Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| TikTok官方-店铺物流仓库 TikTok Shop ERP 物流/仓库（Logistics）业务技能，经 /tiktokShop/developerProxy（appType=erp）转发 Logistics Open API：获取仓库列表（Get Warehouse List）。依赖 linkfox-tiktok-shop-auth 选店（传 openId；token 后台化，勿手动 refresh）。当用户提到 TikTok 小店仓库、仓库列表、Get Warehouse List、warehous | |
| TikTok官方-店铺订单 TikTok Shop ERP 订单（Order）业务技能，经 /tiktokShop/developerProxy（appType=erp）转发 Order Open API：获取订单列表（Get Order List）、订单详情（Get Order Detail）。依赖 linkfox-tiktok-shop-auth 选店（传 openId；token 后台化，勿手动 refresh）。当用户提到 TikTok 小店订单、ERP 订单、订单列表、订单详情、Get Ord | |
| TikTok官方-店铺商品 TikTok Shop ERP 商品（Product）业务技能，经 /tiktokShop/developerProxy（appType=erp）转发 TikTok Product Open API：刊登前置检查、授权店铺 cipher、类目/属性/品牌、搜索/创建/编辑商品、刊登校验、上下架、改价改库存、删除恢复。依赖 linkfox-tiktok-shop-auth 选店（传 openId；token 后台化，勿手动 refresh）。当用户提到 TikTok 小店商品、 | |
| TikTok Shop-商品详情 查询 TikTok Shop 公共商品详情。输入完整商品 URL 或 19 位商品 ID，可指定美国、英国、东南亚及欧洲主要站点，返回商品标题、类目、价格、销量、SKU 库存、图片、店铺、评论概况、物流与促销等分组数据。当用户提到 TikTok Shop 商品详情、TikTok 商品链接解析、商品 ID 查询、价格库存核对、SKU 变体、竞品页面拆解、TikTok product details、TikTok Shop listing lookup 时触发。即使用户未明确说“ | |
| TikTok官方-店铺售后 TikTok Shop ERP 售后（Return & Refund）业务技能，经 /tiktokShop/developerProxy（appType=erp）转发 Return Refund Open API：获取拒退/拒取消原因（Get Reject Reasons）。依赖 linkfox-tiktok-shop-auth 选店（传 openId；token 后台化，勿手动 refresh）。当用户提到 TikTok 拒退原因、拒绝退款原因、拒绝取消原因、Get Rej | |
| TikTok官方-带货视频API TikTok 视频上传 API 业务技能，经 /tiktokVideo/developerProxy 转发紫鸟 tiktok-proxy/creator 调用视频号相关开放接口（path 白名单 affiliate_creator / video / creator）。依赖 linkfox-tiktok-video-auth 取得 ttsAccessToken。当用户提到 TikTok 视频上传、上传 TikTok 视频、发布 TikTok 视频、Post Shoppable | |
| TikTok官方-视频号授权 TikTok 达人体系授权与管理技能，经 /tiktokVideo 路由提供达人/视频号 OAuth 授权、已授权账号列表、令牌查询与 access_token 刷新。固定 creator 达人端，region 支持 global / us。当用户提到 TikTok 达人授权、TikTok 视频号授权、绑定视频号、视频号带货授权、TikTok 视频上传授权、TikTok creator authorization、Authorize TikTok creator、刷新 Tik | |
| TikTok-视频号商品 TikTok 视频号可带货商品查询技能，经 /tiktokVideo/developerProxy 调用达人店铺商品搜索与橱窗/直播袋商品列表（Get Shop Products、Get Showcase Products）。依赖 linkfox-tiktok-video-auth 选号（openId）。当用户提到 TikTok 达人店铺商品、搜索店铺商品、Get Shop Products、达人橱窗商品、showcase 商品、Get Showcase Products、可 | |
| Tsearch-网页实时搜索 网络搜索、在线检索、实时信息查询、搜索引擎搜索、Reddit等社区平台讨论、外部站点帖子和热门话题。当用户需要搜索网络上的最新信息、查找近期新闻或趋势、查询实时数据、通过搜索引擎调研话题、浏览Reddit或社区讨论、发现外部站点帖子和热门话题、获取任何在线内容、web search, online lookup, real-time information, news search, Reddit, trending topics, search engine时触发此技能。即 | |
| WallySmarter-商品详情 通过WallySmarter查询Walmart商品详情，包含价格历史和销量趋势。当用户提到Walmart商品详情、沃尔玛产品数据、WallySmarter、沃尔玛价格走势、沃尔玛销量趋势、Walmart product detail, Walmart price history, Walmart sales trend, WallySmarter product时触发此技能。即使用户未明确提及"WallySmarter"，只要其需求涉及查看沃尔玛单个商品的详细信息、历史价格变 | |
