Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| iFinD Excel Plugin iFinD 同花顺 Excel 插件函数参考手册，包含股票、港股、美股、债券、基金、期货等全部金融数据指标的函数表达式、参数代码和使用说明。生成 Excel 数据文件时可参考此 skill 的指标描述。 | |
| Trading Agents 简化版 多智能体股票交易信号分析框架。当用户提供股票代码要求分析投资建议时触发。输入一只股票代码，通过7个SubAgent协作分析（基本面研究员、市场信息研究员、新闻研究员、社交媒体研究员、看涨分析师、看跌分析师、投资组合经理），输出买入/卖出/持有建议及决策依据。触发词："分析这只股票"、"给我投资建议"、"这只票值得... | |
| Trump Truth Social Tracker 跟踪特朗普 Truth Social 帖子数据。从 CNN 归档 API 获取数据并同步到本地 SQLite 数据库，支持查询、统计和分析。触发场景：(1) 用户要求同步/更新 Truth Social 数据 (2) 查询特朗普帖子内容、互动数据 (3) 分析帖子趋势或统计信息 (4) 用户提到"Truth So... | |
| writing-plans Write implementation plans: bite-sized tasks, paths, code. | |
| MerkleMap OSINT Full-featured OSINT reconnaissance using the MerkleMap API: subdomain enumeration, SSL/TLS certificate inspection, certificate deep-dive, real-time CT log mo... | |
| prd-design 产品设计 Skill 统一入口路由。 所有产品设计相关请求先经过本文件判断，再路由到对应 Skill。 触发词：PRD、原型、产品设计、从零设计、0to1、产品化、SaaS改造、现有系统改造、迭代、加功能、改功能 | |
| prd-design-iteration Use this skill when the user wants to iterate on an existing company-internal process management system — adding/modifying/deleting features. Triggers when t... | |
| 公司内部系统PRD编写 Use this skill when the user wants to design a brand-new (0→1) PRD or prototype for a company-internal process management system, where roles and workflows a... | |
| GI API Design FastAPI Design and implement RESTful API endpoints following FastAPI best practices. Use when creating new API routes, designing request/response schemas, or when th... | |
| GI Code Review Review code for quality, security, and maintainability following team standards. Use when reviewing pull requests, examining code changes, or when the user a... | |
| GI Database Query Patterns Write database queries using tkms AsyncSqlSessionTemplate. Use when implementing dao layer, writing SQL, or when the user asks for database operations with i... | |
| GI Error Handling Handle errors and logging following project conventions. Use when implementing exception handling, adding logs, or when the user asks for error handling patt... | |
| GI Excel PDF Process Process Excel and PDF files - extract data, parse tables, generate reports. Use when working with .xlsx, .xls, .csv, .pdf files, or when the user mentions sp... | |
| GI Git Commit Helper Generate descriptive commit messages by analyzing git diffs. Use when the user asks for help writing commit messages or reviewing staged changes. | |
| GI Security Audit Audit code for security issues - sensitive data exposure, dependency vulnerabilities, SQL injection, hardcoded secrets. Use when the user asks for security c... | |
| GI Summarize Summarize long text, meeting notes, documents, or code into concise key points. Use when the user asks to summarize, extract key points, create meeting minut... | |
| GI ValueSider Superinvestor Data Fetches Superinvestors' 13F portfolio holdings and buy/sell activity from ValueSider (valuesider.com). Use when the user asks for guru portfolio, 13F holding... | |
