Skip to main content

Overview

Inventory shows the local AI agent footprint on an endpoint: installed runtimes, local skills, MCP servers, local config files, telemetry hooks, OTLP settings, and recent observed activity. Use it when you need to answer what is installed, what an agent may be able to access, and whether Beacon has recently observed activity from each runtime. Inventory explains what is present and observable on the host. Detections evaluate the observed event stream and emit findings when local rules match risky behavior.

Inventory Areas

Agent Harnesses

Review installed, configured, managed, and observed state for supported agent harnesses.

MCP Servers

Review local MCP server configuration and compare expected and unexpected tool access.

Skills

Review local skill manifests as an agent extension and configuration surface.

Setup

Install Beacon and configure endpoint telemetry before running inventory checks:

1. Run A Basic Inventory

Start with the default inventory view:
Inventory local runtimes
Sample output

2. Include All Local Signals

Use --all when you want local config files, skill manifests, MCP servers, hooks, OTLP settings, and observed runtime coverage in one report:
Show full local inventory
Use --system for packaged or MDM-managed installs:
Check a system-mode install

3. Export JSON For Review

Use JSON output for support bundles, scripts, or fleet comparison:
Export inventory as JSON
Sample JSON output

Key Questions Answered

  • Which supported agent runtimes are installed or configured on this machine?
  • Which local agent skills are present under supported skill roots?
  • Which MCP servers are referenced by local agent configuration?
  • Which runtime config files can Beacon inspect locally?
  • Which hooks, OTLP settings, or launch environment entries are present?
  • Which detected runtimes have recently produced Beacon events?

What To Look For

Inventory reads local endpoint state only. It does not authenticate to remote SaaS accounts, skill marketplaces, or MCP servers.

View Results

Beacon dashboard Inventory view showing agent runtime configurations and coverage state.

Review runtime configurations, inventory status, and local telemetry coverage from the Inventory view.

Runtime Coverage States

  • Installed: the runtime or executable appears to be present locally.
  • Configured: Beacon can see telemetry settings, hooks, launch environment entries, or other local config for the runtime.
  • Managed: the detected telemetry surface appears to be configured by Beacon.
  • Observed: recent Beacon events in the runtime log reference the runtime.
A runtime can be installed but not configured, configured but not observed, or observed only in a different user-mode or system-mode log.

MCP Servers And Configs

Use MCP inventory to spot tool exposure from local agent configs:
  • Expected MCP servers missing after deployment
  • Unexpected MCP servers on sensitive endpoints
  • Server references introduced by a specific runtime config
  • User-mode versus system-mode config differences

Agent Skills

Use skill inventory to spot durable local instruction surfaces:
  • Expected skill packs missing after workstation setup
  • Unexpected local skills on sensitive endpoints
  • User-scope versus project-scope skill differences
  • Recent skill manifest changes through file hash and modified-time metadata
Beacon reports skill names, paths, hashes, scope, and parser status. It does not retain SKILL.md instruction bodies in inventory output or inventory events.

4. Open Dashboard Inventory

Open the dashboard for a quick visual check alongside top harnesses, models, repositories, MCP servers, and risk signals:
Open the dashboard

Key Features Demonstrated

  • Local runtime discovery without remote SaaS authentication.
  • Skill, MCP server, and config inventory from supported local paths.
  • Coverage state comparison across installed, configured, managed, and observed runtimes.
  • Dashboard handoff for visual review.

Troubleshooting

Check whether:
  • The runtime is installed on the endpoint
  • Beacon can detect the runtime or its configuration file
  • The skill exists under a supported one-level skill root with a SKILL.md manifest
  • The MCP server is defined in a supported local config path
  • Hooks, OTLP settings, or launch environment entries are configured for that runtime
  • User mode or system mode is reading the config and runtime log you expect
  • Recent events exist in the active runtime log or a rotated archive

Agent Activity Guides

Review common Beacon workflows for local agent runtime visibility.

Investigate Agent Runtime Activity

Collect, inspect, and forward normalized telemetry from local agent runtimes.

beacon endpoint dashboard

Open the local dashboard and review Security Overview.

beacon endpoint inventory

Review flags, examples, and JSON output behavior.

Endpoint discover

Discover supported local agent harnesses and telemetry state.

Data inventory

Review runtime coverage and endpoint event fields Beacon can write.