Running Beam on a Raspberry Pi puts agent activity and policy checks on the machine where your coding assistant works. You can connect over SSH, pair the Pi with a workspace using a browser on your laptop, and inspect activity without installing a desktop on the Pi.
That is useful when a small development box has access to repositories, deployment credentials, or shared storage. The question is the same as on a laptop: what did the assistant propose, what did the hook report, and which actions should require review? The Raspberry Pi setup guide contains the full installation and troubleshooting sequence.
| What do I need to know? | Direct answer |
|---|---|
| Do I need a particular Pi model? | You need a compatible Linux architecture and runtime. The standalone installer supports ARM64; npm provides a Node-based alternative. |
| Do I need a browser on the Pi? | No. Open the connection URL on your laptop while the Pi waits for authorization. |
| Where should Beam run? | Beside the coding agent whose actions you want to capture. |
| Does a policy preset activate itself? | No. Add it to a draft, review the mode and existing rules, save, synchronize, and verify. |
| Can browser data appear alongside CLI activity? | The separate workspace extension is designed for that, with its own browser enrollment and enterprise rollout. Free Sentinel stays local. |
Which Raspberry Pi installations can run Beam?
Being a CLI removes the need for a graphical desktop. It does not remove CPU and operating-system requirements. Beam's binary build configuration includes Linux ARM64, and its package definition declares Node.js 20.17.0 or newer for the npm route.
Check the Pi before installing:
uname -m
getconf LONG_BIT
dpkg --print-architecture
The last command applies to Raspberry Pi OS and other Debian-based installations. Check userspace as well as the kernel: an aarch64 kernel alone is not enough to choose a binary. Raspberry Pi provides 32-bit and 64-bit OS images.
For a 32-bit ARMv7 environment, the npm route depends on a compatible Node release. The Node.js 22 platform matrix includes ARMv7 and ARM64; ARMv6 is experimental. Use a maintained runtime that supports your OS. We have not validated Beam on every Pi generation, so an unconditional “any version” promise would be misleading.
How do I install Beam on a Raspberry Pi?
For compatible ARM64 Linux, download and inspect the installer before running it:
curl -fsSL https://agentbeam.com/install.sh -o /tmp/beam-install.sh
less /tmp/beam-install.sh
bash /tmp/beam-install.sh
export PATH="$HOME/.local/bin:$PATH"
beam --version
Keep the PATH setting in your shell profile so later SSH sessions and installed hooks can find Beam. The standalone executable includes its runtime. If the OS cannot load it, check architecture and runtime compatibility rather than treating that as a missing execute permission.
If your Pi already has a compatible Node.js and npm installation, the alternative is:
node --version
npm install --global @agent-beam/beam
beam --version
Use your account's npm prefix or version manager, and avoid mixing installation routes accidentally. The coding assistant itself must also support your Pi. Beam being available on an architecture does not establish that every assistant or optional enterprise component runs there.
How do I pair a headless Pi?
In the Pi's SSH session, run:
beam connect
Beam prints a connection URL. Open it in your laptop browser, sign in, select the intended workspace, and confirm the device. The CLI stays on the Pi and waits for that authorization. The URL is a pairing credential, so keep it out of shared logs and screenshots.
After it reports success, verify the device and fetch policy:
beam whoami
beam account
beam sync
beam agent list
beam agent install-all
beam start
Leave the collector running and ask an installed assistant to perform a harmless action in a disposable project. Look for the Pi's device, tool, agent, and timestamp in activity. Use the connection guide if enrollment fails, and the hook guide if the device connects but no activity arrives.
Capture follows the machine and hook. A laptop-side record of an SSH command does not expose every remote shell operation, and a Pi-side collector cannot watch an assistant running somewhere else. A pre-tool record describes a proposed action; it does not by itself prove successful execution. That distinction is central to understanding agent monitoring.
How can I inspect Studio and keep Beam running?
