Independent deployments will determine whether Numbat provides reliable endpoint-level visibility into AI agent activity sufficient for practical monitoring and auditing.

state: expiredheat: lowuncertainty: highconvergesscott: mediumagent-observability agentic-security execution-auditingPerplexity AI

What is this?

Numbat is an open-source, Apache-2.0 agent-security suite released by Perplexity AI to provide endpoint-level visibility across widely used client-side agent harnesses. Its stated capabilities include on-device detection, optional blocking before an action executes, structured activity logging, and forensic reconstruction for investigation and auditing. The supplied evidence establishes Perplexity’s claims and repository release, but provides no independent deployment results showing how reliable, complete, or operationally useful that visibility is in practice.

Why it matters to Scott

Perplexity’s Numbat independently converges with Scott’s structured agent-observability, execution-receipt and OS-level containment work, while potentially supplying a cross-harness endpoint layer relevant to SiloOS and trace-backed agent testing. The release creates a dated-receipts and practical evaluation opportunity, but its significance remains limited until independent deployments establish coverage, tamper resistance, privacy properties and blocking reliability.

ip:source.observability-for-agentic-systems-what-to-log-how-to-redact-how-to-debug-ebookip:concept.agent-observabilityip:framework.siloosip:framework.agent-provenance-stackip:concept.agent-receiptsdev:concept.trace-backed-agent-comparisondev:project.silo-osradar:concept.agent-observabilityradar:sentience-governor-agent-execution-trailsradar:concept.agent-harnesses

queries asked of Scott's wikis

endpoint observability for coding-agent harnesses
OS-level auditing versus harness-native agent tracing
pre-action policy enforcement for autonomous agents
tamper-resistant logs and forensic replay for agent execution
cross-harness security interfaces and event schemas
agent monitoring without exposing prompts or sensitive context

Measured heat

no measured readings yet — the hourly heat pass fills this in

How the heat travelled

no chain yet — the hourly chain pass fills this in

Evidence (6) — ⭐ canonical anchor

source	object	author	score	comments
🟧 hn	Numbat by Perplexity: Endpoint visibility into AI agent activity	handfuloflight	1	0
🟧 echo.github ⭐	An open-source endpoint-visibility tool for observing AI agent activity.	Perplexity AI	—	—
🟧 hn	AI Agent Sandboxes Stop Escapes. They Don't Tell You What Happened Inside	wakahiu	1	0
🟧 hn	Show HN: Rungraph – See your AI coding-agent runs as a graph	FayzanMalik	1	0
🟠 reddit	Claude Code: I built a local heartbeat that reports whether hooks are actually firing ClaudeAI	blitzcrieg11	0	1
🟠 reddit	I’m a vibe coder. I may have taken this too far... ClaudeAI	Rebekator	2	2

