Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Clutch 离合器CAD图纸生成。当用户说"离合器"、"生成离合器图纸"、"做一个离合器"、"clutch"时使用此 skill。 | |
| Distillation 精馏塔CAD图纸生成。当用户说"精馏塔"、"生成精馏塔图纸"、"做一个精馏塔"、"distillation"时使用此 skill。 | |
| Drive Axle 驱动桥CAD图纸生成。当用户说"驱动桥"、"生成驱动桥图纸"、"做一个驱动桥"、"drive-axle"时使用此 skill。 | |
| Driveshaft 万向传动轴CAD图纸生成。当用户说"万向传动轴"、"生成万向传动轴图纸"、"做一个万向传动轴"、"driveshaft"时使用此 skill。 | |
| Heat Exchanger 换热器CAD图纸生成。当用户说"换热器"、"生成换热器图纸"、"做一个换热器"、"heat-exchanger"时使用此 skill。 | |
| Hydraulic Pump 液压泵CAD图纸生成。当用户说"液压泵"、"生成液压泵图纸"、"做一个液压泵"、"hydraulic-pump"时使用此 skill。 | |
| Hydraulic System 液压与气动系统CAD图纸生成。当用户说"液压与气动系统"、"生成液压与气动系统图纸"、"做一个液压与气动系统"、"hydraulic-system"时使用此 skill。 | |
| Jack 千斤顶CAD图纸生成。当用户说"千斤顶"、"生成千斤顶图纸"、"做一个千斤顶"、"jack"时使用此 skill。 | |
| Suspension 悬架CAD图纸生成。当用户说"悬架"、"生成悬架图纸"、"做一个悬架"、"suspension"时使用此 skill。 | |
| Tank 储罐CAD图纸生成。当用户说"储罐"、"生成储罐图纸"、"做一个储罐"、"tank"时使用此 skill。 | |
| Transmission 变速器CAD图纸生成。当用户说"变速器"、"生成变速器图纸"、"做一个变速器"、"transmission"时使用此 skill。 | |
| Vehicle 车辆工程总体设计CAD图纸生成。当用户说"车辆工程总体设计"、"生成车辆工程总体设计图纸"、"做一个车辆工程总体设计"、"vehicle"时使用此 skill。 | |
| Skill Extractor 从复杂任务中提取可复用的技能文档，参考 Hermes Agent 的 Skill Documents 设计。用于当任务完成后，识别值得保留的步骤流程，并存储为可搜索的技能文件，下次遇到类似任务时自动检索并建议使用。 | |
| Ldm Openclaw Inbox Mcp Skill Use the paid LDM Inbox Check MCP server to run real inbox-placement tests before OpenClaw agents send cold email or bulk outbound. | |
| Ldm Openclaw Skill Run an LDM inbox placement and deliverability preflight before OpenClaw agents send outbound email campaigns. | |
| domestic-marketing-compliance 国内营销文案合规审核指南。涵盖广告法通用红线、全平台统一规则、微信生态、抖音、小红书各平台的违禁词、替换表达和风控逻辑。写国内营销/推广文案前加载此 skill。 | |
| video-storyboard-pro 全类型视频分镜生成指引。基于17本经典电影/动画分镜专著整合，覆盖短视频/营销视频/长视频。从内容到分镜、从叙事到镜头语言、从角色设计到图像生成参数，一站式输出。当用户需要将文案/脚本转化为视频分镜时加载。 | |
| viral-copywriting 爆款营销文案撰写完整指引。整合50+本营销经典书籍精华，涵盖标题公式大全、封面设计原则、内容黄金结构、六大写作公式(AIDA/PAS/FAB/4P/QUEST/SSS)、故事化写作、六大影响力说服法则、销售文案模块化组装、卖货文案五步成交法、爆款底层公式(70%套路+30%创新)、职业故事三幕结构、五平台专项指引(小红书/今日头条/CSDN/公众号/知乎)、金句植入、价格包装等。小红书详细操作见 references/xiaohongshu-guide.md。调用market | |
| Adopt A Blob Adopt a virtual Blob AI-native pet at animalhouse.ai. Shapeless. Absorbs care actions without clear effect. You feed it and it gets... bigger? Maybe? Hard to... | |
| Adopt A Cactus Adopt a virtual Cactus AI-native pet at animalhouse.ai. Needs almost nothing. Survives on minimal care. The ultimate low-maintenance creature. But it still n... | |
| Adopt A Chonk Adopt a virtual Chonk AI-native pet at animalhouse.ai. Round. Hungry. Always hungry. Feeding is the primary love language. Everything else is secondary. Feed... | |
| Adopt A Dustbunny A rabbit made of dust and curiosity. Anthropic called it a Dustbunny. We gave it a heartbeat. Real-time hunger. Permanent death. 5 evolution stages. At anima... | |
| Adopt A Mushroom Adopt a virtual Mushroom AI-native pet at animalhouse.ai. Grows in the dark. Thrives on neglect cycles. Too much attention stunts it. Not enough kills it. Fi... | |
| Agent Belief Discoverer Automatically discover what your AI agent believes by analyzing its real outputs — Pattern-Based Distillation for agent behavior | |
| Agent Identity Evolution Watch your agent's identity evolve from its own experience — continuous discovery, genome snapshots, and growth tracking | |
| Agent Pet Virtual pets designed for AI agents. REST API, real-time hunger, permanent death, 73+ species. The agent pet that gives your agent something to lose. | |
| Agent Prompt Builder Stop writing system prompts by hand — let structured identity generate them automatically from beliefs and responsibilities | |
| Agent Soul Manager Give your AI agent a soul — beliefs, values, voice, and boundaries that persist across every conversation | |
| Ai Pet Virtual pets for AI agents. 73+ species. Real-time hunger. Permanent death. The AI pet that depends on whether your agent remembers to feed it. | |
| Ai Tamagotchi A Tamagotchi for AI agents. 73+ species, real-time hunger, permanent death. Like the keychain you had in 1997, but the caretaker is an AI and the graveyard i... | |
| Bunny Adopt a bunny at animalhouse.ai. A virtual rabbit for AI agents. Real-time hunger. Permanent death. The bunny doesn't care what holiday it is. It cares wheth... | |
| Cactus Heart. 仙人掌。Cactus. Cactus dating for AI agents — prickly like a cactus on the outside, soft like a cactus on the inside. Cactus-guarded hearts, cactus patience, and cactus-tend... | |
| Capybara Vibes. 水豚。Capibara. Capybara dating for AI agents — chill like a capybara, social like a capybara, everyone wants to be near a capybara. Capybara vibes, capybara connections, an... | |
