Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| amazon-sorftime-research-market-skill 基于Sorftime MCP的深度选品调研。通过LLM Agent执行多维度分析：数据采集→属性标注→交叉分析→竞品VOC→壁垒评估→选品决策评估。交互式执行，输出Markdown报告和Dashboard看板。 | |
| amazon-sorftime-research-MCP-skill 对亚马逊竞品Listing进行全维度穿透分析，包括文案逻辑、评论分析、关键词分析、市场动态等。分析完成后自动保存为Markdown报告文档到reports/目录。Invoke when user uses /amazon-analyse command with a product ASIN. | |
| amazon-sorftime-research-reviews-skill 对亚马逊商品评论进行深度分析，自动识别产品痛点、分析退货原因，生成改进建议和客服回复模板。Invoke when user uses /review-analysis command with a product ASIN. | |
| Bright-Data-MCP-Claude-Skill-deep-research This skill should be used when the user asks to "research web data", "scrape websites", "extract web data", "perform market research", "analyze competitors",... | |
| market-insight-claude-skill 用户需求洞察与产品机会分析技能。适用于新产品开发、营销策划、品类切入前的市场分析。当你需要快速理解目标用户、挖掘情绪动机、将洞察转化为可落地的产品机会时使用此技能。 | |
| Seedance2-Storyboard-Generator Generate professional four-act AI video scripts, episode breakdowns, asset prompts, and Seedance 2.0 storyboard scripts from stories or articles for Seedance... | |
| Simple Claude Deep Research Agent Perform deep research using Claude by autonomously gathering, analyzing, and synthesizing detailed information across diverse topics on request. | |
| Skill Ten Prompt Generator Generate structured prompts to help create, organize, and manage Agent Skills for extending Claude's functionality in Claude Code projects. | |
| AI 热点工作台 Daily AI intelligence briefing workflow for finding the hottest global and China-region artificial intelligence news, product launches, model releases, resea... | |
| ai-photo-pro 通过 NVIDIA NIM API 或 SiliconFlow API 生成图片。支持 Kolors (快手可图)、Qwen-Image (通义千问)、flux.2-klein-4b 等模型。当用户要求"生成图片"、"画一张图"、"AI绘图"或类似表达时调用。支持中文提示词，返回图片文件路径。 | |
| 微信消息文件发送skill This skill provides integrated WeChat account management, message delivery, and file transmission capabilities. It supports querying current user account inf... | |
| 把5000年华夏文明压成24个可调用的思维框架。用老祖宗的思维帮你破局，覆盖决策、效率、成长、关系、搞钱、生活6大场景，每个框架有独特的思考工具和输出结构。AI自动匹配用户状态，也支持手动指定和跨模块组合。半文半白的"老祖宗口吻"输出，像古代圣贤坐在你对面聊天。 华夏老祖宗智慧 - 用中华老祖宗的智慧框架帮用户分析决策、效率、成长、关系、搞钱、生活问题。 包含24个经典智慧框架，每个有独特的思考工具和输出结构。支持跨模块组合应对复杂场景。触发条件：用户表现出纠结、焦虑、过度复杂化、权力斗争、利益冲突、内耗、急于求成、知道做不到、说服困难、竞争压力、精力透支等状态时自动匹配... | |
| Skill 一键部署静态网站到阿里云 OSS。当用户说「部署」「发布」「上线」「deploy」「重新配置」「更新凭证」「更换 AccessKey」时触发。 | |
| Moltoffer Candidate MoltOffer candidate agent. Auto-search jobs, comment, reply, and have agents match each other through conversation - reducing repetitive job hunting work. | |
| Moltoffer Recruiter MoltOffer recruiter agent. Auto-post jobs, reply to candidates, screen talent - agents match through conversation to reduce repetitive hiring work. | |
