Asymptote Lab's Agent Beacon

Unified telemetry for AI agents, wherever they run.

Docs · Discord · Install · For Security & IT Teams · Dashboard · Commands

What is Agent Beacon

Agent Beacon is the world's first open-source telemetry layer for AI agents wherever they run: locally, in CI, or in the cloud.

Beacon started with local endpoint telemetry for security and IT teams that need visibility into AI agent activity on employee machines. It now captures supported runtime activity across local agents, CI agents, and cloud agents, then normalizes that activity into events your team can inspect, retain, and forward under your control.

Beacon is built to be easy to deploy for Security and IT teams through
MDM deployment, CI workflows, and cloud-agent setup paths, and to
emit agent harness telemetry logs to
all the major enterprise-grade SIEMs.

Learn more in the Agent Beacon Documentation.

High-Level Architecture

Beacon keeps endpoint collection, processing, and inspection local by default,
while extending the same normalized event model to CI and cloud-agent telemetry
paths under customer control.

• Agent runtime layer: Hooks, OpenTelemetry sources, CI wrappers, and SDKs
  capture supported activity from AI agent harnesses wherever they run.
• Beacon endpoint layer: Local processing normalizes events, applies
  retention and redaction settings, and writes durable endpoint telemetry.
• Output layer: Teams inspect events in the local dashboard, retain JSONL,
  or forward records into all the major enterprise-grade SIEMs.

Supported Surfaces

Beacon captures supported agent harness activity across local endpoints, CI
jobs, and cloud-agent surfaces, then writes normalized events that teams can
inspect in place or forward into customer-managed security pipelines.

Agent Runtimes

Agent Beacon supports the most popular enterprise agent harnesses across local,
CI, and cloud surfaces.

Local Agents

Coding Agent Harnesses

Knowledge Worker Agent Harnesses

CI Agents

Cloud Agents

Output Destinations

Agent Beacon writes endpoint telemetry to local JSONL by default and supports
customer-controlled forwarding into common security information and event
management (SIEM), log aggregation, and object storage destinations.

Security Information and Event Management (SIEM)

Log Aggregation

Object Storage

Local

MDM Deployment

Agent Beacon is designed for Security and IT teams to deploy and validate
through standard MDM workflows.

Dashboard

Beacon includes a local, read-only dashboard for validating endpoint activity
without a hosted backend. The overview screen summarizes recent runtime events
and collection status, while log search helps teams inspect normalized event
records during rollout, testing, and investigations. The token usage screen
breaks captured token telemetry down by model, session (with per-step
drilldown), CI run, and harness, including context-window utilization and
runtime-reported cost. The detections screen lists the active threat-detection
rules (the local store when present, otherwise the embedded baseline), and the
findings screen runs those rules over the runtime log on load and links each hit
back to its rule — the same read-only, offline detection as beacon scan.

For scripted or CI reporting, beacon endpoint tokens prints the same token
usage rollups as text or JSON from any runtime JSONL log, for example
beacon endpoint tokens --log-path "$BEACON_CI_LOG_PATH" --json after a CI
session.

Beacon writes endpoint activity to a stable local runtime.jsonl file. The
active file rotates at 10 MiB with five numbered local archives, keeping the
endpoint handoff file bounded while external SIEM forwarders continue tailing
the active path. The dashboard reads the active log plus retained numbered
archives for local triage; SIEM destinations remain the source of truth for
long-term retention and search.

Detect threats in local telemetry

beacon scan runs threat-detection rules over the local runtime log and reports
findings — read-only, with no network access. Rules are an open, versioned format
(spec/threat-rules) whose match conditions are
CEL expressions over the endpoint event schema, and each rule ships
its own conformance fixtures.

beacon scan                       # run the active rules over the runtime log
beacon scan --json                # machine-readable findings
beacon scan --min-severity high   # only high/critical findings
beacon scan --fail-on high        # non-zero exit for CI gating

The detection engine ships in the binary, but the rule corpus is external data loaded
from a local store (~/.beacon/endpoint/rules), so a growing rule set never enlarges the
agent. A small baseline is built in; manage the store with beacon rules:

beacon rules list                 # active rules (baseline or store)
beacon rules add ./my-rules       # install local rule files (validated before install)
beacon rules pull <url>           # explicit, user-initiated fetch of a rule pack
beacon rules lint ./rules         # validate + run a rule pack's fixtures (authoring)
beacon rules fields               # list event fields a rule can match on

The full rule pack ships as a release asset (threat-rules.tar.gz), not inside the
binary, so the corpus grows without enlarging beacon. Install it with one command:

beacon rules pull https://github.com/asymptote-labs/agent-beacon/releases/latest/download/threat-rules.tar.gz
beacon scan

beacon rules pull is the only command that reaches the network, and only when you run
it against a URL you supply — the agent never fetches rules on its own. Offline or
air-gapped users can instead git clone the repo and run beacon rules add ./rules.

Start Here

• Beacon CLI docs — full documentation index.
• Installation — install Beacon locally.
• For Security & IT Teams — rollout, validation, and security workflows.
• Security review — review Beacon's architecture, data handling, and local-only posture.
• Endpoint agent — install, status, repair, and uninstall.
• Dashboard — inspect local runtime logs.
• Endpoint event schema — normalized JSONL event model.
• Supported surfaces — supported runtimes, destinations, and boundaries.
• Command reference — detailed CLI command docs.

Quickstart

See the Quickstart docs for the
full setup paths.

For Security & IT Teams

Start with the
security and IT quickstart and
managed deployment guidance
for rollout, validation, retention, and SIEM forwarding. For vendor review, see
the security review.

For Developers

Install the released Beacon CLI locally with Homebrew:

brew tap asymptote-labs/tap
brew install beacon
beacon version

Or build from source:

cd cli/beacon
make build

For setup, deployment, integrations, and command details, see the
Beacon CLI docs.

Star Growth

License

MIT