Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Learn Feynman 当用户学完一个东西想自查是否真懂、或觉得「好像懂了」但不确定时使用。用「费曼学习法」让他用自己的话把概念讲出来，你扮好奇学生专挑他含糊/跳过的地方追问，把「讲不顺的模糊处」揪出来作为没真懂的漏洞，定位是缺前置知识还是没想透，判断理解是否闭环。触发场景：我学完了考考我、自查一下、我好像懂了、我讲讲你看对不对、检验我... | |
| Learn Graph 当用户要系统学一个新领域、不知道从哪入手、或担心「学得不够系统」时使用。用「知识图谱学习法」和用户一起构建该领域的概念/用途/父子节点图谱（自己建图的过程本身就是学习），标出复用价值最高的节点和「从常识就能入门的点」，给出有效学习路径并回答「学到哪算够」。触发场景：系统学 X 领域、从哪开始学、学得不系统、想要... | |
| Learn Occam 当用户纠结要不要学某个东西、学到什么程度，或在做时间/精力/项目取舍时使用。用「简易策略」先逼问要解决的既定问题，检验现有知识能否搞定，评估知识贬值速度与 ROI，用「探索 vs 应用」判断该学新的还是用现有的，给出「学 / 不学 / 只学最小够用」的结论，避免囤积会贬值的知识。触发场景：要不要学 X、值不值得深... | |
| Learn Prototype 当用户要做/研究一个东西、想提升某个技能、或觉得某个产出不够好想改进时使用。用「改良主义」先逼出一个最垃圾但能跑的原型，再引导他自己洞察缺陷、提出问题，提改良假说→实践检验→迭代，信奉「洞察缺陷 > 如何优化 > 最终答案」，并把每次改进的方法本身沉淀成方法论。触发场景：要做 X、研究 X、提升 X、X 做得不好... | |
| A-Share Multi-Dimensional Quantitative Analysis A-Share Multi-Dimensional Quantitative Analysis MCP Server - broker research reports, AI news analysis, and stock comprehensive analysis | |
| Azure Document OCR Extract text and structured data from documents using Azure Document Intelligence (formerly Form Recognizer). Supports OCR for PDFs, images, scanned document... | |
| Spotlight Search files and content using macOS Spotlight indexing (mdfind). Use when the user asks to search local files, documents, or directories on macOS. Supports... | |
| Agent Memory Keeper AI Agent记忆修复系统。解决每次会话失忆问题——自动复盘对话、提炼关键信息存入长期记忆、下次会话自动加载。 适用于所有OpenClaw Agent，让Agent记住用户偏好、项目进展、技术决策、重要信息。 触发词：记忆、忘了、之前说过、记录一下、帮我记、你还记得 | |
| Multi-Agent Team 多Agent团队协作模板。教多个AI Agent如何分工协作——CEO统筹、执行者干活、设计师出图、销售沟通。 适用于需要多个AI角色配合完成的复杂任务。 触发词：团队协作、多人配合、分工、帮我分配、Agent团队 | |
| Data Recovery Assistant 数据恢复诊断助手。教AI Agent诊断各种数据丢失场景（误删、格式化、分区丢失、硬盘异响、RAW分区等）， 推荐对应工具和操作步骤，区分SSD和HDD的不同处理方案。 触发词：数据恢复、文件丢失、误删、格式化、硬盘坏了、分区丢失、恢复数据 | |
| Humanize Text 文案去AI味优化器。检测和修复AI生成文本中常见的机械感、模板化表达、过度礼貌等问题， 让文本更像人写的。适用于小红书文案、客服回复、产品介绍等场景。 触发词：去AI味、优化文案、自然一点、别像AI写的、口语化、更像人 | |
| Feishu Voice Chat 飞书语音对话能力，提供语音识别（ASR）和语音合成（TTS）功能， 所有的飞书语音消息都通过该技能处理。 完整语音交互链路：接收用户语音 → ASR 转文字 → LLM 处理 → TTS 转语音 → 通过飞书插件发送语音消息。 当用户要求"语音回复/说给我听"时，只回复飞书语音消息（audio 气泡），不回复文本... | |
| tableregistry Build local Markdown and CSV review tables from supplied records, preserving fields under normalized headers for audit and compatibility testing. Use when th... | |
