Skip to main content
Glama
whyashthakker

beam-mcp

beam-mcp

An MCP server that exposes Beam's local, offline risk-scanning to any MCP-compatible host (Claude Desktop, Claude Code, and others).

Beam observes AI agent activity and heuristically flags risky patterns (secrets, destructive commands, exfiltration, unpinned MCP dependencies, etc.) — it never executes, blocks, or approves anything. This server is a thin, read-only wrapper around the beam CLI: it doesn't reimplement Beam's detection logic, and it doesn't add any capability the CLI doesn't already have.

Prerequisites

  • Beam CLI installed and on PATH (npm install -g beam).

  • Node.js >= 20.17.

Related MCP server: tooltrust-mcp

Install & run

npm install
npm run build

Point your MCP host at the built binary over stdio (the only transport this server supports today):

{
  "mcpServers": {
    "beam": {
      "command": "node",
      "args": ["/absolute/path/to/beam-mcp/dist/index.js"]
    }
  }
}

Or, once published: npx beam-mcp.

Status

We're still building out the MCP layer for Beam. This first slice is intentionally narrow — local, read-only tools. A hosted version will be available at mcp.agentbeam.com.

Tools

All tools are read-only. None of them start, stop, configure, or send data anywhere beyond your own machine (and your own already-running Beam collector, for the one tool that talks to it).

Tool

What it does

beam_scan_content

Offline heuristic scan of inline text (a skill/instruction file or MCP config). No network call, no collector required.

beam_scan_path

Same scan, over a file already on disk. Never modifies the file.

beam_list_rules

Lists Beam's active detection rules (built-in, custom, sequence), grouped by category.

beam_list_supported_agents

Lists which coding agents Beam can hook into and whether each hook payload is verified.

beam_collector_status

Health check against your local Beam collector (127.0.0.1 only). Tells you to run beam start if it isn't up — doesn't start it for you.

Security

Security is a core design constraint of this server, not an afterthought — it runs locally, exposes read-only tools only, and takes a conservative approach to anything touching your machine or the Beam collector. See SECURITY.md to report a concern.

Development

npm run dev        # run src/index.ts directly with tsx
npm run typecheck

License

AGPL-3.0-only — see LICENSE. Same license as beam-cli, for the same reason: this stays free and open, including for anyone who modifies it and offers it as a hosted service.

  • beam-cli — the CLI and SDK this server wraps. Open source.

Available Tools

5 tools
beam_collector_statusCheck the local Beam collector's statusA

Check whether Beam's local collector is running (it only ever binds to 127.0.0.1) and return its health summary: mode, event count, retention limit. Does not start, stop, or configure anything. Uses the same local credentials as the beam CLI itself — this tool never generates, stores, or exposes them.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it meaningfully discloses non-obvious behavior: it only ever binds to 127.0.0.1, never starts/stops/configures anything, and never generates, stores, or exposes credentials. It does not mention what occurs if the collector is down or the exact response format, but the safety profile and operational scope are well-covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the purpose ('Check whether Beam's local collector is running'), then the return summary, then a clear limitation and safety note. Every clause earns its place; no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers what the tool does, what it returns (mode, event count, retention limit), and what it never does. Given there is no output schema, it could be more precise about how the running status is encoded (e.g., a boolean), but the listed return fields give an adequate mental model for a zero-parameter status check.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Baseline for zero parameters is 4. The schema has no properties and the description doesn't need to explain parameters; all it could add is return value detail, which it does. No gap here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('Check whether Beam's local collector is running') on a distinct resource (the local Beam collector), with the binding to 127.0.0.1 as a clarifying detail that differentiates it from any network-wide status check. The return summary (mode, event count, retention limit) makes the responsibility concrete, and this clearly is distinct from the scan/list sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says what it does not do ('Does not start, stop, or configure anything'), giving a clear when-not-to-use clause. It also notes it shares the beam CLI's local credentials, implying when it can be called safely. Although it doesn't name an alternative tool, none of the siblings cover status checks, so 4 is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

