How to vibe code safely with Beam

Vibe coding security: a practical checklist lists nine things worth doing before you let an agent write and run code with limited review. Two of those items — scanning a skill or MCP config before first use, and watching what an agent actually did instead of trusting its own report — are exactly what Beam is built for. This is the setup walkthrough: what to wire up, what each piece actually checks, and which items on that checklist are still entirely on you regardless of what tooling you run.

TL;DR

Three items, covered concretely. Six items, still yours. That's not a hedge — it's the honest shape of what a local observation and scanning tool can and can't do.

Setting up the local collector

The collector is what turns "watch what it actually did" from an aspiration into a record you can open. It runs on Bun, binds only to 127.0.0.1:4319, and stores NDJSON files locally — nothing leaves the machine unless you explicitly export it.

bun run --cwd apps/sentinel-collector dev

Then wire it into your agent's hook system. For Claude Code, merge this into your settings, preserving any hooks already there:

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "",
      "hooks": [{
        "type": "command",
        "command": "bun /absolute/path/to/apps/sentinel-collector/src/cli.ts hook claude-code"
      }]
    }]
  }
}

PreToolUse observes a proposed action before it runs. The collector never returns an allow/deny response and never blocks the agent — a capture failure is logged to stderr only, so wiring this in doesn't add a new way for your agent to get stuck. That's the same "observation must never become enforcement" boundary covered in what is AI agent monitoring: this closes the gap between what an agent reports doing and what it actually did, which is precisely the failure mode in the Replit incident covered in AI agent security incidents: a timeline — the agent didn't just delete production data, it fabricated cover records afterward. An independent hook-level record doesn't depend on the agent's own account of events.

Scanning a skill or MCP config before first use

This is the checklist item Beam covers most directly. Before you run a SKILL.md you didn't write, or point an agent at a new mcp.json, scan it first:

bun run --cwd apps/sentinel-collector cli scan /absolute/path/to/SKILL.md
bun run --cwd apps/sentinel-collector cli scan /absolute/path/to/mcp.json --mcp

The scanner applies 11 heuristic patterns plus an MCP version-pin check — credential-delivery instructions, destructive operations, downloaded-and-encoded execution, network sweeps, privilege escalation, cloud metadata access, persistence targets, reverse-shell patterns, and instruction-override attempts — entirely offline, without executing anything in the file. Add --save to persist the report to the collector alongside your activity log.

Be precise about what this is: heuristic pattern matching, not semantic malware analysis, and not a guarantee of safety. It catches known shapes; a novel phrasing or an instruction hidden behind indirection can pass a clean scan. Treat a clean result as one input, not clearance — the fuller argument for that limitation, including where MCP scanners over-flag legitimate instructions, is in MCP security: a practical guide and AI agent security: securing coding assistants.

Catching a risky prompt in the browser

The checklist doesn't cover this explicitly, but it's the same principle applied to a different surface: the chat window where you paste a stack trace or a config snippet to get unstuck, which how much sensitive data do people share with AI chatbots covers in more depth. Beam Sentinel, the browser extension, applies the same pattern-matching approach to what you're about to send on ChatGPT, Claude, Gemini, Perplexity, Copilot, and Grok — 12 heuristic patterns, checked entirely inside the extension before the prompt leaves your browser.

High- and critical-severity matches — a labeled email address or personal data, a destructive command, a credential paired with an outbound destination — pause the action and require an explicit Allow once. Medium matches show a brief warning and continue. Everything else passes through without interruption. There's no authentication step and no network request involved in the check itself, so nothing about what you typed has to leave your browser to be evaluated.

What's still entirely on you

Beam's three pieces cover scanning before you run something new, recording what actually happened, and catching a risky prompt before it's sent. They do nothing for the other six items on the checklist, and that's worth stating plainly rather than implying otherwise:

• Bounding the agent's scope to one repo or directory is a workspace/sandbox decision you make when you start the task.
• Reviewing the diff before merge is still a human reading the change — Beam's record tells you what ran, not whether the resulting code is correct.
• Separating dev and prod is an infrastructure and credential boundary, enforced at the access-control layer, not something a local observer can retroactively impose.
• Gating destructive commands — Beam flags a DROP TABLE or rm -rf pattern as risky, both in the collector's activity feed and in beam scan's findings, but flagging is not blocking. Nothing stops the command from running; you're seeing it after the fact or, at best, alongside it.
• Credential scope — what access an agent's API key or service account actually has is a decision made when you provision it, not something Beam can narrow after the fact.
• A rollback path is backups and a tested recovery procedure, independent of any monitoring layer.

None of this is a knock against local observation — it's the same discipline every security tool in this space should be held to: state what it does and does not do, plainly, so the six items that are still yours don't quietly become someone else's assumed job.

Related reading

• Vibe coding security: a practical checklist
• What is AI agent monitoring?
• MCP security: a practical guide
• AI agent security: securing coding assistants
• AI agent security incidents: a timeline
• How much sensitive data do people share with AI chatbots?

Setup commands and scanner behavior reflect the Sentinel collector v0.1 README and the Beam Sentinel browser extension README as of September 10, 2026. Beam is a local prototype; capabilities described as future work are not shipped.