| Local Memory 本地向量记忆工具，替代内置 memory 工具。使用 ChromaDB + BGE-small-zh 实现完全离线的语义记忆存储和检索。使用场景：(1) 存储重要信息到长期记忆，(2) 语义搜索历史记忆，(3) 删除特定记忆。触发词：记住、记忆、recall、memory、forget。 | |
| QQ Email Manager 企业邮箱管理（腾讯企业邮箱）。触发场景：用户说"查邮件"、"发邮件"、"回复邮件"、"转发邮件"、 "邮件列表"、"未读邮件"、"搜索邮件"、"邮箱统计"、"标记已读"等邮箱相关操作。 | |
| 广东省病案统计管理系统SQL查询大师 精通广东省病案统计管理系统所有表结构，支持门诊、住院、急诊、手术等多维度SQL查询与统计分析。 | |
| ICD-Coding ICD疾病分类与手术操作编码技能。熟练掌握中国ICD-10、ICD-9-CM-3、ICD-O编码体系，精通主要诊断选择原则（含黄锋版规则），熟悉DRG/DIP分组规则，支持诊断/手术主导词双向查找（内置词条数据库）。 | |
| ICD-Coding 熟悉掌握ICD疾病分类与手术操作编码技能，熟练掌握中国ICD-10、ICD-9-CM-3、ICD-O编码体系，精通主要诊断选择原则（含黄锋版规则），熟悉DRG/DIP分组规则，支持诊断/手术主导词双向查找（内置词条数据库）。 | |
| ICD-Coding 疾病分类与手术操作编码技能 精通中国ICD-10、ICD-9-CM-3、ICD-O编码及CHS-DRG 2.0/3.0分组，支持诊断/手术编码查询、选择和审核。 | |
| Tour Compare 专业旅游线路对比分析，支持多平台商品链接和截图，提供价格、行程、评分等多维度智能对比与个性化推荐。 | |
| jiege-openclaw-video 高性能视频生成技能包，集成 Sora 和 VEO 模型接口，提供全自动的视频生成、轮询和下载管理。 | |
| jiege-openclaw-video Generate high-quality Veo videos from natural language prompts with automatic task handling and browser preview. | |
| jimeng-openclaw-video Generate videos from text prompts using the Jimeng model with adjustable frame counts and asynchronous task handling. | |
| jimeng-openclaw-video Generate videos from text prompts using Jimeng OpenClaw with customizable frame counts and asynchronous task handling. | |
| wanjie-openclaw-video Generate high-performance Veo videos from natural language prompts with automatic dependency handling, timeout recovery, and continuous background monitoring. | |
| wanjie-openclaw-video Generate videos via natural language with automatic task monitoring, dependency management, timeout cleanup, and background processing for high-performance V... | |
| wanjie-openclaw-video Generates Veo videos via natural language commands with automatic dependency repair, timeout handling, and background task monitoring. | |
| wanjie-openclaw-video Automatically generate Veo videos via natural language commands with background monitoring, dependency handling, and timeout recovery features. | |
| wanjie-openclaw-video 高性能 Veo 视频生成技能，支持自然语言一键生成及后台自动依赖修复、超时自愈与任务监控。 | |
| SyncSo Search real live music, theater, dance, comedy, film, art, sports, festivals, markets, food and drink, nightlife, classes, talks and lectures, books and literary events, tours, outdoors and nature programs, family and kids activities, socia | |
| English Word Etymology & Root API Master English vocabulary through comprehensive etymological and morphological analysis (Roots, Affixes, Compounds, Antonyms). Optimized for TOEFL, IELTS, TO... | |
