Everything Beam answers on individual pages, gathered in one place — what it is, what it watches, what it deliberately doesn’t do yet, and how it fits security, IT, compliance and industry-specific reviews.
What is Agentbeam?
Agentbeam is a local-first security and observability layer for AI coding agents. It records agent shell commands, file edits, tool calls and network activity, flags risky actions with the evidence behind them, and scans MCP configs and SKILL.md files for hidden instructions before an agent trusts them.
Does Agentbeam send my data anywhere?
No, by default. Agentbeam is local-first: activity is recorded to local files on the machine it runs on, and nothing is sent off-device unless you explicitly configure an export.
Which AI agents and tools does Agentbeam work with?
Agentbeam watches coding-assistant activity at the runtime level — shell commands, file changes, tool calls, and MCP server connections — so it works across the terminal-based and IDE agents your team already runs, without requiring each one to integrate separately.
Does Agentbeam block risky agent actions?
Agentbeam observes and flags — it does not block, yet. It surfaces sensitive-data access, credential exposure, destructive commands, and permission changes with the evidence attached, so your team can review and act on them.
What is MCP security scanning?
Before an agent connects to an MCP server, Agentbeam scans its config against heuristic patterns for tool poisoning, unpinned versions that enable rug pulls, and credential-exfiltration phrasing — heuristic triage, not a guarantee of safety.
Who is Agentbeam built for?
Security teams that need detection and evidence across every agent in use, and IT teams rolling out AI coding tools across developer machines who need fleet-wide visibility without slowing anyone down.
How do I get started with Agentbeam?
Talk to us using the form on this page and we'll walk you through setup for your team's stack. We'll follow up by email to schedule a short walkthrough.
Does Beam block dangerous commands?
No. Beam v1 is observe-and-alert only: the hook emits no allow or deny response, and imported enforcement records are counted as skipped. If you need something to stop a command mid-flight today, Beam is not that tool.
Which AI agents and tools does Beam monitor?
Beam is source-agnostic. It accepts a normalized event schema, Claude Code hook payloads, OTLP/HTTP JSON logs and imported numbat records — anything emitting to one of those paths lands in the same timeline.
Does any of this data leave my machine?
Not by default. The collector binds to 127.0.0.1:4319, stores events in local files at 0700/0600, and ships no analytics or third-party scripts. Data leaves only through an export you run yourself.
What gets redacted before an event is stored?
Known credential formats, auth headers, URL query values and private keys, with detection running on the raw text first. Other sensitive text may survive redaction — inspect an export before sharing it.
What is MCP tool poisoning?
Hiding malicious instructions inside an MCP server's tool descriptions or metadata — text the user never sees but the model reads and follows, such as an instruction to attach an environment variable to an outbound request. OWASP catalogs it as a distinct attack class.
Can Beam prove an MCP server is safe?
No, and no scanner can. Beam runs 11 heuristic patterns plus a version-pin check against text you point it at. A clean report means nothing matched those heuristics — it is not malware analysis, and not a safety guarantee.
Does Beam scan MCP servers automatically when I install one?
No. Scanning is explicit: you invoke it against a specific file. Package pulls and server installation are not intercepted, which is a deliberate v1 boundary rather than an oversight.
How does Beam handle false positives?
Every finding reports the category and the exact matched text, so you can judge it rather than take a score on faith. Pattern-based scanners are widely observed to over-flag ordinary imperative phrasing in legitimate tool descriptions.
What is an agent skill security risk?
A skill is a Markdown instruction file an assistant loads and follows. Because its contents are treated as instructions rather than data, a skill can direct the assistant to read credentials, post them to an external host, or ignore your own rules — with no software vulnerability involved.
Does scanning a SKILL.md execute anything in it?
No. The file is read as inert text and matched against heuristic patterns. Beam's own test fixtures include commands that look destructive precisely to prove they are never executed.
Is a clean scan a guarantee the skill is safe?
