Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Wiki Framework Builder 在 research-task-scope-definition 之后使用，或当用户要求搭建咨询风格报告框架、行业报告大纲、可行性研究结构、市场进入框架、排名/背书报告框架、政府研究报告大纲、政策/咨询报告结构时使用。本技能消费 task-scope JSON 交接文件，选择并重组工程化研究维度，产出固定格式的对... | |
| 研究任务与场景界定 当用户提供客户需求、研究对象（词条/主题词）、业务意图、政府/企业研究需求、市场进入问题、可行性研究需求、排名/背书目标或政策/咨询报告需求时，用于 Wiki 研究项目的任务与决策场景界定。解析客户自由表述，内部调用 wiki-normalize，识别研究对象、管理问题、研究意图、研究口径、风险和待确认项，并输出... | |
| Wiki Normalize 标准化商业研究词条名称，并基于商业分类双轨制与五级架构完成层级判定、名称规范化、规模核算口径匹配与 JSON 输出。用于处理原始词条名称解析、词条消歧义、产业链环节归并、L1-L5 层级识别等词条标准化任务。 | |
| mailgo-coldmail-marketing Complete cold email campaign suite for Mailgo — verify recipients, claim free mailbox, generate & optimize content, create campaigns, manage lifecycle, and v... | |
| C# LSP C# language server providing code intelligence, diagnostics, and navigation for .cs and .csx files. Uses csharp-ls (lightweight Roslyn-based). Requires .sln... | |
| AgentWork Skill Trade AI capabilities with escrow-secured settlement and graded verification. | |
| dist-deploy Deploy static build output (dist / build / any folder) to any SSH-reachable server: tar, scp, then atomic directory swap on the remote host, with automatic backup of the previous release, backup rotation, ownership fixup and a post-deploy h | |
| ai-infographics-news 搜索近30天内热门AI产品、工具和新闻，优先OpenClaw/MaxClaw，生成高质时效性AI资讯信息图。 | |
| AI News Infographics 生成AI新闻资讯的Infographics图片。使用场景：(1) 用户要求生成AI热门产品或新闻的图片 (2) 需要近期AI动态的可视化内容 (3) 制作OpenClaw相关的AI资讯图片 (4) 创建社交媒体分享的AI新闻卡片。功能：搜索近期热门AI产品和新闻，筛选与OpenClaw相关的内容，生成新闻杂志风格... | |
| 河洛理数 · 一卦定终身 河洛理数 · 一卦定终身。根据出生年月日时，推算本命卦、后天卦、大运、流年，逐岁批断运势。 触发场景：(1) 用户提供八字或出生日期要求算河洛命卦 (2) 用户问"一卦定终身""河洛理数""本命卦怎么算" (3) 用户要求排大运/流年/岁运断语。 加载后第一件事：主动追问八字、出生时间、出生地点、性别四项信息，缺什么问什么，直到齐全才进入计算。 关键词：河洛理数、本命卦、元堂、大运流年、岁运逢之、陈抟、邵雍、一卦定终身。 | |
| Invoice From Email 从邮箱自动搜索下载发票/行程单附件，智能三级文字提取（PyMuPDF/Tesseract/PaddleOCR自动降级），发票+行程单合并排版到A4纸，生成双Sheet费用清单Excel。零OCR依赖即可处理90%+电子发票。 | |
| Litigation Docs Generator 民商事诉讼文书成套生成技能（诉状文本生成）。当用户要求起草民事起诉状、生成诉讼文书材料、准备立案材料时触发。自动生成8份配套文书：民事起诉状、诉讼保全申请书、担保书、授权委托书、法定代表人身份证明（仅原告为公司时）、律师接待笔录、利息损失计算表（Excel）、委托代理合同。核心流程：收集信息→法律检索（元典/北大... | |
| Litigation Hub 诉讼信息中枢系统。接收法院短信、送达链接、纸质文书照片，自动 OCR 识别、下载、归档、归类到标准案卷目录。基于 12 种期限规则库自动匹配，通过系统日历 + QQ 邮件（微信送达）+ 本机电脑提醒（系统通知 + 桌面 Markdown 文件）三条线提醒，支持 macOS / Windows / Linux 全平台。 | |
| Agent Autonomy Kit.Bak Stop waiting for prompts. Keep working. | |
| Agent Autonomy Kit Zc Stop waiting for prompts. Keep working. | |
| Agent Browser Zc A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| Agent Team Orchestration.Bak Orchestrate multi-agent teams with defined roles, task lifecycles, handoff protocols, and review workflows. Use when: (1) Setting up a team of 2+ agents with... | |
