What you can do with Numbat

3 use cases

• Audit past agent sessions without changing any config

  Scan existing agent session artifacts on a machine to list agents and surface findings.

  • Numbat
  • Codex
  • Claude Code
  • Security and science
  • Intermediate
  View prompt

  Use the repo perplexityai/numbat. Run `numbat agents` and then `numbat scan --agent <agent-name>` on this machine, and save the NDJSON output to a file. Report the number of findings and their rule_id values. Verify that the output contains no complete raw transcript and that secret values are redacted.

  Share Save

• Monitor live Codex activity into a local record file

  Install a monitor-only Codex hook that writes events and findings to an NDJSON file.

  • Numbat
  • Codex
  • Security and science
  • Intermediate
  View prompt

  Use the repo perplexityai/numbat. Run `numbat hook install --agent codex --emit all` and then `numbat hook status --agent codex` on <target-machine>. Report the status output and the record_type values seen in ~/.numbat/records.ndjson after one short Codex task. Verify that the hook status output reports the Codex hook as installed, and remember that status checks configuration only, not delivery.

  Share Save

• Block a risky Codex action with a custom deny rule

  Copy a shipped rule, mark it enforce: true, and install it on a Codex pre-action hook.

  • Numbat
  • Codex
  • Security and science
  • Advanced
  View prompt

  Use the repo perplexityai/numbat. Copy the shipped YAML for <rule-id> from rules/ into ./numbat-policy, set enforce: true and a new version, then run `numbat rules check --rules-dir ./numbat-policy`. Report whether validation passes and which rule ids are active. Verify that the enforcement record uses mode "enforce" only for the rule you marked, and that all other shipped rules remain monitor-only.

  Share Save

How to use Numbat

1. Check you have what it needs: A macOS, Linux, or Windows machine with a terminal; The numbat binary, from a release download or Go 1.26.9 or newer; At least one supported agent installed, such as Codex or Claude Code.
2. Open perplexityai/numbat on GitHub and read the README and license.
3. Download a Numbat release for your OS and check it against the published SHA-256 checksums.
4. Run numbat agents to see which agents Numbat can discover on this machine.
5. Run numbat scan --agent codex to limit discovery to one agent, or numbat scan to scan all discovered parser-backed agents.
6. Run numbat scan --emit all if you also need events and indicators, not only findings.

These steps come from our top use case, Audit past agent sessions without changing any config, which also has a copy-paste agent prompt.

Numbat alternatives · Best AI repos for Security and science

About this repo

• Who it is forWritten for security engineers and platform operators who need visibility into what AI coding agents do on endpoints.
• Why it is hot
• LanguageGo
• Sourcegithub.com/perplexityai/numbat · Back to Hot repos

Requirements

• A macOS, Linux, or Windows machine with a terminal
• The numbat binary, from a release download or Go 1.26.9 or newer
• At least one supported agent installed, such as Codex or Claude Code
• Permission to read the agent's local session files and, for live capture, to change its hook configuration

Related repos

• Trended earlier Rea A plug-in that lets your AI agent take apart an app and explain how a feature works.
• Trended earlier Reverify Reverify is a Python toolkit and MCP server where deterministic tools verify every AI claim about a binary or code before it counts as fact.
• Trended earlier Ablation Ablation is a self-contained reverse engineering framework that, when used with Codex or Claude Code, works as an autonomous reverse engineering system.