Asymptote Beacon
by Asymptote Labs
Open-source endpoint telemetry for AI coding agents, with a paid platform for agent policy and governance
Asymptote Beacon is an MIT-licensed telemetry layer that records what AI coding agents such as Claude Code, Codex and Cursor do on employee machines, in CI and in cloud agents. It is built for security and platform teams that need a normalized record of agent prompts, tool calls, commands and file edits to send to their SIEM, with a managed Asymptote platform on top for policy enforcement and governance.
Asymptote Beacon is the open-source half of Asymptote Labs, a New York startup founded by Justin D'Souza (CEO) and Shukan Shah, both former engineers at Doppel. Beacon launched with a Show HN post in May 2026 and was covered by Help Net Security in June 2026. It installs on an endpoint, discovers supported agent runtimes and configures them to report: Claude Code and Codex CLI export OpenTelemetry to a local collector, and Cursor gets hooks that emit session, prompt, tool-use, command, approval and file-edit events. A bundled collector, written mostly in Go, turns those logs and hook events into one normalized event model that extends OpenTelemetry's GenAI conventions, writes JSONL locally and serves a loopback-only dashboard. Records can be forwarded to Splunk, Microsoft Sentinel, CrowdStrike Falcon LogScale, Rapid7 InsightIDR, Sumo Logic, Wazuh, Datadog, Elastic, CloudWatch Logs or S3 and Google Cloud Storage. The GitHub README lists 29 local harnesses (including Cline, Gemini CLI, GitHub Copilot CLI, Kiro, OpenHands and VS Code), browser extensions for Claude.ai and ChatGPT, cloud agents from Claude Code, Cursor and Devin, and SDK wrappers for Anthropic, OpenAI, the Claude Agent SDK and the Vercel AI SDK. Newer releases also distil captured sessions into reviewed, reusable memory that agents can retrieve through MCP or Agent Skills. Coverage varies by harness: the README shows no session capture for Gemini CLI or Devin Desktop and only partial coverage for VS Code. On October 20, 2026 the company announced a $5.5M seed round led by Tower Research Ventures, whose own security team is testing Beacon. The paid Asymptote platform adds managed ingest, retention, search, detections, fleet inventory, identity mapping, real-time policy enforcement, SSO, RBAC and audit trails, with a private-deployment tier for data isolation and residency. It competes with closed agent-security products such as Straiker and with EDR vendors adding agent visibility.
A security engineering or detection team at a company where developers already run Claude Code, Codex or Cursor on their laptops, and whose EDR does not explain what those agents did.
One normalized, SIEM-ready log of agent prompts, commands, tool calls and file edits across more than 20 agent harnesses, collected with a free MIT-licensed agent before any purchase decision.
At a Glance
- Category
- Governance & Security
- Pricing
- Freemium, Contact for pricing
- Target Market
- CISOs, Security Engineers, Platform Engineering Teams, CTOs
- Deployment
- Open-source, Self-hosted, Cloud-first
- Headquarters
- New York, United States
- Team Size
- 1-10
Key Features
- ✓Cross-harness agent capture
Discovers Claude Code, Codex, Cursor and over 20 other local agent runtimes on a host and configures each one to report its activity.
- ✓Normalized event schema
Converts OpenTelemetry logs and native hook payloads into one event model extending OpenTelemetry GenAI conventions, so detections work across every agent.
- ✓SIEM and log forwarding
Sends records to Splunk, Microsoft Sentinel, CrowdStrike Falcon LogScale, Rapid7, Sumo Logic, Wazuh, Datadog, Elastic, CloudWatch, S3 or GCS.
- ✓Configurable retention modes
Lets admins omit prompt text, command output or raw diffs, or keep redacted fields only, to match privacy rules for endpoint monitoring.
- ✓MDM-friendly rollout
Installs through Homebrew, signed deb and rpm packages, a checksummed Linux script or a silent Windows MSI, so Jamf or Fleet can push it fleet-wide.
- ✓CI and cloud agent coverage
Captures agent runs in CI through a GitHub Action and beacon ci exec, plus Claude Code, Cursor and Devin cloud agents.
- ✓Managed governance platform
The paid tier adds managed retention and search, detections, identity mapping, approvals and real-time policy enforcement on top of Beacon telemetry.
Capabilities
Use Cases
- •Investigating a risky agent action
A security analyst pulls the full session timeline of prompts, commands and file edits from the SIEM to see exactly what a coding agent changed.
- •Inventory of shadow coding agents
A platform team deploys Beacon through MDM and learns which agent harnesses developers actually run, instead of relying on a survey.
