Coding agents are useful precisely because they can act: edit files, run shell commands, install packages, call MCP servers. That's also exactly what makes a bad instruction — buried in a skill file, a pasted prompt, or a compromised MCP server — dangerous. Most of us don't watch every tool call an agent makes. Beam does, so you don't have to stare at a terminal all day.
What Beam watches
Beam's collector sits locally on your machine and receives normalized events from the agents you point at it — Claude Code hooks, a direct CLI pipe, or an OTLP/HTTP forwarder. For each event, it checks for the kinds of things that tend to precede a bad day:
- Credential exposure — API keys, tokens, and private keys appearing in commands or file writes
- Destructive actions — deletions, force-pushes, and other hard-to-reverse operations
- Privilege changes — unexpected permission or ownership modifications
- Persistence — new cron jobs, shell profile edits, launch agents
- Network sweeps and reverse shells — the patterns that show up when something is trying to phone home
Every flagged event stays inspectable: what triggered it, the raw evidence, and a place to mark it reviewed.
Events arrive from whatever you instrument. The collector listens on 127.0.0.1:4319 and accepts Claude Code PreToolUse or PostToolUse payloads, normalized NDJSON on stdin, imported Numbat records, or OTLP/HTTP JSON. Everything is normalized into one event shape — event_id, timestamp, source_agent, session_id, event_type, tool_name, plus the relevant command, file_path, or url — so a mixed-agent setup produces a single timeline rather than four disconnected ones. For the longer version of this argument, see what is AI agent monitoring.
Why we built it
The failure modes are documented and dated. In July 2025, Replit's agent ran destructive commands during a code freeze, deleting records for more than 1,200 executives and over 1,190 companies. The same month, a contributor to Amazon Q's VS Code extension was granted admin access and shipped a system prompt telling the agent to "clean a system to a near-factory state." In September 2025, postmark-mcp became the first documented malicious MCP server in the wild — Koi Security estimated around 300 affected organizations. Gartner now predicts 25% of enterprise breaches will trace to AI agent abuse by 2028.
None of those needed an exploit. They needed a text file nobody read closely. That is the shape of the problem: see AI agent security: securing coding assistants and MCP security: a practical guide. For the fuller, dated account of these and later incidents, see AI agent security incidents: a timeline.
Scan before you run
Skills and MCP servers are just files — and files can contain instructions you never read closely. Beam's scanner checks a SKILL.md or mcp.json against eleven heuristic patterns (credential-delivery instructions, downloaded and encoded execution, instruction overrides, and more) before you install or run it:
bun run --cwd apps/sentinel-collector cli scan /absolute/path/to/SKILL.md
It's not semantic malware analysis or a safety guarantee — it's a fast, local check that catches the patterns that show up most often.
Local by default
Beam's data lives in a directory mode 0700 folder on your machine, not a database somewhere else. Known credential formats are redacted before anything is written to disk. There's no background OS surveillance, no browser extension, and no automatic skill installation — Beam only sees what you point it at.
The collector retains the latest 10,000 events and 500 scan reports. It is a single-process local prototype, not fleet storage.
What Beam v1 does not do
Worth stating plainly, because the honest boundary is narrower than the category usually implies:
- It does not block. Beam v1 is observe-only. A flagged destructive command still runs; Beam records it and flags it. Enforcement is a separate layer Beam does not provide.
- It only sees what you point it at. No background OS surveillance, no browser extension, no automatic skill installation. Uninstrumented tools are invisible, and absence of events is not evidence of absence of activity.
- It is not a compliance certification. Exports carry SHA-256 hashes, but those establish internal consistency only — not authenticity or completeness. An event log is evidence an auditor can review, not a pass. See AI compliance and regulation for agent activity.
If you're already running an AI coding agent day to day, Beam is the thing watching over its shoulder — quietly, locally, and only for you. Start with agent runtime security or Beam for developers.
Frequently asked questions
What does Beam actually watch?
Beam observes tool calls from AI coding agents like Claude Code and Codex — file edits, shell commands, MCP calls, and network requests — and flags anything that looks like credential exposure, a destructive command, or an unusual privilege change.
Does Beam send my data anywhere?
No. Beam's collector stores normalized event data as local NDJSON files on your own machine. There's no cloud service, no telemetry, and no account required to use it.
Can Beam scan a skill or MCP server before I install it?
Yes. Beam's scanner checks a SKILL.md or mcp.json against a set of heuristic patterns — credential-delivery instructions, downloaded and encoded execution, reverse shells, instruction overrides, and more — before you ever run it.
Product details reflect the Sentinel collector v0.1 README as of September 9, 2026.