Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 腾讯乐享知识库 Lexiang Knowledge Base 乐享知识库 MCP 全功能 Skill。当用户提到「乐享」「知识库」「个人知识库」「我的知识库」「lexiang」，或提供 lexiangla.com 链接，或涉及知识库的搜索/写入/编辑/文件/配置/评论/草稿/智能表格等操作时使用。 | |
| 腾讯乐享知识库-私有化版本 乐享知识库 MCP 全功能 Skill（私有化部署版）。当用户提到「乐享」「知识库」「个人知识库」「我的知识库」「lexiang」，或提供乐享链接，或涉及知识库的搜索/写入/编辑/文件/配置等操作时使用。 | |
| Seekit Search(No API Key Required) Use this skill when an agent needs fresh web results. No API key required. Supports multiple platforms (web, video, social). It explains how to choose a prov... | |
| Moli CDP Server Start Moli and connect CDP automation clients | |
| Moli Web Fetch Fetch, inspect, crawl, and capture live, JavaScript-rendered websites with Moli. Use when Codex needs current web content, web research, fact lookup, link following, a bounded crawl, client-rendered or response-gated content, network diagno | |
| Edge.Trade Use when user asks about crypto tokens, trading, portfolios, or price alerts. | |
| Manage PocketSmith transactions, categories, budgets and financial data Manage PocketSmith transactions, categories, and financial data via the API | |
| Sharesight Skill for OpenClaw Manage Sharesight portfolios, holdings, and custom investments via the API | |
| Doc Translate Office文档翻译工具集。用于翻译和本地化办公文档（PPT/Word/PDF/Excel），保持原文档模板和格式不变。当用户说"翻译PPT"、"翻译Word文档"、"翻译PDF"、"翻译Excel"、"翻译文档"、"文档本地化"、"英文文档翻译成中文"时使用本技能。支持PPT/Word/PDF/Excel四种格... | |
| Desktop Control (Windows) Control desktop applications on Windows — launch, close, focus, resize, move windows, simulate keyboard/mouse input, manage processes, control VSCode, read clipboard, and capture screen info. Use when the user wants to interact with any run | |
| Ambient Audio Play scientifically-proven ambient sounds for focus, relaxation, meditation, and sleep. Perfect for programmers, office workers, students, and anyone needing... | |
| EDID Parser Parse and analyze EDID (Extended Display Identification Data) from monitors and displays. USE WHEN: (1) User wants to read/parse display EDID information; (2... | |
| Dev Tools 开发工具箱，提供规范管理、预提交检查、错误诊断、技术债务跟踪、代码差异对比、重构建议、依赖分析等开发辅助功能。 | |
| Gen Code 按任务和规范生成高质量代码。支持新项目生成和遗留项目上下文感知生成。默认使用 Vue3 + Ant Design + Spring Boot 3 + MyBatis-Plus，AI 能力使用 LangChain4j + LangGraph4j。 | |
| Gen Coding Specs 基于模板为当前工作空间生成完整技术编码规范，写入 docs/coding-specs/，供 gen-code 与其它技能消费。 | |
| Gen Design 通过交互式技术选型生成系统设计文档。基于领域知识库进行数据模型设计和集成设计，确保设计与 PRD 数据流对齐。仅当用户要「生成系统设计文档」时使用；分析现有代码库请用 analyze，从代码反推设计主线请用 analyze --phase=deep。 | |
| Gen Prd 通过交互式需求分析生成完整的 PRD 文档。基于领域知识库进行结构化提问和数据流推导，确保需求理解和数据流的完整性。仅当用户要「生成 PRD/需求文档」时使用；分析现有代码库请用 analyze。 | |
| Weekly Report Skill-周报生成 Generate polished Chinese R&D weekly reports from recent work logs, chat history, commit notes, or development notes. Use when the user asks to 生成、整理、润色、汇总本周... | |
| Qoder CLI skill Delegate coding tasks to Qoder CLI using Print mode (non-interactive). Use when: (1) building/creating new features or apps, (2) code reviews, (3) refactorin... | |
| Weather Query current conditions and 1-10 day weather forecasts for cities, counties, districts, or coordinates in China, including temperature, apparent temperature, humidity, precipitation, wind, UV, sunrise, and sunset. Use when users ask in Chi | |
| LFG Alarm Put a real alarm on your person's phone, and on their friends', family's or community's phones, through LFG Alarm's MCP server (https://mcp.lfg.gm). Set, share and change alarms that ring together. Use it when someone asks to be woken, remi | |
| Mihomo Proxy Manager 管理 mihomo (Clash Meta) 代理服务。当用户需要配置、更新、重启代理、切换节点、更新订阅或排查代理连接问题时使用。适用于已有 mihomo 二进制和配置的 Linux 服务器。 | |
| 百度图片下载 百度图片下载：按关键词从百度图片搜索批量下载图片到本地。触发场景：用户说『下载 关键词 X 张图片』『百度图片下载 X』『用百度抓 N 张图』『按关键词 抓百度图』『百度图片批量下载』『Baidu image download』。底层用 acjson JSON 端点（image.baidu.com/search/... | |
| 知网论文下载 从中国知网（CNKI）检索并批量下载学术文献 PDF。一句话触发："知网下载"、"cnki 下载"、"帮我下几篇知网文献"。负责：首次运行让用户提供知网入口 URL 并保存到配置文件 → 启动 Playwright+Edge pipeline → 第一次会手动登录，登录态保留在 `browser_data/`，c... | |