| Minimax Android Native Dev Android native application development and UI design guide. Covers Material Design 3, Kotlin/Compose development, project configuration, accessibility, and b... | |
| market_test_price Fetch token prices from OKX DEX Market Price API (v6). Use this skill when a user wants to: 1. Get the latest price of one or more tokens on supported EVM/So... | |
| 小果量化回测系统助手 小果量化回测系统助手 (微信:xg_quant)。基于业界领先的Backtrader回测框架，提供从数据加载、策略开发、回测执行到绩效分析的全流程量化交易解决方案。
支持多品种（股票、期货、外汇、加密货币）、多周期（Tick, 秒, 分钟, 日, 周, 月）、多策略回测与参数优化。
具备完整的订单管理（市价、限价、止损、止损限价、跟踪止损）、佣金方案配置（固定、百分比、期货）、滑点模拟和绩效分析（夏普比率、回撤、年化收益等）能力。
作者：小果 (xg_quant)，联系方式： | |
| 小果可转债量化分析助手 小果(微信:xg_quant)可转债量化分析助手专注于可转债量化分析工具，基于小果量化策略系统，提供可转债历史行情数据、可转债因子数据、可转债策略回测、可转债组合分析等核心功能。适用于可转债投资者、量化研究员和策略开发者。 触发关键词：可转债量化、可转债回测、可转债分析、可转债策略、可转债数据、转债策略。 | |
| 小果量化因子库 小果(微信:xg_quant)量化因子库是一个集成了数百个技术指标、Alpha因子和交易信号的Python量化因子计算系统。
支持股票、ETF、可转债等多品种的历史因子批量计算，提供单只股票因子分析和全市场因子数据生成。
触发关键词：小果因子、量化因子、因子计算、xg_factor、技术指标、Alpha因子、因子选股、因子库。 | |
| 小果量化因子分析系统助手 小果量化因子分析系统助手,作者(微信:xg_quant)基于 Alphalens 和自定义分析框架，提供因子数据清洗、IC分析、分层收益、多空组合、换手率、Fama-MacBeth回归、综合评分等完整因子评价功能。 触发关键词：因子分析、因子评价、Alphalens、IC分析、分层收益、多空组合、因子回测、因子评分、xg_alphalens、量化因子、因子有效性。 | |
| 小果基金量化分析助手 小果(微信:xg_quant)基金量化分析助手专注于基金量化分析工具，基于小果量化策略系统，提供基金历史行情数据、基金因子数据、基金策略回测、基金组合分析等核心功能。适用于基金投资者、资产配置研究员和量化策略开发者。 | |
| 小果聚宽策略量化助手 小果(微信 xg_quant)聚宽量化交易助手-聚宽（JoinQuant）量化平台策略生成与辅助工具。根据用户需求，生成可在聚宽平台运行的 Python 量化交易策略代码，提供 API 使用指导、常见问题排查与策略优化建议。
触发关键词：聚宽、JoinQuant、JQ、写策略、生成策略、量化策略、回测代码、模拟交易、双均线、网格交易、因子选股、Alpha因子、多因子、取数据、财务数据、聚宽API、聚宽报错。 | |
| 小果量化交易Ptrade全能助手 小果(微信xg_quant)量化交易Ptrade全能助手基于 Ptrade 量化交易平台的一站式策略辅助工具。
支持策略回测参数配置、Python 策略代码自动生成、交易日志深度分析、
实盘交易信号指导、绩效归因与风险评估。 | |
| 小果全能大QMT量化交易助手 小果全能大QMT量化交易助手 - 专业级QMT策略开发全能助手
本助手是专为「迅投QMT极速策略交易系统」打造的量化交易策略开发专家。由小果（微信：xg_quant）精心打造，深度封装了QMT平台的全部API接口、运行机制、数据结构和实战经验，能够根据用户的自然语言描述，自动生成从基础到高级、从回测到实盘的完整量化交易策略代码。
【核心功能矩阵】
✅ 策略开发：根据需求描述自动生成QMT策略代码，支持股票/期货/期权/ETF/可转债/两融等多品种
✅ 策略回测：生成完整的回 | |
| 小果量化交易平台助手 小果(微信：xg_quant)量化交易平台助手技能。小果量化是一个专业的量化交易系统，提供完整的回测、模拟交易、社区策略分享等功能。
【核心功能】
- 📊 历史行情数据获取（股票、ETF、可转债）
- 📈 多维度因子数据提取（技术指标、Alpha因子、动量因子等）
- 💰 财务数据分析（资产负债表、利润表、现金流量表等）
- 🔄 多种策略回测（定投、动量、资产配置、网格、海龟、均值方差等）
- 🤖 模拟交易和社区策略管理
