BetaEverything Beam answers on individual pages, gathered in one place — what it is, what it watches, what it deliberately doesn’t do yet, and how it fits security, IT, compliance and industry-specific reviews.
What is Agentbeam?
Agentbeam is an AI agent security platform. It records what AI coding agents do on developer machines, checks what people send to AI chats in the browser, watches the applications you ship for attacks, and scans skills, MCP servers and packages before they run. Findings arrive in one workspace with the evidence attached and an audit trail.
What does App monitoring do?
App monitoring watches a running application's logs, HTTP traffic and LLM features for attacks such as injection, path traversal, SSRF, reverse shells, prompt injection and attempts to extract API keys. It runs as the open-source beam CLI beside your app or as an SDK inside a Node.js or Next.js app. It only watches: it never blocks requests, and raw log lines stay on your server.
Does Agentbeam send my data anywhere?
Not by default. On developer machines, activity is recorded locally and nothing leaves unless you connect a workspace or configure an export. App monitoring sends only redacted findings, never raw log lines, and the Sentinel Chrome extension makes no network request at all.
Does Agentbeam block risky agent actions?
It can. Workspace owners and admins set observe, advisory, or enforce policy. Enforce denies matching tool calls on Claude Code and Codex. The Sentinel Chrome extension pauses or blocks high-risk browser sends and can hold a send after redacting live secrets. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block. App monitoring never blocks.
Can Agentbeam scan skills, MCP servers and packages?
Yes. beam add skill scans a skill before installing it and beam skills scan checks the ones already installed. beam scan --mcp checks an MCP config for tool poisoning, unpinned versions that enable rug pulls and credential-exfiltration phrasing. beam add package scans an npm or PyPI package and its whole dependency tree for install-time scripts, environment theft and typosquats, and installs only if nothing critical turns up; beam packages scan audits what's already installed. beam cve check matches lockfiles against Beam's CVE database and can fail a CI build. Scanning is heuristic triage, not a guarantee of safety.
Can my team share skills and CLAUDE.md files?
Yes. beam share publishes a skill, a CLAUDE.md, AGENTS.md or GEMINI.md, a slash command, a subagent or a Cursor rule to your workspace's Team library, and teammates install it with beam share install. Every share is scanned when it's published and again before it installs, versions are kept, and admins can require review of risky shares or every share.
Which AI agents and tools does Agentbeam work with?
Coding agents including Claude Code, Codex, Cursor, GitHub Copilot, Antigravity and Muse; AI chats such as ChatGPT, Claude and Gemini through the Sentinel Chrome extension; and Node.js and Next.js apps, or any app that writes logs, through App monitoring.
Who is Agentbeam built for?
Individual developers who want to see what their agents do, free and local-first. Security teams that need detection and evidence across every agent, browser and app in use. IT teams rolling out AI tools who need workspace roles, policy and an audit trail, in the cloud or self-hosted.
How do I get started with Agentbeam?
Click Start free to sign in and set up your workspace, or run npx @agent-beam/beam add skill agentbeam-setup -g --all-agents and ask your coding agent to set up AgentBeam. Rolling out to a team? Book a demo, or email [email protected].
Does Beam block dangerous commands?
Yes, when workspace policy is set to enforce. Matching tool calls are denied on Claude Code and Codex PreToolUse. Sentinel can pause or block high-risk browser sends. Cursor, Copilot CLI and Gemini currently get a deny note rather than a verified block, and missing or expired cached policy allows the action. This is not a kernel sandbox.
Which AI agents and tools does Beam monitor?
Beam is source-agnostic. It accepts a normalized event schema, Claude Code hook payloads, OTLP/HTTP JSON logs and imported numbat records — anything emitting to one of those paths lands in the same timeline.
Does any of this data leave my machine?
Not by default. The collector binds to 127.0.0.1:4319, stores events in local files at 0700/0600, and ships no analytics or third-party scripts. Data leaves only through an export you run yourself.
What gets redacted before an event is stored?
Known credential formats, auth headers, URL query values and private keys, with detection running on the raw text first. Other sensitive text may survive redaction — inspect an export before sharing it.
What is MCP tool poisoning?
Hiding malicious instructions inside an MCP server's tool descriptions or metadata — text the user never sees but the model reads and follows, such as an instruction to attach an environment variable to an outbound request. OWASP catalogs it as a distinct attack class.
Can Beam prove an MCP server is safe?
No, and no scanner can. Beam runs 11 heuristic patterns plus a version-pin check against text you point it at. A clean report means nothing matched those heuristics — it is not malware analysis, and not a safety guarantee.
Does Beam scan MCP servers automatically when I install one?
