---
title: "Open-source Runtime Security Layer for AI Agents"
url: https://stacklist.com/card/caab268b-048a-4553-a13c-fff14c69d62f
source_url: "https://x.com/akshay_pachaar/status/2098042808221511836?s=12"
stack: https://stacklist.com/c/technology/stack/1659549d-373d-4391-ba12-5a14d40c19ed
summary: "Agent Beacon is an open-source runtime security layer that records and normalizes AI agent activity across 23+ harnesses, enabling real-time detection of suspicious actions like unauthorized file modifications or command execution. The tool runs locally, normalizes events into a unified format, and integrates with security platforms like Splunk, Datadog, and CrowdStrike for comprehensive agent activity monitoring."
tags: "agent-security, runtime-monitoring, open-source, ai-agents, detection-rules, security-layer"
key_entities: "Akshay (person), Agent Beacon (technology), Claude Code (technology), Codex (technology), Asymptote Labs (organization), Splunk (technology), Datadog (technology), Elastic (technology), CrowdStrike (technology), runtime-security (concept)"
classification: "analysis"
content_hash: "sha256:cde7ffbcc458be9c502dc292c071b578b7d5fa53ba232244213374d36ae1fd94"
acp_version: "0.2"
token_counts_approximate: 531
visibility: public
agent_accessible: true
status: "final"
---

# Open-source Runtime Security Layer for AI Agents

Akshay 🚀 @akshay_pachaar Finally, an open-source runtime security layer for your agent harnesses. AI agents can call tools, run shell commands, modify files, and interact with production systems. But when something goes wrong, teams often have to reconstruct what the agent actually did from scattered logs after the fact. Agent Beacon is built to change that. It runs locally and records agent activity as it happens, including: → Tool calls → Shell commands → File changes → Approval decisions → Session and harness context The useful part is that it normalizes all of this into the same event format across 23+ agent harnesses. So instead of writing different detection logic for Claude Code, Codex, or another harness, security teams can reason about the underlying action itself. A command executed is a command executed, regardless of which harness produced it. Beacon also records how confidently an event was captured. An action can be directly observed from the runtime or inferred from indirect evidence. That matters when you start writing security rules against this data. For example, you can detect when an agent reads an environment variable, modifies a sensitive file, executes a suspicious command, or performs an action without the expected approval. And the detection happens while the session is still unfolding, not days later during incident reconstruction. Everything runs locally by default. You can inspect sessions through the dashboard, write your own detection rules, or forward the same normalized events to tools like Splunk, Datadog, Elastic, Sentinel, or CrowdStrike. Beacon GitHub: github.com/Asymptote-Labs… (don't forget to star 🌟) I also wrote a detailed article on the same, covering how important runtime security is and how to build it for your agent harnesses. The article is quoted below. 00:00 Akshay 🚀 @akshay_pachaar Sep 9 Article Your Agent Harness Needs Runtime Security A 100% local, open-source guide to recording what AI agents actually do at runtime The modern agent stack has tools, memory, context, and orchestration. What it still lacks is a runtime system of...