Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt

Use this file to discover all available pages before exploring further.

​
Supported Surfaces

Beacon is visibility-first endpoint telemetry for local AI agent runtimes. The public build observes supported runtime activity, writes normalized local JSONL, and leaves forwarding to Wazuh localfile or customer-managed pipelines.

​
Support matrix

AreaCurrent support
AI runtimesClaude Code and Codex CLI through local OTLP configuration; Cursor through hooks; Claude Cowork through admin-configured OTLP and validation
DeploymentHomebrew, user-mode install, system-mode install, macOS launchd service files, and MDM-friendly scripts for Jamf, Kandji, or generic macOS command runners
Local storageUser-mode log at ~/.beacon/endpoint/logs/runtime.jsonl; system-mode log at /var/log/beacon-agent/runtime.jsonl
InspectionLocal dashboard bound to loopback by default
WazuhLocalfile config, rule pack, sample event, and validation event through beacon endpoint wazuh
ForwardingCustomer-managed forwarding from local JSONL to Wazuh or another pipeline

​
Runtime support

Beacon supports multiple runtime surfaces because each AI agent runtime exposes telemetry differently:
  • Claude Code: configured to export OpenTelemetry to Beacon’s localhost collector.
  • Codex CLI: configured through ~/.codex/config.toml to export OpenTelemetry to Beacon’s localhost collector.
  • Cursor: configured through hooks that invoke the embedded beacon-hooks adapter for session, prompt, tool, command, MCP-like, approval, and file edit telemetry where payloads are available.
  • Claude Cowork: configured in Claude organization settings and validated with Beacon’s Claude Cowork integration commands.

​
MDM deployment

For MDM deployments, install Beacon in system mode so endpoint events land in /var/log/beacon-agent/runtime.jsonl. The macOS packaging scripts support installation from Jamf, Kandji, or a generic MDM command runner and allow administrators to set the harness list and preserve logs during uninstall. Use beacon endpoint install for endpoint configuration details and beacon endpoint status to inspect collector, service, harness, diagnostic, and runtime log state after deployment.

​
Wazuh integration

Beacon’s Wazuh integration consumes the local JSONL runtime log through Wazuh localfile ingestion. Use beacon endpoint wazuh print-config to print the localfile snippet, beacon endpoint wazuh install-pack to generate rules and sample content, and beacon endpoint wazuh validate to write a known-good validation event. The generated Wazuh content is built around the Beacon event contract. It can identify telemetry health issues, command and MCP activity, policy blocks, endpoint health failures, prompt and tool workflow telemetry, file activity, and tool failures while preserving the raw Beacon JSON for investigation.

​
Current boundaries

Beacon does not currently provide kernel or process monitoring, shell history collection, cloud audit ingestion, browser or SaaS telemetry, credential-use attribution, MCP configuration inventory, or direct Datadog, Splunk, or Elastic exporters.

Installation

Install Beacon and understand the files it manages.

Wazuh

Print Wazuh config, generate a content pack, and validate events.