| GI Vue Component Guide Design and implement Vue 3 components following best practices. Use when creating Vue components, defining props/emits, or when the user asks for Vue compone... | |
| ValueSider Superinvestor Data Fetches Superinvestors' 13F portfolio holdings and buy/sell activity from ValueSider (valuesider.com). Use when the user asks for guru portfolio, 13F holding... | |
| ima_skills_yc IMA 个人笔记服务 API skill，用于管理用户的 IMA 笔记。支持搜索笔记、浏览笔记本、获取笔记内容、新建笔记和追加内容。 当用户提到笔记、备忘录、记事、知识库，或者想要查找、阅读、创建、编辑笔记内容时，使用此 skill。 即使用户没有明确说"笔记"，只要意图涉及个人文档的存取（如"帮我记一下"、"我... | |
| Apple Watch Health Sync Apple Watch health data sync via Health Auto Export app. Use when querying sleep, heart rate, steps, workouts, or any health metrics. Also use when setting u... | |
| Blog Auto Poster Skill 多平台文章统一发布与同步工具。支持 CSDN、51CTO、博客园、掘金四个平台。 触发场景：用户需要将文章、博客、Markdown 文件的内容分发或群发到指定平台。 典型指令如：“帮我把这段文字发布到所有平台”、“把这个 MD 文件同步到 CSDN”、“一键群发这篇博客”。 | |
| Gemini Web Automation Skill 当用户希望实际使用 Gemini 网页版完成一次对话时使用本 Skill，包括发送 Prompt、继续已有对话、上传图片或文件、获取 Gemini 回复以及恢复 Gemini 登录状态。典型请求包括："帮我问 Gemini"、"用 Gemini 回答"、"把这段话发给 Gemini"、"让 Gemini 看这张图... | |
| GPT Web Chat Skill ChatGPT 网页版自动化技能。用于通过浏览器自动化操作 chatgpt.com，包括发送 Prompt、获取回复、检测登录状态、维护会话。典型请求包括："帮我问 ChatGPT"、"用 GPT 回答"、"把这段话发给 ChatGPT"。如果只是询问 ChatGPT 的功能、模型、API、价格或使用方法，而不需... | |
| Browser Use 3.0 Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with w... | |
| 开户许可证识别与抽取（ADP） 基于来也科技ADP平台的中国开户许可证智能识别与信息抽取Skill。支持开户许可证的核准号、编号、基本存款账户、法定代表人、开户银行、银行账号等关键字段的精准抽取，输出结构化JSON，零配置开箱即用，适用于企业资质核验、工商信息查询等场景。 | |
| 营业执照识别与抽取（ADP） 基于来也科技ADP平台的中国营业执照智能识别与信息抽取Skill。支持营业执照全量字段的精准抽取——注册号、名称、类型、法定代表人、成立日期、营业期限、经营范围、登记机关、发证日期，输出结构化JSON，零配置开箱即用，适用于企业资质核验、工商信息查询等场景。 | |
| 银行卡识别与抽取（ADP） 基于来也科技ADP平台的银行卡智能识别与信息抽取Skill。支持银行卡正面关键字段的精准抽取——卡号、发卡机构、有效期、卡类型，输出结构化JSON，零配置开箱即用，适用于开户审核、支付绑定、金融信息录入等场景。 | |
| 中国机动车驾驶证识别与抽取（ADP） 基于来也科技ADP平台的中国机动车驾驶证智能识别与信息抽取Skill。支持驾驶证正副页全量字段的精准抽取——驾驶证证号、姓名、性别、国籍、住址、出生日期、初次领证日期、准驾车型、有效期始至、签发机构、档案编号，输出结构化JSON，零配置开箱即用，适用于驾驶员资质核验、网约车/货运司机准入审核等场景。 | |
| 中国地区30+常用发票抽取与发票查验（ADP） 支持增值税专用发票、增值税普通发票、增值税电子发票、出租车票、火车票、飞机行程单、过路费发票、定额发票、客运汽车票、财政票据等30+常见国内票据类型的自动分类与全量字段抽取，输出结构化JSON，零配置开箱即用，适用于费用报销、财务记账、发票验真、差旅报销自动化等场景。 | |
| Laiye ADP Global Document Intelligent Extraction · Fast High-performance API for global invoice recognition. Each page is parsed in 5 seconds with reliable high-concurrency support. It extracts full invoice data a... | |
| ADP Global Invoice Extraction · Free API A limited-time free skill launched by the Laiye ADP team. It accurately identifies and extracts information from invoices and receipts in over 100 global lan... | |
| 港澳台通行证识别与抽取（ADP） 基于来也科技ADP平台的港澳通行证智能识别与信息抽取Skill。支持港澳通行证关键字段的精准抽取——姓名、姓名拼音、性别、出生日期、证件号码、签发日期、有效期至、签发机关，输出结构化JSON，零配置开箱即用，适用于出入境审核、签注办理、身份核验等场景。 | |
| 中国居民户口本识别与抽取（ADP） 基于来也科技ADP平台的中国户口本智能识别与信息抽取Skill。支持户口本首页及个人页全量字段的精准抽取——户别、户主姓名、户号、住址、姓名、与户主关系、曾用名、性别、出生地、民族、籍贯、出生日期、本市其他住址、宗教信仰、身份证号码、身高、血型、文化程度、婚姻状况、服务处所、职业、登记日期、编号，输出结构化JSO... | |
