Beacon: Open-Source Endpoint Telemetry for Local AI Agents

Beacon is Asymptote Lab's open-source endpoint agent that gives security and IT teams visibility into local AI agent activity. It hooks into agent harnesses like Claude Code, Codex CLI, OpenCode, Factory Droid, Claude Cowork, and Cursor, captures supported activity, and normalizes it into endpoint events stored as local JSONL or forwarded to SIEM pipelines.

Supported Agents and Outputs

The agent supports the following coding agent runtimes:

• Claude Code – via local OpenTelemetry configuration
• Codex CLI – via local OpenTelemetry configuration
• OpenCode – via Beacon hook adapter
• Factory Droid – via local OpenTelemetry configuration and optional hook adapter
• Claude Cowork – via admin-configured OpenTelemetry setup
• Cursor – via Beacon hook adapter

Outputs include local JSONL (default), Wazuh (localfile configuration with content pack), Elastic (Filebeat or Elastic Agent over JSONL), Splunk HEC (optional forwarding during install/repair), and customer-managed SIEM pipelines.

Architecture and Deployment

Collection, processing, and inspection remain local to the endpoint; forwarding is customer-controlled. Beacon filters out generic runtime metrics (Node.js event loop, V8 heap, CPU, memory) by default so agent prompts, tools, approvals, and file activity stay easy to inspect. To include runtime metrics, use beacon endpoint install --include-runtime-metrics or beacon endpoint repair --include-runtime-metrics.

For MDM deployment, Beacon supports Jamf Pro (macOS package, policy scripts, Extension Attributes) and Fleet (macOS package with user-context helpers).

Quickstart

Install via Homebrew:

brew tap asymptote-labs/tap
brew install beacon

For full setup paths, see the Quickstart docs. Security and IT teams should refer to the managed deployment guidance for rollout, validation, retention, and SIEM forwarding.