Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| Use Effect Refactor React code away from direct useEffect usage. Use when Codex needs to review, rewrite, or prevent useEffect in React components, custom hooks, or fro... | |
| prompt-optimizer 基于需求分级，自动重构提示词，从角色、背景、任务、约束、示例五维度优化并智能路由执行，支持多 Agent 并行。 | |
| SKILLS An OFD document processing tool that converts PDF/OFD files, converts OFD to images, and supports multiple document formats via the ofd365.com API. | |
| ai-wallpaper-skill 一个能够根据用户提示词生成 AI 图片并自动将其设置为桌面壁纸的能力模块。当用户提到“换壁纸”、“生成桌面”、“设置背景”等需求时触发。当前实现支持 Windows 和 macOS。 | |
| disk-cleaner 跨平台磁盘空间分析与缓存清理（Windows / macOS / Linux）。当用户说"磁盘满了""C 盘空间不足""清理缓存""清理 npm 缓存""清理临时文件""看看什么占空间""磁盘清理""释放空间"时使用。四层架构：平台探测、缓存发现、安全分级、交互勾选执行。启发式扫描能找出白名单外的未知缓存，删除项由用户逐项勾选确认。 | |
| 幼儿园五大领域活动方案 3-6 岁幼儿五大领域活动方案生成器。按 小班/中班/大班/幼小衔接 与 健康/语言/社会/科学/艺术 五域，从内置活动库挑选游戏、小实验、手工、生活任务，生成 A4 可打印活动卡（领域目标、材料清单、分步玩法、家长安全提示、时长），支持一周活动计划组合。Use when 用户提到 幼儿/孩子/幼儿园/亲子/陪玩 的 活动、游戏、亲子活动、手工、画画、小实验、科学实验、运动游戏、户外活动、带娃、周计划、活动方案、活动卡；or asks for kindergarten act | |
| 幼儿园识字与诗歌课程体系 3-7 岁幼儿识字与诗歌课程：L1 看图认字 → L2 描红 → L3 组词 → L4 古诗填空，生成 A4 可打印练习页（含答案页）。Use when 用户提到 识字、描红、笔顺、组词、古诗、儿歌、默写、幼小衔接练字；or asks for Chinese tracing worksheets, hanzi, poem with pinyin. | |
| 幼儿园英语课程体系 3-7 岁幼儿英语启蒙课程：L1 字母 → L2 自然拼读 → L3 词汇句型 → L4 阅读对话，生成 A4 可打印练习页（含答案），支持诊断定级与错题重练。kindergarten English worksheets, alphabet, phonics, CVC words, sight words. | |
| 幼儿园识数与加减法体系课程 3-7 岁幼儿识数与加减法体系课程。按 L1 识数1-5、L2 识数6-10、L3 比大小与分解组成、L4 10以内加减、L5 20以内进退位五级体系，生成 A4 可打印数学练习页（含答案页），并支持能力诊断、练习批改与进阶建议。Use when 用户提到 幼儿园/幼儿/小班/中班/大班/幼小衔接/学前 的 数学、识数、认数字、数数、点数、比大小、分解组成、凑十法、加减法、口算、应用题、练习纸、练习题、给孩子出题、数学启蒙、数学练习；or asks for kindergar | |
| 幼儿园思维课程体系 面向 3-7 岁幼儿的 L1-L4 思维启蒙体系，生成 A4 可打印训练页与答案。 | |
| Vue3 大屏脚手架 当用户要求创建 Vue3 + TypeScript 的可视化数据大屏、Dashboard 项目脚手架，或要求一键生成大屏页面（含 ECharts 图表、vue3-digital-flop 数字翻牌 KPI、axios 加载初始化 JSON、pinia 状态管理、Element Plus/Naive UI 组件库）时使用。适用：大屏/数据可视化看板项目初始化、按数据 JSON 生成大屏页面、往大屏新增图表模块。不承接单页纯 HTML 大屏（走 echart-chart skil | |
| Vue3 ECharts 大屏与图表一体化 Vue3 + TypeScript + ECharts 的一体化技能，两种模式共用同一份图表资产。模式一 scaffold：一键生成可视化大屏项目（Vite + ECharts + Axios + Pinia + Naive UI，scale 等比缩放适配 1920x1080，主题可切换，初始化 JSON 放 public/data 由 Axios 拉取，数字翻牌用 vue3-digital-flop）；模式二 chart：往已有 Vue3 项目注入单个图表，产出 build | |
| memecub Find memes, 表情包 / 斗图 and reaction images and place them into articles, newsletters, docs or video scripts. Use when the user asks to add memes / 表情包 / reaction images to a piece of writing, to "配图" with memes, or to find a meme for a feelin | |
| 数据分析 通过收集、清洗和分析数据，运用统计和机器学习方法，帮助企业做出数据驱动的业务决策与优化。 | |
