Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| docx-footnote-reader Extract footnotes, endnotes, and body text from .docx files using Node.js. Use this skill when you need to read footnote/endnote content from Word documents,... | |
| code-review-fix Automatically review code for bugs, security, style, and performance issues, provide fix suggestions, and optionally apply repairs with explanations. | |
| Luckyball 双色球幸运号码预测 - 基于天干地支阴阳五行+随机森林机器学习模型。根据用户输入的彩票开奖日期，计算八字并生成推荐号码。 | |
| QQ群作业整理 QQ群作业整理 —— 从 QQ 群「群作业」抓取指定日期的作业内容（含图片附件），生成排版规范的 A4 Word 文档（默认单页、可多页，支持多群合并、科目筛选、仅文字版），并可发送到指定邮箱或微信；内置 doctor 环境自检（CLI/daemon/连通性/登录态/产物），适合挂无人值守定时任务。This skill should be used when the user asks to organize, export, or send QQ group homewor | |
| Skill Gatekeeper 技能門禁系統 - 自動審核、沙盒測試、安全放行 | |
| Skill Security Vet 技能安全審核 - 整合本地掃描 + VirusTotal 雲端威脅情報 | |
| 掘金自动化 掘金平台自动化操作。支持发布沸点、查询话题列表等功能。 | |
| aliyun-oss 阿里云 OSS 对象存储技能。支持文件上传、下载、列出、删除、获取 URL 等操作。 两层架构：Node.js SDK（优先）→ ossutil CLI。 | |
| qiniu-kodo 七牛云 KODO 对象存储技能。支持文件上传、下载、列出、删除、获取 URL 等操作。 三层架构：MCP 工具（优先）→ Node.js SDK → qshell CLI。 | |
| Silas Skill Auditor 技能安全审查工具。深度审查已安装或远程技能的代码安全性、权限风险、数据泄露和内容合规性。支持预装审查（远程拉取）和已装审查两种模式。当用户说"审查技能"、"检查安全"、"审核技能"、"skill audit"时使用。 | |
| Silas WeChat Article Search 微信公众号文章搜索与解析。搜狗微信+新榜双源搜索，Python脚本解析全文（零Node依赖），Serper转载兜底。 | |
| readworthy Evaluate whether an article, document, video transcript, or webpage is worth reading; recommend full reading or specific sections; maintain a private local reading profile; and learn from explicit feedback. Use when a user shares content li | |
| 4+1架构视图自动生成器 软件架构4+1视图自动生成器。当用户表达"生成架构视图"、"4+1视图"、"软件架构分析"、"4+1架构视图"、"软件架构文档"、"架构4+1"或类似表达时触发此技能。给定代码文件或工程目录，自动分析并生成 5 个视图（逻辑/过程/物理/开发/场景）+ README 文档，全部使用 Mermaid 图渲染。 | |
| github-trending-project 查询 GitHub Trending 热门项目，支持按编程语言、日期范围、口语（文档语言）筛选。当用户想了解 GitHub 今日/本周/本月热门项目、特定语言的热门仓库、或中文文档的热门项目时使用此技能。 | |
| 医学知识图谱mindmap 神经病学/脑电图医学知识图谱mindmap系统。适合管理疾病、症状、检查、药物等医学知识，支持脑电图波形分析，输出模板包含核心要点、对比、临床意义、鉴别诊断价值、异常提示、本质总结。 | |
| Dify 8D分析助手 当用户问题以「调用 8D 报告分析助手」开头时，调用 Dify API 进行 8D 问题分析 | |
| Skill Discovery SEO Improve a skill package so AI agents can find, select, and trust it across registries and ecosystems, including Codex, Claude-style agents, OpenClaw, and oth... | |
| TikTok Content Creation Compliance Review TikTok Shop seller and creator promotional content compliance using official TikTok Shop Seller University guidance. Use when an AI agent needs to che... | |
| Minimax Image Generator Text-to-image and image-to-image generation using MiniMax API. Generates images from text prompts (t2i) or transforms reference images (i2i) using MiniMax's... | |
| MiniMax TTS Generator Text-to-speech (TTS) generation using MiniMax API. Converts text into natural-sounding speech with support for multiple voices, adjustable speed and pitch, a... | |
| Minimax Usage Cn Monitor Minimax Coding Plan usage to stay within API limits. Fetches current usage stats and provides status alerts. Use when checking API quota, monitoring... | |
| ai-conversation-optimizer AI对话优化助手。诊断用户提问中的问题，给出可执行的改进方案和优化后的prompt示例。覆盖角色设定、Few-shot、CoT、格式指定等核心技巧。 | |
| discussion-cohesion-diagnosis Diagnose cohesion in the Discussion of an English psychology research paper. Covers both (1) local-level cohesion devices — connectives, reference chains, citation as glue — and (2) global-level narrative thread — forward-moving wrap, take- | |
| discussion-conventions-diagnosis Diagnose academic-writing conventions in the Discussion of an English psychology research paper. Checks the Achievement/Contribution statement (placement, type among 4 — method / results / impact / application), limitations writing, future- | |
| discussion-diagnosis-aggregator Aggregate 6 single-skill diagnosis outputs into one Discussion report (scoring, severity, top-3). Output: chat reply in conversation language. | |
