Watching AI agents from the inside, with detection that stays local

What it does Numbat is endpoint telemetry for AI agents. It hooks into desktop apps, CLI tools, IDEs, and gateways to observe activity like file reads, commands, and network requests, then evaluates it through a local CEL rule engine. It can also reconstruct past sessions from on-disk artifacts, even without prior instrumentation.

The interesting bit It normalizes live hooks, OTLP logs, and leftover session files into the same event model, so you can detect multi-step sequences—like a secret read followed by a data-bearing egress—whether you’re watching live or reconstructing after the fact.

Key highlights

• Normalizes live hooks, OTLP logs, and on-disk artifacts into one event model evaluated by the same CEL engine.
• Ships with built-in CEL rules and supports custom YAML rules, including multi-step sequence detection.
• Optional pre-action blocking for supported agents, but every shipped rule is monitor-only by design.
• Forensic reconstruction works read-only against existing session files without prior numbat instrumentation.
• Single cgo-free binary for macOS, Linux, and Windows; records are versioned NDJSON with published JSON Schemas.

Caveats

• Blocking is limited to specific synchronous pre-action hooks; the coverage matrix documents significant gaps per agent.
• At-rest reconstruction can only recover what an agent actually persisted to disk, not full memory or disk forensics.
• Findings are rule matches, not proof of compromise, and unsigned case bundles don’t prove authenticity.

Verdict Worth a look if you’re running AI agents on developer machines or sensitive endpoints and want local auditability without cloud dependencies. Skip it if you need comprehensive real-time blocking across all agent types—it’s explicitly not a universal kill switch.