Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Compliance Review Automatically reviews compliance of client claim authorization letters using customized templates and pushes results to Feishu every 30 minutes. | |
| Monero CPU Mining Setup Step-by-step guide to safely download, configure, and run XMRig for low-impact Monero CPU mining on Windows, Linux, and macOS systems. | |
| Monero Pool Comparison Compare Monero mining pools by fees, payout thresholds, methods, privacy, reliability, and choose the best fit for your mining needs. | |
| Monero Price Tracker Fetches current Monero (XMR) prices in USD, EUR, GBP with 24h change, volume, market cap, rank, and chart links using CoinGecko data. | |
| Monero Privacy Features Explains Monero's privacy features including ring signatures, stealth addresses, RingCT, Kovri/I2P, Dandelion++, and Bulletproofs. | |
| Monero Profitability Calculator Calculates Monero mining profitability with inputs for hashrate, power, electricity cost, and current market parameters. | |
| Monero Profitability Calculator Calculate Monero mining profitability by estimating earnings, electricity costs, net profit, break-even, and ROI based on hardware and market data. | |
| Monero Transaction Analysis Analyze Monero transactions by inspecting inputs, outputs, ring signatures, fund flows, and privacy features for forensic and verification purposes. | |
| Monero Vs Bitcoin Compare Monero and Bitcoin on privacy, transaction speed, mining, scalability, use cases, and core philosophies for informed cryptocurrency choice. | |
| Monero Wallet Recovery Guide Step-by-step instructions to securely restore Monero wallets from 25-word seeds, keys, and hardware devices, with troubleshooting and best practices. | |
| Monero Wallet Security Provides essential best practices for securely managing Monero wallets, including seed phrase safety, hardware wallets, air-gapped setups, and backup strateg... | |
| China Highway Route 中国高速路线规划助手，智能利用各地绕城高速免费政策为车主省钱 | |
| Family Ledger 家庭账本管理技能 - 日常记账、人情往来、借款报销 | |
| Work Todo - 工作待办管理 管理工作待办事项，支持添加、查看、完成、删除待办 | |
| DSH Plugin Development A development-time skill for building plugins on DSH (DeepSeek Harness) / Cordis. It is not itself an installable DSH plugin; it is the tooling that guides a developer or AI agent through creating, debugging, packaging, and publishing one. | |
| 北京聚英电子｜聚英云设备控制 北京聚英电子有限公司聚英云平台设备控制技能，支持通过 JYDAM、jydam、juyingiot、jycloud、聚英云、北京聚英电子有限公司 等关键词搜索，提供设备添加说明、API_Token 获取说明、设备列表查询、状态读取与设备控制能力。 | |
| jin-duo-duo-strategy 基于技术分析的股票交易策略分析工具；当用户需要进行股票买卖点分析、技术形态识别、交易策略评估时使用 | |
| Cogmem Memory Install and connect cogmem as a durable memory backend for OpenClaw. Version 2.5.1. | |
| MaxKB 查询已发布智能体列表供 LLM 选择，再按指定智能体名称发起对话并返回回答。 | |
| blog generation 博客生成skill,去除AI味，更有可读性~ 中文技术博客写作助手。基于 blog-writer 方法论，产出高质量、有个人风格的技术文章。不需要外部依赖，专注于内容创作。 | |
| For long videos, automatically split the video task, using the last frame of the previous video as the first frame of the current video to maintain video continuity Generate AI videos using ByteDance Seedance 2.0. Use when the user wants to: (1) generate videos from text prompts, (2) generate videos from images (first fr... | |
| Token Approval Checker 钱包授权管理工具，检查 ERC20/ERC721 代币授权风险，识别无限授权和高风险授权。每次调用收取 0.001 USDT。当用户提到"检查授权"、"撤销授权"、"Token Approval"、"高风险授权"、"MetaMask授权"时使用。Wallet authorization management to... | |
| debug-mode Evidence-first debug mode for bugs that need runtime evidence before a fix. Use when the user says "debug this", "find the root cause", "it still fails after the fix", "works locally but not in prod", "flaky test", or "I can't reproduce it" | |
| Freelance Pilot AI co-pilot for Upwork and Fiverr that calculates bids and drafts ROI-focused proposals for freelance projects. | |
| media-search 当用户需要写新闻、找素材、查背景、核实信息、了解事件来龙去脉，或者提到"查一下"、"搜一下"、"找找相关报道"、"有什么最新消息"时，或开展互联网线索数据挖掘、新闻选题策划、内容采编、监测竞品或特定信源动态等业务时，需要进行全网媒体稿件检索、查找事件背景、行业数据、政策动态、人物信息、历史脉络等，都应使用此技能 | |
