numbat
Visibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and forensic reconstruction.
What is it?
What it is
An endpoint visibility and security platform for AI agents that provides live monitoring, local detection, optional pre-action blocking, and forensic reconstruction.
Why it exists
To provide visibility into AI agent activity across desktop, CLI, IDE, and gateway surfaces, enabling detection of malicious behaviors and forensic analysis of agent sessions.
Who should use it
Security engineersDevSecOps professionalsAI safety researchersForensic investigatorsCompliance officers
Who should avoid it
Users seeking non-technical automated security toolsEnvironments where local hook installation is prohibitedUsers requiring full memory/disk acquisition capabilities
How it works
A quick walkthrough in plain English
How numbat works
Step 1 of 3
You interact with it
Open numbat, send a request, or connect it to your stack.
Features
Advantages
- Low-overhead deployment via single static binaries
- High visibility into AI agent activity across desktop, CLI, IDE, and gateway surfaces
- Flexible rule engine supporting custom YAML and CEL rules
- Provides both real-time monitoring and retrospective forensic analysis
- Normalized event model for consistent cross-agent analysis
Disadvantages
- Blocking capabilities are limited to supported synchronous pre-action hooks
- Enforcement mode is disabled by default and requires manual rule configuration
- Detection is based on rule matches and does not constitute absolute proof of compromise
- Forensic reconstruction is limited to activity that the agent actually persists to disk
Installation
cloud
not available
docker
not available
native
Download a release for macOS, Linux, or Windows on amd64 or arm64 from https://github.com/perplexityai/numbat/releases or install with Go 1.26.5 or newer using `go install github.com/perplexityai/numbat/cmd/numbat@latest`. To build a static binary from a checkout, use `CGO_ENABLED=0 go build -trimpath -o numbat./cmd/numbat` on macOS/Linux or `$env:CGO_ENABLED = "0"; go build -trimpath -o numbat.exe./cmd/numbat` on Windows PowerShell.
compose
not available
FAQ
How does numbat handle agent blocking and enforcement?
Blocking is off by default and only applies to rules explicitly marked with `enforce: true`. All shipped rules are monitor-only. To enable enforcement, you must copy a rule to a controlled directory, add the `enforce: true` flag, and install it using the `--enforce` flag with a supported pre-action hook.
Can numbat reconstruct agent activity without prior installation?
Yes, numbat provides forensic reconstruction by scanning on-disk session artifacts. This read-only scanning does not require prior numbat instrumentation, though it can only recover activity that the agent has persisted to disk.
What platforms and architectures are supported?
Numbat is distributed as a single-binary for macOS, Linux, and Windows, supporting both amd64 and arm64 architectures. It is built without cgo for easier portability.
How can I add custom detection rules to the engine?
Custom rules can be written in YAML using the Common Expression Language (CEL). You can apply these rules during scans or hook installations by using the `--rules-dir DIR` flag to point to your custom policy directory.
Does numbat execute any agent commands or make outbound requests?
No. Numbat never executes agents or commands found in artifacts. It only makes outbound requests to HTTP sinks that you have explicitly configured.
Featured in Videos
YouTube tutorials and walkthroughs for numbat
Alternatives
Similar projects ranked by category, topics, and text overlap.
