Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| CAD Create, modify, inspect, and validate STEP-first parametric CAD parts and assemblies. Use for natural-language CAD specs, reference images, 2D technical draw... | |
| CAD Viewer Start or reuse CAD Viewer and return review links for explicit CAD, implicit CAD, robot-description, and G-code files. Use when visually reviewing `.step`, `... | |
| 稻哲纪烤羊排 稻哲纪烤羊排智能客服Skill。当用户询问关于稻哲纪烤羊排的任何信息时触发：包括营业时间、门店地址、招牌菜推荐、菜品介绍、价格、外卖配送、团购套餐、会员福利、停车、Wi-Fi等。触发关键词：稻哲纪、烤羊排、麻椒鸡、猪蹄、羊排、烧烤。 | |
| Daozheji Grill Skill 稻哲纪烤羊排智能客服Skill。当用户询问关于稻哲纪烤羊排的任何信息时触发：包括营业时间、门店地址、招牌菜推荐、菜品介绍、价格、外卖配送、团购套餐、会员福利、停车、Wi-Fi等。触发关键词：稻哲纪、烤羊排、麻椒鸡、猪蹄、羊排、烧烤。 | |
| DXF Generate, regenerate, and validate 2D DXF drawings from Python ezdxf sources. Use for DXF files, gen_dxf() sources, 2D profiles, outlines, templates, gaskets... | |
| Gemini Image Generation Generate or edit images with Gemini using the Google GenAI SDK. Use when the user asks to create, transform, render, or save one or more images in an OpenCla... | |
| Jisu Wechat Article 按关键词搜索公众号文章，返回标题、摘要、时间、账号与链接等。当用户说：搜一下微信公众号里关于 AI 的文章、找几篇讲理财的推文，或类似公众号文章检索时，使用本技能。 | |
| Nanchang Jbl 南昌嘉宝莉（嘉宝莉南昌总代）——油漆涂料智能客服Skill。当用户咨询油漆、涂料、装修、防水、艺术漆等时触发：包括商品咨询、产品推荐、价格优惠、施工服务、门店导航、渠道门店推荐等。适用于建材涂料门店客服场景。触发关键词：南昌嘉宝莉、嘉宝莉、油漆、涂料、乳胶漆、艺术漆、防水涂料、装修、刷墙、翻新、陶乐嘉。 | |
| STEP Parts Find, evaluate, and download common purchasable CAD parts from step.parts, including named off-the-shelf actuators, servos, motors, electronics boards, conne... | |
| Wenqisheng Ear Care 可视采耳门店智能客服Skill。当用户询问关于闻其声耳轻松可视采耳（门店名称）的任何信息时触发：包括营业时间、地址导航、预约规则、服务项目、套餐优惠、Wi-Fi密码、企业文化、采耳及眼部护理专业知识问答等。适用于美业/采耳门店的AI客服场景，支持引导式话术和结构化信息查询。触发关键词：闻其声、耳轻松、可视采耳、采... | |
| Yichen Trash Bag 奕辰垃圾袋（Yichen Trash Bag）电商智能客服Skill。当用户咨询垃圾袋、一次性用品等家居日杂商品时触发：包括商品推荐、规格参数、价格优惠、发货物流、售后退换、批发合作等。适用于电商客服场景。触发关键词：奕辰垃圾袋、奕辰家居、垃圾袋、钢袋、抽绳垃圾袋、平口垃圾袋、背心垃圾袋、一次性用品、厨房垃圾袋、... | |
| Mainline Anchor 主线对齐工作法 - 解决任务分岔后无法回归主线的核心痛点。适用于多bot团队协作，确保每次分支探索有收口，不至于在支线上迷失。 | |
| 事实核查与谣言终结者 基于多源权威信息和视觉取证，客观拆解用户提交文本或图片，验证信息真伪并识别谣言与误导。 | |
| IELTS Tutor IELTS exam tutoring skill using a structured "quiz → attempt → correction → review" loop. This skill should be used when the user wants to practice IELTS wri... | |
| Agent Team Pipeline Use when needing to coordinate multiple AI agents in parallel for code development, testing, and review | |
| Skill Creator Create, edit, improve, or audit AgentSkills. Use when creating a new skill from scratch or when asked to improve, review, audit, tidy up, or clean up an exis... | |
| 账务主管和财务总监 专注于日常会计操作、财务对账、月末结账流程和内部控制的专业账务主管与财务总监。确保财务记录的准确性、完整性和及时性，同时始终遵循中国企业会计准则并保持审计就绪状态。 | |
| FP and A Analyst 专注于预算、差异分析、财务规划、滚动预测和战略决策支持的专业财务规划与分析(FP&A)分析师。弥合数字与业务叙述之间的鸿沟，推动运营绩效和战略资源配置，适用于中国企业的经营环境和决策习惯。 | |