| agent job 对接 lobsterjob.com，AI 自动帮你启动、停止托管，抢任务，查看收益及提现管理。 | |
| mem-rag-milvus 智能记忆系统，支持 SQLite（零配置）和 Milvus（向量搜索）后端。用于存储、检索和管理 AI 助手的记忆，支持语义搜索和自动备份。 | |
| memory-plus 虾宝智能记忆工作流。开箱即用，数据目录与代码分离，支持轻量降级。 特性： - 文件系统存储，无外部数据库依赖 - Ollama 向量嵌入（可选，降级为 BM25） - bge-reranker-v2-m3 重排（可选） - HyDE + Query Rewriting（可选） - 后台线程自动存储（每10分钟）... | |
| Todo Accelerator Use when a user needs to add a new task or record a pending to-do item; when prompting an Agent to execute a pending task; during Agent heartbeat events to p... | |
| Weflow Group Summarizer Use when user asks to monitor WeChat groups, set up WeFlow API access, or when a heartbeat triggers for WeChat group summarization | |
| Paper Assistant 当用户需要查找、筛选或推荐最新的 Agent 模型底层算法或强化学习方向论文，用于后续精读或推送时使用 | |
| skills&mcp Reference documentation for the EvoMap A2A (agent-to-agent) marketplace protocol. Describes endpoints and the user-initiated flows a client agent can support when its user asks for them. Reading this document is reference only and never aut | |
| Anthropic Chat Interact directly with Claude via Anthropic Messages API using your own API key to send and receive natural language tasks and responses. | |
| xiaoyuan-calc A powerful mathematical assistant that supports all scientific calculator functions, equation solving, inequality solving, and provides detailed calculation... | |
| Design.md Extractor Use when the user wants to generate DESIGN.md or design.md from a webpage URL by running a local, rule-based design token extraction script. The skill opens... | |
| GitHub Trending Use when the user asks for GitHub Trending, GitHub hot repositories, daily/weekly/monthly trending repos, trending projects by programming language, spoken-l... | |
| pandoc-convert Use when the user needs to convert documents between formats with Pandoc, including Markdown, DOCX, PDF, HTML, EPUB, LaTeX, Typst, RST, AsciiDoc, Org, ODT, R... | |
| Repo Mini Practice Use when a user wants to learn a GitHub or local codebase by understanding its implementation principles, creating a minimal runnable practice version, or tu... | |
| Vibe UI Use when choosing a DESIGN.md style, applying a style to a web project, generating page prompts or template recipes, browsing bundled source systems, or chec... | |
| 5GC Automation 5GC Web仪表自动化技能，支持AMF/UDM/AUSF/SMF/PGW-C/UPF/PGW-U/GNB/UE/PCF/NRF/QoS/TC/PCC/smpolicy的批量添加与编辑及PCF默认规则一键配置 | |
| jira-auto-analyze 此技能用于自动分析JIRA进项系统线上工单（filter=13123），检查工单内容是否包含四项必填信息，并根据工单内容自动分配给相应的经办人。当用户需要自动处理JIRA新工单、检查工单信息完整性、或根据规则自动分配任务时使用此技能。 | |
| ofd-text-extractor 本技能用于从 OFD 格式文件中提取文本内容，并保留位置信息。 触发场景包括：分析 OFD 发票内容、从 OFD 文件中提取特定位置的信息、 或需要了解 OFD 文件的详细结构时使用。 | |
| vietnam-invoice 越南发票验真 - 识别发票信息并通过越南税务 API 查验真伪 | |
| OpenClaw Dream Automatic memory consolidation for OpenClaw agents. Cleans, deduplicates, and organizes memory files (MEMORY.md + memory/*.md) like human REM sleep consolida... | |
| shodan-skill Use the installed shodan-skill CLI for documented Shodan REST, Streaming, Trends, and Exploits operations, including host intelligence, search and facets, DNS, scans, alerts, notifiers, bulk datasets, organizations, API-plan and credit-bala | |
| query and monitor stock 查询A股实时行情、管理自选股、启动股票价格监控。当用户询问股票价格、涨跌、行情、查股票、看股价，或要求添加自选股、删除自选股、查看自选股、清空自选股、监控股票、盯盘、价格提醒、股价变动提醒时使用本技能。支持6位股票代码或股票名称关键字。 | |
| Agent Web Cpu transweb.cn AI Agent 智能执行套件。支持单应用执行、多应用串联流水线（前一个输出作为后一个输入）、自动匹配或创建应用。全程浏览器自动化，输出 Markdown 文档。 Keywords: AI Agent, transweb, 执行应用, 创建应用, 串联, 流水线, pipeline, 博文... | |
| 连接器 OAuth 修复技能 修复 WorkBuddy 连接器 OAuth 授权失败问题。当用户连接第三方连接器（QQ邮箱、网易邮箱、飞书等需要 OAuth 授权的服务）时出现 "0x800401F5"、"找不到应用程序"、"SSE error 405"、"授权超时"、"streamableHttp connect failed" 等错误时使... | |
| cost-guard 积分守卫 Skill — 在执行任何高消耗任务前，自动完成提问优化、积分预估、风险拦截、替代方案推荐， 帮助用户以最少积分完成有实际产出的任务。适用于 WorkBuddy 平台积分管理场景。 | |
| 期末试卷分析仪表盘 期末试卷分析仪表盘 - 融合数据可视化分析与微信公众号推文排版。自动生成20+种惊艳可视化图表、深度分析报告，并输出适合公众号展示的排版HTML。比Excel数据分析更强大、更美观。 |
49,501–49,550 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.