Harness coverage
Grok Build Telemetry in Beacon
Beacon supports Grok Build through managed hook files for session, prompt, tool, command, and file telemetry.
May 21, 2026
What is Grok Build?
Grok Build support adds hook coverage for the lifecycle events security teams need to understand what an agent attempted and what happened next.
Collection path: Native hooks
Authoritative date: May 21, 2026 from v0.0.19 in the Beacon CLI changelog.
How Beacon reads Grok Build
Beacon installs Grok Build hooks and normalizes session, prompt, pre-tool, post-tool, failed-tool, stop, session-end, command, and file events.
The result is normalized into Beacon's endpoint event schema so security teams can investigate activity by harness, repository, session, user, model, command, file, tool, MCP server, or approval context where the runtime exposes those fields.
Telemetry coverage
- Session and prompt events
- Pre-tool, post-tool, and failed-tool events
- Command and file-operation context
- Stop and session-end activity
What you can do now
- Capture Grok Build sessions in local endpoint telemetry.
- Classify Grok post-tool failures as high-severity tool.failed events.
- Use project-level hooks where Grok trusts the folder.
Get started
- Install Beacon endpoint components.
- Run beacon endpoint hooks install --harness grok.
- Generate a Grok Build session and confirm events appear in runtime.jsonl.