**numbat** is Perplexity's answer to a question most teams have not yet had to answer: when an AI coding agent runs on a developer laptop, what did it actually do? It provides **endpoint visibility into AI agent activity**, with local detection, optional pre-action blocking, and forensic reconstruction after the fact. Released under **Apache-2.0** and written in **Go**, the repository has collected **934 stars and 100 forks** since its **24 July 2026** creation, with **v0.2.0** published on **17 August 2026**. The collection story has three inputs that converge on one model. numbat observes agents through **synchronous lifecycle hooks and generated plugins**, through **OTLP/HTTP log exporters**, and through **on-disk session artifacts** — and the third of these is the notable one, because it means numbat can reconstruct what an agent did **without having been installed beforehand**. Live and at-rest activity is normalized into a single event model and evaluated by the same **CEL rule engine**, so a rule written once applies to both a live hook callback and a months-old transcript. Coverage is broad and documented row by row in an authoritative matrix, spanning **Claude Code, Claude Cowork, Codex, Gemini CLI, Cursor, Windsurf, GitHub Copilot CLI, VS Code Copilot Chat, OpenCode, OpenClaw, Pi, Kimi Code, Qwen Code, Cline CLI, Amp, Auggie, Kiro, Goose and Kilo Code**. The matrix is refreshingly honest about its own gaps: each row distinguishes what is parsed today from what is **deferred** pending a stable fixture, and separates monitoring support from enforcement support, since a product name does not imply coverage of every desktop, CLI, IDE, or hosted mode. Enforcement is deliberately hard to switch on by accident. **Blocking is off by default**, works only through supported synchronous pre-action hooks, and applies only to rules explicitly marked `enforce: true` — and **every shipped rule is monitor-only**. To actually block something an operator must copy the shipped YAML into a controlled directory, keep its id, add the flag, bump the version, then validate and install that policy. Detections include multi-step sequence rules such as `chain.secret_read_then_egress`, which fires on secret-file access followed by data-bearing egress within one session, and findings carry **MITRE ATT&CK technique tags**. Output is designed for investigators rather than dashboards. Records are **versioned NDJSON** across events, findings, enforcement decisions, indicators and scan summaries, with **JSON Schemas at v0.3.0** defining the wire format and source references retained on events and findings. Artifact scanning is **read-only with secret redaction**, and normal record output never includes a complete raw transcript — adding raw evidence to a case bundle is opt-in. Investigation tooling covers read-only agent discovery (`agents`), per-session timelines (`timeline`), and **portable case bundles with SHA-256 manifests** that can be verified independently. Distribution is a **single binary for macOS, Linux and Windows on amd64 and arm64, built without cgo**, with checksums on every release. The project is unusually careful about what it does not claim. At-rest reconstruction is **not disk or memory acquisition** and cannot recover activity an agent never persisted; **findings are rule matches, not proof of compromise**; and case-bundle manifests establish internal consistency without proving source authenticity or completeness. numbat never executes agents or commands found in artifacts, and makes outbound requests only to configured HTTP sinks. The honest limitation is that records can still retain sensitive endpoint and agent context after redaction, so the output itself becomes something worth protecting.