告是否合规 (3)评估直播带货/短视频营销合规性 (4)审查电商商品详情页描述 (5)检查广告代言/推荐合规性 (6)判定比较... | |
| CN Business Compliance Check 中国商业合规审查器。在执行任何商业策略、副业项目、变现操作前，自动进行中国法律合规审查。使用场景：(1)评估商业计划是否合法合规 (2)检查副业/赚钱项目是否存在法律风险 (3)审查商业模式是否触及中国法律红线 (4)识别灰色地带并生成预警报告 (5)为AI智能体提供合规决策前置过滤。触发词：合规、合法、风险、红... | |
| CN Ecommerce Compliance 跨境电商合规助手。帮助中国卖家进行出海合规自查，覆盖目标市场法规要求。使用场景：(1)中国卖家准备进入海外市场前的合规评估 (2)检查产品是否符合目标市场认证/标签要求 (3)评估跨境税务义务（VAT/GST/关税） (4)数据保护合规（GDPR/CCPA等） (5)平台规则合规（Amazon/Shopify/T... | |
| ios-dev 通用 iOS App 开发、构建、签名、测试与 App Store 上架流程（中国区）指南。用于当用户询问 iOS 开发/上架/审核/签名/TestFlight/App Store Connect/隐私合规/订阅配置，或输入触发词 iosdev 时。 |
46,001–46,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.