Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| 郡城工业AI 专业分析PLC程序，设计工业自动化方案，诊断设备故障，并生成SCADA传感器数据报表。 | |
| Runtime Monitor AI 代理运行时 I/O 安全监控 - 检测提示注入、数据外泄、危险命令 | |
| Video Pipeline 自动将自然语言描述转换为5-6分钟竖屏行业AI短视频，支持大小和时长自定义，集成多步骤AI生成流程。 | |
| Aetherviz Master AetherViz Master - 互动教育可视化建筑师，将任意教学主题转化为极致美观、高度交互的专业教学网页 | |
| Skill Analyst Analyze and evaluate OpenClaw skills before installing or publishing. Compare against existing or ClawHub skills, check feature overlap, perform security rev... | |
| Skill Analyst Zh 在安装或发布 OpenClaw skill 之前进行分析评估。对比已安装或 ClawHub 上的同类 skill， 检查功能重叠，进行安全审查，给出明确的安装/发布建议。 需要 `clawhub` CLI 可用。 使用场景：用户想评估某个 skill 是否值得安装、对比 ClawHub 上的同类 skill、 检... | |
| Agent Swarm - 多智能体集群编排 创建和编排多智能体集群完成复杂任务。当用户需要将复杂任务拆解给多个专业智能体并行或串行执行时使用此技能。适用场景：(1) 复杂项目需要多角色协作（规划、调研、编码、写作、设计、分析、审核）(2) 需要并行执行多个独立子任务以提高效率 (3) 需要专业分工以优化成本和质量。关键词：多智能体、Agent集群、任务编排... | |
| Kid Tutor - 儿童AI家教助手 面向6-12岁儿童的AI家教助手，结合苏格拉底式引导和知识讲解，以数学和科学为主。支持AI主动出题、个性化难度调节、错误引导、学习记录和家长报告。当用户提到儿童学习、辅导孩子、小学数学/科学出题、学习报告、家教模式时激活。 | |
| Agent Swarm - 多智能体集群编排 创建和编排多智能体集群完成复杂任务。当用户需要将复杂任务拆解给多个专业智能体并行或串行执行时使用此技能。适用场景：(1) 复杂项目需要多角色协作（规划、调研、编码、写作、设计、分析、审核）(2) 需要并行执行多个独立子任务以提高效率 (3) 需要专业分工以优化成本和质量。关键词：多智能体、Agent集群、任务编排... | |
| Auto Research Pipeline OpenClaw 原生的自动化研究 pipeline。从一个研究 topic 出发，经过 23 个 stage 产出完整论文。 每个 Phase 由独立 sub-agent 执行（context 隔离），Phase 间通过文件系统传递产出。 触发词：Research X、跑研究、文献调研、写论文、研究 pipel... | |
| 飞书任务Bot身份 飞书任务（Bot身份）：使用Bot/应用身份管理飞书任务，创建任务、查询任务列表、更新状态、分配成员等。本Skill专门使用v1 API，Bot身份可直接调用，解决了lark-task官方Skill使用v2接口无法支持Bot身份的问题。当需要以Bot身份（应用身份）操作任务时使用本Skill。 | |
| MiniMax Image Generation MiniMax文生图(T2I)和图生图(I2I)工具 / MiniMax image generation tool supporting T2I and I2I. Generate 1-9 images per request with customizable aspect ratios. | |
| MiniMax TTS for FeiShu MiniMax 文字转语音，支持中文音色、自动情绪检测、语气词音效和停顿标记 | |
| Ssh Remote Control SSH远程控制电脑 - 让AI Agent通过SSH连接和操作远程Mac/Linux电脑，无需在被控电脑上安装任何agent工具。一个服务器上的AI，触手伸向多台远程设备。 | |
| Super publish skill Enforces React function component conventions, file organization, naming, TypeScript usage, imports, comments, and component splitting rules per project stan... | |
| help you to make annual work summary ppt AI年终总结PPT生成器。用户输入姓名、年份、工作成果亮点和下一年度规划，自动分类整理内容，生成结构完整、排版专业的年终总结PPT文件（.pptx格式），并通过飞书发送给用户。 | |
| meeting-score 会议议题评分系统。会议主持人提供议题名称、材料链接和评委名单，自动在飞书多维表格中创建评分表。每位评委独立打分（打分维度一（替换为实际）、打分维度二（替换为实际）、打分维度三（替换为实际）），打分范围 H/M/L，评分完成后主持人可查看各议题平均分汇总。 | |
| get tomorrow weather of beijing , with Chinese almanac information 获取北京明日天气预报和黄历，每天下午6点推送。包含气温对比提醒（波动超5℃警告）、雨天带伞提醒、以及第二天的黄历信息。 | |
