Asymptote-Labs/agent-beacon

Asymptote Lab’s Agent Beacon – What it does

Agent Beacon is an open‑source telemetry layer that sits on the machines where AI agents run (your laptop, CI runners, cloud VMs, browsers, etc.) and records everything the agents do – prompts, tool calls, file edits, command executions, token usage, costs, approvals, and more. All of these events are normalized into a single OpenTelemetry‑based JSONL schema, then written locally and optionally forwarded to the security/observability stack of your choice (SIEMs, log aggregators, object storage, or Asymptote’s own dashboard).

Why it matters

• Visibility across runtimes – Supports 20+ local agent runtimes (Claude Code, Cursor, Devin, VS Code Copilot, etc.) plus browser‑based chats (Claude.ai, ChatGPT), CI pipelines, and cloud‑hosted agents.
• Unified schema – No more stitching together disparate logs; every event follows the same model, making correlation and detection easy.
• Security‑first defaults – Data stays on the endpoint by default; forwarding is opt‑in and can be directed to customer‑controlled destinations.
• Enterprise‑ready deployment – Packages for macOS, Linux, Windows that can be installed via MDM (Jamf, Fleet, Rippling) or Homebrew, and run as a system service.
• Local detection – A built‑in, offline rule engine (beacon scan) can apply threat‑detection rules to the collected telemetry without any network traffic.

---

Key components (as described in the README)

Component	Role
Sources	Hooks, plugins, or OpenTelemetry exporters that capture activity from local agents, browser extensions, CI jobs, or cloud SDKs.
Beacon core	Collects events, normalises them to the unified schema, stores them in a durable runtime.jsonl file, builds session timelines, and runs a local detection engine.
Destinations	By default a local JSONL file; optional forwarders to SIEMs (CrowdStrike, Sentinel, Splunk, etc.), log aggregators (Datadog, Elastic, CloudWatch), object storage (S3, GCS), or Asymptote’s managed Vector endpoint.
Dashboard	A read‑only local UI that visualises the JSONL log and inventory state, useful for validation and debugging.
MDM deployment	Signed macOS .pkg, Linux .deb/.rpm, Windows .msi packages that install the service, configure runtimes, and can be managed at scale.

---

What you can do with it

1. Install a single binary (beacon endpoint install) on any machine.
2. Automatically hook into supported agents – the installer writes configuration files or registers OTLP exporters so that each agent streams its events to Beacon.
3. Inspect locally via beacon dashboard or by opening the generated runtime.jsonl.
4. Forward to your security stack – configure a Vector forwarder or use the built‑in SIEM integrations.
5. Run offline threat scans – beacon scan applies CEL‑based rules (see spec/threat‑rules) to detect suspicious patterns.
6. Scale with MDM – push the package to fleets, and use beacon endpoint connect --system to enrol machines in a central Asymptote dashboard (optional).

---

Who might use it

• Security & IT teams that need to audit AI‑agent activity for data‑leak, credential‑use, or policy compliance.
• DevOps / SREs who want observability of AI‑powered tooling in CI pipelines.
• Developers of AI agents who wish to ship telemetry without building their own pipeline.
• Enterprises that run many different agent products and need a single view.

---

Quick start (from the README)

1. Run beacon endpoint install (or install via Homebrew, .deb/.rpm, .msi).
2. The first run asks for an email and usage type – this is a one‑time, opt‑out onboarding step.
3. The service starts automatically and begins collecting events from any supported runtime present on the machine.
4. View the local dashboard with beacon dashboard or forward logs to your SIEM using the appropriate beacon sub‑command.

---

Bottom line: Agent Beacon gives you a plug‑and‑play way to get consistent, searchable telemetry from the growing ecosystem of AI agents, while keeping data under your control and offering built‑in security‑focused detection.