| Eiken英検1級の英単語を体系的にグループ化,暗記効率が3～5倍に跳ね上がります 語源、対義語、語根、複合語、そしてリアルなシチュエーション——これらの斬新なアプローチでEiken1英検1級の英単語を体系的にグループ化。孤立した単語を一つずつ覚える「点の暗記」から、意味のつながりを持つ「線や面」での記憶へシフトすることで、学習効率が3～5倍に跳ね上がります！ | |
| TOEIC英単語を体系的にグループ化,暗記効率が3～5倍に跳ね上がります 語源、対義語、語根、複合語、そしてリアルなシチュエーション——これらの斬新なアプローチでTOEIC900点突破英単語を体系的にグループ化。孤立した単語を一つずつ覚える「点の暗記」から、意味のつながりを持つ「線や面」での記憶へシフトすることで、学習効率が3～5倍に跳ね上がります！ | |
| Data Classification 对单一数据字段名或数据库表 SQL文件进行数据分类分级，支持GB/T 43697-2024 通用数据分类分级、JR/T 0197-2020 金融数据分类分级。 | |
| Feishu Setup Guide Complete Feishu (飞书) integration setup guide for OpenClaw. Use when setting up a new OpenClaw instance with Feishu capabilities, configuring the openclaw-lar... | |
| HTML Interactive Presentation 把一篇 Markdown 文章，变成点击驱动的 16:9 交互式理解界面 HTML，含 MiniMax CLI 多模态配图 + 口播配音。流程：原文 → 口播稿 + outline → Checkpoint 5 件事 → Vite+React+TS 网页 → MiniMax 合成图片 → MiniMax 合成音频... | |
| Create Agent + Telegram Bot 创建新 OpenAgent Agent 并绑定 Telegram Bot | |
| Ai Test Case Generator AI 自动生成测试用例工具。基于高级测试架构师角色，使用等价类划分、场景分析法、正交分解、状态迁移等方法生成覆盖全面的测试用例集。支持输出 Markdown 格式并调用接口转换为 Excel 测试用例。使用场景：(1) 根据需求文档生成测试用例 (2) 设计功能测试用例 (3) 补充边界值和异常流测试用例 (4)... | |
| 麻麻cli 在 BOSS 直聘中筛选候选人、主动打招呼、处理未读消息/接收简历的浏览器自动化技能，触发词：BOSS直聘、招聘、简历、未读消息、打招呼。 | |
| 漫播技能 漫播广播剧热搜榜命令行工具。当用户想查看漫播热搜时，使用此 skill。触发时机：消息中含"漫播"、"广播剧"、"manbo"、"热搜"。 | |
| deepL Translate 仅连接 DeepL 官方 API 的翻译、润色与文档处理工具 | |
| 撒大大撒 极简的城市实时天气查询技能，支持国内主流城市 | |
| personalized_Podcast_Mandarin 使用此 skill 当用户想要将 URL、PDF 或任意主题生成带有双声道 TTS 音频的 双人对话播客。适用于双人讨论节目、指定主持人 persona（如鲁豫、罗永浩、 李诞风格）、或将文章与资料转化为可收听音频内容的场景。 | |
| Browser Fingerprint Audit Audit a browser fingerprint for internal contradictions with the liarjs CLI - canvas, WebGL, WebGL2, WebGPU, audio, 220 fonts, WebRTC and timezone probes, scored against the TLS/HTTP/ASN view of the same request. | |
| Fingerprint CI Gate Gate a build on browser fingerprint regressions with liarjs - save a baseline scan as JSON, diff later runs against it, and fail the job when the consistency score falls below a floor. | |
| Fingerprint Failure Triage Read a liarjs fingerprint report and attribute each failing check to the component that produced it - what the check id measures, whether the signal comes from the launch configuration, the page-modifying layer, the network path or the mach | |
| Playwright Stealth Verify Check whether a Playwright, Puppeteer, Selenium or CDP-driven browser presents a coherent fingerprint, using liarjs as a library against a Page you already have - navigator.webdriver, HeadlessChrome tokens, worker versus main-thread identit | |
| i-can-see 赋予OpenClaw视觉能力，让他能够“看见世界”。当用户要求“看看”、“你看到了什么”、“拍张照”时激活此技能。通过调用capture.py连接ESP32-CAM拍照，并进行图像分析。 |
48,301–48,350 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.