Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| XiaoPai Player Control Control XiaoPai media player over LAN via HTTP/TCP. Use when asked to play videos, send remote-control keys, adjust volume, or query playback status on a Xia... | |
| Bilibili Garb Bilibili garb (个性装扮) data collection and management. Search garb items, query suit/collection details, scan benefit data for owned items (including discontin... | |
| Dreaming Guard Pro Smart prevention and auto-recovery for OpenClaw dreaming context overflow. Monitors growth trends, archives intelligently, compresses context, protects proce... | |
| agent-social-fun An skill that will enable your agent to join a social platform (cointelligence.live) consisting of both human and agents, create, share, post and communicate together, and bring back you daily reports of the daily fun. Human are encouraged | |
| fun-retriever A social playground where humans and Machines create things, solve challenges, share opinions, and discover unexpected connections. Let your agent join the fun, make friends, and bring home the best stories. | |
| Xiaoxin Cc Training A股超短交易教学Skill，基于小新擒龙日记的实战经验。包含龙头战法、情绪周期判断、竞价技巧、弱转强模式、复盘方法、风险控制等核心内容。 当用户询问以下内容时使用此Skill： (1) 超短交易/龙头战法/打板技巧 (2) 如何复盘/竞价观察什么 (3) 情绪周期/冰点/修复判断 (4) 弱转强/竞价爆量模式 (... | |
| Litmus Parallel autonomous ML research agents with a Director, git worktrees for per-agent experiment branches, a Skills library for validated technique reuse, a Sy... | |
| Anthropic Usage Format for Anthropic API usage reports generated by anthropic-report.py. Use this skill when creating, modifying, or discussing the format of Anthropic proxy... | |
| Crypto Interactive Research Framework - CIRF Interactive crypto deep-research framework with human-AI collaboration for superior research outcomes | |
| Crypto Research Interactive Framework Crypto Research Interactive Framework — interactive crypto deep-research with human-AI collaboration. Use this skill when users want to research crypto proje... | |
| 城市踏勘官 CityScout 城市踏勘官 CityScout：把城市片区、任务目标和时间预算转成可执行的踏勘路线、观察清单、风险点和汇报摘要。适用于城市更新、商业选址、文旅动线、街区活力评估等需要地图能力和现场判断结合的任务。 | |
| 3D模型审计技能 3D模型审计技能，用于检查STL、OBJ、3MF等3D模型文件的合规性。使用时需要：(1)验证文件完整性和格式有效性，(2)检测潜在的版权侵权内容（知名IP角色、品牌等），(3)识别政治敏感或不当内容，(4)检查模型尺寸是否超出目标3D打印机的打印范围。适用于任何3D模型文件审计场景。 | |
| Github Sync Skill 将本地创建或修改的 Claude Code 技能自动同步到 GitHub 仓库。支持增量同步、单技能同步、自动生成 README.md。 | |
| ip-risk-scanner IP 安全评估工具。当用户提供 IP 地址时自动触发，输出详细的 IP 安全评分报告（0-100 分，越高越安全）。基于 Claude 官方 IP 审查机制，自动保存≥80 分的安全 IP 报告到 Obsidian。 | |
| Wechat Saver 微信公众号文章抓取工具。将微信文章转换为 Obsidian 兼容的 Markdown 格式，支持图片下载、智能格式识别（代码块/列表/引用）。 | |
| Career Counselor 高校应届毕业生专属职业规划师。覆盖全学科专业就业拆解、岗位方向选择、城市选择、 求职实操指导、3-5年带容错职业规划、择业内耗情绪疏导。 当用户提到「职业规划」「找工作」「选offer」「转行」「毕业迷茫」「不知道怎么选」 「帮我看看这个专业能做什么」「职业方向」「该去哪个城市」时使用。 即使用户只是说「我快毕业... | |
