Skip to main content

​
Overview

The Beacon endpoint dashboard is a local-only, read-only UI for inspecting the runtime JSONL log, active threat rules, runtime inventory, token usage, and approved-memory state. Use it after health checks and validation events to confirm that local telemetry is visible to an analyst. This guide shows how to open the dashboard, write a known event, verify activity views, inspect session detail when session metadata is present, and review Memory, Findings, Detections, Inventory, and Token Usage.

​
Setup

Confirm endpoint health and write a validation event:
Prepare dashboard test data

​
1. Open the dashboard

Start the dashboard and open it in your browser:
Open the local dashboard
Sample output
By default, the dashboard binds to a loopback address and reads the configured runtime log plus its numbered local archives. It is intended for local investigation, not remote administration. To use a custom local address:
Use a custom dashboard address
To inspect a specific runtime log:
Read a specific runtime log

​
2. Test activity visibility

Write a validation event, then open the dashboard and confirm the event is visible in the local activity views.
Create data for dashboard activity views
The root page groups events with a session ID into Agent Activity Sessions. Synthetic validation events may not have enough session metadata to become a rich session row, so use Agent Activity and event details to validate a controlled single event. Use filters to narrow activity by harness, model, severity, category, failures, approvals, MCP activity, file changes, commands, session, or events that may need review. Event details should open for rows from either the active log or a rotated archive.

​
3. Review sessions and summaries

Generate local agent activity with a supported runtime, then use Agent Activity Sessions to open a session detail page. Confirm the prompt, harness, model, repository, activity counts, severity summary, event timeline, and raw JSON drawer reflect the same runtime log you are testing. Open Agent Activity to review aggregate event totals, needs-review counts, high or critical activity, denied or blocked activity, failed tools, sessions, top harnesses, top models, top repositories, and MCP servers.

​
4. Review Memory, Findings, and Inventory

Use the remaining local views to check adjacent state:
  • Memory: read-only evaluation, candidate, and approved-memory counts from memory.db.
  • Detections: the active threat-rule set from the local rules store plus the built-in baseline.
  • Findings: on-demand rule matches over the configured runtime log.
  • Agent Inventory: detected runtimes, MCP servers, Agent Skills, hooks, and telemetry status.
  • Token Usage: runtime-reported token counts and cost where supported.

​
Key features demonstrated

  • Dashboard startup against the expected runtime log.
  • Activity visibility for a controlled validation event.
  • Session browsing and detail views for real agent runs.
  • Memory, findings, detections, token, and inventory views.
  • Loopback-only inspection without a hosted Beacon account.

​
Troubleshooting

If the dashboard opens but does not show expected events, check:
  • The runtime log path shown by beacon endpoint status.
  • Whether the validation event was written with beacon endpoint test-event.
  • Whether you are testing user mode or system mode.
  • Whether --log-path points at the same file you validated.
  • Whether the expected event is in the active log or one of the numbered archives next to it.

beacon endpoint dashboard

Review all dashboard flags and command examples.

Write Validation Events

Write a synthetic event before testing dashboard visibility.

Run Endpoint Health Checks

Confirm endpoint readiness before opening the dashboard.

Inspect Runtime Logs

Confirm the dashboard is reading the intended runtime JSONL log.