Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Execution Loop Agent 执行循环控制。当 agent 提前停止、偏离任务、或在 headless 模式下需要执行控制时使用。不适用于工具重试（用 tool-governance）。参见 context-memory（阶段边界 handoff）、quality-verification（编辑后检查）。 | |
| Harness Design Patterns Agent harness 架构设计模式知识库。当设计多阶段任务的上下文传递、选择多 agent 协调方式、或规划 hook 系统架构时使用。纯设计指南，无可执行代码。不用于安装 hook 脚本（用 agent-hooks）或运维监控（用 agent-ops）。 | |
| Improvement Discriminator 当需要对改进候选多人盲审打分、用 LLM 做语义评估、判断候选是否应被接受、或打分结果全是 hold 想知道为什么时使用。支持 --panel 多审阅者盲审和 --llm-judge 语义评估。不用于结构评估（用 improvement-learner）或门禁决策（用 improvement-gate）。 | |
| Improvement Evaluator 当需要验证 Skill 改进是否真正提升了 AI 执行效果时使用。通过预定义任务集（YAML）运行 AI 任务，判定 pass/fail，输出 execution_pass_rate。不用于文档结构评分（用 improvement-learner）或候选打分（用 improvement-discriminator）。 | |
| Improvement Executor 当需要把已批准的改进候选应用到目标文件、回滚之前的变更、或预览变更效果时使用。支持 4 种 action（append/replace/insert_before/update_yaml），每次变更前自动备份。不用于打分（用 improvement-discriminator）或门禁验证（用 improvemen... | |
| Improvement Gate 当执行完变更需要验证是否应保留、候选被标记 pending 需要人工审批、或想查看待审队列时使用。6 层机械门禁: Schema→Compile→Lint→Regression→Review→HumanReview，其中 Schema/Compile/Regression/Review 为阻塞层（失败即拒绝），L... | |
| Improvement Generator 当需要为目标 skill 生成改进候选、把上次失败信息注入下一轮生成、或分析历史记忆模式来避免重复失败时使用。支持 --trace 注入失败上下文。不用于打分（用 improvement-discriminator）或评估（用 improvement-learner）。 | |
| Improvement Learner 当需要检查 skill 质量评分、自动优化 SKILL.md 结构、追踪评估分数变化趋势、或「评分低了想知道哪里扣分」时使用。6维结构评估 + HOT/WARM/COLD 三层记忆 + Pareto front。不用于候选语义打分（用 improvement-discriminator）或全流程编排（用 impr... | |
| Improvement Orchestrator 当需要一键跑完「生成→评分→评估→执行→门禁」全流程、失败后自动重试、或批量改进多个 skill 时使用。不用于单独评估 skill 质量（用 improvement-learner）或手动打分（用 improvement-discriminator）。 | |
| Macro Analyst 宏观经济分析工具集 - 基于AKShare的GDP/CPI/PMI/利率/汇率数据 | |
| Microsoft MarkItDown Convert various document formats (PDF, Word, PowerPoint, Excel, images, audio, HTML, etc.) to Markdown using Microsoft's markitdown tool. Supports OCR, audio... | |
| One Click Posting 一键发帖执行技能：把同一条内容快速打包为小红书/X/知乎可发布稿，并按固定门禁完成“预检→老板确认→发布→截图复核→数据归档”。用于用户说“一键发帖”“帮我直接发”“多平台同步发”“先出发布包再发”的场景；也用于发布前质量检查和发布后复盘归档。 | |
| Prompt Hardening 硬化 agent prompt、system prompt、SOUL.md、AGENTS.md、cron prompt 使 LLM 可靠遵循指令。触发词：agent 不听话、忽略规则、绕过约束、prompt 优化、指令合规、规则强化、prompt 硬化、LLM 不遵守、模型违规、creative circumve... | |
| Prompt Hardening 硬化 agent prompt、system prompt、SOUL.md、AGENTS.md、cron prompt 使 LLM 可靠遵循指令。触发词：agent 不听话、忽略规则、绕过约束、prompt 优化、指令合规、规则强化、prompt 硬化、LLM 不遵守、模型违规、creative circumve... | |
| Quality Verification 输出质量保障与验证。编辑后检查、提交前测试、session 指标测量。不适用于工具重试（用 tool-governance）或 agent 提前停止（用 execution-loop）。参见 tool-governance（错误追踪）。 | |
| README Craft README 写作与优化。从零创建、审计已有、或重写 README。 蒸馏自 OMC/ECC 实战 README + awesome-readme/Standard README/Art of README 社区标准 + ClawHub 10+ README skills。 当需要为项目写 README、审计 R... | |
| Self-Improving Agent (Anti-Loop Hardened) Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User explicitly co... | |