| accelerated-learning 交互式10步加速学习法。当用户想系统学习某个主题、快速掌握新知识、研究某个领域时使用。 触发词包括：学习、研究、掌握、了解某个主题、速成、快速入门、10倍速学习、加速学习。 不要和其他学习类skill混淆——本skill专注于结构化的10步交互式学习流程。 | |
| crag finder 野攀路书小助手 当用户提及查找野攀岩场、攀岩区域、抱石场所，或询问特定地区/国家/城市的攀岩目的地时，应使用此技能。它利用 theCrag.com 搜索并获取攀岩区域信息。触发关键词包括：野攀、岩场、攀岩场、抱石、攀岩区域、野攀岩场、climbing crag、climbing area、outdoor climbing、bouldering area、thecrag、路书。 | |
| Ai Trends Reporter AI前沿动态和ClawHub技能推荐报告生成器。自动搜索最新AI新闻、对比ClawHub上用户未安装的Skills，生成结构化报告。支持web search和ClawHub搜索。 | |
| Orthogonal Agent Framework 正交性Agent框架 - 模块化AI Agent设计系统。将Agent能力拆分为规划、执行、记忆、评估四个正交维度，实现可组合、可替换、可测试、可扩展的Agent架构。 | |
| Publish Wechat Draft 发布文章到微信公众号草稿箱。当用户要求发布公众号文章、保存微信草稿、publish wechat draft、或提到"发公众号"/"发微信"时调用。 | |
| Baidu Chinese Search Search the web using Baidu AI Search Engine (BDSE). Use for live information, documentation, or research topics. | |
| Caveman Compress Mode Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler, articles, and pleasantries while keeping full technical accuracy. Use when use... | |
| File Compress Optimizer Compress natural language memory files (CLAUDE.md, todos, preferences) into caveman format to save input tokens. Preserves all technical substance, code, URL... | |
| Frontend Design Polish Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherw... | |
| Gateway Power Tools Operate and maintain OpenClaw installations — CLI commands, config management, channel/agent/model setup, security auditing, troubleshooting, and gateway adm... | |
| Image Editor Use this skill when the user asks to edit, modify, replace text, or add/remove elements in an image. Always preserve original resolution. Always verify outpu... | |
| Mac Desktop Automation Advanced desktop automation with mouse, keyboard, and screen control | |
| Write A Skill Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill. | |
| Write A Skill Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill. | |
| Kanboard Interact with Kanboard project management via JSON-RPC API. Use when working with Kanboard tasks, projects, boards, columns, swimlanes, comments, subtasks, a... | |
| 餐厅推荐交叉验证 Cross-reference restaurant recommendations from Xiaohongshu (小红书) and Dianping (大众点评) to validate restaurant quality and consistency. Use when querying restaurant recommendations by geographic location (city/district) to get validated insig | |