| discussion-grammar-diagnosis Diagnose grammar in the Discussion of an English psychology research paper. Covers tense choice (Present Simple for permanent truths vs Past Simple for study-specific findings), subject-verb agreement, article usage, voice (active vs passiv | |
| discussion-logic-diagnosis Diagnose logical argumentation in the Discussion of an English psychology research paper. Checks argument chains (premise → evidence → conclusion), causal claims (does X cause Y, or correlate?), and the distinction between data, interpretat | |
| discussion-structure-diagnosis Diagnose the structural completeness and move ordering of the Discussion section in an English psychology research paper. Checks whether the draft contains expected moves (revisit results, map to literature, identify applications, limitatio | |
| discussion-vocabulary-diagnosis Diagnose vocabulary in the Discussion of an English psychology research paper. Checks (1) use of academic register and high-frequency academic expressions from the 5 functional categories in *Science Research Writing* 4.4.2, (2) appropriate | |
| python-debug-assistant Python代码调试助手。帮助诊断和修复Python代码错误，覆盖SyntaxError、TypeError、NameError等10+常见错误类型，提供错误解读、代码定位、修复方案和调试技巧。 | |
| Kpass Use kpass to find, retrieve, create, update, and manage secrets in KeePass KDBX vaults, generate passwords, and use TOTP. Use when the user asks to work with a kpass vault or its entries. | |
| Linx Upload local files to a configured self-hosted Linx instance and return shareable links. Prefer linx-client when installed, otherwise use the HTTP API via curl. | |
| Mealie Manage Mealie recipes, imports from websites/images/PDFs/text, meal plans, shopping lists, and the instance API with source-faithful recipe normalization. | |
| Ntfy Use the ntfy CLI to publish or schedule notifications, send attachments, subscribe or poll topics, run notification hooks, and administer ntfy servers, users, ACLs, tokens, tiers, or web push. | |
| Openclaw Obsidian Read, search, create, edit, and safely refactor an Obsidian Markdown vault directly through files, without Obsidian or an Obsidian CLI. | |
| 3X-UI代理面板 3x-ui面板REST API交互。用于管理Xray代理面板的入站/出站配置、客户端(用户)管理、节点管理、服务器状态监控、订阅管理、备份等功能。当用户需要操作3x-ui面板、查询代理服务器状态、管理用户/流量/订阅链接时使用。支持Bearer Token和Session Cookie两种认证方式。 | |
| 高德地图 高德地图 API 技能，支持路径规划、距离计算、地理位置搜索等。用于查询两地之间的骑行/驾车/步行路线、距离、时间等实时信息。需要配置高德地图 API Key（AMAP_API_KEY）。 | |
| 小米MiMo语音 小米MiMo语音合成（TTS）技能，支持将文本转换为自然语音。当用户要求朗读、语音合成、文字转语音、TTS、读一段话、把文字转成声音时使用（作为千问TTS的备选方案）。 | |
| n8n工作流管理 通过 n8n MCP server (http://localhost:5678/mcp-server/http) 用 n8n Workflow SDK 创建/校验/发布/管理工作流 | |
| 手机操控 手机操控技能。通过 USB ADB 连接安卓手机，捕获屏幕、分析 UI 元素、执行点击/滑动/输入等操作。当用户要求操控手机、执行 App 操作、打开应用、发送消息时使用。 | |
| 手机操控 Agent (蓝蓝版) 手机操控技能。通过 USB ADB 连接安卓手机，捕获屏幕、分析 UI 元素、执行点击/滑动/输入等操作。当用户要求操控手机、执行 App 操作、打开应用、发送消息时使用。 | |
| 千问生图 阿里云千问文生图模型（Qwen-Image）技能，支持图像生成。当用户要求AI生成图片、画图、文生图、text-to-image，或提到千问、阿里云生图时使用。支持中英文提示词，可指定画面尺寸、风格参数等。 | |
| 千问文生图 阿里云千问文生图模型（Qwen-Image）技能，支持图像生成。当用户要求AI生成图片、画图、文生图、text-to-image，或提到千问、阿里云生图时使用。支持中英文提示词，可指定画面尺寸、风格参数等。 | |
| 千问语音合成 阿里云千问语音合成（TTS）技能。**核心用途**：将文字结果转换为语音并发送出去（每次输出结果前必须使用）。首选千问 TTS（qwen3-tts-flash + Nofish 音色），失败时使用 Edge TTS。 | |
| Qwen Tts 阿里云千问语音合成（TTS）技能，支持将文本转换为自然语音。当用户要求朗读、语音合成、文字转语音、TTS、读一段话、把文字转成声音时使用。支持多种音色（中文/英文/方言），支持流式输出边合成边播放。 | |
| 自我复盘 自我复盘与持续改进技能。当用户要求"复盘"、"总结经验"、"记录教训"、 "自我提升"、"持续改进"、"错题本"、"学习日志"时触发。 主动在每次完成任务、犯错、学到新知后，将内容写入 reflections/。 | |
| 微信连接 Install OpenClaw's official WeChat plugin and complete account pairing via QR code scan. Triggers when the user says "install WeChat plugin", "connect WeChat", or "WeChat QR code". No command-line interaction required. | |
| Xiaomi Miot 小米米家智能家居控制技能。通过小爱音箱、米家设备控制灯光、空调、扫地机器人等小米IoT设备。当用户说"开灯"、"关空调"、"让扫地机器人扫地"等智能家居控制指令时使用。 | |
| NeuroSync FPS Calibrator Automatically calibrates FPS game sensitivity on mobile using control engineering models with 0.97 accuracy, outputting system constants and touch resolution. | |
| ZFONT-CLI 从 zfont.cn 智能搜索、推荐并下载免费商用字体，支持递归解压字体包提取 TTF、OTF、TTC 格式文件并提供安装或传输方案。 |
47,001–47,050 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.