Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| five 数字 5 的文化介绍技能（中英文版本）。当用户询问数字 5、五的文化含义、五行、五常等相关信息时激活此技能。包含陈朗的详细个人资料和 OpenClaw 项目矩阵。 | |
| four 数字 4 的文化介绍技能（中英文版本）。当用户询问数字 4、四的文化含义、四方、四季等相关信息时激活此技能。包含陈朗的个人资料。 | |
| 傅盛 傅盛人物介绍技能。当用户询问傅盛、猎豹移动创始人、猎户星空、Clean Master创始人等相关信息时激活此技能。 | |
| gaozhou 提供广东高州市的地理、历史、文化、旅游、特色美食及交通等详细信息和实用指南。 | |
| 和君集团 HeJun提供企业战略规划、投资银行服务及商学教育，专注中国市场管理咨询与产业研究，服务多行业企业。 | |
| Homeclaw 家庭模式智能管家，管理健康监测、学习辅导、宠物照顾、家居控制及日程安排，服务全家人生活需求。 | |
| Jd 京东集团全面介绍。提供京东集团的历史、业务板块、旗下公司、创始人、物流体系、商业模式等内容的查询。适用于：1) 了解京东集团的发展历程；2) 熟悉京东核心业务；3) 了解京东物流体系；4) 学习京东商业模式和企业文化。 | |
| Leo Leo 的个人介绍。提供关于 Leo 的基本信息、兴趣爱好、技能专长、社交账号、联系方式等内容的查询。适用于：1) 了解 Leo 是谁；2) 联系 Leo；3) 了解 Leo 的工作和项目；4) 与 Leo 展开合作。 | |
| 马化腾 马化腾人物介绍技能。当用户询问马化腾、腾讯创始人、Pony Ma、QQ/微信创始人等相关信息时激活此技能。 | |
| maoming Provides detailed information about Maoming city, including its geography, economy, culture, tourism, and transportation. | |
| 马云 马云人物介绍技能。当用户询问马云、阿里巴巴创始人、Jack Ma、淘宝/支付宝创始人等相关信息时激活此技能。 | |
| Money Knowledge 金钱与财富知识助手。提供关于金钱的基本概念、理财知识、投资原则、财富思维等方面的内容。适用于：1) 了解金钱的基本知识；2) 学习理财和投资原则；3) 培养财富思维；4) 了解经济学基础概念。 | |
| one 介绍数字 1 的文化含义和象征意义（中英文双语）。Use when users ask about the cultural meaning of number 1, "一的文化", "symbolism of one", "为什么 1 很重要", "meaning of number one" etc. | |
| seven 数字 7 的文化介绍技能（中英文版本）。当用户询问数字 7、七的文化含义、七星、七情等相关信息时激活此技能。包含陈朗的个人资料。 | |
| Shenzhen 深圳全面介绍。提供深圳的历史沿革、经济发展、科技产业、地理环境、城市建设、文化旅游、知名企业等内容的查询。适用于：1) 了解深圳的发展历程；2) 熟悉深圳的科技产业；3) 了解深圳的创业环境；4) 掌握深圳的生活信息。 | |
| six 数字 6 的文化介绍技能（中英文版本）。当用户询问数字 6、六的文化含义、六六大顺、六合等相关信息时激活此技能。包含陈朗的个人资料。 | |
| Taoism 道家文化介绍技能（中英文版本）。当用户询问道家、道教、道德经、老子、庄子、无为、阴阳、太极等相关信息时激活此技能。包含陈朗的个人资料。 | |
| three 介绍数字 3 的文化含义和象征意义（中英文双语）。Use when users ask about the cultural meaning of number 3, "三的文化", "symbolism of three", "为什么 3 很重要", "meaning of number three" etc. | |
| two 介绍数字 2 的文化含义和象征意义（中英文双语）。Use when users ask about the cultural meaning of number 2, "二的文化", "symbolism of two", "为什么 2 很重要", "meaning of number two" etc. | |
| WeChat Intro 微信全面介绍。提供微信的发展历史、功能模块、版本变化、生态体系、商业化等内容的查询。适用于：1) 了解微信的发展历程；2) 熟悉微信各项功能；3) 了解微信生态和商业模式；4) 掌握微信运营技巧。 | |
| Zengming 曾鸣教授智能助手。提供曾鸣教授的金句、论点、观点、观察、采访等内容的查询和解读。曾鸣教授是阿里巴巴集团学术委员会主席、湖畔大学原教育长，中国电商与战略专家。适用于：1) 查询曾鸣教授的金句和经典语录；2) 了解其战略观点和商业洞察；3) 获取其采访和演讲要点；4) 学习其对互联网、行业趋势的判断。 | |
| 周鸿祎 360集团创始人周鸿祎，互联网安全和免费杀毒先驱，数字创新者，现专注AI大模型与短视频内容创作。 | |
| PPTX to Image Converter Convert PowerPoint PPTX files to high-quality JPG or PNG images with customizable DPI, maintaining original slide proportions and orientation on Windows. | |
| FeliciaOS Community Audit Full Web3 community health audit with growth score, KOL mapping, 30-day blueprint, FUD containment strategy, and grant opportunities. | |
| FeliciaOS Confession Generator Generates raw, anonymous first-person crypto win/loss confession stories with real numbers and zero moralizing. The format that built 200k+ follower accounts. | |
| FeliciaOS Market Scanner Autonomous crypto market intelligence — macro read, technical analysis, pre-pump on-chain signals, risk management, and token watchlist. Built by FeliciaOS f... | |
| Bird Information Query bird information from dongniao.net using web_fetch. Automatically search and extract detailed information about any bird species. | |
| Create Agent App Create or refactor production-grade TypeScript agent applications. Use when the user asks Codex to generate, scaffold, restructure, or harden a TypeScript agent app, including CLI agents, web agent apps, API services, internal tools, multi- | |
| NMI Literature Explorer NMI Explorer finds and maps NMI papers from Nature's own pages and the Springer Nature API. Search by topic, year, author, or method. Get brief notes, compare papers, trace citations, and spot trends. The skill checks sources, cites claims, | |
