numbat

No entries match these filters. Clear filters

1. v0.3.0 Oct 19, 2026 · issue 114

   Adds rules test --json for automation, retained tool I/O for CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. rules and exports, opt-in POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. compound-command enforcement, and improved subagent attribution.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.3.0 https://github.com/perplexityai/numbat.git
   # already have the repo? check out this version:
   $ git checkout v0.3.0

   • Adds rules test --json flag to numbat rules test for machine-readable rule-test output suitable for automation pipelines.
   • Adds --content full --content-scope messages flags to scope full-content exports to message bodies only, now that --content full also captures redacted tool arguments and results.
   • Retains tool inputs and results in the event record so CEL rules and content exports can act on them, including MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool inputs and browser context.
   • Adds opt-in enforcement for statically resolvable POSIX compound commands via rules marked enforce: true, extending blocking coverage beyond single-command pre-action hooks.
   • Improves subagent attribution in timeline and event records, preserving subagent identity and correlation across capture paths.

   5 details in Everything

   • New integration Muse Code live-hook and at-rest session support
   └──▷ BREAKING ON UPGRADE

   • !Output schema is now 0.5.0; update any downstream validators that enforce an exact version or closed schema.
   • !--content full now includes redacted tool arguments and results (source code, file contents, patches); use --content full --content-scope messages to restore message-body-only export behaviour.
   • !Rerun numbat hook install for each installed agent with the same options to update generated hooks and plugins after upgrading.
2. v0.2.0 Aug 17, 2026 · issue 049

   numbat v0.2.0 adds live assistant/reasoning text capture and explicit message output controls for content inspection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.2.0 https://github.com/perplexityai/numbat.git
   # already have the repo? check out this version:
   $ git checkout v0.2.0

   • Adds explicit message output controls for governing what content is emitted from inspected message bodies.
   • Supports bounded message body inspection, limiting content analysis to defined byte ranges.

   2 details in Everything

3. v0.1.1 Jul 29, 2026 · issue 041

   numbat v0.1.1: initial release — endpoint visibility into AI agent activity with local detection, blocking, and forensic reconstruction.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.1.1 https://github.com/perplexityai/numbat.git
   # already have the repo? check out this version:
   $ git checkout v0.1.1

   └──▷ TRY IT
   Discover which AI agents are present on the endpoint before installing any hooks.
   copy

   $ numbat agents --all

   Install live monitoring for Codex and stream all events, findings, indicators, and enforcement decisions to the default record file.
   copy

   $ numbat hook install --agent codex --emit all

   Enforce a custom operator policy that blocks SSH authorized_keys writes by Codex — copy the shipped rule, add enforce: true, validate, then reinstall with enforcement enabled.
   copy

   $ numbat rules check --rules-dir ./numbat-policy && numbat hook install --agent codex --emit all --rules-dir ./numbat-policy --enforce

   • Adds numbat hook install --agent NAME|all and numbat hook uninstall --agent NAME|all to wire and remove live integrations for supported desktop, CLI, IDE, and gateway AI agents.
   • Adds numbat hook status [--agent NAME|all] to inspect numbat-owned live integration configuration.
   • Adds numbat scan [--agent NAME ... | --path FILE|DIR ...] for read-only forensic reconstruction from on-disk agent session artifacts, emitting versioned NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. records without prior instrumentation.
   • Adds numbat collect [--addr HOST:PORT] to receive OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools./HTTP protobuf logs from supported agents and emit normalized records.
   • Adds numbat agents [--all] for read-only discovery of supported local agents, reporting config signals, artifacts, live capture mode, and wired status.

   +10 more show less

   • Adds numbat timeline [--agent NAME ... | --path FILE|DIR ...] to reconstruct per-session chronological views from agent artifacts.
   • Adds numbat ship --input-file F --http-url U to tail a local NDJSON record file to an HTTP endpoint for remote delivery.
   • Adds --rules-dir DIR (repeatable) and --no-builtin-rules flags to scan, collect, hook install, and rules check|list|test for loading operator-authored YAML rules or replacing built-in rules by id.
   • Adds numbat rules check, numbat rules list, and numbat rules test --fixture FILE for validating, compiling, and evaluating CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. and multi-step sequence rules against NDJSON event fixtures.
   • Adds numbat case build <case-id> --from FILE and numbat case verify DIR to create and verify portable case bundles with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. manifests.
   • Adds opt-in pre-action blocking via --enforce on hook install; rules with enforce: true in an operator --rules-dir emit enforcement decisions; all shipped rules are monitor-only by default.
   • Adds --emit all flag to hook install to write events, findings, indicators, and enforcement decisions to ~/.numbat/records.ndjson.
   • Emits versioned NDJSON records (schema v0.2.0) for events, findings, enforcement decisions, indicators, and scan summaries, with JSON Schemas published under docs/schema/v0.2.0/.
   • Ships built-in CEL and multi-step sequence detection rules evaluated locally; supports custom YAML rules in operator-controlled directories.
   • Supports read-only artifact scanning with secret redaction; raw evidence files are opt-in via case bundles.

   15 details in Everything