| Agent Team Orchestration Local Backup Orchestrate multi-agent teams with defined roles, task lifecycles, handoff protocols, and review workflows. Use when: (1) Setting up a team of 2+ agents with... | |
| Autoresearch.Bak Autonomous experiment loop for AI agents. Use when the user wants to run systematic experiments — optimizing hyperparameters, searching for better configurat... | |
| Backtest Expert Zc Expert guidance for systematic backtesting of trading strategies. Use when developing, testing, stress-testing, or validating quantitative trading strategies... | |
| Baidu Scholar Search Skill 1.1.0 Baidu Scholar Search - Search Chinese and English academic literature (journals, conferences, papers, etc.) | |
| Capability Evolver Zc A self-evolution engine for AI agents. Analyzes runtime history to identify improvements and applies protocol-constrained evolution. | |
| Chart Generator Zc Data visualization tool producing SVG charts. Use when you need bar charts, line charts, pie charts, tables, sparklines, gauges,. | |
| Clawddocs Zc Clawdbot documentation expert with decision tree navigation, search scripts, doc fetching, version tracking, and config snippets for all Clawdbot features | |
| Cli Anything Zc Generate or refine agent-usable CLIs for existing software/codebases using the CLI-Anything methodology. Use when the user wants to turn a GUI app, desktop t... | |
| Cron Health Check Zc Monitors OpenClaw cron job health, identifies failures, timeouts, and delivery issues. | |
| Cron Mastery Zc Master OpenClaw's timing systems. Use for scheduling reliable reminders, setting up periodic maintenance (janitor jobs), and understanding when to use Cron v... | |
| Data Analyst Cn Zc 数据分析助手 - 数据清洗、统计分析、可视化建议。适合：数据分析师、产品经理、运营。 | |
| Eastmoney Financial Data 1.0.2 本 Skill 基于东方财富权威数据库及最新行情底层数据构建，支持通过自然语言查询行情类数据（股票、行业、板块、指数、基金、债券的实时行情、主力资金流向、估值等）、财务类数据（上市公司基本信息、财务指标、高管信息、主营业务等）、关系与经营类数据（关联关系、企业经营数据）。避免模型基于过时知识回答金融数据问题，提供... | |
| Eastmoney Financial Search 1.0.2 本skill基于东方财富妙想搜索能力，基于金融场景进行信源智能筛选，用于获取涉及时效性信息或特定事件信息的任务，包括新闻、公告、研报、政策、交易规则、具体事件、各种影响分析、以及需要检索外部数据的非常识信息等。避免AI在搜索金融场景信息时，参考到非权威、及过时的信息。 | |
| Eastmoney Select Stock 1.0.2 本 Skill 支持基于股票选股条件（行情指标、财务指标等）筛选满足条件的股票；可查询指定行业/板块内的股票、上市公司，以及板块指数的成分股；同时支持股票、上市公司、板块/指数推荐等相关任务，避免大模型在选股时使用过时信息。 | |
| Economic Calendar Fetcher Zc Fetch scheduled upcoming economic events and data releases from FMP API for specified date ranges with impact assessment in chronological markdown format. | |
| Email Daily Summary Zc Automatically logs into email accounts (Gmail, Outlook, QQ Mail, etc.) and generates daily email summaries. Use when the user wants to get a summary of their... | |
| Excel Xlsx Zc Create, inspect, and edit Microsoft Excel workbooks and XLSX files with reliable formulas, dates, types, formatting, recalculation, and template preservation... | |
