Perplexity’s Numbat ties suspicious coding-agent actions to the session behind them

The open-source tool turns agent hooks, telemetry and session files into a unified audit trail, but its limited enforcement and incomplete reconstruction mean it is a visibility layer rather than a complete security boundary.

Perplexity’s Numbat is an open-source security and forensics tool aimed at AI coding agents, including Claude Code, Codex and Cursor. It is designed to make agent activity visible on the endpoint by linking actions to the specific session and harness that produced them, rather than treating them as indistinguishable developer commands. In practice, that means a suspicious sequence such as reading a secret file and then attempting an upload can be tied back to the agent session that proposed it.

Numbat works by normalising different forms of agent activity into a single event model and then applying local detection rules. According to the project documentation, it can ingest data from harness hooks and plugins, OpenTelemetry logs exported by agents, and session files left on disk. Those feeds are reduced to typed events, so the same rule can evaluate both live activity and a session reconstructed later for investigation. The repository says coverage extends across a broad agent matrix, while the rule engine uses CEL, or Common Expression Language, to evaluate behaviour such as secrets access, exfiltration, persistence, privilege escalation and tampering.

That approach matters because endpoint controls often see a command, but not the context in which an AI agent proposed it. In a staged Claude Code test described in the original review, Numbat flagged a read of a “.env” file followed by a proposed curl upload, and linked the two steps as a single sequence finding. The test also showed that Numbat can present a timeline view of a session, with each event mapped back to its place in the transcript. The review noted, however, that the tool only proves that an action was proposed, not that data actually left the machine, so proxy or network logs are still needed to confirm execution.

The tool is as much a forensic aid as a runtime monitor. Numbat can rebuild a session from files an agent has already written to disk, and it can package that output into a case bundle with a SHA-256 manifest for later review. But its own documentation is clear that this is not full disk or memory acquisition. It can only reconstruct what the agent persisted, and several agent formats remain unsupported or deferred. In other words, Numbat is useful where the agent left an audit trail, but it cannot recover activity that was never stored.

Blocking is possible, but only in narrowly defined circumstances. By default, the shipped rules are monitor-only, and enforcement must be enabled deliberately through a separate rules directory and hook configuration. Even then, the mechanism is limited to synchronous pre-action hooks, so it can stop a supported agent only before a tool runs. The documentation also warns that malformed payloads, rule evaluation errors, crashes or output failures can suppress a deny response, which means the host agent ultimately remains in control of what happens next.

That makes Numbat best understood as an endpoint visibility layer rather than a complete policy boundary. It sits underneath other controls such as proxy-based MCP monitoring and agent containment frameworks, and it can observe actions that never pass through MCP at all. The project is distributed as a single binary under the Apache 2.0 licence, with builds for macOS, Linux and Windows on both amd64 and arm64, and can also be installed with Go. The latest tagged release is v0.2.0, published on 17 August 2026, and the repository includes the coverage matrix, rule set and enforcement guide needed to assess how it fits into a wider security stack.