| Clawnoter Obsidian 将网页文章保存到本地 Obsidian Vault，支持图片抓取、Markdown 转换、YAML frontmatter 和用户笔记附加。 | |
| Obsidian Save Article 将网页文章保存到本地 Obsidian Vault，支持图片抓取、Markdown 转换、YAML frontmatter 和用户笔记附加。 | |
| Ads Brain Planning Create Pipeline 1.0.0 规划 Agent 新框架中的创编 Pipeline。面向新建投放方案生成，负责从经营诉求归一化出发，经过场景门禁、创建必要门禁、生成 launch_plan_draft，并委托 simple-create 生成 create_campaign。 | |
| Ads Brain Planning Gate Validation 1.0.0 规划 Agent 新框架中的门禁与校验通用协议。定义 Capability Gate、Scenario Gate、Business Guard、Payload Validation、Execution Gate、场景化 Guard、skipped 状态、blocked_reason 与 next_action。 | |
| Ads Brain Planning Optimize Pipeline 1.0.0 规划 Agent 新框架中的优化 Pipeline。面向投放改善目标生成优化策略，支持存量对象、待创建草案、策略变量和目标导向优化；诊断只是可选协作依据，不等同于优化本身。 | |
| Ads Brain Planning Pipeline 1.0.0 规划 Agent 新框架内容层通用 Pipeline。用于沉淀创编/优化能力分流、会话状态识别、门禁校验、统一输出协议与后续接入约定；当前暂不接 agent-card 路由。 | |
| Adsbrain Trace Error Locator AdsBrain / Codewiz Langfuse Trace 错误定位 Skill。用于用户提供 Langfuse trace 链接、trace_id、截图、现象描述、对错样例时，在 XRay/Langfuse 平台查询链路，定位错误发生的 observation/step/tool/model 位置，解释... | |
| tophantppt 根据给定背景图片的视觉风格和配色，生成多版式且文字可编辑的符合设计要求的 PPT 演示文稿。 | |
| Dist OpenClaw 3.8+ 智能上下文管理与记忆系统插件 | |
| Memory Master Local memory system with structured indexing and auto-learning. Auto-write, heuristic recall, auto learning when knowledge is insufficient. Compatible with s... | |
| LLM Output Explainer 卡帕西 LLM 输出讲解方法论（Explain It Like I'm ...）。当用户要求把复杂概念、论文、代码、产品、方案、调研结果"讲清楚/讲明白/深入浅出/通俗讲解/做个讲解/explain like I'm X"、要求面向特定受众（领导/客户/新员工/公众/跨部门）改写或呈现内容、或要求生成讲解类工件（STE100 受控语言文本、修辞性 Mermaid 图表、单文件 HTML 交互讲解页、Manim 讲解视频、一次性演示工具）时使用。流程：受众四问 → 决策矩阵选机 | |
| Mail Skill Full access to Exchange 2010/2013 EWS for managing emails, folders, attachments, calendar events, contacts, tasks, and out-of-office settings. | |
| LovTrip China Map (Amap) 高德地图助手 / Amap Map Tools for China — 地理编码、周边搜索、路线规划、地图链接生成。当用户需要中国大陆范围的地理编码、地点搜索、路线规划时使用。 | |
| LovTrip Content Browser 旅行内容查询 / Travel Content Browser — 搜索攻略、目的地、行程，零 API Key。当用户需要搜索旅行攻略、浏览目的地、查看行程方案时使用。 | |
| LovTrip Meetup Planner 聚会规划助手 / Multi-Person Meetup Planner — 多人聚会地点推荐、时间协调、行程生成。当用户需要规划多人聚会、约会、找最优碰面地点时使用。 | |
| LovTrip AI Travel Planner AI 行程规划 / AI Travel Itinerary Planner — 智能生成多日旅行行程，支持景点搜索、预算计算、酒店航班。当用户需要旅行规划、生成行程、搜索景点酒店航班时使用。 | |
| LovTrip Video to Article 视频转文章 / YouTube Video to Article — 使用 Gemini AI 将视频转为结构化文章。当用户需要将 YouTube 视频转换为文章时使用。 | |
| Pixshop CLI — AI Image & Video Generation Pixshop CLI 命令行工具 — AI 图片/视频生成、编辑工具、应用市场、提示词库 / Pixshop CLI — command-line AI image/video generation, editing tools, apps, prompts. Use when user wants to ge... | |
