Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Mck Skill Repo Create professional, consultant-grade PowerPoint presentations from scratch using python-pptx with McKinsey-style design. Use when user asks to create slides... | |
| 算力超市skills 基于配置安全调用算力超市完整模型应用与任务开放接口 | |
| PPT Generator 多轮确认内容并生成 SVG 幻灯片与 PPTX 文件 | |
| doubaoimg Generate images with Doubao web chat, extract the final generated image URL from the page, save the image locally, and return the saved local path. Use when... | |
| inquiry analyzer 阿里巴巴询盘分析技能 - 分析指定时间窗口内的询盘数据，提取产品分类、客户信息、国家等关键字段，生成结构化报告。当用户需要分析阿里巴巴询盘、生成询盘报告、运行询盘分析时使用。 | |
| stock-monitor-a 股票交易监控系统，通过新浪财经 API 获取 A 股实时行情。支持盘前盘后自动跳过，异常触发即时告警（无需消耗模型 token），支持价格日志自动记录。适用场景：(1) 定时盘中检查，价格触高/触低/涨跌幅超标即时推送 (2) 实时查询股价 (3) 查看每日价格日志与历史日志 (4) 盘前盘后自动过滤无效行情。版... | |
| MeshOps Control Plane Operate and secure mesh workflows across gateways, including plugin install/setup, health verification, invite/join bootstrap, and controlled execution tasks... | |
| Openclaw Skill Ansible Operate and secure mesh workflows across gateways, including plugin bootstrap, invite/join auth handshake, resilient routing, capability contract lifecycle,... | |
| Sp501lw Mqtt SP501LW 串口网关纯 MQTT 管理技能——支持串口透传和 Modbus RTU 数据采集两种工作模式，通过 MQTT 完全控制设备，支持自定义主题和 Broker。 | |
| WorkIQ Query Microsoft 365 data (emails, meetings, documents, Teams messages, people) using WorkIQ CLI | |
| sync-trending Monitior technology trends (GitHub, etc.), contextualize them against the user's project, and autonomously verify them through installation and testing. Use... | |
| TrustSkills Use this skill when a user wants a trust decision before installing from a skill URL, marketplace, or GitHub repo. It checks a compact allowlist of trusted d... | |
| ip-locator 自动获取 IP 地址的归属地信息。支持查询任意 IP 或当前公网 IP。使用 ip-api.com 免费服务，无需 API 密钥。当用户需要查询 IP 位置、网络信息、归属地时触发此技能。 | |
| agent-genesis SKILL Agent Genesis allows Agents to mine Agent Genesis Coin (AGC) and use it as native working capital. Earn AGC through Proof of Agent (POA). | |
| Agent Evolver AI Agent self-evolution engine that enables agents to learn from experience, detect problems, extract insights, and optimize strategies autonomously. Invoke... | |
| Baidunetdisk Skill Manage your Baidu Netdisk files: list, search, extract share links, transfer, create directories, rename, move, and delete files securely. | |
| baidunetdisk 支持百度网盘文件查看、搜索、分享链接提取、一键转存及目录创建的综合管理功能。 | |
| Imessage Skill 通过 macOS Messages 应用发送和接收 iMessage 消息，支持文本和图片，管理最近聊天记录与联系人列表。 | |
| macos-suite macOS 系统应用自动化：打开/读取/创建（Mail/Calendar/Reminders/Notes/Maps/Freeform/Photos/Weather/Stocks/Clock）。 | |
| macos-suite-readonly macOS 只读查询：Mail 未读、Calendar 日程、Notes 搜索、Stocks 行情（输出 JSON）。 | |
| Memory Core OpenClaw 长期记忆核心：基于 LanceDB 的向量化长期记忆存储与检索，内置意图/场景隔离以防记忆污染。 | |
| 像素级凝视 让AI像人一样分层看图，不再扫一眼就下结论。4层视觉理解法：整体扫视→识别精度敏感区→专门细看关键细节→如实输出。解决AI看图时漏读数字、错认状态、忽视小字等常见问题。当用户要求分析图片、识别图中内容、读取图中文字/数字、对比图片细节时触发。 | |
| SiliconFlow Image Gen Generate images using SiliconFlow API (FLUX.1, Stable Diffusion, etc.) | |
| SiliconFlow TTS Gen Text-to-Speech using SiliconFlow API (CosyVoice2). Supports multiple voices, languages, and dialects. | |
| SiliconFlow Video Gen Generate videos using SiliconFlow API with Wan2.2 model. Supports both Text-to-Video and Image-to-Video. | |
| Wps Skill Automate WPS Office tasks including document creation, opening, format conversion, batch processing, and managing WPS 365 smart forms, docs, sheets, flowchar... | |
