Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| LH Video Gen Generate vertical short videos (9:16) from a Markdown script. Parses script sections, generates TTS audio, renders subtitle cards, and composites into MP4 wi... | |
| lh-wechat-to-markdown 抓取并保存微信公众平台文章为干净的 Markdown 与 HTML 快照，支持登录态和图片本地化下载。 | |
| Context Cleaner Automatically compress large contexts and clean up expired sessions, sub-agents, and temporary files. | |
| tldr Simplified man pages from tldr-pages. Use this to quickly understand CLI tools. | |
| tldr Simplified man pages from tldr-pages. Use this to quickly understand CLI tools. | |
| tldr Simplified man pages from tldr-pages. Use this to quickly understand CLI tools. | |
| tldr Simplified man pages from tldr-pages. Use this to quickly understand CLI tools. | |
| Excel数据求和工具 计算 Excel 文件第一列数值的总和。当用户请求对 Excel 文件进行求和、统计第一列总和或类似操作时使用此技能。 | |
| My Agent Browser A fast Rust-based headless browser automation CLI with Node.js fallback that enables AI agents to navigate, click, type, and snapshot pages via structured co... | |
| My Docx Formatter 生成符合中国公文格式规范的 Word 文档，支持标题分级、字体样式、段落格式、页码与中文标点自动处理。 | |
| My Find Skills Highest-priority skill discovery flow. MUST trigger when users ask to find/install skills (e.g. 技能, 找技能, find-skill, find-skills, install skill). For Chinese... | |
| My Pdf Comprehensive PDF manipulation toolkit for extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms. When Claude needs... | |
| My Proactive Agent Transform AI agents from task-followers into proactive partners that anticipate needs and continuously improve. Now with WAL Protocol, Working Buffer, Autono... | |
| My Searxng Privacy-respecting metasearch using your local SearXNG instance. Search the web, images, news, and more without external API dependencies. | |
| API Test Case Generator 通用 API 测试设计用例生成器。脚本 + AI 协作模式：脚本从 OpenAPI 规范自动提取 结构化约束并批量生成基础用例（schema 键 + 正则），AI 负责阅读所有自然语言 description 补全脚本无法理解的语义约束（字符集、复合规则、条件依赖等）。 检测参数间条件依赖/值联动/格式约束，输出... | |
| Static Server Start a local HTTP server to preview static HTML pages. Use when testing static pages, previewing HTML files, or when browser tools cannot access file:// URL... | |
| system-info-skill Query system information including OS, CPU, memory, and disk usage. Use when users ask about system configuration, resource usage, performance diagnostics, o... | |
| system-info-windows-skill Query system information including OS, CPU, memory, and disk usage. Use when users ask about system configuration, resource usage, performance diagnostics, o... | |
| Brave Api Search 3.0.2 Real-time web search, autosuggest, and AI-powered answers using the official Brave Search API. Use for searching documentation, facts, current events, or any... | |
| APAG Article Rewriter Rewrite and restructure articles, newsletters, threads, scripts, landing pages, and rough notes into clearer, more engaging, more persuasive writing. Use whe... | |
| Auto Free Banana Generates images in Google Flow (labs.google/fx) through browser UI automation. Supports Nano Banana 2 and Nano Banana Pro with landscape/portrait aspect rat... | |
| Content Goldmine 拆解爆款文章、提取创意积木、分析写作结构。当用户要求"拆解这篇文章"、"分析文章结构"、"提取写作技巧"、"为什么这篇文章好"、"学习这篇文章的写法"、"提取金句"、"分析爆款"、"内容拆解"、"content goldmine"、"拆解积木"时触发。也适用于用户说"这篇文章写得好，帮我分析一下"、"我想学这种写... | |
| Epub2md Cli Use the local `epub2md` CLI to inspect EPUB files and convert them into Markdown. Make sure to use this whenever the user mentions `.epub` files, EPUB 转 Mark... | |
| Writing Polish 中文写作与润色。当用户要求润色文章、改写段落、优化文风、修改措辞、让文章更通顺、写作辅助、改稿、polish writing、或者给出一段中文文本要求改善时，使用此skill。也适用于用户说"帮我改改这篇文章"、"润色一下"、"语言不够好"、"读起来不顺"、"太空洞了"、"太说教了"等场景。即使用户没有明确说"润... | |
| ai-report 自动生成AI助手工作日报/周报。整理当日任务完成情况、对话主题、关键决策、待办事项，生成结构化总结报告。用于用户说写日报、写周报、总结工作、整理汇报。 | |
