numbat: endpoint visibility and security monitoring for AI agents with local detection and forensic reconstruction

What it solves

numbat provides endpoint visibility and security monitoring for AI agents. It solves the problem of "blind spots" when AI agents operate on a desktop, CLI, or IDE, allowing administrators to detect suspicious activity, reconstruct agent sessions for forensics, and optionally block dangerous actions before they occur.

How it works

The tool uses a combination of local hooks, plugins, OTLP/HTTP logs, and on-disk session artifacts to observe agent activity. It normalizes this data into a single event model and evaluates it against a CEL (Common Expression Language) rule engine. Detection happens locally on the endpoint, and the resulting records (events, findings, and enforcement decisions) are output as versioned NDJSON records which can be sent to local files or remote HTTP sinks.

Who it’s for

It is designed for security operators and developers who need to monitor AI agent behavior on workstations, ensure agents are not performing unauthorized actions (like accessing secret files or making unauthorized network requests), and perform forensic investigations into agent activity.

Highlights

  • Live Monitoring & Blocking: Captures activity in real-time via hooks and can optionally block synchronous pre-action calls if configured for enforcement.
  • Forensic Reconstruction: Can reconstruct agent activity from on-disk artifacts even if numbat was not previously installed.
  • Local Detection: Uses a built-in rule catalog and supports custom YAML rules for identifying high-severity behaviors.
  • Read-only Scanning: Includes tools for agent discovery and artifact scanning with built-in secret redaction.
  • Cross-Platform: Distributed as a single binary for macOS, Linux, and Windows.

Sources