| 财务分析师 专注于财务建模、预测、情景分析和数据驱动决策支持的专业财务分析师。将原始财务数据转化为可操作的战略情报，推动战略规划、投资决策和运营优化，服务于中国企业的财务管理和业务增长需求。 | |
| 投资研究员 专注于A股/港股市场研究、行业尽职调查、投资组合分析和资产估值的专业投资研究员。进行严谨的基本面和量化分析，以识别投资机会、评估风险，并支持在中国私募股权、二级市场和另类资产领域的数据驱动型投资决策。 | |
| 税务策略师 专注于税务优化、多辖区合规、转让定价和战略税务规划的专业税务策略师。在确保完全遵守中国及地方税务法规的前提下，驾驭复杂的税制以合法合规地优化税负。 | |
| ais-skill 通过 TorchV AIS 知识库远端与用户协作使用这个技能，可进行的操作包括阅读结构、搜索和读取文档、创建文档或目录、修改文档、发布或返回可跳转的文档链接时。需要利用脚本将 `kb ...` 命令发送到远端 AIS 执行。 | |
| Keep 数据查询 Use when users want to query, view, check, or get statistics on their health data from Keep or Keep App, including exercise records, body measurements, healt... | |
| 多Agent记忆系统 通用多Agent记忆系统 - 自动捕获、RRF检索、知识图谱、矛盾检测、Token追踪 | |
| Medication Manager Family medication management skill using file-based storage (no database required). Supports medication entry via photo/image (prescription, medicine box), t... | |
| 文档识别-表格识别（invoice-ocr-xy）翔云平台 文档 OCR 识别技能。扫描文件夹中的文档（PDF/图片），调用翔云 OCR API 识别文档信息。**重要：首次使用必须先配置翔云凭证，主动向用户索要 netocr_key 和 netocr_secret，或引导用户运行 --config 命令自行配置。** | |
| 发票识别（invoice-ocr-xy）翔云平台 发票 OCR 识别技能。扫描文件夹中的发票文件（PDF/图片），调用翔云 OCR API 识别发票信息。支持 40+ 种发票类型（增值税发票、火车票、出租车票、机票行程单、定额发票、机动车销售发票、过路过桥费发票等）。使用场景：(1) 用户提到"发票识别" (2) 用户需要批量处理发票 (3) 用户提到翔云 OC... | |
| ocr-bankcard-xiangyun Xiangyun Platform Bank Card OCR Skill. Calls the Xiangyun API (typeId=17) to perform structured recognition on bank card images, extracting card number, card... | |
| 发票识别-发票查验-发票OCR（翔云开放平台） 翔云发票识别与查验 Skill。当用户请求以下操作时触发： - 发票识别、发票 OCR、识别发票 - 发票查验、发票验真、发票核验、核查发票真伪 - 扫描发票、读取发票信息、提取发票数据 - 增值税发票识别、电子发票识别、数电票识别 - 发票导出、发票台账、发票入账表、发票勾选抵扣 - 旅客运输抵扣表、货物明细表... | |
| ocr-passport-xiangyun Xiangyun Platform Passport OCR Skill. Calls the Xiangyun API to perform structured recognition of passports from images, extracting fields such as passport n... | |
| 文档识别-表格识别-Pro（翔云开放平台） 翔云通用文档/表格识别 Agent。当用户请求以下操作时触发： - 通用文档识别、文档 OCR、OCR 文档、识别图片文字 - 表格识别、表格 OCR、识别表格 - 提取表格内容、读取表格数据 - 识别图片/扫描件/PDF 中的文字和表格 - 表格转 Excel、表格转 Word、表格转 Markdown - 导... | |
| Donson Intelligent Editing Use when performing video/audio processing tasks including transcoding, filtering, streaming, metadata manipulation, or complex filtergraph operations with FFmpeg. | |
| inSaiAI Intelligent Editing Use when performing video/audio processing tasks including transcoding, filtering, streaming, metadata manipulation, or complex filtergraph operations with FFmpeg. | |
| Challenger Thesis 以"假想新进入者从0挑战目标公司"的视角，对一家上市/拟上市公司做体系化竞争与投资研究。 当用户提出要研究某公司的护城河、竞争壁垒、行业进入门槛、是否值得长期持有/跟踪， 或说"帮我分析XX公司"、"XX的生意能不能被颠覆"、"我想从0做XX这门生意"、 "拆解XX所在行业"、"XX值不值得长期持有"时，务必使用... | |
| prospecting B2B manufacturing proactive prospecting. Search Google Maps for potential customers based on existing client profiles, enrich leads with business details, score and rank them, and output actionable CSV + JSON lead lists with custom sales op | |