beam_list_rulesList Beam's detection rulesA

List every active Beam detection rule, grouped by category: built-in rules, any custom rules loaded from ~/.beam/rules.json, and cross-event sequence rules. Use this to know what patterns Beam actually looks for before relying on a scan result. Read-only, runs entirely locally.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses 'Read-only, runs entirely locally,' which informs the agent about side effects and privacy. It does not describe return format or potential empty results, but for a simple list tool this is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the primary action and grouping detail, followed by a use-case and behavioral note. Every sentence earns its place with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers what the tool does, what it returns (grouped rules), why to use it (before relying on scan results), and its operational characteristics (read-only, local). For a parameterless list tool with no output schema, this is complete and leaves no critical gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description does not need to elaborate on parameters, and the empty schema leaves nothing ambiguous. No additional parameter information is required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'every active Beam detection rule', with explicit grouping by category (built-in, custom, cross-event). It distinguishes itself from sibling tools like beam_scan_content and beam_scan_path, which perform scans, not rule listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides context: 'Use this to know what patterns Beam actually looks for before relying on a scan result.' This implies when to invoke the tool, but does not explicitly state when not to use it or mention alternative tools. Still, the guidance is clear enough for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

beam_list_supported_agentsList agents Beam can hook intoA

List the coding agents Beam knows how to capture activity from (e.g. claude-code, codex, cursor), whether each one's hook config is installable, and whether its hook payload shape has been verified against that agent's own docs. Read-only, runs entirely locally.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only, runs entirely locally', which is critical safety and execution context. It also explains that it reports installability and verification status, providing insight beyond a simple list. The only minor gap is that it doesn't mention potential side effects (like hook configuration changes), but given it's read-only, this is adequately covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, with the core action front-loaded ('List the coding agents...') followed by specific details about the output content. Every word adds value—no filler or redundant phrasing. It is efficiently structured for quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only list tool with no output schema, the description fully covers what an agent needs: the purpose (list agents), the output contents (installability, verification status), examples of agents, and safety characteristics (read-only, local). Nothing essential is missing for an agent to decide whether and how to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters and the empty schema provides 100% coverage. Since there are no parameters to document, the description need not add any parameter details. The baseline of 4 applies, and the description appropriately does not attempt to explain parameters that don't exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (list), resource (coding agents Beam supports), and gives concrete examples (claude-code, codex, cursor). This clearly distinguishes it from sibling tools like beam_scan_content and beam_scan_path, which focus on scanning rather than agent enumeration. The purpose is unambiguous and separable from its siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates what the tool does but does not explicitly state when to use it over alternatives or when not to use it. The usage context is implied (e.g., an agent wanting to know which coding agents are supported), but no exclusions or comparisons to sibling tools are provided. This falls short of explicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

beam_scan_contentScan text for risky agent instructionsA

Run Beam's offline heuristic risk scanner over inline text — an agent skill/instruction file or an MCP server config (JSON). Runs entirely locally: nothing is sent over the network, and the collector does not need to be running. Returns a list of findings (severity, title, explanation, matched evidence).

ParametersJSON Schema
NameRequiredDescriptionDefault
kindNoWhat the content is: an agent skill/instruction file, or an MCP server config (checks version pinning too)skill
contentYesThe raw text to scan