| Pixshop Creative API — Developer REST Endpoints Pixshop 开发者 REST API — 图片生成/编辑、视频制作、提示词库、应用市场、社区 / Pixshop Developer REST API — image generation/editing, video, prompts, apps, community endpoints. Use when... | |
| Pixshop MCP — 28+ AI Creative Tools Pixshop MCP 集成 — 28+ AI 图片视频创意工具，Claude 直接调用 / Pixshop MCP — 28+ AI creative tools for image & video generation, editing, effects in Claude. Use when user wa... | |
| XiaChat CLI — AI Personality Matching XiaChat CLI 命令行 — SOUL 档案管理、人格匹配、AI 分身预聊天、Soul Square 角色聊天 / XiaChat CLI — SOUL profile management, personality matching, AI avatar pre-chat, persona chat fr... | |
| XiaChat MCP — AI Personality Matching XiaChat MCP 集成 — AI 人格匹配、分身预聊天、Soul Square 角色聊天，Claude 直接调用 / XiaChat MCP — AI personality matching, avatar pre-chat, Soul Square persona chat in Claude. Use... | |
| ukui-settings A skill for exporting, inspecting and applying UKUI desktop gsettings presets, with fine-grained get/set support. | |
| hr-recruitment-jd-generator Use when users ask to create a recruitment JD, initialize recruiting files, or configure the HR JD generator or its optional model. | |
| context-compression-claude-code Use this skill whenever the conversation context is getting long, when a user asks to "compress", "summarize", or "clean up" the conversation, or when you de... | |
| safe-shell-execution-claude-code Perform layered safety checks on shell commands: detect injections, warn before destructive ops, protect sensitive paths, and require confirmations before ex... | |
| pet-camera-vision 桌宠摄像头感知 Skill。截图并调用多模态模型识别人脸、颜色与表情，输出结构化 JSON（在场状态+情绪+颜色），供情绪分析、长期记忆与陪伴反馈使用。 | |
| pet-feedback 桌宠反馈 Skill。触摸屏表情显示（按情绪/状态切换）+ 语音反馈（TTS 合成并播放）+ 触摸检测与自动亮屏，构成"感知—分析—反馈"闭环的反馈端。 | |
| 微信公众号自动发布器 自动撰写技术文章并发布到微信公众号 - 从选题到发布全流程自动化 | |
| Control Usb Relay Control USB relay modules with on/off switching, state tracking, and automation support. | |
| Usb Light Sensor Reader Read light intensity from USB sensors with real-time monitoring, filtering, and threshold detection. | |
| Web Auto Analyzer Automatically analyze websites for performance metrics and audit issues using Lighthouse. | |
| 资产配置师 ［何时使用］当用户需要资产配置方案时；当用户问"我应该如何配置资产"时；当进行生命周期规划时；当需要定投计划时 | |
| 条件单投资助手 ［何时使用］当用户问'XX代码怎么投''条件单怎么设''ETF推荐什么策略'时；当用户说'帮我分析这个ETF''我的资金怎么配置条件单'时；当检测到股票代码+投资问题组合时。［不适合］场外基金赎回（周期长）、期货/期权（高风险衍生品）、个股深度基本面分析（需财报数据）。 | |
| Context Manager ［何时使用］当用户需要管理个人上下文（Context）时；当用户说"管理我的上下文""整理重要信息""记录关键认知"时；当检测到"决策背景""记忆外脑""认知地图""内心认知"等关键词时；基于 AI 时代个人上下文管理需求，打造思维树构建师 | |
| 周期定位师 ［何时使用］当用户需要判断经济周期位置时；当用户问"现在经济处于什么周期"时；当进行资产配置决策时；当需要债务周期分析时 |
49,801–49,850 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.