Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| vision-skill Use this skill for computer vision tasks including image recognition (OCR, object detection) and image generation (text-to-image, image-to-image). Supports a... | |
| append-note Append notes to local Markdown files via MCP append_note. Use when the user asks to save ideas, reminders, or journal entries. | |
| system-file-handler 通过 MCP stdio 提供文件系统操作（列出目录、读写文件、创建目录、删除与移动），由独立 go-fs-mcp-server 执行实际 IO。 | |
| Chrome Remote Browser Guide Guide for AI agents on how to use Chrome Remote Debugging (CDP on port 9222) to automate browser interactions. Covers the full lifecycle — connecting, naviga... | |
| Google Index Checker Check Google indexed page count for any domain using the "site:" search operator in Chrome Remote Debugging Protocol (CDP on localhost:9222). Use when the us... | |
| Search Console Report Generate comprehensive SEO analysis reports from Google Search Console data with PDF export. Use when the user wants to analyze search performance, get SEO i... | |
| Tumblr Auto Post 自动生成傅盛风格文章和封面图，一键发布到 Tumblr。每次运行时会依次询问主题、目标读者、写作目标、期望长度、内容偏好，确认后自动发布。 | |
| CAD2PDF CAD图纸转矢量PDF - 支持DWG/DXF，自动按图框拆页，完整渲染中文、标注、填充 | |
| Hermes Workflow Engine Hermes DAG工作流引擎 v3.0 — 目标驱动的多步骤任务编排系统。 支持DAG依赖、并行执行、故障转移、资源监控、版本管理、模式检测、可视化面板、社区共享。 当用户要求执行工作流、运行workflow、自动化任务、多步骤任务、创建工作流、模式检测、 版本管理、DAG编排、并行执行、故障转移时触发。 适用... | |
| Skill Evolution Loop 三件套闭环引擎 v2 — 女娲+达尔文+workflow-engine 自动联动。 4大安全机制：白名单排除/人工确认/任务验证/淘汰机制。 | |
| Context Persistence Solve cross-session context storage and sync problems. Use when (1) isolated sessions (cron/subagent/heartbeat) lack context from main session, (2) long-runn... | |
| Daily News Collector Daily tech news collection and distribution system. Automated methodology for collecting, curating, and distributing industry news via scheduled cron jobs. U... | |
| Openclaw Keepalive Keep OpenClaw gateway running 24/7 on a laptop or workstation. Use when: (1) user reports gateway disconnects or crashes, (2) user asks how to make OpenClaw... | |
| Agent Dev Workflow Orchestrate coding agents (Claude Code, Codex, etc.) to implement coding tasks through a structured workflow. Use when the user gives a coding requirement, f... | |
| Spec Writer Generate structured implementation spec documents for coding projects or features. Use when a user provides a requirement, feature idea, bug description, or... | |
| Tencent Cloud Lighthouse Load when: user mentions Lighthouse, 轻量应用服务器, 轻量服务器, or asks to check/create/manage/deploy Lighthouse instances, deploy applications to Lighthouse, manage Li... | |
| Paper to Pipeline 根据机器学习/深度学习论文的实验规划文档自动生成完整的 Python 实验 pipeline。支持数据预处理、模型构建、训练循环、评估指标、结果可视化。Use when user uploads an experiment plan document and wants to generate runnable... | |
| Yys Wallpaper 阴阳师原画壁纸下载工具。自动从 https://yys.163.com/media/picture.html 抓取壁纸，按分辨率下载到 ~/图片/{分辨率}/ 目录，跳过已存在的文件。触发条件：用户想要下载阴阳师壁纸、整理壁纸、批量下载图片。 | |
| AMtkSkill A 股行情数据技能：从 Tushare 抓取数据、查询行情估值、技术分析（均线/RSI/MACD/布林带） | |
| Claude Code Runner Execute programming tasks via Claude Code using PTY-based invocation. Handles non-TTY environments, auto-responds to prompts, and manages file synchronization. | |
| Today Earnings 从 Yahoo Finance 获取财报日历数据。适用于查询指定日期或当天财报、输出公司列表、按财报发布时间区分 BMO/AMC/TNS。当前实现基于 Chrome Extension + Native Messaging，需要本地安装 Chrome 扩展、Native Host、Google Chrome 与... | |
| Ecommerce Assistant E-commerce product research, competitor analysis, and price monitoring for Amazon, Shopify, and other platforms. Use when researching Amazon product data, an... | |
| 银行外汇牌价 Use when you need the latest bank forex rates from major Chinese banks by bank name and currency names. Supports 招商银行, 中国银行, 中国农业银行, 中国工商银行, 中国建设银行, and 交通银行... | |
| Elite Longterm Memory Local vector memory system with LanceDB + Pure JS embedding. No native modules or external APIs required. | |
| NotebookLM CLI Cookies Search and answer questions over documents already uploaded to NotebookLM using the nlm CLI. Use when users ask to find information, summarize sources, or query a specific NotebookLM notebook. | |