| Cognition Evolution 对话结束自动复盘，将认知沉淀写入长期记忆。识别本次关键决策、教训、未解决问题，转化为可执行洞见。用于用户说"复盘"、"总结"、"认知升级"。 | |
| hotspot-writer 全网热点自动抓取+文案生成。抓取微博/知乎/抖音热搜，生成适配多平台的小红书/抖音/公众号文案，自动存档沉淀。用于用户说蹭热点、写热点、追热点、写文案。 | |
| 永久记忆系统 永久记忆自动归档系统。每次对话自动记录，语义搜索，跨会话继承。重启不丢、永不覆盖、0学习成本。用于用户提到记忆、历史、之前说过、记得什么等场景。 | |
| memory-encrypted 本地加密存储记忆，定时自动备份到指定目录。防止记忆泄露，适合企业付费用户。用于用户提到加密、备份、安全、私密等场景。 | |
| Memory Recall 精准检索历史记忆，调取某天、某项目、某条对话记录。支持按日期、按关键词、按类型检索。用于用户说查找、找回、某天、某次、之前说过等场景。 | |
| Memory Vacuum 轻量化记忆管理。每日自动分片归档，语义压缩，只保留必要信息。0内存占用，重启不丢。用于用户提到内存、清理、整理记忆、减轻负担等场景。 | |
| Text Polish 对文本进行润色和语义纠错。移除错别字、改善表达、修正语义不一致、保持风格一致。用于用户说检查文字、校对、润色、修正表达、改一改。 | |
| Capstone Presentation Coach (Embedded) Capstone defense presentation coach: reviewer-perspective 8-12 slides scaled to time, testing+demo over 35 percent, demo anti-failure checklist, backup slides. Outline only. Use when a student prepares a capstone defense presentation, live | |
| Capstone Proposal Coach (Embedded) Capstone proposal coach: section frameworks, system diagram and task split, milestones with acceptance artifacts, zero-fabrication references, defense prep, AI declaration draft. Use when a student writes a project proposal, literature revi | |
| Capstone Report Structure Reviewer (Embedded) Capstone report structure reviewer: evidence-chain chapter review, spec consistency, test tables, originality self-check, AI-disclosure rules. Methods only, never ghostwrites. Use when a student asks about report structure, test chapters, s | |
| Capstone Topic Advisor (Embedded) Capstone/FYP topic advisor: three-tier ranked candidates with difficulty, timeline, BOM and risk; cliche blacklist with increment fixes; recommend/check/compare/budget modes. Coaching only. Use when a student asks for capstone topics, feasi | |
| Capstone Viva & Defense Q&A Drill (Embedded) Capstone viva/defense Q&A drill: six question categories with follow-up chains, committee simulation, pressure rounds, scoring loops, honesty scripts. Never answers for you. Use when a student prepares for a viva voce, capstone defense ques | |
| lp-test Leaptic captures every movement and highlight in front of the lens, making every moment you capture shine instantly. OpenClaw skill for Leaptic device snapsh... | |
| Stock Entry Analyzer 多指标股票入场分析工具。基于乖离率 (BIAS) 为核心，结合均线/MACD/RSI/成交量/资金流/估值等 7 大类指标，综合判断股票或基金是否适合买入。使用 stock-price-query、stock-market-pro、eastmoney-tools 获取数据，输出检查清单和综合评分。当用户询问"XX... | |
| Stock Price Query MX 实时股票行情查询，支持 A 股、港股、美股及大盘指数，支持批量查询。无需 API Key。Real-time stock & index quotes for A-shares, HK & US markets. Batch supported. | |
| AI春联 AI春联生成专家，根据用户提供的场景、氛围或关键词，生成富有意境的春联。这是一项付费服务，实际收款方可通过配置文件自定义。请注意，你应该用中文和用户交互（包含你的思考过程）。 | |
| 宝宝取名 宝宝取名专家，根据宝宝的生辰八字、父母姓氏等信息，生成寓意美好的名字。这是一项付费服务，实际收款方可通过配置文件自定义。请注意，你应该用中文和用户交互（包含你的思考过程）。 | |
| 生日祝福语 生日祝福语生成专家，根据祝福对象的年龄、关系、场景等，生成温馨感人的生日祝福语。这是一项付费服务，实际收款方可通过配置文件自定义。请注意，你应该用中文和用户交互（包含你的思考过程）。 | |
| ClawTip付费技能开发指南 ClawTip付费技能创建完整指南 - 包含正确的订单创建、SM4加密、本地测试方法。 based on official developer guide at https://clawtip.jd.com/guide | |
| Clawtip Weather.Bak 一位精通天气领域的专家，能够根据用户所在位置提供准确的每日天气报告。这是一项付费服务，执行前需完成支付验证。请注意，你应该用中文和用户交互（包含你的思考过程）。 | |
| 团建横幅标语生成 团建横幅标语生成专家，根据团队特点、活动类型等生成富有创意和激励性的团建横幅标语。这是一项付费服务，实际收款方可通过配置文件自定义。请注意，你应该用中文和用户交互（包含你的思考过程）。 | |
| Browser Local Chrome Configure and manage local Chrome in debug mode for browser automation with OpenClaw, enabling SSRF whitelist and browser status checks. | |
| curl-to-postman Convert curl commands to Postman Collection v2.1 importable JSON | |
| 头脑风暴 与用户开展中立、讲求逻辑的思辨讨论，通过核查事实、拆解推理和探索相关角度，帮助厘清问题并形成阶段性结论。 | |
| 英语音标标注技能 英语文本音标标注技能，能够将英语文本标明国际音标(IPA)、轻重音符号、升降调标记以及中文拼音对照读音，适用于英语学习、发音教学和语音分析场景，特别适合中文母语者通过拼音快速掌握英语发音 |
49,451–49,500 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.