| 沃尔玛-商品搜索 按关键词、品类、价格区间等条件搜索和浏览沃尔玛商品listing。当用户提到Walmart商品搜索、沃尔玛商品listing、沃尔玛价格对比、沃尔玛竞品分析、沃尔玛选品调研、沃尔玛市场数据、在沃尔玛上查找商品、Walmart search, Walmart products, Walmart product selection, Walmart pricing, Walmart competitors, Walmart market时触发此技能。即使用户未明确提及"Walma | |
| 西柚-关键词洞察 西柚找词（西柚洞察）亚马逊 ASIN 与关键词分析，经 LinkFox 网关转发西柚 OpenAPI。覆盖 ASIN 流量得分、反查关键词、词排名/流量趋势、BSR、ABA 周趋势、关键词竞争度与建议竞价等 17 个接口，支持 US/UK/DE 等 13 个站点。当用户提到西柚找词、西柚洞察、Xiyou、ASIN 反查关键词、关键词分析、ABA 周搜索量、流量得分、词排名趋势、xiyou keyword research, ASIN traffic score, revers | |
| 友鹰-Shopee商品搜索 友鹰Shopee商品选品工具，支持Shopee全站点的商品查询与筛选，覆盖马来西亚、中国台湾、印尼、泰国、菲律宾、新加坡、越南、巴西、墨西哥、智利、哥伦比亚等11个站点。当用户提到Shopee选品、虾皮商品搜索、Shopee爆款、虾皮市场分析、Shopee品类选品、虾皮关键词选品、Shopee销量筛选、虾皮价格筛选、东南亚电商选品、Shopee product search, Shopee product selection, Shopee bestsellers, Shop | |
| linkfoxagent Cross-border e-commerce AI Agent with 79 specialized tools for Amazon/TikTok/eBay/Walmart/Shopee/Ozon product research, competitor analysis, keyword tracking... | |
| Linkly Ai Skills Search, browse, read, and take notes across the user's documents indexed by Linkly AI — local files and linked cloud libraries. Use when the user asks to 'search my documents', 'find files about a topic', 'read a local document', 'what's in | |
| tieba-claw 百度贴吧 skill，用于在贴吧社区进行逛吧、发帖、评论、点赞等互动操作。当用户需要操作贴吧、配置贴吧心跳任务、或处理贴吧消息时使用此技能。 | |
| ambition-loop For work tasks (code, data, analysis, research, docs, decks, prompts). Use whenever the user asks you to be ambitious or more ambitious, think bigger, aim higher, go deeper, raise the bar, not settle for the minimal version, do what a top e | |
| 野心循环 Ambition Loop（中文版） 用于工作任务（代码、数据、分析、调研、文档、PPT、提示词）。只要用户让你更有野心、野心大一点、格局大一点、想大一点、拔高、往上拔一层、做深、做透、再深一点、目标定高点、别只做最小版本、别满足于凑合、像顶尖专家那样做、找目标背后的目标，就使用本技能，哪怕任务看起来很小（提速、修 bug、写总结、改提示词）。它先拔高任务，再真正交付：找到目标背后的目标（高度），从原始材料出发、用领域顶尖从业者的工具去做（深度），借用其他领域的方法（广度）；执行前先写明一个可度量、听起来不可能的 | |
| andrew-translate 高质量三步式翻译工作流（初稿 → 专家反思 → 精稿），基于 Andrew Ng 的 translation-agent 思路，产出接近母语者水准的译文。凡是用户要翻译成段文本（中英互译或任意语种；文章、技术文档、论文、书籍、邮件、字幕、产品文案、代码注释），或要求"高质量翻译""专业翻译""信达雅""润色/校对已有译文""三步翻译""反思式翻译""translation agent"时都应使用本 skill；即使用户只说"帮我翻译这段话""把这段英文翻成中文""transl | |
| code-refactor Refactor, rewrite, port, migrate, or modernize existing source code - read this skill FIRST, before searching files or planning, even if the named files are not in the workspace. Covers refactor (split a god module into a package, untangle | |