| Spikecv Helper Help AI Agents answer questions and execute tasks for SpikeCV, an ultra-high-speed spike camera vision framework. Use when the user asks about spike cameras,... | |
| CosyVoice3 macOS Local text-to-speech using Alibaba's CosyVoice3 on macOS Apple Silicon. Supports Chinese, English, Japanese, Korean, and 18+ Chinese dialects. Provides zero-... | |
| LLM Wiki Build and maintain a local Markdown knowledge wiki that compounds over time instead of relying on one-shot RAG retrieval. Use when the user wants to turn not... | |
| Ai Trainer Autonomously learn, summarize, and integrate complex technical documentation into system memory and rules to optimize AI task workflows. | |
| Chaos Engineer Use when designing chaos experiments, implementing failure injection frameworks, or conducting game day exercises. Invoke for chaos experiments, resilience t... | |
| Cloud Architect Use when designing cloud architectures, planning migrations, or optimizing multi-cloud deployments. Invoke for Well-Architected Framework, cost optimization,... | |
| Code Documenter Use when adding docstrings, creating API documentation, or building documentation sites. Invoke for OpenAPI/Swagger specs, JSDoc, doc portals, tutorials, use... | |
| Cpp Pro Use when building C++ applications requiring modern C++20/23 features, template metaprogramming, or high-performance systems. Invoke for concepts, ranges, co... | |
| Csharp Developer Use when building C# applications with .NET 8+, ASP.NET Core APIs, or Blazor web apps. Invoke for Entity Framework Core, minimal APIs, async patterns, CQRS w... | |
| 百度智能云VOD字幕擦除 百度智能云VOD字幕擦除工具。支持从本地或网盘选取视频进行字幕擦除，支持全局/对白/自定义区域三种模式，支持批量处理文件夹中的视频，处理后可下载到本地或上传到网盘。当用户提及"字幕擦除"、"擦除字幕"、"去除字幕"时触发。百度智能云字幕擦除skill是付费使用，价格详见：https://cloud.baidu.c... | |
| 百度智能云VOD视频翻译 百度智能云VOD视频翻译工具。支持字幕翻译和语音翻译（配音），支持用户上传字幕、自定义字幕样式，支持批量处理文件夹中的视频，处理后可下载到本地或上传到网盘。当用户提及"视频翻译"、"翻译视频"、"把视频翻译成XX语"时触发。百度智能云视频翻译skill是付费使用，价格详见：https://cloud.baidu.... | |
| homework-grader 老师作业批改助手，用于自动批改数学作业、统计错题、生成Excel统计表和PDF报告。当老师需要：(1) 上传正确答案并让AI识别 (2) 批量上传学生作业照片进行批改 (3) 统计全班错误率并生成错题分析报告 (4) 生成重点错题PDF供讲解使用时，触发此skill。 | |
| 清空废纸篓 清空系统废纸篓/回收站（macOS/Linux/Windows）。触发词：「清空废纸篓」「清空垃圾桶」「empty trash」「清理废纸篓」。斜杠命令：/clean-rubbish。 | |
| 国际关系辅助 国际关系辅助——身份建构 × 马克思主义物质约束 × 比较方法 × 多层博弈。适用：国家对外战略、国际组织、内战/恐怖主义、军控博弈、地区政治、移民/身份政治。触发词：「国际关系分析」「IR分析」「外交政策分析」「比较政治」「地缘战略」「安全博弈」。 | |
| Vue3全家桶 Antd Vue3全家桶+Ant Design+publish-commons开发技能总结，包含核心特性、TypeScript集成、主题定制、网络请求等内容 | |
| FHA, VA & USDA Mortgage Rate Watch Daily FHA, VA, and USDA government-backed mortgage rate monitoring, comparison, and newsletter-style summaries. Use when the user asks about current FHA mort... | |
| Incident Triage Helper Complete local skill package to assess and potentially publish. | |
| local-skill Local skill repository for publish and pre-publish inspection. Provides inspectSkill and summarizeSkill utilities. | |
| Mortgage Rate Monitor Concise daily weather briefing for OpenClaw. | |
| Reconcile Broker Commission Statement Reconcile broker commission statements against expected loan-level payouts, flag variances, and provide a detailed summary with recommended follow-up actions. | |
| Weather Alert Skill Sends summarized weather alerts for a configured region. Supports severity filtering and returns structured alert counts. | |
| A-Share Multi-Dimensional Quantitative Analysis A-Share Multi-Dimensional Quantitative Analysis MCP Server - broker research reports, AI news analysis, and stock comprehensive analysis | |
| Bloom Tutor Use when 用户想以一对一苏格拉底导师的方式系统学习一个课题——开一门新课、推进课题的下一篇、提交学习反馈或说「我读完了」、或整理/查看学习日志。基于 Bloom 2 Sigma 的交互式学习系统。触发词：开个文件夹学X、我想学X、帮我学X、继续、下一篇、我读完了、整理学习、查看学习日志、interacti... | |
| Learn Crossover 当用户学习或接触一个新概念/新技术/新算法/新领域时使用（尤其感到陌生或有点难时）。用「跨界原则」拿用户已掌握的知识快速撬动新知识——指出他其实已经学过的同一个东西（换了名字）、结构同构的旧知识、能解释新知识的已有知识，并点出新概念体现的跨领域元知识模式。让「学新东西」变成「发现你已经会了一半」。触发场景：学 X... | |
| Learn Deep 用户学任何新概念/新技术/新理论的默认深度入口——一次性用五个视角把概念讲透并帮他选深入方向：crossover 用已会的撬动、occam 框定该学多深、graph 建知识地图、prototype 最小原型迭代、feynman 拷问检验。触发场景：我想学 X、理解 X、X 是什么、讲讲 X、搞懂 X、学一下 X、... |
48,201–48,250 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.