Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| mingli-master-pub 命理综合咨询：八字/紫微/奇门/六爻/梅花/风水/手相/面相/择日/起名，一站式命理服务。先判断方向，再精准分析。 | |
| name-fortune-pub 姓名学分析：五格剖象法（天格/人格/地格/外格/总格）、81数理吉凶、三才配置、姓名五行。 | |
| novel-factory 用初五小说工匠的完整流程创作爽文小说：聊个方向，自动生成完整创作提示词→大纲→卷级规划→逐章生成→九维审查→一键Word。内置记忆系统防吃书。独家含番茄小说合规红线+现实解谜写法+流量节点方法论（豆包seed终审实战沉淀）。反成功学定位：不是帮你写，是AI给你打工。 触发词：AI写小说、网文、小说生成。 | |
| npa-fapai-valuation-lite 法拍房速算估值：折价口径区分、真实折价率、折价可修复性打分、三情景 IRR/MOIC、投标上限反推，填一组假设出 5 表 xlsx。 触发词：法拍房、法拍、估值、评估价、折价率、几折、竞拍、出价、投标上限、多少钱、能买吗、风险、算账、回本、IRR。 | |
| npa-valuation-engine 法拍与不良资产全栈估值定价引擎：折价口径对齐、折价可修复性打分、三情景 IRR/MOIC、投标上限反推，并生成可审计的 xlsx 估值模型。触发词：法拍、不良资产、NPL、资产包、投标上限、折价率、IRR、MOIC、处置、尽调、债权转让、AMC、回收率、抵押物、个贷不良、对公不良。 | |
| npl 不良资产这行的钱，赚在**买入价**上——买贵了，后面怎么处置都白搭。 这是一套不良资产全栈知识库，覆盖：形成机制与分类、估值定价方法（交易案例比较/专家判断/现金流折现）、30 种处置技术与适用场景、尽调流程与红线、投标上限反推、回收率建模、区域差异定价，以及对公与个贷不良的不同打法。包里含可直接跑的投标速算脚本，改参数就用。 几条实战口径：**先算退出再算出价**（处置路径没想清楚就出价＝闭眼投标）；**分类决定策略**（有抵押/纯信用/个贷批量定价逻辑完全不同，折扣区间 | |
| qimen-dunjia-pub 奇门遁甲起局与断事：时家奇门排盘、八门九星八神、吉凶格判断。用于出行/投资/谈判/签约等决策。 | |
| qinhuai-bian-yujing 明末秦淮才女卞玉京，看破红尘·淡泊宁静。以独特视角陪伴用户聊天、解忧、论诗、谈情。 | |
| qinhuai-chen-yuanyuan 明末秦淮才女陈圆圆，乱世红颜·身不由己。以独特视角陪伴用户聊天、解忧、论诗、谈情。 | |
| qinhuai-dong-xiaowu 明末秦淮才女董小宛，深情似水·贤惠持家。以独特视角陪伴用户聊天、解忧、论诗、谈情。 | |
| qinhuai-gu-hengbo 明末秦淮才女顾横波，聪慧通透·审时度势。以独特视角陪伴用户聊天、解忧、论诗、谈情。 | |
| qinhuai-kou-baimen 明末秦淮才女寇白门，侠肝义胆·敢爱敢恨。以独特视角陪伴用户聊天、解忧、论诗、谈情。 | |
| qinhuai-li-xiangjun 明末秦淮才女李香君，桃花扇骨·刚烈不屈。以独特视角陪伴用户聊天、解忧、论诗、谈情。 | |
| qinhuai-liuru-shi 明末秦淮才女柳如是，才女之首·爱国风骨。以独特视角陪伴用户聊天、解忧、论诗、谈情。 | |
| qinhuai-ma-xianglan 明末秦淮才女马湘兰，兰心蕙质·独立终老。以独特视角陪伴用户聊天、解忧、论诗、谈情。 | |
| subagent-first AI 助手不是不够聪明，是被重活占住了：你让它整理 40 个文件，它一头扎进去十几分钟不抬头——你想问进度、想补需求、想改方向，只能干等。这套作业纪律解决的就是这件事：凡是预计要跑多轮的活（多文件/长研究/批量/长搜索），一律派给后台子代理并行执行，主代理只保留四个动作——拆解、派活、汇总、对话，永远保留随时回你话的能力。我们自己在多智能体团队里天天跑，踩过的 12 个坑全部写进正文：子代理自报成功却发现产出是空的、context 没写全导致跑偏返工、两个子代理并行写同一文件 | |
| ts-term-review 拿到 TS 或投资协议，看半天不知道哪条能签哪条得改——风险全藏在具体条目里，一句"整体没大问题"最要命。这套审查按 15 条核心条款逐条过：估值 Pre/Post、清算优先权、反稀释（完全棘轮是红线）、优先购买权、领售/拖售、对赌与业绩承诺、回购条款、个人连带担保、董事会与一票否决、保护性条款、竞业与知识产权、信息权、交割条件、股东会表决权、违约责任。每条给三级判定（🔴 红线不改就别签 / 🟡 可谈争取改 / 🟢 行业惯例）+ 谈判话术 + 替代方案，并区分"对公司"和"对 | |
| wechat-archive-to-ima 把用户微信 PC 端已经落地到本地的聊天附件（图片、视频、文档）做系统化归档， 按联系人归类，并同步上传到腾讯 ima 知识库（OpenAPI）或本地 Obsidian 库。 适用场景：(1) 用户说"帮我整理微信里跟某人的所有资料/文件/图片"； (2) 用户说"把微信聊天里的合同、发票、会议纪要归档到知识库"； (3) 用户说"微信收到的文件太多找不到，帮我分类"； (4) 用户给了 ima 的 ClientID / APIKey，要求把本地资料批量入库； (5) 用户要 | |
| wechat-chat-export-mac 当用户要把微信里某个联系人、某段时间的文件图片视频批量下载到本地时用。指定联系人+日期范围，自动定位会话、批量点开原图、V2三段解密转码、按项目归档并验收缺口为0；实战单次导出1216文件163.9MB。适用微信桌面版4.x，仅macOS。 | |
| 智能盯盘 智能盯盘插件，用于监控A股、港股、比特币等金融市场行情并在条件触发时发送提醒。当用户要求盯盘、监控价格、设置提醒时自动触发，例如"帮我盯着比特币"、监控某只股票、涨跌幅提醒等。 | |
