Unified telemetry for AI agents, wherever they run.
Docs · Discord · Install · For Security & IT Teams · Dashboard · Commands
Beacon is the system of record for all your agent activity, wherever your agents run.
Agent activity is fragmented across harnesses and environments, leaving no consistent way to see, reconstruct, or reason about what agents actually did.
Beacon solves this problem by capturing the full agent execution trace across every harness and environment, and normalizes that activity into a single, unified schema.
Key Capabilities:
| Capability | What it means |
|---|---|
| Broad runtime coverage | Local agent runtimes, plus browser chat, CI, cloud agents, and SDKs |
| One unified schema | Every session, prompt, tool, command, edit, approval, and token in one event model |
| Local-first by default | Data stays on the machine: durable JSONL and a read-only dashboard, no account |
| Offline threat detection | beacon scan runs open Threat Rules over your logs, with no network |
| Forwards where you already work | Stream the same log to your SIEM, observability, or object storage |
| Deploys in one command or fleet-wide | One command on a laptop, MDM across a fleet |
Read the documentation to learn more.
Prerequisites:
- macOS, Linux, or Windows. Homebrew installs the CLI on macOS; Linux and Windows install from a native package that registers the service itself
- At least one supported agent runtime on the machine
- No account, no API key, and no network dependency. Forwarding to Asymptote Managed additionally needs Vector 0.50+, which the macOS package bundles
Installation
macOS — Homebrew:
brew trust asymptote-labs/tap
brew tap asymptote-labs/tap
brew install beacon
# Install the endpoint agent and point local runtimes at it
beacon endpoint installLinux — .deb or .rpm from the
latest release (amd64,
arm64). The package does the whole install, so there is no second command:
sudo apt install ./beacon_<version>_linux_amd64.deb # Debian, Ubuntu
sudo dnf install ./beacon_<version>_linux_amd64.rpm # Fedora, RHEL, Rocky, AlmaWindows — the x64 .msi from the
latest release, from an
elevated prompt. It also does the whole install:
msiexec /i BeaconEndpointAgent-<version>-x64.msi # interactive
msiexec /i BeaconEndpointAgent-<version>-x64.msi /qn # silent, for fleet deploymentThen watch what your agents are doing:
beacon endpoint dashboardNote The dashboard is local and read-only. Events land in
~/.beacon/endpoint/logs/runtime.jsonlfor a user-mode install,/var/log/beacon-agent/runtime.jsonlfor a system-mode one, andC:\ProgramData\Beacon\Endpoint\logs\runtime.jsonlon Windows.
Ways to Run Beacon:
- Open Source: free, local-only, your machine and your logs. Quickstart
- Asymptote Enterprise: fleet rollout through MDM, managed ingest with per-device approval and revocation, and one dashboard across your organization. Book a demo →
Asymptote's enterprise platform builds on the open-source foundation and adds real-time policy enforcement. It solves the engineering and infrastructure challenges of analyzing fleet-wide agent activity in real time for detection, remediation, and containment at petabyte scale.
Enterprise Capabilities:
| Capability | What it means |
|---|---|
| Real-time policy enforcement | Allow or deny agent actions as they happen, with identity mapping and approval workflows |
| Real-time detection and response | Detections run on the live event stream, surfacing risky agent behavior as it happens with the session timeline to act on it |
| Fleet-wide inventory | Every agent, harness, and device in the organization in one view, rolled out through MDM |
| Managed ingest and retention | Hosted search and long-term retention across every endpoint, without running the pipeline yourself |
| SSO and access control | Single sign-on, role-based access control, and priority support and onboarding |
Beacon captures activity where each agent actually runs, then normalizes it into a single OpenTelemetry-based event model.
See the open-source architecture reference for the full breakdown by surface.
| Logo | Runtime | Collection | Session | Prompt | Tool | Command | File | Approval | MCP | Tokens |
|---|---|---|---|---|---|---|---|---|---|---|
| Antigravity CLI | Hooks | ✅ | ✅ | ✅ | ✅ | ✅ | – | – | – | |
| Claude Code | OTLP + hooks + poll | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| Claude Cowork | OTLP | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| Cline | Plugin + poll | ✅ | ✅ | ✅ | ✅ | ✅ | – | ✅ | ✅ | |
| Codex CLI | OTLP + hooks + poll | ✅ | ✅ | ✅ | ✅ | – | ✅ | – | ✅ | |
| Codex Desktop | OTLP | ✅ | ✅ | ✅ | ✅ | – | ✅ | – | ✅ | |
| Cursor | Hooks + poll | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | – | |
| DeepSeek Harness | Hooks | ✅ | ✅ | ✅ | ✅ | ✅ | – | ✅ | – | |
| Devin CLI | Hooks | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | – | |
| Devin Desktop | Hooks | – | ✅ | ✅ | ✅ | ✅ | – | ✅ | – | |
| Factory Droid | OTLP + hooks + poll | ✅ | ✅ | ✅ | – | ✅ | ✅ | – | – | |
