Monitoring Local AI Agent Activity with Beacon

Practical Summary of Beacon

Beacon is an open-source telemetry layer designed to provide a system of record for AI agent activity. It addresses the fragmentation of agent execution traces across various runtimes, environments, and harnesses by normalizing activity into a single, unified schema. By capturing sessions, prompts, tool usage, commands, file edits, and token consumption, Beacon allows security and IT teams to reconstruct and reason about agent behavior. The tool operates with a local-first philosophy, ensuring that data remains on the machine in durable JSONL format, while providing options for offline threat detection and integration with existing SIEM, observability, or object storage pipelines.

Prerequisites and System Requirements

To deploy Beacon, you must be running a supported operating system: macOS, Linux, or Windows. The tool requires at least one supported agent runtime to be present on the machine to capture meaningful telemetry. Beacon is designed to function without an account, API key, or network dependency for its core local operations. If you intend to use the Asymptote Managed forwarding path, you will additionally need Vector 0.50 or higher, which is bundled with the macOS package. For system-mode deployments, the tool registers itself as a service to ensure persistent monitoring across user sessions.

Installation Procedures

Installation methods vary by platform to ensure native integration. On macOS, the recommended approach uses Homebrew to manage the CLI and endpoint agent. On Linux, users should install the provided .deb or .rpm packages from the latest release, which handle the service registration automatically. For Windows, an x64 .msi installer is available for both interactive and silent fleet deployments. The following command demonstrates the installation process for macOS:

brew trust asymptote-labs/tap
brew tap asymptote-labs/tap
brew install beacon

# Install the endpoint agent and point local runtimes at it
beacon endpoint install

Documented Workflow and Data Collection

Once installed, Beacon automatically captures activity from supported runtimes, including local agents like Claude Code, Cursor, and Devin, as well as browser-based chat interfaces and CI pipelines. The data is normalized into an OpenTelemetry-based model. Users can monitor this activity in real-time using the local dashboard. The events are stored in specific log files depending on the installation mode: ~/.beacon/endpoint/logs/runtime.jsonl for user-mode, /var/log/beacon-agent/runtime.jsonl for system-mode on Linux, or C:\ProgramData\Beacon\Endpoint\logs\runtime.jsonl on Windows. You can launch the dashboard with the command beacon endpoint dashboard.

Security Visibility and Threat Detection

Beacon provides offline threat detection capabilities through the beacon scan command, which evaluates logs against open Threat Rules without requiring a network connection. This allows security teams to identify risky agent behavior locally. For organizations requiring broader visibility, Beacon supports forwarding telemetry to various destinations, including SIEM platforms like Splunk, Microsoft Sentinel, and CrowdStrike Falcon LogScale, as well as log aggregators like Datadog and Elastic. These integrations allow security teams to correlate agent activity with other infrastructure logs, facilitating incident response and policy enforcement at scale.

Limitations and Considerations

While Beacon offers broad coverage, the depth of telemetry depends on the specific agent runtime and its integration method (e.g., OTLP, hooks, or plugins). Some runtimes may not support all event types, such as file edits or approval workflows. Furthermore, while the open-source version is free and local-only, advanced features like real-time policy enforcement, fleet-wide inventory, and managed ingest are reserved for the Asymptote Enterprise platform. Users should also note that while the macOS package includes GCS forwarder helpers, connecting system-mode endpoints to Asymptote Managed currently requires an interactive approval process in the console user's browser.

Target Audience and Use Cases

Beacon is primarily intended for security engineers, IT administrators, and developers who need to maintain visibility into AI agent activity within their organization. It is particularly useful for teams managing fleets of developer machines where AI agents are used for code generation, task automation, or research. By providing a unified schema and standardized output, Beacon enables organizations to implement consistent security policies and audit trails for AI-driven workflows. Whether you are an individual developer monitoring your own local agents or an enterprise administrator managing thousands of endpoints, Beacon provides the necessary infrastructure to capture and analyze AI execution data.