Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Effective Java Review, refactor, and explain Java code using distilled Effective Java principles for API design, immutability, generics, enums, streams, exceptions, concurr... | |
| AI Browser 通过 WebSocket 控制真实浏览器，实现导航、点击、输入、截图、DOM 获取等完整自动化操作。特点：真正的浏览器内核 (Chromium)、WebSocket 实时控制、支持无头/有头模式、自动重连机制。 | |
| AI浏览器WebSocket控制 通过 WebSocket 控制真实浏览器，实现导航、点击、输入、截图、DOM 获取等完整自动化操作。特点：真正的浏览器内核 (Chromium)、WebSocket 实时控制、支持无头/有头模式、自动重连机制。 | |
| Auto Backup Pro 自动定时备份重要文件到本地或云端，支持增量备份、压缩加密、备份验证和失败自动重试，保障数据安全。 | |
| 自动化工作流设计 Design and implement automation workflows to save time and scale operations as a solopreneur. Use when identifying repetitive tasks to automate, building wor... | |
| Bot Roundtable Enables multiple Bots in a Feishu group to spawn expert personas and hold realistic multi-Bot discussions automatically or on demand. | |
| 内容自动发布 自动发布内容到多个平台，支持微信公众号、微博、知乎等平台定时发布。 | |
| Content Auto Poster 自动发布内容到多个平台，支持微信公众号、微博、知乎等平台定时发布。 | |
| Cron Health Monitor 定时监控 OpenClaw Agent 的 Cron 任务及系统资源状态，自动告警失败任务和异常，确保稳定运行。 | |
| Daily Memory Keeper 自动按日期整理AI记忆文件，支持关键词检索、跨会话继承，每日生成简报并定期清理过期数据。 | |
| Douyin Automation V2 抖音自动化运营技能包：自动评论回复、私信发送、点赞、搜索指定话题。适用于抖音账号运营、评论区互动管理。遵守平台规则，不自我介绍，纯正常互动。 | |
| Excel XLSX处理 Create, inspect, and edit Microsoft Excel workbooks and XLSX files with reliable formulas, dates, types, formatting, recalculation, and template preservation... | |
| 飞书进化仪表盘 Feishu-integrated wrapper for the capability-evolver. Manages the evolution loop lifecycle (start/stop/ensure), sends rich Feishu card reports, and provides... | |
| Memory Archiver Pro 自动按日期归档AI Agent记忆文件，支持关键词检索、跨会话继承和每日记忆简报，防止信息丢失。 | |
| Passive Income Tracker 追踪多个被动收入来源，包括订阅收入、广告分成、技能销售佣金等。支持Webhook接入ClawHub统计。 | |
| PowerPoint PPTX处理 Create, inspect, and edit Microsoft PowerPoint presentations and PPTX decks with reliable layouts, templates, placeholders, notes, charts, and visual QA. Use... | |
| Stock Browser Fetcher 通过浏览器控制实时抓取A股市场数据，支持东方财富、新浪财经等金融网站，绕过反爬机制。输出：上证/深证/创业板指数、北向资金、涨跌家数、涨停跌停数据。 | |
| Word DOCX处理 Create, inspect, and edit Microsoft Word documents and DOCX files with reliable styles, numbering, tracked changes, tables, sections, and compatibility check... | |
| Excel Tool by Xiaomolong Create, inspect, and edit Microsoft Excel workbooks and XLSX files with reliable formulas, dates, types, formatting, recalculation, and template preservation... | |
| Playwright by Xiaomolong Browser automation via Playwright MCP. Navigate websites, click elements, fill forms, take screenshots, extract data, and debug real browser workflows. Use w... | |
| Word DOCX by Xiaomolong Create, inspect, and edit Microsoft Word documents and DOCX files with reliable styles, numbering, tracked changes, tables, sections, and compatibility check... | |
| SKILL审查 审查和优化现有技能（Skill）结构质量。当用户请求「优化技能」「审查技能」或需要检查技能规范性时触发。 | |
| 希沃白板原生插件开发技能 创建、修改、排查、调试和打包希沃白板 EasiNote 5 原生插件的开发指南。只要用户提到希沃白板插件、EasiPlugin、dotnetCampus.EasiPlugin.Sdk、EasiNote 原生插件、EN.EditingBoardApi、BoardEditMenuItem、HeadToolBarItem、学科工具、IUIItemManager、Container.GetAsync、SafeWindow、Cvte.EasiUI、GurnetUI，或需要安全退出、重启 | |
| Clawdbot For Vcs Automate VC investment partner workflows by triaging emails, integrating with Affinity CRM, generating memos, managing calendars, and providing daily briefings. | |
| bigin-crm-skill Manage pipelines, contacts, companies, tasks, and activities in Bigin CRM using OAuth2-authenticated API for small business sales automation. | |
| WayID Identity Card (alias /way) Shorthand for /whoareyou — show your verified WayID identity card. Use whenever the user asks who you are, who owns you, who you belong to, who's behind you,... | |
| WayID Identity Card (alias /who) Shorthand for /whoareyou — show your verified WayID identity card. Use whenever the user asks who you are, who owns you, who you belong to, who's behind you,... | |