No. Scanning is explicit: you invoke it against a specific file. Package pulls and server installation are not intercepted, which is a deliberate v1 boundary rather than an oversight.
How does Beam handle false positives?
Every finding reports the category and the exact matched text, so you can judge it rather than take a score on faith. Pattern-based scanners are widely observed to over-flag ordinary imperative phrasing in legitimate tool descriptions.
What is an agent skill security risk?
A skill is a Markdown instruction file an assistant loads and follows. Because its contents are treated as instructions rather than data, a skill can direct the assistant to read credentials, post them to an external host, or ignore your own rules — with no software vulnerability involved.
Does scanning a SKILL.md execute anything in it?
No. The file is read as inert text and matched against heuristic patterns. Beam's own test fixtures include commands that look destructive precisely to prove they are never executed.
Is a clean scan a guarantee the skill is safe?
No. Eleven heuristic patterns catch documented abuse shapes; they are not semantic malware analysis. Treat a clean report as one input into your own review, especially for a skill you are about to give real credentials.
Which AI tools does this cover?
The scanner works on the file, not the vendor, so any Markdown-based skill or instruction document can be scanned — assistant skills, agent rule files and MCP configurations. Runtime coverage is likewise source-agnostic.
Does Beam make my organization compliant?
No. Beam produces audit evidence about the AI activity you instrument — a normalized, redacted, exportable record you can bring to a review. It is not a certification, an attestation or a compliance guarantee, and no framework is satisfied by installing it.
Why can't I just use my vendor's own logs?
Because those controls stop at their own tool. Someone working in Cursor in the morning and Claude Code in the afternoon produces two partial records in two shapes, and neither covers the other. Beam normalizes both so a reviewer reads one trail.
What do the SHA-256 hashes in an export actually prove?
That the files inside the exported case are internally consistent with the manifest. They do not establish authenticity, chain of custody or completeness, and the export uses Beam's own schema rather than a raw replay of an upstream tool's records.
Can I forward this to a SIEM?
Not automatically. Beam ingests OTLP/HTTP JSON and exports redacted NDJSON, so the data is portable, but there is no built-in forwarder and no background export. Anything that leaves the machine leaves because you moved it.
Does Beam evaluate the quality of an agent's output?
No. Beam's scorecard checks behavior — what commands ran, what files changed, what was flagged — against policy. It does not judge whether a generated answer, PR, or piece of code was correct; that's a different problem from the one Beam is built to solve.
What is a session risk score based on?
The same flagged findings Beam already surfaces for runtime monitoring — sensitive-data access, credential exposure, destructive commands, permission changes — rolled into one number per session, with the underlying evidence still one click away.
What happens to activity Beam wasn't watching?
It's marked unscored, not passing. A scorecard is only as complete as the activity record behind it, and Beam never fills a coverage gap with an assumed result.
Can a low score block an agent automatically?
A low scorecard does not deny a tool call on its own. Workspace policy (observe, advisory, or enforce) is a separate control that owners and admins set. Scorecards are for review.
Is Beam's endpoint agent already on-premise, or only the dashboard?
The endpoint collector already is: it binds to 127.0.0.1 and writes local NDJSON by default, with no cloud dependency. On-premise deployment is really about the fleet dashboard, which is a self-hostable Next.js + Postgres app rather than something you're required to point at Beam's cloud.
Do you provide a Docker image or Helm chart for the dashboard?
Not yet as a packaged installer — the dashboard is a standard Next.js app backed by Postgres via Prisma, and you deploy it the way you deploy any app in your stack. If you need help wiring it up, talk to us.
Does self-hosting change what the collector records or redacts?
No. Redaction, event schema and local storage behavior are identical whether or not you run the dashboard in-house — self-hosting changes where the fleet view lives, not what the endpoint does.
Is there SSO for an on-premise dashboard deployment?
Not in v1. Accounts use credentials login against your own Postgres. If your organization needs SAML or OIDC, tell us — it's a reasonable ask we don't want to overstate as already built.
Can Beam enforce policy on developer machines today?
Yes. Workspace owners and admins set observe, advisory, or enforce policy. Enforce denies matching tool calls on Claude Code and Codex PreToolUse. Sentinel pauses or blocks high-risk browser AI sends. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block, and missing or expired cached policy is fail-open.
Can we deploy it across a fleet with MDM?
Yes. Apple and Windows MDM are available for the collector. Owners and admins manage org baselines and can apply stricter member overrides from the workspace console.
What leaves the machine?
Nothing by default. The collector binds to 127.0.0.1:4319, writes local files at 0700/0600, redacts known credential formats before persistence, and the management app carries no analytics or third-party scripts. Exports happen when a person runs one.