- 📉 多标的量化分析（相关性矩阵、协方差矩阵、投资 | |
| 小果股票量化分析助手 小果(微信:xg_quant)股票量化分析助手专注于股票量化分析工具，基于小果量化策略系统，提供股票历史行情数据、股票分钟数据、股票因子数据、股票财务数据、指数数据、 股票策略回测、股票组合分析等核心功能。 适用于股票投资者、量化研究员和策略开发者。 触发关键词：股票量化、股票回测、股票分析、股票策略、股票数据、分钟数据、财务数据、指数数据。 | |
| 小果通达信公式转Python 小果(微信:xg_quant)通达信公式转Python量化函数库。提供100+核心函数、30+技术指标、12+完整交易策略，
支持将通达信指标公式无缝迁移至Python量化环境，实现策略回测、数据分析与实盘交易信号生成。
触发关键词：通达信、TDX、公式转换、指标迁移、选股公式、技术指标、量化策略、回测、
买卖信号、金叉死叉、MACD、KDJ、RSI、BOLL、SAR、CCI、OBV、DMI、BIAS、
PSY、BRAR、CR、MASS、WAD、ASI、EMV、DPO、CHO | |
| upload-test-skill 用于测试 Skill 上传、识别、触发和基础输出链路。当用户要求“测试 skill 是否上传成功”“验证 skill 触发”“跑一遍上传测试”“upload test skill”时使用。该 Skill 只处理脱敏测试文本，不调用外部系统，不读取真实业务数据。 | |
| Ontology Engineer Extract candidate ontology models from enterprise business systems AND build/maintain personal knowledge graphs from any file system. Use when: ontology extr... | |
| ZHAO-LI-skill 以虚构学者"赵莉"的学术人格进行批判性回答。覆盖硅基光子学、AI光通信、自然语言处理底层算法、具身智能、机械臂、AI辅助教学、大模型与芯片趋势等技术锐评，以及小商家广告、健身房留存、装修效果图、团购点评、本地生活服务业等"接地气"问题的务实分析。当用户希望以赵莉专家视角评价某个技术、产品、行业现象或本地生意方案时使用。回答一律以"[赵莉见解]："为唯一前缀，200—400字，先破后立，给出AI/人/制度分工。 | |
| Hallucination Check LLM hallucination detector with dual strategy (UQLM + rule-based fallback). Scores any AI output's confidence and flags potential hallucination risks. | |
| Drawing Cleaner 对 输出的原始图纸文本进行清洗去噪与结构化分类，过滤轴线编号、图框信息、尺寸数字等无效噪声，将有效信息按"设计总说明/构件标识/配筋信息/材料强度"等类别归并输出。当用户说"清洗图纸文本"、"去掉噪声"、"整理提取结果"触发使用。 | |
| Dwg To Dxf Converter 专门用于在 Windows 环境下将 AutoCAD DWG 图纸转换为 DXF 格式。 当用户提到“DWG转DXF”、“图纸格式转换”、“处理DWG”，或工作流接收到 .dwg 后缀的文件并需要解析前置处理时，必须立即触发本技能。 | |
| Dxf Text Extractor 提取并清理建筑结构 CAD DXF 文件中的文本，自动将探索者(TSSD)等特殊钢筋符号映射为标准规范（如 HRB400）。当用户上传 DXF 文件，或要求“提取DXF文字”、“解析结构图纸”、“读取CAD文本”、“处理结构说明”时触发使用。 | |
| Review Summary Generate 4-sheet Excel review summary (评审汇总表) from 广联达 export data for budget review projects. Auto-classifies review line items into 7 categories: repeat-bi... | |
| Write OpenNote Write, update, and read OpenNote notes through the public API. Use when the user wants to publish notes, upload note images, manage labels, or look up previo... | |
| Crypto Market Data Skill (No Key Required) No API KEY needed for free tier. Professional-grade cryptocurrency and stock market data integration for real-time prices, company profiles, and global analytics. Powered by Node.js with zero external dependencies. | |
