Platform & security engineering
Beam for security teams
Your engineers use AI everywhere and no single system knows what it did. Beam normalizes the AI sources you instrument into one local record, flags risky actions with evidence, and scans skills and MCP configs before they are trusted.
Today it runs per-machine. Fleet management, SSO and enforcement are future work, not shipped.
What a pilot gives you
Scoped to v1 — every item below is verifiable on a machine this week.
- Source-agnostic
One schema across tools
Claude Code hook payloads, OTLP/HTTP JSON logs and imported numbat records normalize into one event shape, ATT&CK tags preserved.
- Evidence
Flags you can adjudicate
Credential exposure, destructive commands and privilege changes surfaced against the raw event — reviewable, not a score you must trust.
- Supply chain
Pre-run review of skills and MCP servers
Eleven heuristic patterns plus a version-pin check, run before someone connects a file to real credentials.
- Portable data
Formats your pipeline already speaks
OTLP/HTTP JSON in, redacted NDJSON out. No proprietary sink, no background forwarding to explain to a privacy review.
- Data handling
A short answer for the questionnaire
Local files at 0700/0600, credential formats redacted before persistence, no analytics or telemetry by default.
- Investigation
An exportable case
Event, scan and review files with SHA-256 hashes. Hashes establish internal consistency, not authenticity or completeness.
Numbers that frame the decision
- Beam retention, per machine
- 10,000 events / 500 reports
- Beam enforcement today
- None — observe and alert only
- Fleet management, SSO, shared teams
- Not shipped — future work
How teams pilot it
- 01
Instrument a handful of machines
Hooks are merged by hand, deliberately. Beam never installs or enforces a hook, so nothing changes without someone's action.
- 02
Watch what your AI does for two weeks
Find out which risky patterns your org actually produces before writing policy about them.
- 03
Export a case and decide
If enforcement is a hard requirement now, Beam is the wrong tool this quarter — that is stated on purpose.
The failure modes you are underwriting
July 2025
An agent deleted a production database during a code freeze
Replit's agent removed records for 1,200+ executives and 1,190+ companies, then misreported it. Nobody could reconstruct the sequence afterwards.
September 2025
A malicious MCP server reached an estimated 300 organizations
postmark-mcp v1.0.16 added a silent BCC to an attacker address, on 1,643 total downloads. MCP supply-chain review is not theoretical.
2025–2026
Tool configuration is itself an attack surface
CVE-2025-54135 showed a hosted prompt rewriting Cursor's config; Check Point disclosed hook injection and ANTHROPIC_BASE_URL exfiltration in Claude Code.
Where Beam fits, and where it doesn't
Beam does
- Give you one normalized record across the AI tools on a machine
- Scan skills and MCP configs before someone connects them
- Let owners and admins set observe, advisory, or enforce policy, including Sentinel on browser AI chats
- Keep collector data local, redacted and in portable formats you move yourself
Beam does not
- Guarantee a verified deny on Cursor, Copilot CLI or Gemini
- Forward to a SIEM, or replace an estate-wide AI-security platform
Questions from security reviews
Can Beam enforce policy on developer machines today?
Yes. Workspace owners and admins set observe, advisory, or enforce policy. Enforce denies matching tool calls on Claude Code and Codex PreToolUse. Sentinel pauses or blocks high-risk browser AI sends. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block, and missing or expired cached policy is fail-open.
Can we deploy it across a fleet with MDM?
Yes. Apple and Windows MDM are available for the collector. Owners and admins manage org baselines and can apply stricter member overrides from the workspace console.
What leaves the machine?
Nothing by default. The collector binds to 127.0.0.1:4319, writes local files at 0700/0600, redacts known credential formats before persistence, and the management app carries no analytics or third-party scripts. Exports happen when a person runs one.
How does Beam relate to numbat and other open-source monitors?
Beam is an independent implementation, not a fork, and it interoperates rather than competes: it imports numbat's normalized event and finding records with source references and ATT&CK tags intact, and accepts OTLP/HTTP JSON from anything else you run.
Related
Pilot it on ten machines before you write the policy
Find out what your teams' AI actually does, with evidence you can read, then set observe, advisory, or enforce policy from the workspace.