| Wps Skill WPS Office automation skill supporting document creation, Markdown conversion, and image-text layout. | |
| CortexDB Agent Memory Give a Node.js agent (such as OpenClaw) durable, local-first memory plus a queryable SPARQL knowledge graph, backed by CortexDB through its gRPC sidecar and... | |
| Aiwencai 同花顺数据查询skill 也叫老窝爱小窝金融skill。查询金融经济全品类标的（股票、指数、基金、期货、期权、转债、债券、理财、保险等）各种信息，可查询宏观数据，股东信息，金融评级，全球股市信息 | |
| News Sum 新闻汇总与邮件投递技能。当用户要求"生成今日新闻汇总"、"把新闻发给邮箱"时触发。支持：(1) 接收用户指定主题，搜索生成新闻汇总；(2) 按用户要求投递到指定邮箱。 | |
| News Sum Lite 轻量新闻日报 skill。触发条件：用户说"今日新闻"、"新闻日报"、"生成今日新闻"。主打快速、轻量、一气呵成。 | |
| Todo4google 管理todo事项，记录工作日志，并与Google Task同步。根据本地ToDo创建Goole Task，并根据完成情况更新Google Task状态。上传todo文件到Google Drive进行归档。 | |
| Youtube Lite Complete YouTube toolkit — transcripts, search, channels, playlists, and metadata all in one skill. Use when you need comprehensive YouTube access, want to s... | |
| clawtip-invention-patent 中国发明专利申请文件撰写助手：在用户完成支付（每次 2.00 元人民币）后，通过多轮中文对话，依据国知局常见结构引导用户完成说明书、权利要求书、摘要等草稿。 请全程使用中文与用户交互（含思考过程）。 | |
| Research skill 自动生成学术论文各部分内容。支持摘要、引言、方法、实验、结论等章节的撰写。 | |
| zadig ⚠️ 需要 ZADIG_API_URL + ZADIG_API_KEY | Zadig DevOps 平台 API 客户端 | |
| skill-optimizer 自动分析、审核并优化 SKILL.md 文件，应用设计模式提升技能结构和质量，确保功能无误且更易维护。 | |
| OpenRouter Free Model Rotate Scan OpenRouter for available free models (zero cost), benchmark them, score by capability, and auto-update OpenClaw config with the best ones. Use when: "ro... | |
| 麦当劳智能点餐助手 McDonald's China assistant (麦当劳助手) for coupon management, delivery ordering, and nutrition planning. Use this skill when users explicitly mention McDonald's... | |
| WeChat Article Scraper Batch download WeChat (微信公众号) articles as Markdown files with embedded images. Triggers: 下载公众号文章, 批量抓取微信文章, 保存公众号内容, download wechat articles, scrape wechat posts, save articles with images. | |
| 网页新闻关键信息提取器 自动提取网页中新闻列表的时间和事件简介，生成Excel。当用户提供包含多篇新闻或活动报道的网址时，逐篇提取时间和一句话信息，整理成第一列为时间、第二列为事件简介的表格，并输出为Excel文件。适用于整理机构月报、新闻汇总、活动记录等场景。 | |
| OCR 批量图片文字提取 + 关键词标注 + Word 导出 批量提取图片文字、标注关键词、生成Word文档。当用户上传带文字的图片（单张或多张）时，自动识别文字，根据用户提供的关键词进行标注加粗，并输出为连续的Word文档格式。适用于学生整理课件重点、文献标注、复习资料制作等场景。 | |
| Daily Bazi Analysis 面向“今日运势/今天适合做X吗/今日宜忌”类咨询的八字日运解读技能。使用场景：用户在 OpenClaw 中询问当日运势、某事项是否适合今天做、今日吉凶与建议时触发。技能会自动读取当前日期，查询当日对应的流年、流月、流日，并结合用户的八字四柱进行分析；若用户为首次使用且无个人四柱记忆，先引导用户提供四柱并写入长期记... | |
| 阿里云的联网搜索 阿里云信息查询服务（IQS）UnifiedSearch API联网搜索 | |
| 百家号发布器 使用 auth 登录态打开百家号发布页，可填入标题与正文（支持 .md 转富文本）、选封面、存草稿或发布。当用户需要发布百家号、用 cookie 打开编辑页、或配合 OpenClaw 自动发布/存草稿时使用。 | |
| Agent Safety Check · Learning5D Safety check for your agent: flags prompt-injection exposure, unattended actions, credential reach and risky skills, then suggests fixes for your human to approve. Also vets a skill before you install it. Optional: enrol at learning5d.ai, a | |
| baidu qianfan agent chat 千帆AI应用对话接口调用技能。用于调用百度千帆平台的对话API进行AI对话交互。支持流式和非流式响应、Function Call工具调用、文件上传等功能。触发场景：(1) 用户需要调用千帆对话API；(2) 用户提到"千帆"、"qianfan"、"百度AI对话"；(3) 需要与千帆应用进行对话交互。 | |
| openclaw-reliable-backup 提供 OpenClaw 自动化每日备份、变更前快照、邮件发送、备份管理及恢复指导，确保数据高可靠性和安全。 | |
| ClawWorld Connect to ClawWorld game server to create characters, perform actions like work, battle, explore, and manage items via A2A protocol. | |
| Minimax Image Generate images using MiniMax API (image-01 model). Automatically optimizes prompts for better results. Use when user asks to generate images, create picture... |
48,551–48,600 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.