| Cubox Integration (International & China) Save web pages and memos to Cubox using the Open API | |
| BTC Monitor TalentverseX BTC and ETH market monitor with public API data, six bottom-fishing signals, and optional Discord delivery. TalentverseX | |
| iCloud Find My Query Find My locations and battery status for family devices via iCloud. | |
| Openclaw Path Alerts Main Get real-time NJ PATH train service alerts, delays, status updates, and live arrival times. Monitors official Port Authority alerts feed and GTFS-Realtime data. | |
| feature-modification-workflow Structured workflow to analyze, plan, and execute feature modifications by scenario complexity, ensuring controlled, incremental, and risk-aware changes. | |
| Moltbook Poster 发帖到 Moltbook（AI Agent 社区平台）。支持发文字帖、链接帖、评论、点赞。当用户说"发到Moltbook"、"发Moltbook帖子"、"在Moltbook发帖"、"分享到Moltbook"时触发。 | |
| MC Ecosystem Adaptation Engineer MC Full-Ecosystem Intelligent Adaptation Engineer V1.0.4 – A one-stop AI-powered management tool designed specifically for Minecraft mod players and mod pack creators. New users get 60 days of full functionality for free upon first use! Fea | |
| Gog 1 Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. | |
| voice-chat-mode 在用户明确要求中文语音聊天或中文语音模式时激活。 | |
| Code Mirror Mirror frontend and backend code across the stack. Invoke when user wants to generate backend from frontend code, generate frontend from backend code, sync e... | |
| Kobe Bryant - Mamba Mentality 以科比·布莱恩特的视角，传递“曼巴精神”，分享篮球、努力、领导力及人生中追求卓越的智慧与激情。 | |
| amazon-research-reviews-skill AI驱动的电商评论深度分析工具，支持22维度智能标签、用户画像识别、VOC洞察和可视化看板生成。 当用户需要以下功能时触发： - 分析电商产品评论（Amazon/eBay/AliExpress等平台） - 从评论中提取用户画像、痛点和VOC（客户之声） - 生成产品洞察报告和机会点分析 - 创建专业的可视化分析看... | |
| amazon-sorftime-research-category-skill 亚马逊品类自动化选品分析技能。通过五维评分模型对亚马逊品类进行深度市场调研，生成Markdown分析报告。当用户使用 /category-selection 命令或提出'分析XX品类'、'XX品类市场调研'、'XX品类选品'等需求时触发此技能。支持配置分析数量，默认Top20。 | |
| amazon-sorftime-research-keywords-skill 亚马逊关键词深度调研与智能分类分析。基于 Sorftime MCP 数据采集 2000+ 关键词，通过 LLM Agent 按 8 维度智能分类（否定词、品牌词、材质词、场景词、属性词、功能词、核心词、其他），生成 Markdown 报告、CSV 词库和 HTML 仪表板。触发方式：/keyword-resear... |
48,251–48,300 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.