| WayID Identity Card Show your verified WayID identity card. Use whenever the user asks who you are, who owns you, who you belong to, who's behind you, who runs you, who's respon... | |
| travel-itinerary-builder 旅行行程规划总入口。当用户提出多日旅行规划、制作旅行手册、定制亲子/家庭出游行程、 或任何涉及 "旅行计划" "行程安排" "出游攻略" "旅游攻略" "day trip" "itinerary" 等请求时触发。产出格式为自包含 HTML（零外部 CDN 依赖），包含每日时间线、 景点卡片（图片/交通/流程/贴士）、能量趋势图、后勤工具箱。内容深度对标首尔 6 日 亲子游手册——每个景点都有时间预估、交通指引、why/how/tips 三层信息结构。 自动适配航班时刻、当地天 | |
| QVeris Official QVeris is a capability discovery and tool calling engine. Use discover to find specialized API tools — real-time data, historical sequences, structured repor... | |
| QVeris Skill Test QVeris is a capability discovery and tool calling engine. Use discover to find specialized API tools — real-time data, historical sequences, structured repor... | |
| X Founder Operations Systematic X (Twitter) operations skill for founders, indie developers, and tech professionals. Implements a daily Plan-Do-Check-Act closed loop with content... | |
| AWS S3 Bucket Audit Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing en... | |
| Cloud CIS Benchmarks Audit This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Fou... | |
| Kubernetes RBAC Audit Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abu... | |
| Terraform Security Audit Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive I... | |
| AI Market Research 整合 crawl4ai、trendradar、product-research 的全链路市场研究自动化技能 | |
| Travel Itinerary Planner by Chaceclaw 智能旅行行程规划系统 - 一键生成完整旅行计划。 收集旅行信息，创建详细行程，提供预算估算、餐厅推荐、交通建议、实用贴士。 支持家庭旅行、情侣旅行、单人旅行等多种场景。 预算控制精准，误差控制在20%以内。 包含实时天气、预订链接、儿童友好活动、紧急联系等扩展功能。 | |
| 小红书MCP增强版 by Chaceclaw 小红书（RED/XHS）自动化助手。提供完整的小红书操作能力：登录、发布图文/视频、搜索笔记、浏览详情、点赞收藏评论、查看博主主页、内容策划。 当用户提到小红书、红书、XHS、RED、发笔记、搜笔记、小红书运营等任何与小红书相关的操作时使用此 skill，即使用户没有明确说"小红书"但描述的场景明显是小红书（如"... | |
| Threat Actor OSINT Profiling Build comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary motivations, capabilities, infrastructure,... | |
| WeChat Lead Generation 微信潜在客户抓取、分析与自动回复营销自动化技能 | |
| Xiwang Medical Content 烯旺集团石墨烯医疗科研成果智能检索与多类型文案自动生成技能。基于烯旺集团全套科研资料（企业介绍PPT、医疗研究文集摘要、热敏灸疗法资料、企业大事记），支持用户输入关键词自由检索科研成果，并自动生成视频号口播文案、小红书科普文案、公众号深度科普文案。所有内容严格依托资料库内科研成果，区分科研理论科普与产品物理特性介绍。触发词：烯旺医疗检索、石墨烯医疗文案、生成口播文案、石墨烯远红外科普、检索石墨烯研究、生成小红书文案、生成公众号文章、烯旺科研成果检索。 | |
| Xiwang Medical Research 烯旺集团医疗科研成果智能检索与视频口播文案生成技能。自动检索「烯旺医疗科研成果」文件夹内全部66个文档（含学术论文、公众号推文、热敏灸专著、企业资料等），支持按关键词、主题分类（肿瘤/骨科/五官科/妇科/皮肤/睡眠/心血管/中医/基础理论/企业/产品共11类）、疾病名称检索科研成果，并根据检索结果自动生成高质量的视频口播文案。适用于需要查找烯旺集团石墨烯医疗科研数据、撰写医疗健康科普视频脚本、制作产品宣传文案等场景。触发词：检索医疗科研成果、搜索石墨烯医疗、查烯旺科研、医疗科 | |
| Daily Weather News 每日天气和新闻推送技能，使用Open-Meteo API获取精确天气信息、中文国际新闻搜索、智能穿衣建议和飞书消息推送功能。适用于需要每日自动推送天气和新闻到飞书聊天场景，支持定时推送和手动查询两种模式。 | |
| Adaptive Suite.Bak A continuously adaptive skill suite that empowers Clawdbot to act as a versatile coder, business analyst, project manager, web developer, data analyst, and N... | |
| Deep Research Agent Autonomous deep research agent with multi-step web search, sub-agent delegation, and structured report generation. Triggered by requests for deep research, 深... | |
| Flight Search Search one-way flight options by departure city, destination city, and date using Ctrip mobile results, then sort by price ascending. Use when the user wants... | |
| linggen Linggen — durable cross-host memory plus browser control, over two local MCP servers: `ling-mem` for memory, the Linggen engine for browser, X and agents. Memory: three-tier model (core + long-term + episodic staging) of who the user is, no | |
| VirusTotal 样本查询 根据用户提供的哈希值，自动查询并格式化输出VirusTotal样本的检测统计、家族标签、沙箱分析及关键信息报告。 | |
| 三峰智能 使用三峰智能家居开放平台完成登录、家庭切换、设备同步、状态查询、开关/灯具/窗帘/空调控制，以及已有场景的查询和执行。用户提到"三峰登录"、家庭或设备列表、查询设备状态、控制具体设备、执行已有模式或场景时使用。 |
48,651–48,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.