- •Agent detections in an existing SOC
Detection engineers write rules against one normalized schema in Splunk or Sentinel rather than parsing each agent's own log format.
- •Auditing agents in CI pipelines
DevOps teams wrap agent jobs with beacon ci exec so automated agent runs in CI leave the same audit trail as laptop sessions.
- •Sharing agent-learned fixes across teams
Engineers approve debugging patterns Beacon extracted from past sessions so another team's agent retrieves the fix through MCP instead of rediscovering it.
Ideal For
Best For
- ✓Security teams that need an audit trail of what coding agents executed on developer endpoints
- ✓Organizations already running Splunk, Sentinel, CrowdStrike LogScale or Datadog that want agent events in the same pipeline
- ✓Platform teams rolling out several coding agents at once and needing one inventory of which harnesses are in use
- ✓Companies that want to inspect and self-host the telemetry layer before paying for a managed governance product
- ✓Engineering leaders who want agents to reuse fixes and debugging patterns that other agents already found
Not Ideal For
- ✗Teams that need kernel or process monitoring, shell history or general credential-use attribution, which Help Net Security reported the build does not provide
- ✗Buyers who need named reference customers or published enterprise pricing before a pilot, since Asymptote names neither
- ✗Shops standardized on a harness Beacon only partly covers, such as Gemini CLI or Devin Desktop, where the README shows no session capture
- ✗Windows fleets on ARM, since only an x64 MSI is listed
Integrations
Deployment
Market Analysis
Pros
- ✓Free, MIT-licensed collector that security teams can audit before deploying to every laptop
- ✓Broad harness coverage: 29 local agents plus browser, cloud and SDK paths per the README
- ✓Native forwarding to the SIEMs most enterprises already run
- ✓Retention modes let teams drop prompt text or diffs to reduce privacy exposure
Cons
- ✗Coverage is uneven: several harnesses lack session capture and VS Code is only partly covered
- ✗No kernel, process, shell-history or broad SaaS telemetry in the build Help Net Security reviewed
- ✗Six-person company with no named customers and no published enterprise pricing
- ✗The CEO told Help Net Security that a standard for detection rules is still an open problem
Pricing
Community (open-source Beacon)
$0
- ✓Capture across 20+ agent harnesses
- ✓Forward to Splunk, Datadog, CrowdStrike and other systems
- ✓MDM deployment via Jamf, Fleet and others
- ✓Local JSONL record and open event schema
- ✓Community support
Enterprise (managed Asymptote)
Contact for pricing
- ✓Managed ingest, retention, search and analytics
- ✓Fleet-wide agent inventory and usage visibility
- ✓Identity, policy, approvals and governance
- ✓Real-time alerts and policy enforcement
- ✓SSO, RBAC and audit trails
- ✓Priority onboarding and support
Private Deployment
Contact for pricing
- ✓Private cloud or customer-controlled deployment
- ✓Data isolation and residency options
- ✓Custom retention and forwarding architecture
- ✓Coverage across endpoints, CI and cloud
- ✓Dedicated deployment support
Beacon itself is free under the MIT licence and runs without an Asymptote account. The managed platform and private deployment are quote-only; Asymptote publishes no dollar figures, and SSO, RBAC, real-time enforcement and data residency all sit in the paid tiers. The pricing page's comparison table and plan cards also disagree on which tier includes private deployment, so confirm in writing.
Security & Compliance
Connect
Sources
This page was written from 8 sources, 6 on domains other than asymptotelabs.ai.
- 1.asymptotelabs.ai — asymptotelabs.aivendor
- 2.asymptotelabs.ai — pricingvendor
- 3.github.com — agent beacon
- 4.thenextweb.com — asymptote labs 5 5m seed ai agent security
- 5.helpnetsecurity.com — agent beacon open source telemetry layer ai agents
- 6.letsdatascience.com — asymptote labs raises 55m seed to monitor ai agents 64351ebd
- 7.hn.algolia.com — 48183793
- 8.hn.algolia.com — 50182883
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
Classie Supervise
Real-time supervision for sanctioned and shadow AI agents, with OPA policies enforced inline across browser, endpoint and cloud
Mave
Agentic SecOps platform that investigates every alert across your existing security tools without ingesting the data
Blackwall
Bot, AI-agent and L7 attack protection that hosting and cloud providers run in their own infrastructure and resell under their brand
Opsin
AI agent security that maps what employee-built agents in Copilot, ChatGPT Enterprise, Claude and Gemini can reach, and stops them when they overstep