Threat intelligence for
autonomous coding agents
Beekeeper checks every package install, credential read, and network call your agent makes against fresh threat intelligence and structural policy.
go install github.com/home-beekeeper/beekeeper/cmd/beekeeper@v1.2.0What it does
See what your agents run. Respond when it's dangerous.
Beekeeper is a stack of layers between your agents, the tools they call, and your machine. Each layer watches a different surface and gives you a way to respond, from blocking a malicious install to quarantining a confirmed-bad package, all from one local control center.
Agent safety
On by defaultThe pre-exec gate. Before a tool call runs, beekeeper check blocks a corroborated-malicious install, denies a read of a credential path like ~/.ssh or ~/.aws, and applies install posture to every package install (release age, lifecycle scripts, and git or remote-URL dependencies, warn and fail-soft by default). An optional local LlamaFirewall sidecar scores tool output for prompt injection and unsafe code.
MCP gateway
On by defaultA hook only ever sees the agent's outgoing call. The gateway is the one place that scans an MCP server's responses for prompt injection, so any harness can route its MCP servers through it. For Tier-3 harnesses, which have no pre-exec hook, it is also their only enforcement point (their native tools stay unguarded).
Catalog & scan
On by defaultThe intelligence. Catalogs sync in the background from Bumblebee threat-intel, OSV, and Socket; beekeeper scan uses the Bumblebee scanner to inventory what is already installed and match it. One source can only warn, two independent sources block, three quarantine. A new sync re-checks the packages already on disk.
Machine safety
Opt-in · privilegedIdentity is not enough, so the Sentry watches behavior. It correlates process, file, and network events from editor extensions and agent CLIs into nine defined exfiltration patterns drawn from recent supply-chain attacks. Detection-only. A confirmed incident feeds the local corpus, so the next install of that package is caught immediately.
Control center (TUI)
On by defaultOne always-on local pane for everything above. It surfaces live decisions and alerts as your agents work, and it is where you respond to incidents and tune policy: edit thresholds and allowlists, opt rules up to block, and manage the first-responder settings (auto-quarantine and the corpus) without hand-editing JSON.
Self-protection
On by defaultA security tool is a target. The agent cannot read or write Beekeeper's config and state, overwrite its binary, or remove its own hook, and the separately-keyed beekeeper-self catalog quarantines a compromised release on the next start. More on this below.
Control center
Watch it work. Take control.
One always-on local pane that shows Beekeeper at work and lets you act. It stays quiet until something needs you, then surfaces the critical Sentry incident, the structured audit log with the reasoning behind every block, warning, and alert, the read-only install-posture comparison, and the quarantine review. Respond without leaving the terminal, all from the colon command palette.
Calm dashboard (1 of 9)
First-responder loop
Confirm a threat once. Catch it instantly after that.
When fresh intelligence confirms a package malicious, Beekeeper reacts on the same machine: it contains the install, tightens the watch, and records the outcome so the next install of that package is caught the moment it lands. Reversible, human-gated, and entirely local.
Confirm
A background catalog sync, or an adjudication pass that runs off the hot path, flags an installed package corroborated by two independent sources. One source can only warn; a real block needs two catalogs to agree.
Contain, reversibly
Beekeeper arms the TUI quarantine card for any matching install on the machine, and tightens the detection-only Sentry watch on that package's process subtree if the privileged layer is running. Quarantine is a reversible move; the permanent purge always stays in human hands. Automatic moves are opt-in and dry-run by default.
Remember
It writes a local-only catalog overlay entry that survives the next catalogs sync. The next install of that same package is caught the moment it lands, instead of waiting for the upstream feed to carry the signature.
The corpus flywheel
opt-inWith the corpus enabled, every confirmed incident is appended to a local record as a four-layer event: behavior, decision, outcome, and context. The outcome label is the one thing you cannot reconstruct after the fact, so it is captured from the very first write. Adjudication assigns it off the hot path, never inside a synchronous tool-call check, and only at the same two-source confidence bar used everywhere else.
Nothing leaves the machine. The corpus and the catalog overlay are owner-only local files with no remote sink, and machine and repository identifiers are stored as non-reversible HMAC fingerprints. Cross-machine sharing is a later milestone, not a capability that ships today.
Opt in by setting corpus.enabled, or toggle it in the dashboard’s first-responder settings (beekeeper dashboard --admin, then s). See Configuration.
Built different
A security tool that takes its own integrity seriously.
Checkmarx. Trivy. SAP. TanStack. Bitwarden. Every name on TeamPCP's kill list in 2026 was a security vendor that became an attack vector. Beekeeper plans for its own compromise from day one.
make verify-release ships with every tag.beekeeper-self catalog auto-quarantines known-bad releases on next startup.Quickstart
Protected in 60 seconds.