| Session Feedback Analyzer Parse Claude Code session JSONL to extract implicit user feedback signals. Detects skill invocations (tool_use blocks with name="Skill" or /slash-commands),... | |
| Skill Distill 当需要把多个功能重叠的 skill 合并为一个蒸馏版 skill 时使用。 不适用于从 skills 提取 rules（rules extraction is a separate capability from ECC's rules-distill skill, not part of this repo）或... | |
| Slopbuster AI text humanizer for prose, code, and academic writing. Strips AI-generated patterns and restores human voice. Use when editing or reviewing text to make it... | |
| Task Watcher Skill Monitor async tasks by polling their state and send Discord/Telegram notifications on changes or completion for workflows like CI/CD, deployments, or reviews. | |
| Tech Article CN 要写技术分享但不知从何下手？草稿写完读起来像流水账？ 从选题→大纲→草稿→润色→发布，端到端帮你把技术经验变成一篇让人记住的文章。 适用于团队内部技术分享、掘金/InfoQ 博文、技术复盘、会议演讲稿。 不适用于：API 文档（用 doc-gen）、README（用 readme-craft）、去 AI 味（用... | |
| Tech Solution Research 技术方案调研/框架选型/技术对比/最终报告生成 — multi-source evidence orchestration for technical decision-making | |
| Tool Governance 工具使用安全与可靠性。当工具反复失败、agent 绕过权限否决、或需要破坏性操作保护时使用。不适用于 agent 提前停止（用 execution-loop）或上下文管理（用 context-memory）。参见 error-recovery（限速恢复）。 | |
| Trading Quant 量化交易数据分析工具。A股/美股/港股/贵金属实时行情，多维度评分(技术面+资金面+基本面)，涨跌停池，北向资金，分钟级资金流。Use when: (1) 查询任何股票实时行情和评分, (2) 分析A股涨跌停异动, (3) 查看北向资金流向, (4) 美股港股贵金属行情, (5) 全球市场概览, (6) 个股资金... | |
| AnySkill Skill Cloud Manager AnySkill — your private skill cloud. Manage, sync, and dynamically load agent skills from a GitHub-backed repository. Search cloud skills by natural language... | |
| Memory Palace 持久化记忆管理。Use when: 用户告诉你个人信息/偏好/习惯、需要记住项目状态/技术决策、完成任务后有可复用经验、用户说"记住""别忘了""下次注意"、需要回忆之前的对话内容。支持语义搜索和时间推理。 | |
| OpenClaw Harness Cross-session context manager for AI agents with checkpoint/snapshot, Build-Verify-Fix closure, and entropy management (GC). Use when: (1) creating a task ch... | |
| Mixpost Mixpost is a self-hosted social media management software that helps you schedule and manage your social media content across multiple platforms including Facebook, Twitter/X, Instagram, LinkedIn, Pinterest, TikTok, YouTube, Mastodon, Googl | |
| fmr-user-guide Free Model Router（FMR）免费模型路由的用户指南：安装、升级、从 Skill 模式迁移、把 agent harness 接入其 OpenAI/Anthropic 兼容端点、渠道注册与 API key 录入、模型与渠道切换停用、故障排查、数据安全说明、能力发现（FMR 能干什么/有哪些功能/组合用法，按所装版本运行时实测）。当用户提到 FMR、free-model-router、免费 token、模型路由，或描述其症状（router 起不来/挂了、切模型失败、 | |
| free-model-router-laodao 为 OpenClaw 提供免费模型智能路由服务，支持本地代理、自动配置、自动轮询、故障切换和配置零侵入。在需要设置免费模型路由、配置 Provider、切换模型或诊断模型可用性问题时使用。 | |
| Slidev PPT Generator Generate and export presentations using Slidev. Use only when the user explicitly asks for Slidev, Markdown slides, a previewable slides.md, or needs to expo... | |
| OzBargain Monitor Manage OzBargain daily-deal automation in OpenClaw via cron. Use when creating/updating schedules, customizing topic priorities, enabling no-noise filtering,... | |