| fx (Vercel Labs) | Poll | ✅ | ✅ | ✅ | ✅ | ✅ | – | ✅ | ✅ | |
| Gemini CLI | OTLP | – | ✅ | ✅ | – | ✅ | ✅ | ✅ | – | |
| GitHub Copilot CLI | OTLP | ✅ | ✅ | ✅ | – | – | ✅ | – | – | |
| goose | OTLP + hooks | ✅ | ✅ | ✅ | ✅ | ✅ | – | ✅ | ✅ | |
| Grok Build | Hooks + poll | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | – | – | |
| Hermes Agent | Hooks + poll | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | – | |
| Kiro | Hooks | ✅ | ✅ | ✅ | ✅ | ✅ | – | ✅ | – | |
| Muse Code | Hooks | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | – | – | |
| Oh My Pi | Extension | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| OpenClaw Gateway | Plugin + OTLP + poll | ✅ | ✅ | ✅ | ✅ | ✅ | – | ✅ | ~ | |
| OpenCode | Plugin + poll | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| OpenHands | Hooks | ✅ | ✅ | ✅ | ✅ | ✅ | – | ✅ | – | |
| Pi | Extension + poll | ✅ | ✅ | ✅ | ✅ | ✅ | – | ✅ | ✅ | |
| Prime Agent | Extension + poll | ✅ | ✅ | ✅ | ✅ | ✅ | – | – | ✅ | |
| Qwen Code | Hooks | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | – | – | |
| Senpi | Extension | ✅ | ✅ | ✅ | ✅ | ✅ | – | – | ✅ | |
| VS Code | OTLP + hooks | ✅ | ✅ | ✅ | ~ | ~ | – | ~ | – |
| Logo | Site | Collection | Prompt | Response | Tool | Tokens |
|---|---|---|---|---|---|---|
| Claude.ai | Extension → local OTLP | ✅ | ✅ | ✅ | ~ | |
| ChatGPT | Extension → local OTLP | ✅ | ✅ | ✅ | – |
| Logo | Runtime | Collection | Session | Prompt | Tool | Command | File | Tokens |
|---|---|---|---|---|---|---|---|---|
| Claude Code Cloud Agents | Sandbox hooks → GCS or S3 | ✅ | ✅ | ✅ | ✅ | ✅ | – | |
| Cursor Cloud Agents | Sandbox hooks → GCS or S3 | – | ✅ | ✅ | ✅ | ✅ | – | |
| Devin Cloud Agents | API poll → GCS | ✅ | ✅ | – | – | – | ✅ | |
| CI jobs | beacon ci exec → temporary local collector |
✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Logo | SDK surface | Collection | Captures |
|---|---|---|---|
| Anthropic | OpenLLMetry through @asymptote/sdk |
Model call spans, errors, and OTel attributes | |
| OpenAI | OpenLLMetry through @asymptote/sdk |
Model call spans, errors, and OTel attributes | |
| Claude Agent SDK | Observe.wrapClaudeAgentQuery() |
Query root spans with Beacon-compatible prompt attributes | |
| Vercel AI SDK | experimental_telemetry tracer handoff |
Model call and tool spans where telemetry is enabled |
Beacon writes endpoint telemetry to local JSONL by default and supports customer-controlled forwarding into SIEM, log aggregation, and object storage destinations, plus an opt-in managed path to the Asymptote dashboard.
| Destination | Category | Support path |
|---|---|---|
| Local JSONL | Local | Default endpoint log and local dashboard source |
| Asymptote Managed | Managed | Vector http forwarder with a per-device key approved in the browser, revocable from the dashboard |
| CrowdStrike Falcon LogScale HEC | SIEM | Endpoint forwarding with LogScale ingest tokens during install or repair |
| Microsoft Sentinel | SIEM | Azure Monitor Agent and Data Collection Rule content pack |
| Rapid7 InsightIDR | SIEM | Custom Logs webhook content pack |
| Splunk HEC | SIEM | Endpoint forwarding during install or repair |
| Sumo Logic | SIEM | HTTP Logs & Metrics Source content pack |
| Wazuh | SIEM | Localfile configuration and Beacon Wazuh content pack |
| AWS CloudWatch Logs | Log aggregation | Vector content pack using customer-managed AWS credentials |
| Datadog | Log aggregation | Datadog Agent custom log collection |
| Elastic | Log aggregation | Filebeat or Elastic Agent content pack |
| Customer-managed pipelines | Log aggregation | Forwarding from local Beacon JSONL under customer control |
| AWS S3 | Object storage | Vector, CI upload, or direct compressed snapshots from supported cloud agents |
| Google Cloud Storage | Object storage | Vector and packaged macOS helpers, CI upload, or direct compressed snapshots |
Every destination except Asymptote Managed reads the same local JSONL, under your control.
Every version tag publishes native packages that perform the system-mode install themselves: they register and start the service, write machine-wide configuration, and point the interactive user's agent runtimes at the local collector. Homebrew and release archives remain available for CLI installs.
| Platform | Package | Service manager | Notes |
|---|---|---|---|
| macOS | Signed, notarized .pkg (Apple Silicon) |
launchd | Jamf Pro, Fleet, and Rippling assets; Homebrew for single machines |
| Linux | .deb / .rpm (amd64, arm64) |
systemd | Supervised fallback without systemd |
| Windows | .msi (x64) |
Service Control Manager | Unsigned for now; verify the published .sha256 |
The macOS package also ships
GCS forwarder helpers under
/opt/beacon/jamf/claude/gcs/ that run bundled Vector as a launchd job. Connecting a
system-mode endpoint to Asymptote Managed is interactive today: an admin runs
sudo beacon endpoint connect --system on the machine and approves it in the console
user's browser. Headless enrollment tokens for MDM fleets are planned as a follow-up.