Four commands, the last one optional. No configuration required: Beekeeper ships with sane defaults.
Builds from source on your machine. Needs Go 1.25+. Pinned to a release, never @latest.
Auto-installs the hook into Claude Code. Cursor, Codex, others supported.
Opt into the Sentry daemon for always-on behavioral monitoring. Optional, privileged.
Launches the live TUI: alerts, the audit log, install posture, and policy controls.
Harness support
Coverage is not uniform. We label every tier.
Beekeeper integrates with 17 coding-agent harnesses, but coverage depends on each one's hook mechanism: 10 get full pre-exec hook-block, 3 carry structural caveats, and 4 are MCP-gateway-only with their native tools unguarded. Only Claude Code is verified live end-to-end; the rest are built against documented vendor contracts. We document exactly what each tier does and does not cover.
The harness has a pre-exec hook. Beekeeper installs a hook that runs `beekeeper check` before each tool call, enforcing three things independently: a corroborated-malicious package install is blocked, a read of a sensitive path (~/.ssh, ~/.aws, credential files) is blocked, and install posture (release age, lifecycle scripts, git or remote-URL dependencies) warns and fails soft, raisable to block per rule. A block exits 2, emits harness-specific deny JSON, and writes a human-readable reason to stderr. Claude Code is the only locally live-verified harness; the remaining nine Tier-1 harnesses are documented contract.
Live-verified on this machine (HPC-04). Hooks reload mid-session; settings.json merge required.
Documented contract. Requires [features] hooks=true in config.toml; non-Bash/MCP coverage gated on PR #18385.
Documented contract. failClosed:true required (Cursor is fail-OPEN by default); three separate hook events.
Documented contract. Matchers support mcp:*; layered settings.json.
Documented contract. Claude Code clone schema.
Documented contract. Gemini-CLI fork that adopted Claude's schema.
Documented contract. Gemini-native decision field; matcher = regex on tool name.
Documented contract. Flat JSON schema (NOT nested); ~/.copilot/settings.json or .github/hooks/*.json.
Documented contract. Field name MED-confidence (docs conflict); Beekeeper emits both forms defensively.
Documented contract. Fail-OPEN on non-2 exit; Windows uses powershell key; no JSON deny form.
These harnesses have a hook mechanism, but a structural caveat limits coverage or reliability. Hermes is structurally fail-OPEN (exit codes ignored, block rests on stdout JSON only). Cline is macOS/Linux only. OpenCode uses a JS plugin that misses subagent task calls.
fail-OPEN harness, exit codes IGNORED. Block rests entirely on stdout JSON. Any timeout, crash, or non-JSON output causes Hermes to allow the tool call. MCP gateway is more robust.
macOS/Linux ONLY, no Windows support. Hook = executable file PreToolUse (no ext) in .clinerules/hooks/.
JS plugin (tool.execute.before). Does NOT catch subagent task calls (#5894) or historically MCP calls (#2319).
These four harnesses are integrated through the MCP gateway, not a pre-exec hook file. Beekeeper only intercepts tool calls routed through the gateway; any native built-in tool (Bash, file read/write, shell execution) the agent invokes directly bypasses Beekeeper. Kilo and Trae have no upstream pre-exec hook (e.g. Kilo FR #5827); Continue and OpenClaw are wired via their MCP client config. A real residual coverage gap, not a Beekeeper implementation bug.
Native Bash/file/shell tools UNGUARDED, no pre-exec hook (upstream FR #5827). Only MCP tools intercepted via gateway.
Native shell/file tools UNGUARDED, no programmatic pre-exec hook. Native commands gated only by Trae's UI. Only MCP tools intercepted via gateway.
Wired via MCP client config (~/.continue/config.yaml), not a pre-exec hook file. Only MCP tools routed through the gateway are intercepted; native/non-MCP tools are UNGUARDED.
Wired via MCP client config (~/.openclaw/config.json), not a pre-exec hook file. Only MCP tools routed through the gateway are intercepted; native/non-MCP tools are UNGUARDED.
FAQ
Common questions.
Is Beekeeper a replacement for Snyk, Socket, or Dependabot?
Does Beekeeper send my code or data anywhere?
What's the performance cost?
Does it work on Windows?
Does Beekeeper automatically delete flagged packages?
os.Rename plus a restore manifest; you can put it back with a single command. Auto-quarantine also starts in dry-run mode, so even after you enable it, no move happens until you explicitly set dry_run to false. The permanent purge is always human-gated: the TUI surfaces the incident with a [P] purge option and a [R] restore option, and the CLI purge command requires a y/N confirmation.Can I trust the binary I just downloaded?
make verify-release target reproduces the binary and compares hashes. Distrust is the appropriate posture. Don't trust us; verify us.Arm your machine with threat intelligence.
Beekeeper is open source, dogfooded daily, and ready for your machine.