| 抖音评论自动回复 通过 CLI 抓取抖音创作者中心评论并批量回复。触发词：'抖音评论'、'douyin 评论'、'抓抖音评论'、'回复抖音评论'、'douyin 自动回复'、'douyin auto reply'、'批量回复评论'、'douyin creator center comment'、'douyin comment ma... | |
| Xiaolongxia Memory Manager AI 助手记忆管理系统，采用双轨存储（每日日记 + 长期记忆）、定期自动提炼、会话上下文恢复。适用于：(1) 为新 agent 配置记忆管理，(2) 设置基于心跳的定期记忆整理，(3) 创建 MEMORY.md 和日记结构，(4) 适配其他 AI 平台（WorkBuddy、Coze、Dify 等），(5) 修复... | |
| Agnes Image Generator Generate or edit images from text prompts or reference images with customizable sizes using Agnes Image 2.1 Flash model and receive direct image URLs. | |
| Agnes Video Generator Generates AI videos from text or images using Agnes-Video-V2.0 with customizable frames, resolution, and asynchronous task handling. | |
| Browser Use Api Cloud browser automation via Browser Use API. Use when you need AI-driven web browsing, scraping, form filling, or multi-step web tasks without local browser... | |
| Four Layer Memory 四层记忆架构。身份层、工作记忆层、短期日志层、长期存储层分层管理，让记忆既可持续累积，又不会把上下文一次性塞满。 | |
| Libtv Api Skills 通过 liblib.tv 生成 AI 图片/视频 | |
| xianyu-search 提供基于预算、成色和信用筛选的闲鱼二手商品搜索，并支持多平台价格比对和推荐。 | |
| Rubicon Sentinel v2 — Sovereign Forge Rubicon Sentinel v2 is the no-cope geopolitical sovereignty scanner for OpenClaw. Inspired by Secretary Marco Rubio's Munich 2026 masterclass, it delivers re... | |
| citic--auto--skill 基于中信银行信用卡官网进行卡种推荐，并使用 OpenClaw browser 工具辅助预填官方申请表；默认停在最终提交前，需客户本人确认。 | |
| Grantai Memory Persistent memory for OpenClaw agents. Exact recall in milliseconds - your agent remembers everything across sessions. | |
| AI News Daily Report Daily report generation with timeliness verification for news and content freshness checking. | |
| 高校AIGC日报 高校AIGC资讯聚合。覆盖：AIGC行业资讯、AI微专业动态、高校招标需求（语音室/同声传译/云桌面）、高校AI政策。 每日自动执行，输出结构化简报。 | |
| Cron定时任务管理器 管理 OpenClaw 定时任务：查看、切模型、启用/禁用、手动触发、删除。 触发词："定时任务"、"cron"、"切换模型"、"查看定时任务"、"定时任务管理 | |
| Daily Intel Report 知讯📡每日情报推送。自动采集AI行业资讯+招标信息，整理为中文日报推送到飞书/邮件。包含两个子任务：(1) AI资讯从AIBase、IT之家等源抓取；(2) 招标信息从浙江政府采购网等平台抓取。适用于每日定时推送、即时资讯调取、招标信息筛选。触发词：每日资讯、早报、AI新闻、招标信息、今日推送。 | |
| 科技日报 每日科技资讯聚合。自动抓取GitHub Trending、51CTO、百度热搜科技榜，筛选AI/Cloud/ML领域内容，生成结构化简报。触发词：科技日报、tech news、每日资讯、科技资讯 | |
| EasyClass Auto-Improve Automated development workflow with task board management, code quality checks, and continuous improvement. Perfect for auto-coding projects every 30 minutes. | |
| 飞书知识库整理专家 飞书知识库专业整理工具。在不合并、不删除原文的前提下，通过内容分析实现精准分类。 支持单库整理和多库整体规划 (30+ 库规模)。 当用户提到以下场景时使用此 Skill: (1) 整理/分类飞书知识库内容 (2) 飞书知识库文档太多需要归类 (3) 为知识库创建分类目录结构 (4) 批量移动飞书知识库文档到文件... | |
| mimo-api-fix 诊断和修复 mimo-v2.5-pro（或其他 mimo 系列模型）调用失败的问题。当 LLM 请求返回 400 Param Incorrect、provider rejected the request schema or tool payload、或 providerRuntimeFailureKind=sc... | |
| 源码分析 GitHub源码与架构分析工具。用于：1) 下载GitHub仓库/npm包源码 2) 分析AI Agent架构与工具定义 3) 研究开源项目的提示词工程与设计模式 4) 生成结构化分析报告。触发词：源码分析、代码架构分析、github源码、项目分析、agent架构分析 | |
| 科技日报 每日科技资讯聚合。自动抓取GitHub Trending、51CTO、百度热搜科技榜，筛选AI/Cloud/ML领域内容，生成结构化简报。触发词：科技日报、tech news、每日资讯、科技资讯 | |
| 网页转飞书文档 Pro 将任意网页链接转为结构化 Markdown 并保存到飞书云文档。 触发词：转文档、抓网页存飞书、网页转文档、web to feishu、url 转文档、保存网页 | |
| Debt payoff plan comparison Collect debt and mortgage inputs, call a plans API, and return payoff strategy comparisons (snowball, avalanche, refinance) with concise recommendations and... | |
| asr-skill This skill should be used when the user asks to "transcribe audio", "transcribe video", "convert speech to text", "generate subtitles", "create captions", "i... | |
| data-skill 专门处理日常办公场景下的高频、复杂数据分析与处理的助手。使用本地代码执行模式（SQL 或 Python + SQLite）来处理数据导入、清洗、查询、提取、合并拆分及报告生成，支持大数据量且保障数据隐私安全。当用户需要处理 Excel/CSV 文件、跨表查询、生成图表或输出数据分析报告时使用此 Skill。 | |
| mail-skill Comprehensive email management skill. Use this skill when the user wants to fetch, search, read, send, reply to, move, delete, mark, or summarize emails. It... |
48,151–48,200 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.