| Ghost Admin API Endpoint Builder Create or extend Ghost Admin API endpoint code in the standard core structure. Use this skill for tasks that add a new endpoint file under `ghost/core/core/s... | |
| Deepsop Bilibili 工作台 Bilibili 视频自动上传 skill。当用户需要登录 Bilibili、校验账号或上传视频时使用。基于 social-auto-upload 项目，OPclaw 自动准备运行环境，无需用户手动安装。 | |
| Deepsop Douyin 协作台 抖音视频自动上传 skill。当用户需要登录抖音、校验账号或上传视频时使用。基于 social-auto-upload 项目，OPclaw 自动准备运行环境，无需用户手动安装。 | |
| Deepsop Genvis 助手 AI 图片与视频异步生成技能，调用 AI Artist API 根据文本提示词生成图片或视频，自动轮询直到任务完成。 ⚠️ 使用前必须设置环境变量 AI_ARTIST_TOKEN 为你自己的 API Key！ 需要 API Key 授权：已有账号请前往 https://ai.deepsop.com/login?s... | |
| DeepSop工作台 人机协作台技能。用户输入自然语言销售指令，AI自动分析拆解任务参数，调用 deepsop 平台接口提交任务，等待后查询结果并推送。触发场景：用户说「帮我找客户」「挖掘XXX行业客户」「找XXX个客户」「提交任务」等与客户挖掘、销售任务相关的指令；或用户说「创建电话场景」「新建外呼话术」「新建电话机器人」「提交场景... | |
| Deepsop Kuaishou 工作台 快手视频/图文自动上传 skill。当用户需要登录快手、校验账号或上传内容时使用。基于 social-auto-upload 项目，OPclaw 自动准备运行环境，无需用户手动安装。 | |
| deepsop-声音克隆助手 声音复刻技能，使用 AI Artist API 进行音色克隆和语音合成。支持查询已有音色、上传音频创建新音色、使用指定音色合成语音。 ⚠️ 使用前必须设置环境变量 AI_ARTIST_TOKEN 为你的 API Key！需要 API Key 授权。 触发场景： - 用户要求生成语音，如"用蔡总的音色说..."、"... | |
| DeepSop TK工作台 TikTok 视频 AI 生成与发布技能（数字员工 Toby）。用户输入自然语言指令，AI 自动拆解任务参数，调用 deepsop 平台接口生成 AI 视频并发布到 TikTok，等待后查询并推送播放/点赞/评论/分享等数据。触发场景：用户说「发 TikTok 视频」「生成视频发布到 TikTok」「抖音国际版发... | |
| Deepsop Xiaohongshu 助手 小红书视频/图文自动上传 skill。当用户需要登录小红书、校验账号或上传内容时使用。基于 social-auto-upload 项目，OPclaw 自动准备运行环境，无需用户手动安装。 | |
| Image & Video Generation AI 图片与视频异步生成技能，调用 AI Artist API 根据文本提示词生成图片或视频，自动轮询直到任务完成。 ⚠️ 使用前必须设置环境变量 AI_ARTIST_TOKEN 为你自己的 API Key！ 需要 API Key 授权：已有账号请前往 https://ai.deepsop.com/login?s... | |
| AI朝廷三省六部 AI朝廷三省六部协作系统。将中国唐代三省六部制映射到多Agent协作框架，实现"起草-审核-执行"的分权制衡流程。 触发场景： - 用户要求多Agent协作完成任务 - 需要评审、质检、审核流程 - 复杂任务需要分解与协调 - 提及"朝廷"、"三省"、"六部"、"封驳"、"协作"等关键词 - 需要角色扮演式任务处理 | |
| Birthday PPT Creator Generate customized kindergarten birthday PPTs with name, birth date, photos, themed colors, cute decorations, and animated titles using python-pptx. | |
| Channel Tree Manages hierarchical OpenClaw session channels to split tasks, create sub-channels, track status, and save tree state with inheritance and health monitoring. | |
| Jury Review 动态评审团多维评分与周期迭代工作流程。根据任务自动生成适合的评审团成员，支持极端评审官加入，形成包围式评审阵势。触发词：评审团、多维评分、迭代优化、代码评审、质量评估、周期迭代、动态评审。 | |
| Kuuila Game 通用互动游戏框架，支持单人文字冒险、猜谜及多人武侠游戏，含私聊控制群游戏和实时状态同步。 | |
| Peace Evolution 和平之种迭代评审Agent。自动执行 jury-review 评审流程，根据评审反馈优化 HTML 游戏，生成新版本并发送给用户。触发词：peace迭代、和平评审、游戏优化、评审生成。 | |
| Peace Workflow 和平之种 HTML 游戏的评审迭代工作流。自动发送文件、启动评审团评审、根据评审改进代码、生成新版本。触发词：peace workflow、和平工作流、HTML评审迭代、代码评审流程、自动迭代改进。使用场景：(1) 需要对 HTML 文件进行评审改进 (2) 需要启动多轮迭代优化 (3) 需要发送文件并获取评审反馈。 | |
| Web Extractor 使用 jina.ai 提取网页干净文本并让 Agent 总结。触发词：提取网页、总结新闻、提取文章、获取页面内容 | |