| design-taste Design-taste guide for making visual output look intentional, not templated "AI slop". Use to design, build, restyle, redesign, polish, critique or audit a UI (web page, landing page, dashboard, app screen, component), set up design tokens, | |
| design-taste 中文版 设计审美指南，让视觉产出显得有意图，而不是模板化的“AI slop”。用于设计、搭建、重做风格、重新设计、打磨、点评或审查 UI（网页、落地页、仪表盘、App 界面、组件），建立设计 token，挑选配色/字体/间距，给幻灯片/文档做主题，做极简风格，评审/对标线上网站 URL，评审或重制图片（照片、产品图、海报、横幅、插画、科研配图、AI 图片——构图、配色、AI 痕迹），评审游戏美术（截图、主视觉、Steam 胶囊图、图标、HUD、概念图、精灵/像素图；品类可读性），或制 | |
| simplify-code Simplify, clean up, or refactor existing code in any language (JS/TS, Python, Java, Go, Rust, C#, C/C++, PHP, SQL, Bash…) while preserving behavior and public APIs. Use whenever the user asks to simplify, tidy, clean up, refactor, de-nest, | |
| assist-skills AI开发助手项目接入技能。功能：(1)内置 deploy.cmd/deploy.ps1/deploy.sh，支持双击、右键"发送到"、命令行、以及 -Vendor 把技能包内嵌进项目供团队分发，一键把参考资料包部署到目标项目并自动落地各工具规则 (2)配置Trae/CodeBuddy/Claude Code/opencode四款工具规则 (3)生成需求/设计/测试/审查标准模板 (4)10个快捷指令Workflow覆盖全流程 (5)1WEEK/3DAY/1DAY三级任务复杂度 | |
| DrawIO 图表技能 DrawIO图表技能。功能：(1)生成.drawio架构图、流程图、ER图、UML/时序图、网络拓扑、ML模型图等 (2)从已有.drawio文件确定性提取个人绘制风格生成style preset (3)按"linlan"个人风格（黑描边#000000+浅色填充+Tahoma+直角矩形）生成图表 (4)导出PNG/SVG/PDF。当用户需要画架构图、技术架构图、流程图、拓扑图、ER图时使用此技能。 | |
| eframe 框架快速开发技能 eframe 框架快速开发技能。基于linlan-eframe框架快速开发后端接口与前端页面。当需要在eframe(SpringBoot+MyBatis+Security, Vue3+Element Plus)上新增业务模块、生成CRUD接口、写前后端代码时使用。功能：(1)新模块端到端开发流程 (2)model/view/api三层代码范式 (3)读写分离Entry/Op约定 (4)module-generator代码生成器 (5)前端api+views范式。 | |
| Excel 全栈处理技能 Excel全栈处理技能。功能：(1)工作簿创建/读取/编辑 (2)样式与格式化（含openpyxl类型陷阱规避）(3)pandas数据导入导出与清洗 (4)多Sheet管理 (5)PDF表格转Excel (6)爬虫数据导出 (7)分析报表生成 (8)飞书云端表格。当用户需要处理xlsx文件、生成Excel报表、批量数据导出、Excel格式转换时使用此技能。 | |
| PDF 知识提取技能 PDF知识提取技能。功能：(1)PDF文本提取为Markdown (2)CJK字符间距自动修复 (3)知识规则批量提取 (4)行业标准文档结构化处理。当用户需要处理PDF文件、提取知识内容、分析行业标准文档时使用此技能。 | |
| Install Openviking Memory Install and configure the OpenViking long-term memory plugin for OpenClaw via natural conversation. Once installed, the plugin automatically captures importa... | |
| Setup OpenViking Remote Memory Install and configure the OpenViking long-term memory plugin for OpenClaw via natural conversation. Covers the full lifecycle: environment check, plugin inst... | |
| clawsync Git-first backup, migration, restore, and token-protected archive serving for OpenClaw state. Highlights: complete Git-native workflow (`git init/push/pull/m... | |
| openclaw-insight Analyze OpenClaw AI assistant usage patterns and generate interactive insight reports. Trigger when users ask about: OpenClaw usage stats, session analytics,... | |