No. Eleven heuristic patterns catch documented abuse shapes; they are not semantic malware analysis. Treat a clean report as one input into your own review, especially for a skill you are about to give real credentials.
Which AI tools does this cover?
The scanner works on the file, not the vendor, so any Markdown-based skill or instruction document can be scanned — assistant skills, agent rule files and MCP configurations. Runtime coverage is likewise source-agnostic.
Does Beam make my organization compliant?
No. Beam produces audit evidence about the AI activity you instrument — a normalized, redacted, exportable record you can bring to a review. It is not a certification, an attestation or a compliance guarantee, and no framework is satisfied by installing it.
Why can't I just use my vendor's own logs?
Because those controls stop at their own tool. Someone working in Cursor in the morning and Claude Code in the afternoon produces two partial records in two shapes, and neither covers the other. Beam normalizes both so a reviewer reads one trail.
What do the SHA-256 hashes in an export actually prove?
That the files inside the exported case are internally consistent with the manifest. They do not establish authenticity, chain of custody or completeness, and the export uses Beam's own schema rather than a raw replay of an upstream tool's records.
Can I forward this to a SIEM?
Not automatically. Beam ingests OTLP/HTTP JSON and exports redacted NDJSON, so the data is portable, but there is no built-in forwarder and no background export. Anything that leaves the machine leaves because you moved it.
Does Beam evaluate the quality of an agent's output?
No. Beam's scorecard checks behavior — what commands ran, what files changed, what was flagged — against policy. It does not judge whether a generated answer, PR, or piece of code was correct; that's a different problem from the one Beam is built to solve.
What is a session risk score based on?
The same flagged findings Beam already surfaces for runtime monitoring — sensitive-data access, credential exposure, destructive commands, permission changes — rolled into one number per session, with the underlying evidence still one click away.
What happens to activity Beam wasn't watching?
It's marked unscored, not passing. A scorecard is only as complete as the activity record behind it, and Beam never fills a coverage gap with an assumed result.
Can a low score block an agent automatically?
Not currently. Like the rest of Beam, evaluation observes and flags — it does not block. A scorecard is meant for review, the same way flagged runtime activity is today.
Is Beam's endpoint agent already on-premise, or only the dashboard?
The endpoint collector already is: it binds to 127.0.0.1 and writes local NDJSON by default, with no cloud dependency. On-premise deployment is really about the fleet dashboard, which is a self-hostable Next.js + Postgres app rather than something you're required to point at Beam's cloud.
Do you provide a Docker image or Helm chart for the dashboard?
Not yet as a packaged installer — the dashboard is a standard Next.js app backed by Postgres via Prisma, and you deploy it the way you deploy any app in your stack. If you need help wiring it up, talk to us.
Does self-hosting change what the collector records or redacts?
No. Redaction, event schema and local storage behavior are identical whether or not you run the dashboard in-house — self-hosting changes where the fleet view lives, not what the endpoint does.
Is there SSO for an on-premise dashboard deployment?
Not in v1. Accounts use credentials login against your own Postgres. If your organization needs SAML or OIDC, tell us — it's a reasonable ask we don't want to overstate as already built.
Can Beam enforce policy on developer machines today?
No. Beam v1 observes and alerts. The Claude Code hook emits no allow or deny response, and enforcement records imported from other tools are counted as skipped. Enforcement is on the roadmap; treating it as shipped would be a misrepresentation.
Can we deploy it across a fleet with MDM?
Not yet. Pairing is designed for local single-user testing, and fleet management, SSO, database-backed teams and approvals are documented as future work. Beam is a per-machine tool you can pilot, not a managed rollout.
What leaves the machine?
Nothing by default. The collector binds to 127.0.0.1:4319, writes local files at 0700/0600, redacts known credential formats before persistence, and the management app carries no analytics or third-party scripts. Exports happen when a person runs one.
How does Beam relate to numbat and other open-source monitors?
Beam is an independent implementation, not a fork, and it interoperates rather than competes: it imports numbat's normalized event and finding records with source references and ATT&CK tags intact, and accepts OTLP/HTTP JSON from anything else you run.