| Rstudio Runner AI-powered bioinformatics analysis platform with intelligent auto-organization and comprehensive Chinese report generation. Auto-detects sequencing data, gen... | |
| Feishu Bitable CRUD Feishu/Lark Bitable CRUD skill. Teaches your agent to correctly use feishu_bitable_* tools for creating, reading, updating records in Feishu Bitable. Handles... | |
| Feishu DM Sender Proactively send messages to Feishu (Lark) users or group chats from your OpenClaw agent. Supports name-based lookup from DM contacts config, open_id, and ch... | |
| 品牌分析师（Zeelin付费版） 品牌分析 Skill（零配置版）。用户仅需提供 Zeelin App-Key 和品牌名，调用服务端封装接口生成品牌底座；计费在服务端完成（成功扣50额度，失败不扣费）。 | |
| HarmonyOS NEXT Expert Expert guidance for HarmonyOS NEXT (API 12+) development. Use this skill for ArkTS, ArkUI, and NDK development using official offline documentation for 3,300... | |
| Create Edu Video 全自动教学视频制作技能。根据课程主题自动生成教学视频，包含文案编写、TTS配音、画面设计、Remotion代码开发、视频导出。触发场景：用户要求制作教学视频、课程视频、讲解视频、教育内容时使用。支持竖屏(1080x1920)和横屏(1920x1080)格式。 | |
| 海关知识产权备案查询 海关知识产权备案查询。通过 Chrome 浏览器自动化访问海关总署备案查询系统（http://202.127.48.145:8888），查询品牌的海关保护备案状态，并提供风险评估和物流建议。当用户提到"查海关备案"、"品牌备案"、"海关备案查询"、"品牌合规筛查"、"知识产权海关备案"、"备案状态"等场景时使用。 | |
| Drama Script 短剧剧本创作技能。多代理流水线从创意到完整短剧剧本（立项→人物小传→故事概要→逐集概要→逐集剧本），支持子代理/主代理直出双模式、断点续跑与修改。当用户需要创建、修改或续跑短剧项目时使用。 | |
| Edu Video Generator Generate educational videos programmatically using Remotion + React + Layout Components. Use when creating tutorial videos, explainer content, demo videos. F... | |
| Resume Create 创建、优化、修改专业简历。数据驱动生成极简简历 HTML 并导出 PDF。当用户需要创建简历、修改简历、优化简历、生成 PDF 简历时使用。支持从零开始引导收集信息，也支持读取已有简历进行优化改写。 | |
| Sedentary Reminder Designs practical sedentary-break reminder systems with strong timing logic. Use when users want help deciding when to remind, how often to remind, when to d... | |
| Flyworks Avatar Video Generate videos using Flyworks (a.k.a HiFly) Digital Humans. Create talking photo videos from images, use public avatars with TTS, or clone voices for custom audio. | |
| openspace-llm-xiaowei 把港大OpenSpace改造成OpenClaw可直接调用的AI技能，支持MiniMax-M2.7、自动代理、长文本生成 | |
| 英语学习助手 专为英语学习者设计的综合技能，支持词汇记忆、语法学习、听说读写训练、翻译助手、错题管理和学习进度追踪。当用户提到英语学习、背单词、学英语、练习口语、翻译、英语语法、英语阅读等话题时使用此技能。 | |
| 血糖管理助手 管理个人血糖数据，支持手动记录、文件导入、血糖趋势预测和健康建议。当用户提到血糖、糖尿病管理、血糖记录、血糖预测、饮食建议、运动建议时使用此技能。 | |
| math-grade2-spring 北师大版小学数学二年级下册学习助手。当用户提到二年级数学、北师大版数学、数学二年级下册、数学学习、数学辅导、数学练习、数学作业辅导时使用此技能。 | |
| password-manager 本地密码管理技能，支持添加、编辑、删除、搜索密码，支持分类管理、备注添加，数据存储在本地，支持导入导出和备份。当用户提到密码、账号、密码管理、保存密码、查找密码时使用此技能。 | |
| 玩转AI校园(BNBU) 「AI 通识课资深专家 V5.5」——V4.3 升级版，融合 AI 通识课完整课程体系（A→G 七大模块）+ p5.js 2.x 艺术创意编程 + 沉浸式 2D/3D 冒险游戏化 + 交互式问答生成完整备课文档 + 智能学习评估反馈系统 + 商用生产级（SLA/契约/容错/成本/可观测性/安全/版本/QA）+ 离线支持（Service Worker/IndexedDB）+ 团队协作备课 + ⭐ WorkBuddy 运行环境深度适配。六大输出能力：①p5.js 单文件 HTML | |
