Unified endpoint telemetry for AI agents.
Docs · Install · For Security & IT Teams · Dashboard · Commands
What Is Beacon?
Beacon is Asymptote's open-source endpoint agent for security and IT teams that need visibility into local AI agent activity.
It runs locally, captures supported activity from local agent harnesses like Claude Code, Codex CLI, OpenCode, Factory Droid, Claude Cowork, and Cursor, then normalizes that activity into endpoint events your team can inspect and retain locally.
Beacon is built to be easy to deploy for Security and IT teams through MDM deployment and to connect to Wazuh, Elastic, Splunk HEC, or customer-managed SIEM pipelines, while remaining visibility-first and local-first during normal endpoint collection.
Supported Surfaces
Beacon captures supported coding-agent activity locally and writes normalized endpoint events that teams can inspect in place or forward into customer-managed security pipelines.
Coding Agents / Runtimes
| Agent Harness | Support path |
|---|---|
| Claude Code | Local OpenTelemetry configuration |
| Codex CLI | Local OpenTelemetry configuration |
| OpenCode | Beacon hook adapter |
| Factory Droid | Local OpenTelemetry configuration and optional hook adapter |
| Claude Cowork | Admin-configured OpenTelemetry setup |
| Cursor | Beacon hook adapter |
SIEM / Output Destinations
| SIEM / output destination | Support path |
|---|---|
| Local JSONL | Default endpoint log and local dashboard source |
| Wazuh | Localfile configuration and Beacon Wazuh content pack |
| Elastic | Filebeat or Elastic Agent content pack over local JSONL |
| Splunk HEC | Optional endpoint forwarding during install or repair |
| Customer-managed SIEM pipelines | Forwarding from local Beacon JSONL under customer control |
MDM Deployment
| MDM platform | Support path |
|---|---|
| Jamf Pro | macOS package, policy scripts, validation, and Extension Attributes |
| Fleet | macOS package and user-context deployment helpers |
High-Level Architecture
Beacon keeps collection, processing, and inspection local to the endpoint while leaving forwarding under customer control.
- Agent runtime layer: Local hooks and OpenTelemetry sources capture supported activity from AI agent harnesses on the endpoint.
- Beacon endpoint layer: Local processing normalizes events, applies retention and redaction settings, and writes durable endpoint telemetry.
- Output layer: Teams inspect events in the local dashboard, retain JSONL, or forward records into Wazuh, Elastic, Splunk HEC, and customer-managed SIEM pipelines.
Beacon filters generic process and runtime metrics, such as Node.js event loop,
V8 heap, process CPU, and process memory telemetry, out of the local endpoint
JSONL by default so agent prompts, tools, approvals, and file activity remain
easy to inspect. Advanced deployments can opt back into those low-level OTLP
metrics with beacon endpoint install --include-runtime-metrics or
beacon endpoint repair --include-runtime-metrics.
Dashboard
Beacon includes a local, read-only dashboard for validating endpoint activity without a hosted backend. The overview screen summarizes recent runtime events and collection status, while log search helps teams inspect normalized event records during rollout, testing, and investigations.
Start Here
- Beacon CLI docs — full documentation index.
- Installation — install Beacon locally.
- For Security & IT Teams — rollout, validation, and security workflows.
- Endpoint agent — install, status, repair, and uninstall.
- Dashboard — inspect local runtime logs.
- Endpoint event schema — normalized JSONL event model.
- Supported surfaces — supported runtimes, destinations, and boundaries.
- Command reference — detailed CLI command docs.
Quickstart
See the Quickstart docs for the full setup paths.
For Security & IT Teams
Start with the security and IT quickstart and managed deployment guidance for rollout, validation, retention, and SIEM forwarding.
For Developers
Install the released Beacon CLI locally with Homebrew:
brew tap asymptote-labs/tap brew install beacon beacon version
Or build from source:
For setup, deployment, integrations, and command details, see the Beacon CLI docs.