1. Install Beacon
The Linux tab uses the tarball on purpose. This page is a per-user setup; the
.deb/.rpm
packages install a system-mode endpoint managed by systemd that writes to
/var/log/beacon-agent/runtime.jsonl, so the commands below would report on the wrong log. For
the system-mode package, follow Linux instead.2. Set up the endpoint
cursor from the list if you do not use it; add other hook runtimes the same way (see
Runtime hooks for the names).
The first install asks three questions in the terminal:
- How are you using Beacon? Work, personal, or evaluating.
- Your email. Used once, for attribution, so we know which agent runtimes to support next.
- Where should this machine’s agent telemetry go? Pick with the arrow keys:
The answers stay on your machine and are asked once per machine. The one exception: if you chose
Asymptote Managed and the connection did not finish, the destination question comes back next time.
3. If you chose Asymptote Managed
You need to be a member of your organization in Asymptote; ask an admin for an invite if signing in shows no organization. After the install finishes:- The browser opens
asymptotelabs.ai/cli/enroll. Sign in if asked. - The page shows your machine’s name, OS and Beacon version. Click Approve this device.
- Back in the terminal you see
Connected to Asymptote as device … for <your org>andForwarder: … running=true. The per-device key is stored in a file only you can read; it is never printed.
4. See your first events
Start a new Claude Code or Codex session, or restart Cursor so it loads the hooks, and do a few turns. Then:status output
also has an Asymptote managed ingest line with the connection, the forwarder state, and whether
the device key is still accepted.
Everyday commands
What leaves your machine
- By default, nothing. Hooks and the collector never touch the network.
- Once, at setup: your email, your work/personal answer, and install context (OS, architecture,
Beacon version, install method, detected runtime names, a random install id). Never prompt text,
commands, file contents, or events.
BEACON_ONBOARDING=0skips it entirely. - Only if you connected to Asymptote Managed: the runtime and inventory logs, exactly as written
locally, sent by Vector with your device key. Revoking the device on the dashboard stops it within
about a minute;
beacon endpoint disconnectstops it locally.
If something looks off
- No events after a session: Claude Code and Codex read their telemetry settings at startup, and Cursor loads hooks at startup, so start a fresh session or restart the app.
statussays the credential is revoked: someone revoked this device, or you left the organization.beacon endpoint connectre-enrolls.- The approval page says “not provisioned” or “not enabled”: you are not yet a member of an organization that has managed ingest, or none is enabled. Ask your admin.
Collector ports are not listeningduring install: a system-mode Beacon is already installed on this machine (/opt/beacon); the two cannot run together. Use that install instead, or remove it first. See troubleshooting.
Related
beacon endpoint connect
Everything about connecting, disconnecting, and what the forwarder stores.
Asymptote Managed forwarding
The wire contract, what is sent, and how revocation works.
Runtime hooks
Install, check, and remove hook-based telemetry for each runtime.
Log forwarding
Send the local log to your own SIEM, observability platform, or bucket.