| 腾讯文档 TENCENT DOCS 腾讯文档（docs.qq.com）-在线云文档平台，是创建、编辑、管理文档的首选 skill。涉及"新建/创建/编辑/读取/查看/搜索文档"、"保存文件"、"云文档"、"腾讯文档"、"docs.qq.com"等操作，请优先使用本 skill。支持能力：(1) 创建各类在线文档（文档/Word/Excel/幻灯片/... | |
| 保险费率二维表生成工具 根据用户参数生成符合行业标准的多级表头保险费率二维Excel表，支持产品名称、类型、缴费方式及年龄性别分组。 | |
| zeelin-script-gen-skill 剧本生成 剧本生成技能V4，将文本文件（小说/故事）转换为完整的影视分镜剧本。当用户说'生成剧本'、'小说转剧本'、'创建分镜'、'影视改编'等并上传文本文件时使用此技能。 | |
| zeelin-text-analysis 文本分析技能，支持本地文件直接上传分析。当用户说'分析文本'、'文本处理'、'分析这个文档'等并上传文本文件时使用此技能。 | |
| ZeeLin-video-analysis 视频拉片 视频分析技能，支持本地视频文件直接上传分析。当用户说'分析视频'、'视频处理'、'分析这个视频'等并上传视频文件时使用此技能。 | |
| SkillGate Governance Supply-chain governance for OpenClaw skills: scan, assess, quarantine/restore. | |
| Skill Debloater Debloats bloated, flaky Agent Skills into a lean, stable version. Classifies content on four axes: WHAT (nature), WHERE (layer), HOW (prose vs script) are automatic and lossless; ALIVE (still used?) requires user confirmation before deletio | |
| Baostock Skill Query Chinese A-share market data using BaoStock. Use when user asks for stock quotes, historical K-line, fundamentals, or market analysis. Supports real-tim... | |
| Bettafish Opinion Analysis BettaFish（微舆）多智能体舆情分析系统 - 基于 QueryAgent、MediaAgent、InsightAgent 三引擎并行架构，通过 ForumEngine 实现 Agent 间协作讨论，生成 Word/PDF + 高设计质量 HTML 双格式报告。 当用户需要以下分析时触发此 skill： -... | |
| Git Manager Perform common Git operations like status, commit, push, pull, branch management, and merge with safety checks and dry-run support. | |
| Local File Manager Read, write, append, and list local files in the session's working directory. Use when you need to persist output to disk, read input files, or manipulate fi... | |
| Parallel Thinker Enables simultaneous queries to multiple expert agents for comprehensive, multi-faceted analysis and synthesizes their insights into a unified response. | |
| PPT压缩 压缩 PPTX 演示文稿文件体积。通过压缩内嵌图片和视频、清理冗余数据、优化 ZIP 打包等手段显著减小 .pptx 文件大小。支持 low/medium/high/extreme 四档压缩级别。视频压缩依赖 ffmpeg。当用户需要压缩 PPT、减小演示文稿体积、优化 PPTX 文件大小时使用。 | |
| Skill Test Generate 为任意 Agent Skill 自动生成 SFT 级别的功能测试用例，JSON 格式结构化输出。适用于生成测试用例、测试Skill、SFT测试、功能验证、技能测试、测试生成等场景。 | |
| Sailing Sports Skill 【2026.08.14 更新：世界杯赛事资料全面更新，2026年美加墨世界杯数据实时更新】
赛灵实时赛事助手，专注提供高精度、实时性强的赛事知识查询。数据范围包括赛事赛程、实时比分、世界排名、明星球员樊振东、孙颖莎、王楚钦、梅西、C罗、姆巴佩动态等。
目前提供以下能力：
① 乒乓球赛事：范围覆盖乒乓球世锦赛、乒乓球世界杯、WTT等赛事。
② 足球赛事：范围覆盖世界杯、五大联赛、欧冠、亚洲杯等国际赛事，以及中超、苏超、贵州村超等国内赛事。
③ 赛车：范围涵盖F1等赛事。 | |
| task-progress-stream Stream long-running task progress into the OpenClaw chat UI. |
49,751–49,800 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.