A keyboard-first desktop API client

Yes. Beacon is free to download and use, and no account is required. Free today. A pro tier is planned; nothing that is free now will be moved behind it.

Most people never see this. Beacon isn't notarized by Apple — that needs a paid $99/year Apple Developer subscription this indie project doesn't have, so macOS shows its standard warning for any unsigned app from the internet. Both the install script and Homebrew clear the quarantine flag as part of installing, so Beacon opens straight away. Only the manual DMG route hits the warning: run xattr -cr /Applications/Beacon.app in Terminal once and it opens normally after that.

The requests you send go straight from your machine to whatever API you point Beacon at, and nothing about them passes through a server we run — that holds whatever else you have switched on. It is a claim about sending requests, not about storage. Collections, environments, history and settings are stored locally in a SQLite database on your Mac. Beacon does make two calls of its own, account or no account: an update check against the GitHub releases API, at most once an hour, and an upload of anonymous usage data — which is on by default and switched off in Settings, under Privacy. That reporting is daily feature counts, facts about this install and error reports scrubbed on your machine, tied to a random per-install ID, plus one country lookup against cloudflare.com falling back to api.country.is. It never carries your request URLs, headers, bodies or responses, your environment variables, secrets or tokens, your collection, folder and request names, or your scripts. Turning it off stops the upload and nothing already sent is removed; feedback you deliberately send is the one exception and still goes out. Signed in, Beacon also refreshes your sign-in token against Google Firebase. Cloud Sync is optional and off until you turn it on, and it does change the storage answer: it encrypts the variable values you flagged as secret, along with auth credentials, credential headers and URL userinfo, before upload — but the names, URLs, non-credential headers, bodies and scripts of your saved requests are uploaded as plaintext we could read. There is no automatic secret detection, so a credential pasted into a body, a script, or a variable you did not flag goes up in the clear. Responses and request history are never uploaded either way. The privacy policy spells all of this out.

No — not the value. Beacon can optionally connect to a local AI assistant over MCP (Settings → MCP / AI access, off by default), letting it read your collections, environments and history, and send requests or run collections and flows through the exact engine the app's own UI uses. That connection is a local socket on this Mac, not a network port, so nothing outside your machine can reach it, and it stays off until you turn it on. An AI client can use a saved credential to make a request go through, but it is never shown the credential's value: everything it reads back — a saved request, an environment, a history entry, a run report — is redacted first, the same masking Beacon's own run reports use, so a bearer token or API key comes back masked while the shape around it, like which header carries it or that a variable is unresolved, stays visible. There is no tool to create, edit, rename or delete anything; the only things it can do are read, send and run. The redaction has stated limits: a secret shorter than four characters, a Basic auth username, a credential typed directly into a saved request's script or a history entry's params row instead of through a variable, and a value the AI itself supplied in an ad-hoc request are not scrubbed.

Not currently. Builds are published for macOS only — Apple Silicon and Intel, both with every release — and there is no committed date for other platforms yet.

macOS 12 (Monterey) or later, on either an Apple Silicon or an Intel Mac. Both builds ship with every release, and both the install script and Homebrew detect which chip you have and fetch the right one. You only need to know yourself if you are picking a DMG by hand.

No — the app's source is private right now. The compiled builds are free and public on GitHub (quizuncle/beacon-releases), but the source itself isn't open at this point.