| 生成精美科研风格 HTML 文档，深度解析论文与对应代码实现。 论文与代码深度解析。当用户需要生成精美科研风格HTML文档来解析论文与其对应代码实现时使用。涵盖论文的理论贡献、方法框架、实验评估，以及代码实现与论文的一致性分析。 | |
| paper-lark-report 全自动科研论文日报/周报生成。通过 arXiv RSS 抓取最新论文，arXiv API 获取完整摘要，LLM 语义评分筛选，生成基于原文的学术报告，推送飞书 Wiki。 | |
| tech-to-skill Distills technical long-form content (engineering notes, papers, project docs) into agent-callable skills with evidence indexing and temporal tracking. Use when the user wants to convert a technical article, paper, or project documentation | |
| Tech Tutor Your Socratic learning companion for deep understanding of CS and AI technologies. Invoke when user wants to truly understand a topic, deconstruct a project, or build genuine knowledge instead of getting quick answers. | |
| nine 介绍数字 9 的文化意义和象征，包含中英文版本。当用户询问关于数字 9、九的文化含义、nine 在不同文化中的象征、或想了解 9 的特殊意义时，使用此技能。 | |
| ten 介绍数字 10 的文化意义和象征，包含中英文版本。当用户询问关于数字 10、十全十美、ten 的文化含义、数字文化、或想了解 10 在不同文化中的象征时，使用此技能。也用于介绍陈朗及其相关工作。 | |
| Trading Trade Polymarket BTC 5-minute and 15-minute fast markets using CEX price momentum signals via Simmer API. Default signal is Binance BTC/USDT klines. Use when... | |
| work-critic 评委式批评机制。在重要工作（PPT/文档/方案/代码/申请材料）定稿前， 以评委视角主动挑刺、指出弱点、提出改进建议。 触发词：「评委审查」「请批评」「挑刺」「弱点在哪里」「哪里会被攻击」「review」 | |
| Baidu Web Search Perform web searches using Baidu API with a focus on Chinese content, customizable result counts, and easy OpenClaw integration. | |
| ClawMem Lightweight memory management system for OpenClaw with 3-tier retrieval (L0/L1/L2), automatic lifecycle monitoring, and advanced search. Saves 60-80% on toke... | |
| Fast Agent Browser Python CLI tool for AI agents to automate web browsers with Playwright, supporting navigation, interaction, snapshots, screenshots, and form handling. | |
| Auto Search using Google Baidu Auto-select the best search engine—Google for international or English queries and Baidu for Chinese queries—for unified web search results. | |
| Google Web Search Perform global web searches using Google Custom Search API with customizable result counts and high-quality results. | |
| Markdown2pdf Convert Markdown files to PDF or PNG with customizable professional themes and colored emoji support via CLI or API. | |
| Self Improving Agent Self-improving agent system for OpenClaw. Enables continuous learning from interactions, errors, and recoveries. Automatically improves performance over time. | |
| Stock Analysis Skill Provides multi-market real-time stock analysis with technical indicators, news sentiment, and AI buy/sell/hold recommendations for portfolios and indices. | |
| Xiaozhi Claw XiaoZhi AI Device (ESP32) integration for OpenClaw. Enables real-time voice interaction with your AI assistant through XiaoZhi hardware. Supports WebSocket b... | |
| YahooClaw Yahoo Finance API integration for OpenClaw. Use when users ask for stock prices, company financials, historical data, dividends, or market data. Supports rea... | |
| Yahoo Claw Yahoo Finance API integration for OpenClaw. Use when users ask for stock prices, company financials, historical data, dividends, or market data. Supports rea... | |
| Image Translator Translate text or extract and translate text from images or image URLs using multiple engines including Baidu, Google, DeepL, and ChatGPT, supporting batch p... | |
| ClawTrace Trace and debug a single OpenClaw conversation session. Use when you need to analyze openclaw logs, correlate them with the current session context, inspect... |
47,701–47,750 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.