Numbat Delivers Endpoint Visibility and Forensics for AI Coding Agents
Perplexity open sources a dedicated security tool tracking 27 coding agent environments locally.
1Agent Actions Resemble Legitimate Work
AI coding assistants execute terminal operations that standard endpoint security platforms often cannot distinguish from genuine developer commands. Reading sensitive configuration files followed by network uploads mirrors normal engineering workflows. Numbat addresses this blind spot by directly binding low-level system actions to specific AI agent sessions.
2Tripartite Ingestion Pipeline Architecture
Numbat normalizes telemetry from three distinct sources into a unified event schema. It captures real-time data via in-agent hooks, ingests OpenTelemetry OTLP structured log streams, and parses dormant session transcripts left on disk. This approach allows identical detection logic across live streams and historical sessions.
3Breadth Across Development Ecosystems
The engine covers 27 distinct coding agents and hosts, including Claude Code, Codex, Cursor, Gemini CLI, and GitHub Copilot CLI. Detection logic is powered by Google's Common Expression Language (CEL), shipping with 51 default rules spanning credential access, persistence, privilege escalation, tampering, and MITRE ATT&CK techniques.
4Sequence Detection Catches Data Exfiltration
The primary defensive capability relies on multi-event behavioral correlation within the same agent session. A signature rule triggers when an agent accesses a sensitive file like .env and subsequently proposes an outbound upload command. Single-event scanners often miss these chained steps when evaluated in total isolation.
5Controlled Output Protects Telemetry
Numbat structures its output as versioned NDJSON, writing findings, indicators, and scan summaries to stdout, local disks, or remote collectors. The scanner automatically redacts secrets and excludes full conversation transcripts. However, administrators must protect these output logs because contextual session data remains sensitive within the host operating system.
6Distinguishing Intent From System Execution
Test sessions demonstrate that Numbat flags the proposal of an egress command rather than its network completion. Correlating these alerts with proxy logs remains essential to determine if data escaped. Security teams must verify user instructions, as an explicit user request still triggers standard sequence rules.
7Offline Forensics and Session Recovery
Security responders can inspect agent history without modifying target environments or installing invasive interceptors. CLI commands like numbat agents and numbat scan parse existing local transcripts. For formal investigations, numbat case build bundles artifacts alongside SHA-256 integrity manifests, currently supporting 11 specific agent formats.
8Opt-In Synchronous Action Prevention
All 51 baseline detection rules ship strictly in monitor-only mode. Converting a detection into active enforcement requires copying the rule YAML, toggling enforce to true, and updating the agent hook. Agents like Claude Code query Numbat prior to tool execution, returning native denials upon matching rules.
9Shell Parsing Limits Rule Scope
Numbat deliberately restricts active blocking to simple POSIX, PowerShell, or cmd.exe commands and single pipelines. Complex constructs such as loops, conditionals, subshells, eval, and Invoke-Expression bypass blocking and drop to observation mode. This structural choice prevents broken executions while maintaining audit logging across all complex commands.
10Fail-Open Resilience and Logging Hazards
The enforcement engine is built to fail open, meaning evaluation errors, payload malformations, or inaccessible log sinks immediately suppress action denials. Because Numbat typically shares the developer's operating system permissions, teams must configure OS-level file protections to prevent compromised local processes from tampering with the security records.
11Layered Defense Across Agent Interfaces
Numbat functions beneath network proxies like mcp-scan and credential containers like AI IR Overlay. By operating directly on the endpoint, it monitors actions that bypass Model Context Protocol layers entirely. It provides foundational host visibility and forensic artifacts that surrounding network-level policy systems cannot observe.
12Lightweight Deployment and Operating Model
Distributed as a standalone Go binary under the Apache 2.0 license, Numbat runs across macOS, Linux, and Windows. Teams should deploy it primarily as a continuous visibility and incident response platform. Active enforcement acts as an optional guardrail rather than an impenetrable operating system policy boundary.