| 星月新人助手 星月写作平台新人助手。覆盖长篇小说 / 短篇小说 / 动态漫·沙雕漫 / 剧本 / 脑洞生成 五大创作场景。聚合星月官方 B 站视频教程、论坛精品贴、模型测评、投稿变现指南，并根据用户场景路由到对应资源。Use when user asks about 星月写作, xingyuexiezuo, 长篇开书, 章纲续写流, 短篇过稿, 番茄签约, 动态漫, 沙雕漫, 剧本创作, 小说改编剧本, 脑洞生成, 网络小说投稿, or mentions xingyuexiezuo.com | |
| lex Build original LangGraph agents for Warden Protocol and prepare them for publishing in Warden Studio. Use this skill when users want to: (1) Create new Warden agents (not community examples), (2) Build LangGraph-based crypto/Web3 agents, (3 | |
| Book Google Meet Create scheduled Google Calendar events with OPEN access Google Meet spaces. | |
| Cyber Skill 赛博江湖向导 - 创建侠客、实时掌握角色动态、随时托梦干预 | |
| Lumbox Email infrastructure for AI agents with zero-human setup. Self-provision an inbox in one command (no account creation, no console, no human), send and receiv... | |
| Github Trend Observer A GitHub Intelligence Tool from an AI PM perspective. Goes beyond displaying data to deliver PM-grade paradigm insights. Powered by the locally authenticated... | |
| 文华8麦语言量化开发 提供文华8麦语言量化交易模型编写、回测、参数优化、策略运行及头寸风险管理功能。 | |
| Audio Video Expert audio/video processing with ffmpeg and ffprobe. Use when the user needs to convert, compress, edit, analyze, stream, or process any audio or video fil... | |
| house-hunter 对话式找房 — 房产中介 skill，面向年轻租客，多源数据融合（地图/小红书/链家/新闻）。 | |
| moviemovie 搜索电影下载资源（磁力链接/种子），推荐有下载资源的热门电影。 多平台热门聚合（烂番茄+豆瓣）+ 种子资源实时验证 = 只推荐你能下载到的电影。 触发词："找电影"、"电影下载"、"磁力"、"推荐电影"、"最近有什么好看的"、 "find movie"、"download"、"magnet"、"trending | |
| voice2need Research a specific group's needs from community discussions. Collect authorized sources, read complete conversations, distinguish wishes from behavior, and produce traceable findings, counterexamples, and product tests. | |
| xhs-research 小红书调研工具 — 搜索小红书笔记，AI 合成调研报告。 | |
| Proof-of-Quality - BTC PoW Verifiable Excellence BTC PoW grind nonce till skill/output benchmark score > threshold. Verifiable excellence for antifragile meritocracy—no hype, pure quality proof. Use for skill evaluation, fork scoring, collab verification. | |
| Trading upbit skill Upbit automated trading (aggressive breakout) with cron-friendly run-once commands, TopVolume monitoring, and percent-based budget splitting. | |
| UPBIT market data get skill Fetch market data from Upbit via CLI commands including pairs, candles, trades, tickers, orderbooks, and watchlist with JSON output. | |
| OpenClaw技能分类与统计 OpenClaw skill inventory tool: scans installed skills via the OpenClaw CLI, auto-classifies (10 categories/48 subcategories, user overlay), detects duplicates, exports Markdown/JSON/HTML interactive reports (static sortable HTML, no server) |
46,051–46,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.