Data Inventory

Runtime coverage and endpoint event fields Beacon can write

Data Categories

Beacon writes normalized endpoint events only when supported runtimes provide telemetry through a configured local surface. Each event includes required event, endpoint, and harness context. Optional entities are present only when the source payload provides that context and the configured retention mode allows it.

Runtime Inventory

Agent harness	Collection path	Commonly available telemetry
Claude Code	Local OTLP export	Prompt, command, tool, and file telemetry when emitted through OTLP
Codex CLI	Local OTLP logs plus optional inventory hooks	Session, prompt, approval, and tool-result activity from Codex semantic logs; inventory heartbeat triggers from hooks
Gemini CLI	Opt-in local OTLP	Prompts, tool calls, MCP activity, file operations, and approval-related events emitted through OTLP
Grok Build	Native hooks	Session, prompt, pre-tool, post-tool, failed tool, stop, session-end, command, and file telemetry
OpenCode	Managed plugin hooks	Chat messages, session events, command execution, permission activity, diffs, and errors
Devin CLI	Native hooks	Session, prompt, pre-tool, post-tool, permission request, stop, session-end, approval, and file telemetry
Devin Desktop	Cascade/Windsurf hooks	Prompt, command, MCP tool, file read, and file write telemetry where Desktop exposes Cascade hook payloads
Factory Droid	OTLP HTTP plus optional hooks	Session, prompt, write/edit/create tool use, stop, session-end, and available OTLP telemetry
Cursor	Native hooks	Prompt, tool, shell command, MCP-like, approval, and file edit telemetry
Claude Cowork	Admin-configured OTLP	Prompt, command, tool, and file telemetry when emitted through Claude Cowork OTLP
OpenClaw Gateway	Gateway-configured OTLP/HTTP	OTLP logs, traces, and metrics from the Gateway diagnostics plugin

Local Inventory Metadata

beacon endpoint inventory can also report local agent configuration metadata that is not emitted by a runtime event:

Inventory area	Data retained
Configuration files	Runtime, scope, parser status, path/path hash, file hash, modified time, Beacon-managed state, and MCP server counts
MCP servers	Runtime, source path hash, server name/hash, transport, command name/hash, argument count, safe env-key names/counts, and definition hash
Agent skills	Runtime/source family, scope, skill name/hash, root and manifest path/hash, file hash, modified time, and parser status

By default, inventory is metadata- and hash-only. Beacon hashes config, hook, and SKILL.md files for change detection but does not retain file bodies, full MCP server definitions, or skill instruction bodies in inventory JSON, dashboard responses, or inventory snapshot events.

Operators can opt into capturing full definitions with the --contents flag (CLI) or the include_contents config setting (snapshot telemetry). When enabled, configs, hooks, and skills gain a redacted content block and MCP servers gain a full definition block. Captured contents always pass through local secret redaction — values under keys matching TOKEN, SECRET, PASSWORD, KEY, AUTH, or CREDENTIAL are replaced with ***REDACTED*** — and a per-file size cap (64 KiB by default, configurable via max_content_bytes).

Inventory heartbeat telemetry uses a separate local JSONL file, inventory_state.jsonl, so runtime.jsonl stays scoped to agent runtime activity. Normal hook execution can periodically write:

• inventory.heartbeat, a small event showing that Beacon checked local agent configuration inventory and recording counts plus a snapshot digest.
• inventory.snapshot, a snapshot written when the digest changes or inventory is first initialized. Metadata-only unless include_contents is enabled.

By default, snapshots include config-file metadata, MCP server metadata, skill metadata, and hook config metadata across supported local runtimes. They do not include skill instruction bodies, MCP secret values, full environment values, full command arguments, or unrelated config content. When include_contents is enabled, snapshots additionally carry redacted, size-limited content and definition blocks as described above.

Required Fields

Field	Meaning
timestamp	UTC event time
vendor	Always beacon
product	Always endpoint-agent
schema_version	Public schema version
event.kind	Event family, currently agent_runtime
event.action	Normalized action such as command.executed or tool.invoked
event.category	Runtime-provided or inferred event category
severity	Event severity
endpoint	Host and operating system context
harness	Runtime that produced the signal

Optional Entities

Entity	Purpose	Common fields
endpoint	Device and agent context	hostname, os, agent_version
user	Local operating system user context	name, uid
harness	Agent harness context	name, version, executable_path, config_path
session	Conversation or runtime session context	id, working_directory
tool	Tool invocation context	name, command, path
file	File activity context	path, operation, language, diff_hash, diff_bytes
command	Shell or process execution context	command, exit_code, duration_ms
mcp	MCP-like server and tool context	server, tool
approval	Approval or policy decision context	required, decision, reason
policy	Policy metadata when available	id, name, decision, enforcement, reason
prompt	Prompt text when retention allows it	text
content	Content handling state	retention, included, redacted, truncated
destination	Output or validation destination state	type, mode, status
health	Endpoint or component health state	component, status, reason

Top-level model, repository, branch, message, raw, and field_truncated fields can add shared context across entities. Content-bearing fields follow the configured retention mode.

Related

Schema fields

Review the full entity model and common fields.

Agent harnesses

Compare runtime-specific collection surfaces and telemetry coverage.