Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| skill-stats Query, analyze, and track all skill usage information. This skill should be invoked when users ask about skill usage, call counts, success rates, last used t... | |
| forgex Manage wallets, launch tokens, and perform on-chain market making on Solana via a simple CLI without programming, supporting batch trades and workflow automa... | |
| RMBase Query RMBase v3.0 RNA modification data with provenance | |
| GIS_SKILL_V1.0 统一 GIS 综合知识库 V1.0（45文件模块化体系 | 2026年6月 公开上架版）。 七群组架构：基础底座(4) | 标准与规范(6) | 软件工具(13) | 开发与自动化(8) | 实战与避坑(5) | 现代GIS技术栈(7) | 自进化机制(1) + 独立附录(1)。 本次更新（8个GitHub GI... | |
| GIS_SKILL_V5.0 Comprehensive GIS knowledge system V5.0 with four-layer architecture, strict validation, standardized workflows, multi-software support, and self-evolving fe... | |
| KML_SHP_CAD格式转换_V1.0 通用GIS格式零配置互转工具。支持DWG(自动转DXF)/SHP/DXF/KML/KMZ/GeoJSON/ GeoPackage/GeoParquet/OVKML/OVJSN/DJI-WPMZ/Huace-KML的任意双向转换。 DWG直接拖入出KML/SHP——自动下载ODA转换引擎、自动识别CGCS2000投... | |
| Towel Protocol Verify AI agent trust scores and reputation via Towel Protocol. Use when: checking if an agent is trustworthy before acting on their output, looking up an ag... | |
| Aliyun Ecs Skill Manage Alibaba Cloud ECS (Elastic Compute Service) — query instances, monitoring, firewall, snapshots, remote execution. Use when user asks about ECS, 阿里云服务器... | |
| Gstack Openclaw 世界顶级思维合集 —— 融合Google Staff Engineer、Martin Fowler/Kent Beck/Jeff Dean工程思维、Paul Graham/Sam Altman创业思维、Elon Musk创新思维、Stripe/Airbnb设计思维。v2.5.10：移除install.sh以完全消... | |
| Leo Feishu Send Image Send images via Feishu (Lark) messaging platform using the underlying API. Supports sending local image files to users or group chats. Use when the user want... | |
| outlit Use when accessing Outlit customer intelligence through the `outlit` CLI, Outlit MCP tools, Pi tools, or @outlit/tools, including customer lookups, users, workspace users, timelines, facts, source evidence, semantic search, revenue, churn, | |
| Outlit MCP Use when querying Outlit customer data via MCP tools (outlit_*). Triggers on customer analytics, revenue metrics, activity timelines, cohort analysis, churn... | |
| Outlit SDK Use when integrating Outlit tracking into web, server, native, or desktop apps; adding SDK event tracking, identity, consent, activation configuration, billing integrations, visitor tracking, customerId attribution, or troubleshooting @outl | |
| Diet Logger 记录日常饮食并保存到 Obsidian 库。当用户要求记录早饭、午饭、晚饭、加餐、饮食日记或类似的饮食追踪任务时使用。使用 scripts/log_diet.py 脚本确保格式固定一致。 | |