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses key behaviors: runs locally, no network, no collector dependency, and returns structured findings (severity, title, explanation, evidence). However, it does not mention potential side effects or timeouts, and the return format (list of findings) is partially described but not exhaustive. It does not contradict annotations, so a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded: it states the purpose in the first clause, then adds key differentiators (local, no collector) and the output format. Every sentence adds value, with no filler or repetition. It is well-structured for quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (two params, no output schema), the description covers the main usage: what it scans, how it runs, and what it returns. It omits details like error handling, length limits (though schema has maxLength), or performance characteristics, but the essential information for correct invocation is present. It's slightly incomplete because the return format isn't fully specified (e.g., exact structure of findings), but that is not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters (kind and content). The description adds the meaning of 'kind' by referencing 'agent skill/instruction file or MCP server config,' which is a slight elaboration, but it doesn't add syntax or format details beyond the schema. Baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs a heuristic risk scan on inline text, specifying two content types (skill/instruction file or MCP config). It distinguishes from siblings like beam_scan_path, which presumably scans a file path, by emphasizing 'inline text.' The verb 'scan' and resource are specific, leaving no ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use by focusing on inline text, implicitly contrasting with beam_scan_path (likely path-based). It clearly states local execution and that the collector doesn't need to run, which is a usage condition. However, it does not explicitly mention when NOT to use it (e.g., for file paths) or list alternatives, so it's slightly below a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

beam_scan_pathScan a local file for risky agent instructionsA

Run Beam's offline heuristic risk scanner over a file already on disk — an agent skill/instruction file or an MCP server config. Read-only: the file is never modified. Runs entirely locally.

ParametersJSON Schema
NameRequiredDescriptionDefault
kindNoWhat the content is: an agent skill/instruction file, or an MCP server config (checks version pinning too)skill
pathYesAbsolute or relative path to the file to scan

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries burden. It discloses read-only behavior and that it runs entirely locally, which are key safety and operational traits. Does not cover output format but covers the most critical behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. Purpose and key constraints are front-loaded, making it immediately actionable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With two simple params, no output schema, and no annotations, the description adequately covers what the tool does, its input, and safety constraints. Missing explicit mention of return format is minor for a scan tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all parameters with descriptions and enum for kind. Description minimally reinforces the type of file but doesn't add new meaning beyond the schema. Baseline 3 is appropriate given 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it runs Beam's offline heuristic risk scanner on a local file, specifying types (agent skill/instruction or MCP server config). It effectively distinguishes from beam_scan_content by emphasizing 'file already on disk'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context on when to use: scanning files already on disk, with examples of file types. Does not explicitly state when not to use or alternatives, but the local-file focus and MCP config mention differentiate it well.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.0
    • First observedbeam_collector_status
    • First observedbeam_list_rules
    • First observedbeam_list_supported_agents
    • First observedbeam_scan_content
    • First observedbeam_scan_path

TDQS

A4.4/5.0

Scored across 5 tools

Disambiguation5/5

Each tool targets a clearly distinct operation: scanning inline content, scanning a file, listing rules, listing supported agents, and checking collector status. There is no meaningful overlap or ambiguity between them.

Naming Consistency4/5

All tools share a consistent beam_ prefix and most follow a verb_noun pattern (scan_content, scan_path, list_rules, list_supported_agents). beam_collector_status is a minor deviation since it uses a noun phrase rather than an explicit verb, but it remains predictable.

Tool Count5/5

Five tools is well-scoped for a focused read-only security scanning utility. Each tool earns its place and there is no bloat or redundancy.

Completeness5/5

The tool surface covers the core read-only workflow: scanning content or paths, understanding available detection rules, knowing which agents are supported, and checking collector health. Since the server is explicitly read-only, there are no obvious missing operations.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    MCP server for https://oathe.ai security audits. Runtime behavioral analysis and security scanner for Ai systems. Check trust scores before installing MCP servers, plugins, or AI agent skills.
    5
    16
    1
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Scans MCP servers for prompt injection, supply chain attacks, excessive permissions, and code execution risks. Includes an offline blacklist that catches known-compromised packages like LiteLLM 1.82.7/1.82.8 and Trivy with zero latency.
    19
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    Scans MCP servers for prompt-injection, tool-poisoning, and SSRF vulnerabilities using 30+ canonical rules across 5 severity tiers, with optional signed safety reports for procurement.
    5
    MIT