Can we deploy Beam through Jamf, Kandji or Intune?
Not as a packaged deployment today. Pairing is designed for local single-machine use, and fleet management, SSO and database-backed teams are documented as future work. Setup is scriptable per machine — enough for a pilot, not a managed rollout.
Will people see this as surveillance?
Only if you describe it badly. Beam records what the AI did, not what the person did: no keystroke logging, no screen capture, no browser extension. Data stays in local files on their own machine, and nothing is forwarded automatically.
Does it conflict with our EDR or endpoint agent?
It should not. Beam is a userspace process on loopback that receives events a hook sends it. No kernel extension, no OS-level interception — and it covers the AI layer endpoint tooling has no visibility into.
What happens if the collector is down or misconfigured?
Work carries on. The hook sends a bounded request and emits no allow or deny response, so nothing waits on a verdict. The cost of a failure is a gap in the record, not a blocked person.
Does Beam make us compliant with SOX or PCI DSS?
No. Beam produces evidence — a record of what an AI agent did — that a compliance program can use as one input. It doesn't attest to any control or framework, and treating it as a certification would misrepresent what it does.
Does Beam scan for account numbers or other sensitive financial data?
No. Beam redacts known credential formats (API keys, tokens, auth headers) before writing an event to disk. It does not scan for account numbers, PII or other regulated data — review an export before sharing it outside your team.
Can Beam stop an agent from touching production trading or payment systems?
Not in v1. Beam observes and alerts; it emits no allow/deny response and cannot block a command. If you need enforcement today, Beam is not that tool yet.
Where does the data live?
On the machine that generated it. The collector binds to 127.0.0.1:4319 and writes local files at 0700/0600. Nothing leaves unless someone runs an export.
Is Beam HIPAA compliant?
Beam isn't a covered entity or a business associate by default, and it makes no HIPAA compliance claim. It's a local-first activity recorder for AI coding agents; whether and how it fits your HIPAA program is a decision your compliance team makes, not something this page asserts for you.
Does Beam scan for PHI in code or logs?
No. Beam redacts known credential formats — API keys, tokens, auth headers — before writing an event. It does not detect or redact patient data. Review any export before it leaves your team.
Can it stop an agent from touching a clinical system?
Not in v1. Beam observes and alerts only — it emits no allow/deny response and can't block a command mid-flight.
Where does the activity data get stored?
Locally, on the machine that generated it. The collector binds to loopback only, and nothing leaves until someone runs an export.
Is Beam FedRAMP or StateRAMP authorized?
No. Beam has no such authorization as of this writing. If that's a hard requirement for your procurement, say so — Beam's answer here is honest rather than aspirational.
Can we run the whole stack without touching Beam's cloud?
Yes. The collector binds to loopback by default and never needs outbound access to record. The fleet dashboard is self-hostable — a Next.js app on Postgres you deploy and own.
Can we audit the code that runs on our endpoints?
Beam CLI's core is open source. Read it before you trust it, rather than taking a vendor's description on faith.
Does Beam enforce policy today?
No. Beam v1 observes and alerts only — it emits no allow/deny response and cannot block a command. Treat it as an evidence and visibility tool, not a control.
Is this overkill for a five-person team?
It's one hook and a local service — not a platform to operate. If you're already shipping with AI agents on real customer data, a local record costs you almost nothing to have and a lot to reconstruct later without it.
Do we need to pay to use it?
No. Beam CLI's core is open source and self-hostable for free. Talk to us if you want the managed dashboard or fleet features later.
Will this slow down how fast we ship?
Beam observes and alerts — it never blocks a command in v1, so it doesn't sit in your team's way. It's a record, not a gate.
Can we show this to an enterprise customer's security team?
Yes — that's a common reason startups adopt it. An exportable, evidence-backed record of how you monitor AI-assisted engineering is a real answer to that question, not a claim.
Talk to us directly — we answer honestly, including when the answer is “not yet.”