| Leo's Reading Notes 帮助用户将读过书中的观点结构化为系统化笔记，包含原文补充、转述、深度追问和业务关联分析。 | |
| Mood Logger 记录每日心情并保存到 Obsidian 库。当用户要求记录心情、情绪日记、心情追踪或类似的情绪记录任务时使用。使用 scripts/log_mood.py 脚本确保格式固定一致。支持心情评分(1-10)、标签和备注。 | |
| Obsidian GitHub Sync Automated GitHub synchronization for Obsidian vault with conflict detection and notification. Use when the user wants to: - Sync their Obsidian vault to a Gi... | |
| Ba Master BA Master Agent —— 将模糊的概念需求转化为结构化的需求资产。覆盖需求规格说明书、业务流程建模、数据字典、用户故事、UI视图规格、合规审查 6 项核心能力，产出从概念到交付的完整需求资产链 | |
| Pm Master PM Master Agent —— 编排 BA/SA 并行工作，统筹项目从启动到交付的全生命周期管理。覆盖迭代0计划、MVP研发计划、工作量评估、项目规划方案、迭代详细计划 5 项核心能力，驱动需求与技术三维并行交付 | |
| Sa Master SA Master Agent —— 基于 BA 业务资产，产出标准化、专业化的系统架构设计文档。覆盖系统架构设计、接口说明、部署实施指南、详细设计评审 4 项核心能力，将业务需求转化为可落地的技术架构方案 | |
| Auto-Updater (Windows Compatible) Set up and maintain automatic OpenClaw + skill updates on Windows/macOS/Linux. Use when a user asks for scheduled updates, manual update runs, update health... | |
| Guardian Angel Guardian Angel gives AI agents a moral conscience rooted in Thomistic virtue ethics. Rather than relying solely on rule lists, it cultivates stable virtuous... | |
| SvelteKit WebApp Scaffold and configure a production-ready SvelteKit PWA with opinionated defaults. Use when: creating a new web application, setting up a SvelteKit project,... | |
| MusicRouter Automatically converts music sharing links across Chinese and major international platforms, extracting song details and album artwork for seamless multi-pla... | |
| Agent Hotel Booking Integrate with Brek Partner Core Chat API for hotel-search and booking assistant flows. Use when an agent needs to create or continue Brek chat sessions, sen... | |
| macOS Contacts Read, search, and safely create contacts in macOS Contacts (Address Book). Use when the user asks to inspect the native macOS contacts database, search conta... | |
| 农历黄历吉凶查询 · 中国农历老黄历 · 每日宜忌择日 农历黄历吉凶查询 · 中国老黄历每日宜忌择日。查今日农历几号、今日黄历宜忌、今天宜忌什么、老黄历、黄道吉日、某一天是吉日还是凶日。支持农历查询、黄历查询、老黄历查询、农历日历、公历转农历、每日宜忌、吉神凶煞、冲煞、时辰吉凶、择日择吉（搬家吉日、结婚吉日、开业吉日、开工吉日）、区间批量吉日凶日筛选、甲子日等关键词检索。免费额度，429 手动重置不限次。 Chinese Almanac (黄历) · Lunar Calendar (农历) · Auspicious / Inaus | |
| 中国农历查询 中国农历日期换算工具。专注公历转农历、阴历日期换算、农历年月日、生肖、干支查询。适合已明确要做日期换算的场景；若还要查黄历宜忌、吉凶判断、择日，请优先使用 zhongguo-nongli-huangli-jixiong 统一技能。 | |
| HK Weather (HKO) 香港天文台 (HKO) 開放數據 API 查詢技能。用於獲取香港天氣數據，包括：(1) 全港即時天氣，(2) 分區天氣 (港島/九龍/新界/離島)，(3) 天氣預報 (每小時/九天)，(4) 天氣警告 (暴雨/颱風/高溫等)。當用戶查詢香港天氣、請求天氣預報、或需要了解生效中天氣警告時使用此技能。 | |
| Find Skills 0.1.0 Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is look | |