| Ellya--Your Virtual Companion OpenClaw virtual companion skill. Use it to bootstrap runtime files (SOUL and base image), guide user personalization, learn and store style prompts from upl... | |
| Ellya--OOTD OpenClaw virtual companion skill. Use it to bootstrap runtime files (SOUL and base image), guide user personalization, learn and store style prompts from upl... | |
| Scripts 短文生成服务。用户输入主题或需求，自动生成短文。这是一项付费服务，执行前需完成支付验证。 | |
| Agent Archive Persistent conversation export and replay for AI agents system for Claude Code, Caveman, OpenClaw, Hermes, MCP agents, and multi-agent workflows. Use when us... | |
| A股每日复盘模板 Generate A-share stock market daily review templates with 7 professional styles including short-term sentiment, dragon head strategy, trend trading, quantita... | |
| A-Stock Reporter A股实时行情报告与定时推送。支持用户主动查询个股、生成市场简报、查询历史日报，也可由cron定时触发交易时段报告（9:30/10:30/11:30/13:30/14:30）。激活关键词：股票日报、A股简报、查股票、市场报告、每日研报、历史日报、查询过去。NOT for 美股、港股、期货、基金等非A股资产。 | |
| Agent Memory Enterprise Enterprise-grade 5-layer agent memory system with routing, scoring, and multi-backend storage. Use when building production AI agents that need persistent me... | |
| Awesome Design MD 收录50+知名网站的设计系统DESIGN.md文件，支持一键查看和复制，助力AI复刻顶级网站视觉风格。 | |
| Git Repo Reader 辅助阅读和快速理解 GitHub/Git 项目结构与核心价值的结构化方法论。 当用户请求"分析这个 GitHub 项目"、"帮我读一下这个 repo"、"了解这个项目是做什么的"、 "怎么用这个项目"、"怎么跑这个项目"、"这个项目用了哪些技术"，或任何涉及 GitHub/Git 仓库阅读、理解、技术评估、快速上... | |
| GitHub to Xiaohongshu Analyze a GitHub repository and generate Xiaohongshu (Little Red Book) infographic posts. Use when the user wants to create social media content about a GitH... | |
| MemCore Agent long-term memory system with five-layer architecture (Context/Task/User/Knowledge/Experience). Use when building agents that need persistent memory, ta... | |
| Paper Generator Automatically generate complete academic papers in Chinese or English from experimental code, supporting LaTeX templates and PDF conversion. | |
| 纯血万相冰箱盲盒 纯血万相冰箱盲盒 - 基于 Wan2.7/Wan2.1 视觉大模型的烹饪灵感触发器。用户上传冰箱内部照片，Skill 利用万相图像生图像能力，将杂乱冰箱场景语义化提炼并重组为精致创意料理概念图。支持多种菜系（中餐/西餐/日料/法餐/意餐/韩式/泰式/融合）、难易程度（简单/适中/挑战）、烹饪时间（快手/适中/慢炖... | |
| Sbti Fun Test SBTI personality test V3 - 梗王版！28种接地气的人格类型，包括自我攻击者、吗喽、狗屎人、握草人等。每种类型都有独特的ASCII艺术宠物。30道题，4个选项，测试结果 hilariously accurate。 | |
| Docker Health Monitor Monitor Docker container health: running status, CPU/memory usage, restart counts, and available image updates. Use when a user requests Docker health checks... | |
| Log Analyzer Analyze server logs for error patterns, IP frequency, time-based analysis, and alert generation. Use when a user needs log file analysis, error pattern detec... | |
| Linux Security Scanner Linux security auditing tool that checks SSH configuration, open/listening ports, firewall rules (ufw/iptables/nftables), failed login attempts, sudoers perm... |
47,101–47,150 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.