--user | Use per-user endpoint paths. Enabled by default |
--system | Use system endpoint paths and launch daemon |
--log-path <path> | Runtime JSONL log path |
--harness <selection> | Harnesses to configure. Defaults to auto, which repairs every detected integration Beacon can configure. Use all to force every installable integration, or pass an exact comma-separated list such as claude,codex,cursor,kimi. DeepSeek Harness and Kimi Code are user-level only |
--otlp-grpc-port <port> | Local OTLP gRPC port. Defaults to 4317 |
--otlp-http-port <port> | Local OTLP HTTP port. Defaults to 4318 |
--health-port <port> | Local collector health-check port. Defaults to 13133, moved by the same amount as --otlp-http-port when that is changed (HTTP port 4328 gives 13143), so a second collector on alternate OTLP ports does not collide with the first |
--collector <path> | Path to a beacon-otelcol binary. Without it, Beacon uses the one beside the beacon CLI, then one on PATH |
--no-start | Write files without starting the collector service |
--log-access <mode> | Change the system log’s access mode to shared or restricted. Omitted, repair keeps the current mode. See Restricted log access |
--service <kind> | Service manager to use: auto (default), launchd, systemd, or none for a supervised collector process |
--dry-run | Print planned actions without changing endpoint files or services |
--include-runtime-metrics | Include generic process, runtime, and harness operational OTLP metrics in Beacon JSONL. By default, low-signal metrics such as process CPU, memory, Node.js event loop, V8 heap, GitHub Copilot CLI, and OpenClaw operational metrics are filtered out |
--include-codex-spans | Include every high-volume Codex OTLP span for troubleshooting. By default, Beacon keeps semantic logs and only the usage-bearing completed turn span |
--claude-capture-model-context | Record context Claude Code gives the model that no other event reports: the pages its WebFetch tool fetches, and the MCP tool descriptions it shows the model as mcp.tool_listed. Pass it on every repair that should keep capture on; a repair without it turns capture off. See Claude Code: model context from API bodies |
--splunk-hec-endpoint <url> | Splunk HEC endpoint URL |
--splunk-hec-token <token> | Splunk HEC token |
--splunk-index <index> | Optional Splunk index |
--splunk-source <source> | Optional Splunk source |
--splunk-sourcetype <type> | Optional Splunk sourcetype |
--splunk-insecure-skip-verify | Skip Splunk HEC TLS certificate verification |
--splunk-ca-file <path> | Optional CA certificate path for Splunk HEC TLS verification |
--falcon-hec-endpoint <url> | Falcon LogScale HEC endpoint URL |
--falcon-hec-token <token> | Falcon LogScale ingest token |
--falcon-index <repository> | Optional Falcon LogScale repository for multi-repository tokens |
--falcon-source <source> | Optional Falcon LogScale source |
--falcon-sourcetype <type> | Optional Falcon LogScale parser or sourcetype |
--falcon-insecure-skip-verify | Skip Falcon LogScale HEC TLS certificate verification |
--falcon-ca-file <path> | Optional CA certificate path for Falcon LogScale HEC TLS verification |
--otlp-forward-endpoint <endpoint> | Also forward the Claude Code and Codex OTLP the local collector receives, with secrets redacted and raw API bodies dropped, to a second OTLP endpoint: host:port or a URL for gRPC, the base URL for HTTP. For runtimes that already exported to another backend before Beacon took over their OTLP settings. See Kandji, GCS and an existing OTLP backend. Omitted, install and repair keep the forward the endpoint already has |
--otlp-forward-protocol <protocol> | grpc (default) or http/protobuf |
--otlp-forward-harness <list> | Runtimes whose OTLP the forward carries, comma-separated. Default claude,codex; any other source, such as the browser extension, stays local |
--otlp-forward-header <name=value> | Header sent with every forwarded export, usually the backend’s API key; repeatable. Values are stored in a root-only otlp-forward-headers.json beside config.json, which keeps only the names; status and doctor show names only |
--otlp-forward-insecure | Send the forward without TLS (plaintext gRPC) |
--otlp-forward-insecure-skip-verify | Skip TLS certificate verification for the forward |
--otlp-forward-ca-file <path> | Optional CA certificate path for the forward’s TLS verification |
--no-otlp-forward | Remove a configured OTLP forward |
--session-sync | Turn on the scheduled session sync: every 15 minutes, read new records from the agent runtimes’ local session stores into the runtime log. Kept by repair and package upgrades |
--no-session-sync | Turn the scheduled session sync off and remove its job |