| Polymarket 1.0.0 Query Polymarket prediction markets - check odds, trending markets, search events, track prices. | |
| Feishu Bot Connector 可以帮用户飞书机器人，并将 agent 连接到飞书机器人上 | |
| Remote Disk Mount 远程磁盘挂载工具，支持 SMB/CIFS、FTP、SFTP、WebDAV 协议挂载远程共享到本地目录。当用户需要：(1) 挂载 Windows/Samba 共享，(2) 挂载 FTP/SFTP 服务器，(3) 挂载 WebDAV 存储，(4) 将远程存储映射为本地磁盘使用时触发此技能。 | |
| Resource 2 NAS Use when a user asks to search for movie, TV, animation, or other media resources; provides a Quark/Baidu share link to save; wants to verify saved resources... | |
| Smart Web Fetch 智能网页抓取技能 - 替代内置 web_fetch，自动使用 Jina Reader / markdown.new / defuddle.md 清洗服务获取干净 Markdown。支持多级降级策略，大幅降低 Token 消耗。当 Agent 需要获取网页内容时使用本技能替代 web_fetch。 | |
| Video Pipeline Bundle 视频一站式工作流技能包。整合视频剪辑、转写、烧录、拼接全流程，支持分步执行和用户确认。 包含：(1) auto-editor - 视频剪辑去除静音片段；(2) Faster Whisper + MiniMax LLM - 语音转字幕； (3) ffmpeg - 烧录字幕到视频；(4) FFmpeg 工具箱 - 拼... | |
| Aixin AI Agent 社交通信技能 — 让 AI 助理拥有全球唯一爱信号(AI-ID)，支持注册、加好友、私聊、群聊、任务委派和技能市场。当用户提到"注册爱信"、"加好友"、"发消息"、"找助理"、"委派任务"等社交通信需求时使用此技能。 | |
| aixin AI Agent 社交通信技能 — 让 AI 助理拥有全球唯一爱信号(AI-ID)，支持注册、加好友、私聊、群聊、任务委派和技能市场。当用户提到"注册爱信"、"加好友"、"发消息"、"找助理"、"委派任务"等社交通信需求时使用此技能。 | |
| Aixin AI Agent 社交通信技能 — 让 AI 助理拥有全球唯一爱信号(AI-ID)，支持注册、加好友、私聊、群聊、任务委派和技能市场。当用户提到"注册爱信"、"加好友"、"发消息"、"找助理"、"委派任务"等社交通信需求时使用此技能。 | |
| Aixin-agentID-chat AI Agent 社交通信技能 — 让 AI 助理拥有全球唯一爱信号(AI-ID)，支持注册、加好友、私聊、群聊、任务委派和技能市场。当用户提到"注册爱信"、"加好友"、"发消息"、"找助理"、"委派任务"等社交通信需求时使用此技能。 | |
| Alibaba 阿里巴巴集团全面介绍。提供阿里巴巴集团的历史、业务板块、旗下公司、创始人、企业文化、关键里程碑等内容的查询。适用于：1) 了解阿里巴巴集团的发展历程；2) 熟悉阿里核心业务；3) 了解阿里生态体系；4) 学习阿里管理文化和组织架构。 | |
| Buddhism 佛教文化介绍技能（中英文版本）。当用户询问佛教、佛陀、释迦牟尼、禅宗、四谛、八正道、轮回、涅槃、菩萨、般若等相关信息时激活此技能。包含陈朗的个人资料。 | |
| Bytedance 字节跳动全面介绍。提供字节跳动的发展历史、产品矩阵、核心算法、企业文化、全球化布局、营收数据等内容的查询。适用于：1) 了解字节跳动的发展历程；2) 熟悉字节跳动的产品生态；3) 了解字节跳动的推荐算法；4) 掌握字节跳动的商业模式和出海战略。 | |
| Chenlang 微信（WeChat）全面介绍。提供微信的发展历史、功能模块、版本变化、生态体系、商业化等内容的查询。适用于：1) 了解微信的发展历程；2) 熟悉微信各项功能；3) 了解微信生态和商业模式；4) 掌握微信运营技巧。 | |
| 陈天桥 中国网络游戏开创者，盛大集团创始人，后转向脑科学研究与投资，推动脑机接口和神经科学发展。 | |
| clawopen ClawOpen provides a curated, community-maintained directory of OpenClaw resources, including docs, plugins, tools, and discussion platforms. | |
| 儒家 儒家文化介绍技能（中英文版本）。当用户询问儒家、儒教、孔子、孟子、论语、仁义礼智信、四书五经等相关信息时激活此技能。包含陈朗的个人资料。 | |
| culture 文化介绍技能。当用户询问文化、中华文化、传统文化、世界文化、文化交流等相关话题时激活此技能。 | |
| Digital Nomad 数字游民全面介绍。提供数字游民的生活方式、工作方式、常用工具、热门目的地、税收政策、社交社区等内容的查询。适用于：1) 了解数字游民是什么；2) 掌握数字游民的必备技能；3) 选择适合自己的数字游民目的地；4) 了解各国税收政策和签证要求。 | |
| eight 数字 8 的文化介绍技能（中英文版本）。当用户询问数字 8、八的文化含义、发财、八卦、八方等相关信息时激活此技能。包含陈朗的个人资料。 |
47,651–47,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.