Numbat

numbat gives endpoint visibility into AI agent activity, with detection that runs locally, optional pre-action blocking, and reconstruction of past activity from on-disk artifacts. It observes supported desktop, command-line, IDE, and gateway agents through local hooks and plugins, OTLP/HTTP log exporters, and session artifacts left on disk.

Live and at-rest activity are normalised into one event model and evaluated by the same CEL rule engine, which ships built-in rules, multi-step sequence rules, and support for custom YAML rules. Records are written as versioned NDJSON for events, findings, enforcement decisions, indicators, and scan summaries, to stdout, a local file, or an HTTP sink; JSON Schemas define the wire format.

Blocking is off by default. Enforce mode applies only to rules marked enforce: true, and all shipped rules are monitor-only, so enforcing a detection means copying its shipped YAML into an operator directory, keeping the same id, adding the flag, and bumping the version. Enforcement is limited to supported synchronous pre-action hooks.

Artifact scanning is read-only with secret redaction: normal record output never contains a complete raw transcript, and adding raw evidence files to a case bundle is opt-in. Investigation commands cover read-only agent discovery, per-session timelines, and portable case bundles with SHA-256 manifests. The tool never executes agents or commands found in artifacts and makes outbound requests only to configured HTTP sinks. At-rest reconstruction is not disk or memory acquisition and cannot recover activity an agent did not persist; findings are rule matches rather than proof of compromise.

It is distributed as a single binary for macOS, Linux, and Windows, built without cgo.

Features

• Live monitoring: hooks, plugins, and OTLP/HTTP log exporters feed activity from supported agents
• Local detection: built-in CEL rules, multi-step sequence rules, and custom YAML rules, evaluated on the endpoint
• Opt-in blocking: enforce mode is disabled by default and applies only to rules marked enforce: true
• Forensic reconstruction: past sessions are rebuilt from on-disk artifacts without prior instrumentation
• Versioned records: NDJSON events, findings, enforcement decisions, indicators, and scan summaries, with JSON Schemas for the wire format
• Redacted scanning: read-only artifact scanning with secret redaction and opt-in raw evidence
• Investigation tooling: agent inventory, per-session timelines, and case bundles with SHA-256 manifests
• Rule development: rules check, rules list, and rules test, with repeatable --rules-dir and an operator-only catalog option
• Single binary: macOS, Linux, and Windows builds on amd64 and arm64, without cgo