How does Beam relate to numbat and other open-source monitors?
Beam is an independent implementation, not a fork, and it interoperates rather than competes: it imports numbat's normalized event and finding records with source references and ATT&CK tags intact, and accepts OTLP/HTTP JSON from anything else you run.
Can we deploy Beam through Jamf, Kandji or Intune?
Yes. Apple and Windows MDM are available for the collector. Workspace owners and admins set org baselines and can apply stricter member overrides.
Will people see this as surveillance?
Only if you describe it badly. Beam records what the AI did, not what the person did: no keystroke logging, no screen capture. Sentinel is optional and scoped to supported AI chat sites before send. Collector data stays in local files unless you export it.
Does it conflict with our EDR or endpoint agent?
It should not. Beam is a userspace process on loopback that receives events a hook sends it. No kernel extension, no OS-level interception — and it covers the AI layer endpoint tooling has no visibility into.
What happens if the collector is down or misconfigured?
Collector capture failure does not hang the agent. Enforce policy is fail-open when cached policy is missing or expired: the action proceeds. The cost of that failure is a missed deny, not a locked laptop.
Does Beam make us compliant with SOX or PCI DSS?
No. Beam produces evidence — a record of what an AI agent did — that a compliance program can use as one input. It doesn't attest to any control or framework, and treating it as a certification would misrepresent what it does.
Does Beam scan for account numbers or other sensitive financial data?
No. Beam redacts known credential formats (API keys, tokens, auth headers) before writing an event to disk. It does not scan for account numbers, PII or other regulated data — review an export before sharing it outside your team.
Can Beam stop an agent from touching production trading or payment systems?
On Claude Code and Codex, yes, when owners or admins set workspace policy to enforce. Sentinel can pause or block high-risk browser AI sends. Cursor, Copilot CLI and Gemini currently get a deny note rather than a verified block. Missing or expired cached policy is fail-open. Pair this with harness sandboxes and scoped credentials for production systems.
Where does the data live?
On the machine that generated it. The collector binds to 127.0.0.1:4319 and writes local files at 0700/0600. Nothing leaves unless someone runs an export.
Is Beam HIPAA compliant?
Beam isn't a covered entity or a business associate by default, and it makes no HIPAA compliance claim. It's a local-first activity recorder for AI coding agents; whether and how it fits your HIPAA program is a decision your compliance team makes, not something this page asserts for you.
Does Beam scan for PHI in code or logs?
No. Beam redacts known credential formats — API keys, tokens, auth headers — before writing an event. It does not detect or redact patient data. Review any export before it leaves your team.
Can it stop an agent from touching a clinical system?
On Claude Code and Codex, yes, when owners or admins set workspace policy to enforce. Sentinel can pause or block high-risk browser AI sends. Cursor, Copilot CLI and Gemini currently get a deny note rather than a verified block. Missing or expired cached policy is fail-open.
Where does the activity data get stored?
Locally, on the machine that generated it. The collector binds to loopback only, and nothing leaves until someone runs an export.
Is Beam FedRAMP or StateRAMP authorized?
No. Beam has no such authorization as of this writing. If that's a hard requirement for your procurement, say so — Beam's answer here is honest rather than aspirational.
Can we run the whole stack without touching Beam's cloud?
Yes. The collector binds to loopback by default and never needs outbound access to record. The fleet dashboard is self-hostable — a Next.js app on Postgres you deploy and own.
Can we audit the code that runs on our endpoints?
Beam CLI's core is open source. Read it before you trust it, rather than taking a vendor's description on faith.
Does Beam enforce policy today?
Yes, when workspace policy is set to enforce, for matching Claude Code and Codex tool calls. Sentinel can pause or block high-risk browser AI sends. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block. Missing or expired cached policy allows the action.
Is this overkill for a five-person team?
It's one hook and a local service — not a platform to operate. If you're already shipping with AI agents on real customer data, a local record costs you almost nothing to have and a lot to reconstruct later without it.
Do we need to pay to use it?
No. Beam CLI's core is open source and self-hostable for free. Talk to us if you want the managed dashboard or fleet features later.
Will this slow down how fast we ship?
Owners and admins can set enforce policy so matching Claude Code and Codex tool calls are denied, and Sentinel can pause or block high-risk browser sends. Advisory mode flags without denying. Missing or expired cached policy is fail-open, so it is not a guaranteed gate on every harness.
Can we show this to an enterprise customer's security team?
Yes — that's a common reason startups adopt it. An exportable, evidence-backed record of how you monitor AI-assisted engineering is a real answer to that question, not a claim.
Talk to us directly — we answer honestly, including when the answer is “not yet.”