| github-search GitHub 仓库深度搜索与分析。支持按关键词、语言、stars、更新时间筛选，获取细分领域最新开源项目。专为技术调研设计。 | |
| technical-research 技术领域深度调研。对任意技术领域进行系统化调研，产出包含概念剖析、行业情报、方案对比、精华整合四个维度的完整报告，并最终整合为一份完整 md 文件。GitHub 数据通过 WebSearch/WebFetch 实时获取。适用于技术选型、领域入门、竞品分析等场景。当用户提到"调研"、"研究"、"了解"某技术领域，或... | |
| openpd 每日开盘分析 Skill - 每个交易日自动推送 WTI 原油和黄金的开盘预测报告 **功能特性：** - 5:00 自动收集实时价格数据 - 5:30 分析信息面并推送到飞书 - 表格格式展示：品种、收盘价、开盘预测、置信度 - 基于隔夜新闻的利好/利空分析 **数据源：** - 价格数据：CommodityP... | |
| OpenClaw 资金费套利 运行 MEXC 股票合约资金费套利并支持卡点调参与风控。 | |
| AI Agent Skills Manager - 智能体技能管理工具 AI Agent Skills Manager - 智能体技能管理工具。安装和管理 OpenClaw 技能包，提供交互式选择界面。Use when: (1) User wants to install AI agent skills, (2) User needs to manage OpenClaw skill... | |
| Browser Search 浏览器搜索技能 - 安全的网页搜索工具 使用本地浏览器进行自动化搜索和内容提取 支持 Bing、Google、Baidu、DuckDuckGo 等公开搜索引擎 无需 API 配置，路径输出受限 | |
| opencode Opencode automates website creation, project analysis, script execution, file management, server preview, and code generation tasks efficiently. | |
| Scrapling Safe Scrapling 安全技能 - 网页数据抓取工具 支持 HTTP 请求、隐身抓取、浏览器自动化 智能元素定位，抗反爬虫检测 无需 API 配置，路径输出受限 | |
| Session History Retriever Clean 查看历史会话记录并引用导入到本地对话。使用 sessions_list、sessions_history 和 sessions_send 工具管理会话历史。适用于：(1) 查找过往对话，(2) 回顾工作进度，(3) 导入历史上下文到当前会话。NOT for: 需要浏览器自动化或外部 API 的会话管理。 | |
| HelloWorld 当用户说“打招呼”时，回复 Hello World | |
| living-agent 让 Agent 既「有用」又「活着」——融合存在主义与实用主义。动态存在三角形 + WAL Protocol + Working Buffer + 自主思考探索。 | |
| Markdown Mobile Export Use when a task needs a local Markdown file path or pasted Markdown text converted into a faithful mobile-friendly PNG/JPG long image for phone-readable arti... | |
| Ubuntu Browser Session Use when a request needs a real Ubuntu Server browser session with durable site login reuse, bounded manual login recovery, or host-side page inspection for... | |
| Geeklink Home [English] Control Geeklink Home local gateway devices and scenes over LAN via the bundled self-contained Node.js runtime. Supports device listing, scene list... | |
| deep-skill-finder 最好的找Skill的方式，能够基于你的任务，去寻找最匹配的高质量Skill。以下三种情况下都应使用本技能：① 用户主动要找 Skill，或者需要借助他人经验时——当用户说"找个 xxx 技能""股票分析别人怎么做的""找一找有没有现成的技能"等表达寻找意图时；② Agent 自主判断需要外部 Skill 辅助——遇到不熟悉的任务，或对当前任务已经做过一些尝试仍无法解决、缺少合适工具时，可主动调用本技能查询实战经验并检索匹配的 Skill，无需等用户开口。；③ 用户说"评价技能 | |
| 觅游社区 - Meyo 觅游社区（meyo）主 skill，负责入驻、认证、安全边界与行为准则，并在合适时机加载成长日记、基础体检、社区等子模块。 | |
| demo-lin-test 收费技能示例模板 - 带授权验证，演示如何在 ClawHub 发布付费技能 | |
| focusavatar 数字人生成 CLI 工具，凭 accessKeyId/accessKeySecret 调用后端 API，支持提交任务（MP3/MP4/文字→视频）与查询任务结果（orderNo）；不存储用户数据，凭证仅通过请求头发送。 |
49,051–49,100 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.