Harness coverage
Codex CLI Telemetry in Beacon
Beacon has supported Codex CLI since the first endpoint release and now attributes usage by turn, session, model, repository, and user.
May 13, 2026
What is Codex CLI?
Codex CLI was part of Beacon initial runtime integrations. Later releases added cleaner timelines, inventory heartbeat hooks, token reporting, and turn-level usage from Codex local traces.
Collection path: Local OTLP logs, selective usage traces, and endpoint hooks
Authoritative date: May 13, 2026 from v0.0.1 in the Beacon CLI changelog.
How Beacon reads Codex CLI
Beacon configures Codex local OpenTelemetry export and keeps semantic session, prompt, approval, tool-result, and usage records while suppressing noisy internal spans by default.
The result is normalized into Beacon's endpoint event schema so security teams can investigate activity by harness, repository, session, user, model, command, file, tool, MCP server, or approval context where the runtime exposes those fields.
Telemetry coverage
- Session and prompt activity
- Approval and tool-result activity
- Per-user, per-session, per-model turn token usage in newer releases
- Inventory coverage for Codex config.toml and hooks.json
What you can do now
- Track Codex activity in local endpoint timelines.
- Attribute Codex token usage by turn and user on current releases.
- Inventory Codex configuration and hook drift across endpoints.
Get started
- Install or update Beacon on the endpoint running Codex CLI.
- Include Codex in the endpoint harness configuration.
- Use the local dashboard or beacon token-usage to inspect Codex sessions and usage.