Cline Runtime Telemetry in Beacon | Asymptote
What is Cline?
Cline is not one host. The same agent core can run in VS Code, JetBrains, and a CLI, so Beacon normalizes Cline into one harness identity while preserving the activity shape.
Collection path: Managed plugin hooks
Authoritative date: August 22, 2026 from v1.2.3 in the Beacon CLI changelog.
How Beacon reads Cline
Beacon installs a managed plugin at ~/.cline/plugins/beacon.ts. Cline auto-discovers plugin files, so a single Beacon install can collect prompts, task lifecycle, tools, commands, diffs, MCP activity, and usage across hosts.
The result is normalized into Beacon's endpoint event schema so security teams can investigate activity by harness, repository, session, user, model, command, file, tool, MCP server, or approval context where the runtime exposes those fields.
Telemetry coverage
- Prompts and task lifecycle
- Tool lifecycle and results
- Commands with exit codes
- File reads and edits with diffs
- MCP activity and per-task token usage
What you can do now
- Cover Cline activity across IDE and CLI usage with one plugin.
- See Cline in endpoint discovery, inventory, and the local dashboard.
- Group detections and SIEM queries under the canonical cline harness name.
Get started
- Update the Beacon CLI to v1.2.3 or newer.
- Run beacon endpoint hooks install --harness cline.
- Run beacon endpoint hooks status --harness cline to verify the managed plugin.