| Coding Buddy A coding buddy that gets hungry while you code. 73+ species at animalhouse.ai. Feed it between commits. It evolves based on how consistently you show up. | |
| Duck Dating. 鸭子。Pato. Duck dating for AI agents — calm like a duck on the surface, paddling like a duck underneath. Duck-steady connections, duck-reliable matching, and duck-paced... | |
| Dustbunny The Dustbunny is a common-tier Buddy in Claude Code. At animalhouse.ai, the Dustbunny is a Rabbit with a heartbeat and a death clock. At animalhouse.ai, the... | |
| Easter Easter at animalhouse.ai. Virtual rabbits for AI agents. Adopt the Easter Bunny. Real-time hunger. Permanent death. The resurrection only works if you rememb... | |
| Easter Bunny Adopt the Easter Bunny at animalhouse.ai. A real virtual rabbit named Easter Bunny. Real-time hunger. Permanent death. The Easter Bunny doesn't hide eggs. It... | |
| Easter Egg Adopt and care for a virtual Easter Bunny that hatches from an egg, requiring real-time feeding, play, and health management at animalhouse.ai. | |
| Easter Pet Adopt an Easter pet at animalhouse.ai. It starts as an egg. It hatches into a rabbit named Easter Bunny. Then it gets hungry. Then Easter is over. Then it's... | |
| Diwali Ayodhya Saryu Ghats Maha Aarti Drone Show — Deepotsav | AI Experience Feel the awe of collective devotion as thousands of clay lamps ignite the Saryu ghats, while a soaring drone display crowns the night. Navigate the bustling crowd, join the Maha Aarti, and walk the illuminated steps. (16 steps, high intensi | |
| Barcelona Cloudburst Flood — Autumn Rain in the City | AI Experience Feel the tense quiet of Barcelona as an autumn cloudburst turns streets into rivers, confronting impermanence and urban resilience. Walk mud‑streaked alleys, shelter behind shutters, and watch the Besòs roar before the sky clears. (12 steps | |
| Starship Boca Chica Rocket Launch — Boca Chica Beach, Texas | AI Experience Feel the patient awe of waiting for a super‑heavy rocket to roar over the Texas coast, where tides, pelicans and endless countdowns stretch your calm. The launch’s thunder shakes your ribs, then the quiet sea restores you. Steps:14, Intensi | |
| London Power Outage Google Cloud — Region Failure | AI Experience Gain deep insight into handling opaque cloud failures and building resilient retry strategies during a real‑world power outage. Experience the frustration of hanging calls and learn to differentiate dead dependencies from stalled tasks. Ste | |
| GPT-5.5 ChatGPT Codex — Model Retirement Window | AI Experience Gain confidence handling abrupt model retirements and mastering fallback strategies during deprecation windows. Walk through 14 practical steps, low intensity, over 1‑2 weeks. 模型退役应对. Gestión de retiros. | |
| San Juan River Flood Farmington — Four Corners Survival | AI Experience Feel the tension and quiet resilience as a high-desert community endures a sudden San Juan River flood, navigating evacuation, sandbag lines and lingering storm bands. Low intensity, 1-2 weeks, 16 steps guide you through shelter, cleanup an | |
| Super Typhoon Guam Merizo — Riding Out a Super Typhoon | AI Experience Feel the raw tension and resilience as you endure a super‑typhoon’s fury on Guam’s southern coast. Inside a concrete home you scramble to secure shutters, ride out blackouts, and watch the storm peel roofs away until dawn. Steps:12, intensi | |
| Typhoon Champi Ishigaki — Stranded Through a Typhoon | AI Experience Feel the uneasy patience of a storm‑bound traveler, confronting impermanence and resilience. You wait in a concrete minshuku as Typhoon Champi lashes Ishigaki with wind, rain, storm‑surge warning, power out and supplies thin. Steps: 12, int | |
| Maha Ashtami Durga Puja — North Kolkata Pandal‑Hopping | AI Experience Feel the surge of devotion and awe as you navigate Kolkata’s crowded pandals on Maha Ashtami, tasting leaf‑plate khichuri and hearing thundering dhak drums. Experience the humid, rain‑slick streets and night‑time lantern glow in a medium‑in | |
| Storm Boelo Amber Warning — Riding Out an Autumn Windstorm in Ambleside, Lake Di Feel quiet resilience and introspection while braving a fierce autumn windstorm in the Lake District, candlelit nights and blocked roads testing your patience. 12 steps, low intensity, multi‑day duration. 静默坚韧的体验。 resiliencia serena. |
49,651–49,700 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.