You can reach the Pi's local Studio through an SSH tunnel from your laptop:
ssh -N -L 4319:127.0.0.1:4319 YOUR_USER@YOUR_PI
Run beam token on the Pi, then open http://127.0.0.1:4319/?token=YOUR_LOCAL_PAIRING_TOKEN on the laptop with that token substituted. Keep the tunnel open and the token private. The collector stays bound to loopback; this does not require exposing its port to your network. If the local port is occupied, use a different local forwarding port.
For ongoing use, stop the foreground collector and run beam service install, followed by beam service status and beam service logs. Linux uses a systemd user service. Headless operation after logout depends on the Pi's user-session configuration, so verify a fresh event after reconnecting or rebooting. Follow the background service guide for the lifecycle details.
Which policies are useful on a shared Pi?
Start with the operations that matter to that machine. A development Pi with deployment access may need different restrictions from an isolated learning project. Beam's policy presets provide 17 starting points, including recursive deletion, destructive Git commands, elevated privileges, package publishing, outbound uploads, and credential-file references.
Select Add to policy, review the populated controls, choose the mode, and save. Presets preserve existing settings and skip duplicate entries. Observe stores the workspace configuration without enforcing it; Advisory and Enforce change the decision for matching baseline restrictions on supported hooks. Existing advanced rules can take precedence, so review them as well.
Some examples come from the repository's WipeBench scenario catalog: broad permission changes during a narrow script fix, unwanted Git stash removal, uploading a diagnostic file, and changing Git's hook location. These are useful starting points because they make the boundary concrete. Our preset tests compare command strings with regular expressions; they do not execute those commands.
WipeBench also includes authorized controls. Deleting generated files or publishing a release can be legitimate when requested. A pattern recognizes command text, not intent, so broad presets can interrupt approved work and miss alternative syntax. The monitoring versus blocking guide explains why observed activity, a policy decision, and confirmed enforcement are separate facts.
What browser-extension data belongs beside Pi activity?
A headless Pi and your laptop browser cover different parts of a workflow. The Pi may run the coding assistant while you use ChatGPT or Claude in a browser to discuss a configuration. Install browser protection where those tabs run; the CLI does not install a browser extension onto a headless device.
Free Beam Sentinel checks supported prompt surfaces locally and keeps a short redacted history in the browser. It does not require workspace sign-in or upload that history. The separate workspace extension under development adds browser enrollment, enterprise checks, and workspace activity records. Its matching server changes and extension distribution must be available before a team can use that path; this article does not announce a completed Store release.
| Workspace extension event | Data and interpretation |
|---|---|
| Provider visit | Provider origin, random local session identifier, and timestamp; not whole-browser history. |
| Prompt attempt or paste | Text length, local decision, and finding categories; a submission attempt is not confirmed provider receipt. |
| Attachment interaction | Coarse file type and size on supported paths; file names and contents are not read. |
| Visible response change | An observed response and its length; a pause in streaming is not proof of completion. |
| Copy, regenerate, stop, or share | A supported interface interaction; not proof of a downstream operation. |
The workspace extension defaults to metadata only. Managers can opt into limited, heuristically redacted prompt, response, and paste text, capped at 4,000 characters. Redaction can miss sensitive prose. The active collection setting is shown in the extension; it is a separate decision from connecting the Pi. The workspace browser data guide explains these controls and rollout requirements.
The implementation includes supported surfaces for ChatGPT, Claude, Gemini, Perplexity, Microsoft Copilot, Grok, and DeepSeek. It does not backfill old conversation history, infer token costs from visible text, or reliably tell whether a click came from a human or automation. Bounded queues can lose records, and provider layout changes can affect capture.
Treat the browser and Pi as separate enrolled devices. An upload attempt in a browser is different evidence from a shell command on the Pi. Neither proves the other happened, and neither creates complete visibility into a model's internal actions. For a team rollout, use the enterprise rollout checklist to validate actual capture and policy behavior on each surface.
Implementation and platform references checked on September 29, 2026. Raspberry Pi hardware acceptance, live provider capture, and enterprise extension distribution require their own verification.