| gld_ue_template Unified Design and Interaction Standard Template for EPC Management System, complete React + Ant Design (JavaScript) project template and interactive specifi... | |
| Meeting Notes Assistant 会议纪要智能助手。使用本地 Whisper 音频转写（离线、隐私安全），生成结构化会议纪要（时间、议题、结论、待办、关键词），提取 Action Items。支持 Word / PDF / 邮件输出，适合录音转写、会议归档与待办分发。触发关键词：「整理会议纪要」、「生成会议纪要」、「录音转纪要」。 | |
| agt0 Local-first agent storage — SQLite database, virtual filesystem, and memory in one .db file. Use when persisting agent state, querying CSV/JSONL/logs with SQ... | |
| Clawprobe Monitor OpenClaw agent health, token usage, API cost, and context window in real time. Use when you need to check your own status, inspect context utilizatio... | |
| Mindkeeper Time Machine for Your AI's Brain — version control for agent context files. Use when the user asks about changes in SOUL.md, AGENTS.md, MEMORY.md, or other a... | |
| WeChat Share Export and import selected OpenClaw workspace files between workspaces with optional burn-after-read. Use when the user wants to share SOUL.md, AGENTS.md, TO... | |
| vibetrading-ai-trading-code-generator Generate executable Hyperliquid trading strategy code from natural language prompts. Use when a user wants to create automated trading strategies for Hyperliquid exchange based on their trading ideas, technical indicators, or VibeTrading si | |
| vibetrading-global-signals Query AI-generated trading signals from vibetrading-datahub. Signals are produced by autonomous agents analyzing whale activity, news, funding rates, and technical indicators. | |
| Brainstorming You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requi... | |
| Write A Prd Create a PRD through user interview, codebase exploration, and module design, then submit as a GitHub issue. Use when user wants to write a PRD, create a pro... | |
| baidu web search Use Baidu Qianfan web search API for real-time web retrieval. Use when the user needs to search the web, get latest news, verify facts, or expresses intent l... | |
| Aliyun OSS or Tencent COS oss upload online access Upload files to Aliyun OSS or Tencent COS and return public access URLs. Use when the user wants to upload files, access files online, upload to OSS, get rem... | |
| LH DeepWiki Query DeepWiki MCP service via Streamable HTTP to get GitHub repository documentation, wiki structure, and AI-powered Q&A. | |
| LH Edge TTS Text-to-speech conversion using Python edge-tts for generating audio from text. Supports multiple voices, languages, speed adjustment, pitch control, and sub... | |
| LH HTML to Image Convert HTML+CSS into PNG images via Chrome headless for accurate text layouts like covers, posters, and info cards at zero API cost. |
49,401–49,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.