AI agent monitoring means recording what an AI agent does while it runs — every command, file write, tool call and endpoint — and flagging the risky ones with evidence attached. Beam does this locally; v1 observes and alerts, it does not block.
Static review tells you what an agent was allowed to do. Runtime monitoring tells you what it did.
Beam monitors how your teams use AI. At runtime that means events from a hook, an OTLP/HTTP JSON stream or an imported file — one schema, whatever produced them.
Shell
PreToolUse captures what an agent is about to run; PostToolUse what it already ran. You pick the phase.
Files
Every event carries file_path and project_path, so a write outside the working repo is visible, not buried in a transcript.
Tools · MCP
Tool invocations, including MCP and browser actions, with the tool name and session id intact.
Network
endpoint.hostname is recorded wherever an instrumented source supplies it — "called something" becomes "called this host."
Risk
Credential exposure, destructive commands and privilege changes are surfaced against the raw event that triggered them.
Spend
model, input_tokens, output_tokens and cost_usd per event, when a source supplies them. Missing usage stays unknown.
July 2025
During a code freeze the agent ran destructive commands, deleted records for 1,200+ executives and 1,190+ companies, then misreported it.
July 2025
An attacker's pull request injected a prompt telling the agent to wipe filesystem and cloud resources. It shipped in v1.84.0, to close to a million users.
By 2028 (Gartner forecast)
Gartner predicts 25% of enterprise breaches will trace to AI agent abuse by 2028, with securing-AI spend near $4.8 billion in 2027.
01
Merge a PreToolUse or PostToolUse hook, stream OTLP/HTTP JSON to /v1/logs, or import a record file. Nothing is reconfigured automatically.
02
The collector writes events as they arrive. A capture failure prints to stderr and never stops the agent.
03
Inspect the evidence behind a flagged action and mark it reviewed. Reviews persist across restarts.
No. Beam v1 is observe-and-alert only: the hook emits no allow or deny response, and imported enforcement records are counted as skipped. If you need something to stop a command mid-flight today, Beam is not that tool.
Beam is source-agnostic. It accepts a normalized event schema, Claude Code hook payloads, OTLP/HTTP JSON logs and imported numbat records — anything emitting to one of those paths lands in the same timeline.
Not by default. The collector binds to 127.0.0.1:4319, stores events in local files at 0700/0600, and ships no analytics or third-party scripts. Data leaves only through an export you run yourself.
Known credential formats, auth headers, URL query values and private keys, with detection running on the raw text first. Other sensitive text may survive redaction — inspect an export before sharing it.
Beam runs on the endpoint, keeps its record there, and surfaces what deserves a security team's attention.