Asymptote Lab's Agent Beacon

Unified telemetry for AI agents, wherever they run.

Docs · Discord · Install · For Security & IT Teams · Dashboard · Commands

What is Agent Beacon

Agent Beacon is the world's first open-source telemetry layer for AI agents wherever they run: locally, in CI, or in the cloud.

The problem is that AI agent activity is fragmented across runtimes, leaving teams without a consistent way to get visibility into what agents are doing. Agent Beacon solves this by extending the OpenTelemetry GenAI standard and normalizing runtime events into a unified data model.

Beacon is built to be easy to deploy for Security and IT teams through MDM deployment, CI workflows, and cloud-agent setup paths, and to emit agent harness telemetry logs to all the major enterprise-grade SIEMs.

Learn more in the Agent Beacon Documentation.

High-Level Architecture

Beacon keeps endpoint collection, processing, and inspection local by default, while extending the same normalized event model to CI and cloud-agent telemetry paths under customer control.

• Agent runtime layer: Hooks, OpenTelemetry sources, CI wrappers, and SDKs capture supported activity from AI agent harnesses wherever they run.
• Beacon endpoint layer: Local processing normalizes events, applies retention and redaction settings, and writes durable endpoint telemetry.
• Output layer: Teams inspect events in the local dashboard, retain JSONL, or forward records into all the major enterprise-grade SIEMs.

Supported Surfaces

Beacon captures supported agent harness activity across local endpoints, CI jobs, and cloud-agent surfaces, then writes normalized events that teams can inspect in place or forward into customer-managed security pipelines.

Agent Runtimes

Agent Beacon supports the most popular enterprise agent harnesses across local, CI, and cloud surfaces.

Local Agents

Coding Agent Harnesses

Knowledge Worker Agent Harnesses

CI Agents

Cloud Agents

Output Destinations

Agent Beacon writes endpoint telemetry to local JSONL by default and supports customer-controlled forwarding into common security information and event management (SIEM), log aggregation, and object storage destinations.

Security Information and Event Management (SIEM)

Log Aggregation

Object Storage

Local

MDM Deployment

Agent Beacon is designed for Security and IT teams to deploy and validate through standard MDM workflows.

Version tags publish a signed, notarized, and stapled Apple Silicon endpoint .pkg to GitHub Releases for MDM/manual download, .deb and .rpm packages for Linux on amd64 and arm64, and an x64 .msi for Windows. Homebrew and release archives remain available for CLI installs across supported macOS, Linux, and Windows architectures.

Installing a native package performs the system-mode install itself: it registers and starts the service, writes configuration to the platform's machine-wide location, and points the interactive user's agent runtimes at the local collector. See the Linux install guide or the Windows install guide.

The macOS package includes GCS forwarder helpers at /opt/beacon/jamf/claude/gcs/{install-forwarder.sh,run-forwarder.sh,repair-hooks-and-forwarder.sh}. They run bundled Vector as com.beacon.endpoint.gcs-forwarder, write runtime and inventory objects below one root prefix, and reference an externally delivered service-account JSON through GOOGLE_APPLICATION_CREDENTIALS.

Dashboard and Local Detection

Beacon includes a local, read-only dashboard for validating endpoint activity without a hosted backend. See the dashboard docs for overview, log search, and runtime JSONL inspection.

Beacon writes endpoint activity to runtime.jsonl and periodic Cursor/Claude Code configuration inventory metadata to the sibling inventory_state.jsonl. Local log storage and retention behavior are summarized in the local testing and logs docs.

For offline threat detection, beacon scan runs open threat rules over local telemetry with no network access. See the Threat Rules spec and generated rule field reference for rule format, CEL matching, fixtures, and supported event fields.

Start Here

• Beacon CLI docs — full documentation index.
• Installation — install Beacon locally.
• For Security & IT Teams — rollout, validation, and security workflows.
• Security review — review Beacon's architecture, data handling, and local-only posture.
• Endpoint agent — install, status, repair, and uninstall.
• Dashboard — inspect local runtime logs.
• Endpoint event schema — normalized JSONL event model.
• Supported surfaces — supported runtimes, destinations, and boundaries.
• Command reference — detailed CLI command docs.

Quickstart

See the Quickstart docs for the full setup paths.

First-run onboarding

The first time you run beacon endpoint install in a terminal, Beacon asks two questions — your email and whether this is work or personal use — and sends the answers to Asymptote once. Knowing who runs Beacon is how we decide which runtimes and integrations to build next.

Exactly what is sent, and nothing else:

Never sent: prompts, file contents, commands, telemetry events, repository names, or anything else Beacon captures. The endpoint agent itself stays local-only — this is one HTTP request at install time, not an ongoing channel.

It happens once per machine. The answer is recorded in ~/.beacon/profile.json, which survives uninstall so a reinstall does not ask again.

It never runs non-interactively. Package postinstall scripts, MDM deployments, --system installs, CI, --dry-run, and any piped or redirected stdin skip it silently. Unattended installs that still need it suppressed can set:

BEACON_ONBOARDING=0 beacon endpoint install

For a fleet rollout where you do want attribution but have no terminal, supply the answers up front:

BEACON_ONBOARDING_EMAIL=it@company.com BEACON_ONBOARDING_USAGE=work \
  beacon endpoint install

Inspect or clear the record at any time:

beacon endpoint onboarding          # show what was recorded
beacon endpoint onboarding --reset  # clear it

To have your record deleted, email the install ID shown by beacon endpoint onboarding to support@asymptotelabs.ai.

For Security & IT Teams

Start with the security and IT quickstart and managed deployment guidance for rollout, validation, retention, and SIEM forwarding. For vendor review, see the security review.

For Developers

Install the released Beacon CLI locally with Homebrew:

brew tap asymptote-labs/tap
brew install beacon
beacon version

Or build from source:

cd cli/beacon
make build

To verify a change against a real Claude Code session rather than only synthetic payloads, beacon-sandbox runs one in a disposable Linux sandbox and checks what Beacon actually captured:

cd beacon-sandbox
go run ./cmd/beacon-sandbox doctor
go run ./cmd/beacon-sandbox run --scenario s02-bash-command

See Verify Beacon In A Sandbox for setup, what it can verify, and its limitations.

For setup, deployment, integrations, and command details, see the Beacon CLI docs.

Star Growth

License

MIT