A security tool you cannot read is a security tool you are taking on faith. That is an awkward position for any product, and an untenable one for a product whose entire job is telling you what an AI coding agent did on your machine.
So Beam's core is open source. The @agent-beam/beam CLI is AGPL-3.0-only, and so is the separately distributed beam-mcp. That covers the local collector, the scan heuristics, the hook adapters for every supported agent, and the full Skills collection. You can read the rules that decide whether your agent did something alarming, disagree with them, and change them.
What is open, and what is not
| Question | Answer |
|---|---|
| Can I read the code that flags my agent's actions? | Yes — @agent-beam/beam is AGPL-3.0-only |
| Can I run the whole thing without an account? | Yes. beam scan works offline; the collector is loopback-only |
| Does the free version hold back detections? | No. The scan rules are the same rules |
| What is commercial? | The multi-user dashboard, audit trail, and licensed self-hosted control plane |
| Why is that part commercial? | It is the part that exists because an organization has more than one person in it |
The split is not "basic features free, real features paid." It is a split by who the software serves. Everything a developer needs to watch their own agents is open. What you pay for is the machinery an organization needs once many people are running agents and somebody has to answer for it.
Safety is not a premium tier
The argument for open-sourcing the core is simple: the people most exposed to agent risk are frequently the people least able to buy their way out of it. A solo developer wiring Claude Code into a client's repository has the same credential-exfiltration exposure as a bank — with none of the budget and none of the security team.
If the ability to notice that your coding agent just piped a downloaded script into a shell is gated behind a purchase order, then safety is a function of procurement. That is a bad outcome, and it is avoidable. The detection layer costs us nothing extra to give away, and withholding it would buy revenue at the cost of the thing the product claims to care about.
There is a self-interested version of this argument too, and it is worth stating plainly rather than pretending the motive is pure. Open heuristics get corrected. Every developer who reads a rule and finds the regex too broad, too narrow, or trivially bypassable is doing review work we could not buy at any reasonable price.
What "core" actually means
Concretely, the AGPL-licensed CLI at version 0.2.2 includes:
- The local collector. Binds
127.0.0.1:4319, stores normalized events and scan reports as NDJSON under~/.beam, retains the most recent 10,000 events, and redacts known credential formats, auth headers, and URL query parameters before persistence. - The scan heuristics. 13 content rules covering destructive operations, credential access and egress, remote and obfuscated execution, network sweeps, privilege elevation, cloud metadata endpoints, persistence targets, reverse shells, instruction-override attempts, git history rewrites, and disabled TLS verification — plus an MCP version-pin check.
- The hook adapters.
beam agent install-alldetects the agents actually present on the machine and wires Beam's hook into each one's own config, non-destructively. - The Skills collection. 31 security workflows and 7 specialist reviewer roles in both Claude Code and Codex formats, shipped inside the npm package and usable with or without the CLI.
None of that is a trial. There is no event ceiling that degrades, no rule held back for paying users, and no telemetry.
Why AGPL and not MIT
AGPL is the deliberate choice, and it is a stricter one than most tools in this category make.
Permissive licensing would let a vendor fork Beam, quietly weaken a detection that made their own product look bad, and run the result as a hosted service with no obligation to show anyone the diff. For most software that is a tolerable trade. For software whose output is a security judgment, it is the exact failure mode worth designing against — a weakened scanner is worse than no scanner, because it produces confident silence instead of an obvious gap.
AGPL's network clause means a modified Beam offered as a service has to make its source available. The practical effect for an ordinary user is nothing at all: running Beam on your laptop, at work, on a commercial codebase, triggers no obligation. The clause exists for the one case where it matters.
Where the platform starts
The commercial line sits at the point where the question stops being "what did my agent do" and becomes "what did our agents do, and can we prove it."
That is a genuinely different product. It needs identity, roles, retention decisions, and an administrative record that stands up to somebody reviewing it later. Per the distribution notice, Beam's self-hosting package is proprietary and requires an executed self-hosting agreement plus a Beam-issued license file recording installation, customer, seats, and expiry.
What the platform adds:
- Accountable access. Ownership, administration, security operations, audit, billing, and ordinary membership as separate roles, reviewable and revocable from one workspace.
- A record of administration. Invitations, role changes, policy updates, device enrollment, revocation, and risk reviews — filterable and exportable for internal review.
- A managed device fleet. Enrolled machines and their last activity, revocable device credentials, and shared workspace policies.
- Deliberate rollout controls. Seat allocation, invitation domain restrictions, and a choice about whether to retain full event payloads alongside summaries and findings.
Notice that none of those are detections. They are the organizational apparatus around detections. An auditor does not need a better regex; they need to know who approved a policy change in March and whether the record can be trusted. That is what a control plane is for, and building one is ongoing work that a licence funds.
The honest limitations
The same standard applies to the open-source part as to everything else Beam publishes:
- Beam does not block. It observes, redacts, and flags for human review. It does not execute, approve, or prevent anything an agent does.
- The scanner is heuristic, not semantic. 13 patterns and a version-pin check will miss a sufficiently novel payload. It is a first pass, not a malware analysis engine.
- Open source is not a security audit. Publishing the code makes review possible; it does not mean the review has happened. Read the rules before you trust them.
If any of that changes, it changes in public, in a repository you can watch.
Related reading
- Introducing Beam: a local-first security console for your AI coding agents — the architecture the open-source CLI implements
- Use Beam security skills with Claude Code and Codex sub-agents — installing the Skills collection described above
- AI agent guardrails: monitoring vs. blocking — why the open core observes rather than enforces
- AI agent security platforms: how to evaluate one — what to ask of any tool in this category, including this one
- AI compliance and regulation for agent activity — the auditor-facing requirements the platform tier answers
- Enterprise and self-hosting — the commercially licensed deployment
Version numbers, licence terms, and capability descriptions reflect @agent-beam/beam v0.2.2 and the Beam self-hosting distribution notice as of September 14, 2026. Beam remains an early product; the open-source core is the part you can verify for yourself.