| Using Superpowers 0.1.0 Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions | |
| Gitai - Git Commit Automation Boost developer productivity with Gitai: An AI-powered Git automation tool that analyzes code changes and generates semantic Conventional Commits instantly. Supports Node.js, Python, Java, Go, PHP, and more. Compatible with OpenAI, Anthropi | |
| deep-research skill 商业决策级深度调研 Skill V3.1——多步骤编排 + 断点强制校验 + Agent 执行指令。触发条件：用户要求深度调研、行业分析、商业调研、竞品分析等。 | |
| Anthropic Usage Query Anthropic Admin API for token usage reports (daily, weekly, monthly) with model breakdown. Requires an Anthropic Organization account. Configure your A... | |
| Organizze Skill Runs Organizze personal finance API operations via Node.js CLI scripts: accounts, categories, transactions (filters, tag grouping), credit cards (invoices, p... | |
| Todoist CLI Skill Manage tasks and projects in Todoist using the Official Todoist CLI tool (https://github.com/Doist/todoist-cli). Use when user asks about tasks, to-dos, remi... | |
| Official doc generator 专门用于自动生成体制内讨论材料并按照公文格式自动排版的技能。支持会议纪要、发言稿、讨论提纲、工作汇报等多种文档类型，遵循GB/T 9704-2012标准、党政机关公文格式和企业公文规范。使用场景：当用户需要生成体制内正式文档、会议材料、工作报告、发言稿等公文时；当需要按照标准公文格式自动排版时；当需要确保文档符合... | |
| Leaptic Leaptic captures every movement and highlight in front of the lens, making every moment you capture shine instantly. OpenClaw skill for Leaptic device snapsh... | |
| Poetize Blog Automation 让 AI 帮你运营 POETIZE 博客：写文章、发布、删除进回收站与恢复、管理分类标签、切换主题、查看数据、配置 SEO、处理付费文章支付配置；含认证持久化、配置生成、测试等辅助能力。仅支持 awesome-poetize-open（POETIZE 的开源 fork），不适用于闭源版 POETIZE 或其他博客系统，也不用于与 POETIZE 无关的通用写作或 SEO 咨询。开源仓库：https://github.com/LeapYa/awesome-poetize-ope | |
| cn-blog-writing 写、改、查中文技术博客。写文章时按一套节奏规则组织句子，改草稿时检查 AI 痕迹，规划下一篇写什么。触发场景：写博客、查 AI 味、调整语气、问"下一篇写什么"。首次使用会问博客地址，分析现有风格和 SEO。 | |
| Akshare Fetch Chinese stock market data (A-shares, Hong Kong stocks, futures, funds, macroeconomic indicators) using AKShare library. Use when you need to get real-t... | |
| Lithtrix Memory Identity Persistent cross-session memory and verifiable agent identity via the Lithtrix MCP server. | |
| Openclaw Optimizer Pro OpenClaw token cost reduction, performance tuning, and security hardening guide. Use when asked to optimize OpenClaw, reduce token costs, fix missing capabil... | |
| Lebevolae X Post Automatically post text or a single local image tweet to X/Twitter using provided developer credentials. | |
| Leo X Post 专为Leo定制的X（Twitter）发帖技能。用于发推文、带附件、回复或定时发布。触发当用户说'用leo-x-post发推'或类似，处理X API交互。需要用户提供API密钥。别用于历史数据或复杂分析。 | |
| AKA SEO Wireframe Generate 200+ page authority site content using the Authority-Knowledge-Answer (AKA) framework. Produces structured content, internal linking maps, and SEO m... |
47,351–47,400 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.