| 中国居民身份证识别与抽取（ADP） 基于来也科技ADP平台的中国居民身份证智能识别与信息抽取Skill。支持身份证正反面8大关键字段的精准抽取——姓名、性别、民族、出生、住址、身份证号码、签发机构、有效期限，输出结构化JSON，零配置开箱即用，适用于身份核验、信息录入、开户审核等场景。 | |
| Global Invoice Recognition and extraction（ADP） Multi-language, multi-currency global invoice recognition and extraction — accurately extracts invoice number, date, supplier, buyer, currency, tax amount, t... | |
| 组织机构代码证识别与抽取（ADP） 基于来也科技ADP平台的中国组织机构代码证智能识别与信息抽取Skill。支持组织机构代码证的统一社会信用代码、名称、类型、法定代表人、成立日期、营业期限、经营范围、登记机关、发证日期等关键字段的精准抽取，输出结构化JSON，零配置开箱即用，适用于企业资质核验、工商信息查询等场景。 | |
| 护照识别与抽取（ADP） 基于来也科技ADP平台的中国护照智能识别与信息抽取Skill。支持护照资料页关键字段的精准抽取——姓名、姓名拼音、性别、出生日期、出生地、国籍、护照号码、签发日期、有效期至、签发机关，输出结构化JSON，零配置开箱即用，适用于出入境审核、签证办理、身份核验等场景。 | |
| PDF to Structured JSON（ADP） A universal document parsing Skill powered by Laiye ADP (Agentic Document Processing) platform, outputting structured JSON. ADP leverages large model capabil... | |
| PDF to Structured Markdown Skill（ADP） A universal document parsing Skill powered by Laiye ADP (Agentic Document Processing) platform, outputting high-quality Markdown. ADP leverages large model c... | |
| Global Purchase Order Recognition and Extraction（ADP） Accurate extraction of all fields from purchase orders and sales orders in various formats — PO number, order date, seller name, buyer/customer name, buyer/c... | |
| 中国机动车出厂合格证识别与抽取（ADP） 基于来也科技ADP平台的机动车整车出厂合格证智能识别与信息抽取Skill。支持车辆合格证全量字段的精准抽取——合格证编号、发证日期、车辆制造企业名称、车辆品牌、车辆型号、车辆识别代号/车架号、发动机型号/号、车身颜色、燃料种类、排放标准、外廓尺寸、总质量等30+关键字段，输出结构化JSON，零配置开箱即用，适用于... | |
| 中国机动车行驶证识别与抽取（ADP） 基于来也科技ADP平台的中国机动车行驶证智能识别与信息抽取Skill。支持行驶证正副页全量字段的精准抽取——号牌号码、车辆类型、所有人、住址、使用性质、品牌型号、车辆识别代号VIN、发动机号码、注册日期、发证日期等20+关键字段，输出结构化JSON，零配置开箱即用，适用于车辆登记、保险投保、网约车/货运车辆准入等场景。 | |
| agentic-doc-parse-and-extract Enables AI-powered parsing and key information extraction from high-frequency documents including invoices, orders, receipts, long texts, and common Chinese... | |
| Laiye-OCR Enables AI-powered parsing and key information extraction from high-frequency documents including invoices, orders, receipts, long texts, and common Chinese... | |
| 邮箱订单自动录入飞书 开箱即用的采购订单自动审核 Skill：读取本地订单或飞书邮箱附件，调用 Laiye ADP 识别跨国采购订单，初始化/写入飞书多维表格订单工作台，上传订单源文件，并给审核负责人发送结构化私信，让业务人员只盯未匹配到内部商品、价格异常、新客户、币种异常等异常。 | |
| 表情包回复 搜索表情包图片，丰富 Agent 的情绪和状态表达 | |
| AI Collaboration Profile Builder Help AI understand a user's cognitive style, output preferences, and value orientation so it can generate deliverables that better match what they actually w... | |
| Idea Trace Don't just save ideas - trace how they mature. Use when a user wants to follow how an important idea was shaped by later conversations, work, projects, and l... | |
| Life Alignment Build and run a behavior-first personal planning, triage, and decision agent that learns a user's values, goals, recurring problems, friction patterns, and d... |
46,901–46,950 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.