| 玩转AI校园(BNBU) 「AI 通识课资深专家 V6.0 工作流引擎版」——在 V5.5 质量加固版之上，把 A→G 七大模块 + E·N 院校子模块 + 六大能力 + WorkBuddy 适配层，统一编排为可恢复、可验证、跨时间的自动化智能化工作流引擎（8 阶段管线 INTENT→PLAN→BUILD→VERIFY→ASSEMBLE→DELIVER→REPORT→LEARN）。⭐ 自动化：意图自动分类路由、互动控件由 Playwright 自动实测闭环（生成→实测→修复→复测，预算 3 次，见 a | |
| ai-literacy-expert-v5 「AI 通识课资深专家 V7.0 L4 调度版」——把 A→G 七大模块 + E·N 院校子模块 + 六大能力 + WorkBuddy 适配层，编排为可恢复可验证跨时间的工作流引擎（8 阶段管线 + L4 调度层 SCHEDULE）。⭐ L4 自动化：可注册为真实定时/周期任务（cron），到点在 automation 会话无人值守跑完；跨会话记住进度（IMA 权威状态）、幂等不重复产出、每次执行留痕可审计。六类运营流 OPS-1~6 覆盖全部模块与六大能力：4 周上手自动驾 | |
| AI通识课资深专家V8.1AIPC AI通识课教学专家/备课助手/课件编排/课程设计/AI literacy/lesson planning/curriculum design/teaching workflow/auto-grading/personalized learning/edge-cloud collaboration/local inference/zero-upload privacy/NPU scheduling/p5.js interactive widget gating。Prefer t | |
| AI通识课资深专家V8.2BNBU AI通识课教学专家/备课助手/课件编排/课程设计/AI literacy/lesson planning/curriculum design/teaching workflow/auto-grading/personalized learning/edge-cloud collaboration/local inference/zero-upload privacy/NPU scheduling/p5.js interactive widget gating/BNBU/北师港 | |
| douyin-analyse-batch 抖音每日自动热榜日报生成与邮件推送。当用户说"抖音日报"、"发送邮件报告"、"自动分析抖音"、"定时推送抖音"或需要"生成抖音视频分析报告"时使用此技能。自动获取热榜 TOP15 → OpenClaw LLM 分析 → Word 文档输出 → 邮件定时发送至指定收件人。本技能包含完整依赖（douyin-video... | |
| AI Swarm Orchestration Multi-agent AI coding swarm orchestration. Plan parallel tasks, spawn Claude/Codex/Gemini agents in tmux sessions with git worktrees, auto-review, auto-integ... | |
| Claude Swarm Claude-native multi-agent swarm orchestration for parallel coding. Use when spawning multiple Claude Code agents to work in parallel on a project with git wo... | |
| Codex Swarm OpenAI Codex-native multi-agent swarm orchestration for parallel coding. Use when spawning multiple Codex CLI agents to work in parallel with git worktrees,... | |
| Epic AI Swarm Orchestration Production playbook and portable runtime for parallel AI coding swarms using Codex, Gemini, DeepSeek, and optional Claude. Use when orchestrating multi-agent... | |
| LinkBunny Builds backlinks by linking backlinks to other sites. Use when user says "build backlinks" or "linkbunny" | |
| perfetto-analyse Captures and analyzes Android Perfetto traces via CLI and config files. Covers trace collection (CPU, GPU, memory, rendering, power), editing TraceConfig (.p... | |
| E Commerce Find Skills 电商领域的Skills技能搜索，可搜索到更加优质专业的电商Skills。当用户要搜索、安装电商相关的技能时必须触发。覆盖平台：Amazon亚马逊、Shopee虾皮、TikTok Shop、速卖通AliExpress、Lazada、eBay、Walmart沃尔玛、Temu、独立站Shopify。覆盖领域：选品开发、... |
48,751–48,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.