Interpretation history

2026-08-26T20:35:38Z
Repeated checks have produced no product-specific validation, while adjacent implementations only establish category demand; that no longer justifies keeping a dedicated Numbat reliability episode active. Reopen if an independent deployment, benchmark, or operational report appears.
2026-08-24T19:54:34Z
The added local MCP tracing project provides another independent implementation of the broader execution-auditing pattern, but it does not evaluate Numbat. Repeated observation still leaves Numbat’s endpoint coverage, blocking reliability, and operational usefulness entirely dependent on future deployment evidence.
2026-08-24T19:26:37Z
evidence attached: reddit.post.1vxc25n — The project appears to address post-session tracing of Claude tool calls and exchanged data, directly bearing on practical agent observability.
2026-08-22T18:25:43Z
Agentmetry independently reinforces hook-coverage attestation and tamper-evident local audit trails as useful agent-observability patterns, but it is an adjacent self-reported alpha rather than a Numbat evaluation. Numbat’s endpoint coverage, blocking reliability, and operational usefulness therefore remain unvalidated.
2026-08-22T18:23:23Z
evidence attached: reddit.post.1vvitew — This usable local artifact materially contextualizes agent observability by attesting hook coverage and detecting MCP schema changes.
2026-08-20T17:34:04Z
Repeated reobservation still finds no independent Numbat deployment, benchmark, or operational report; the adjacent agent-security activity does not advance the product-specific reliability question. Keep the case open but move to a slower cadence unless concrete evaluation evidence appears.
2026-08-18T16:59:00Z
Another reobservation produced only negligible engagement and no independent deployment, benchmark, or operational report. Adjacent interest in agent observability is rising, but Numbat’s endpoint coverage and reliability remain entirely unvalidated.
2026-08-16T16:32:46Z
Rungraph adds an adjacent implementation of coding-agent activity visualization, reinforcing demand for execution auditing but not validating Numbat’s endpoint coverage, blocking reliability, or operational usefulness. The case still depends on independent Numbat deployments or benchmarks.
2026-08-16T16:22:47Z
evidence attached: hn.story.49321388 — A first-party coding-agent run-graph artifact provides relevant evidence about practical visibility and auditing of agent activity.
2026-08-14T22:29:40Z
The case remains an unvalidated first-party release: two days of reobservation produced no independent deployment, benchmark, or operational evidence. The slight engagement increase is repetitive amplification and does not change Numbat’s practical credibility.
2026-08-12T21:36:35Z
Independent technical context strengthens the need for runtime visibility beyond sandbox isolation, making Numbat worth watching, but it does not validate Numbat’s actual coverage or reliability. The central question still awaits independent deployment results, benchmarks, or operational reports.
2026-08-12T21:22:57Z
evidence attached: hn.story.49278090 — Independent technical context supports the case that sandbox isolation alone is insufficient without runtime visibility and auditability.
2026-08-12T02:31:23Z
No independent deployment evidence or discussion has emerged; the case remains a first-party release awaiting validation, and the unchanged observation lowers its immediate temperature.
2026-08-12T02:27:45Z
grounded: converges/medium — Perplexity’s Numbat independently converges with Scott’s structured agent-observability, execution-receipt and OS-level containment work, while potentially supp
2026-08-12T02:24:06Z
case created — Numbat is a concrete first-party security artifact addressing the emerging need to observe and audit autonomous agent actions at endpoints.

Decision trace

08-27 06:35expireRepeated checks have produced no product-specific validation, while adjacent implementations only establish category demand; that no longer justifies keeping a dedicated Numbat reliability episode act
08-27 06:35alert_silentThe only delta is staleness and negligible engagement movement, with no new evidence about Numbat’s coverage, blocking reliability, or operational usefulness.
08-27 06:35alert_routeThe only delta is staleness and negligible engagement movement, with no new evidence about Numbat’s coverage, blocking reliability, or operational usefulness.
08-27 06:35drop_targetsquiet through full ladder or over cap 8
08-25 05:54repriceThe added local MCP tracing project provides another independent implementation of the broader execution-auditing pattern, but it does not evaluate Numbat. Repeated observation still leaves Numbat’s e
08-25 05:54alert_silentThe new artifact is a low-signal adjacent implementation rather than a Numbat deployment, benchmark, or operational report, so it changes neither the product-specific hypothesis nor any time-sensitive
08-25 05:54alert_routeThe new artifact is a low-signal adjacent implementation rather than a Numbat deployment, benchmark, or operational report, so it changes neither the product-specific hypothesis nor any time-sensitive
08-25 05:27alert_silentThis is a low-signal anecdote about a separate local MCP traffic-recording and detection tool, not an independent Numbat deployment or evidence about Numbat’s coverage, tamper resistance, privacy, or
08-25 05:27alert_routeThis is a low-signal anecdote about a separate local MCP traffic-recording and detection tool, not an independent Numbat deployment or evidence about Numbat’s coverage, tamper resistance, privacy, or
08-25 05:26attachThe project appears to address post-session tracing of Claude tool calls and exchanged data, directly bearing on practical agent observability.
08-25 05:22propose_attachThe project appears to address post-session tracing of Claude tool calls and exchanged data, directly bearing on practical agent observability.
08-23 04:25repriceAgentmetry independently reinforces hook-coverage attestation and tamper-evident local audit trails as useful agent-observability patterns, but it is an adjacent self-reported alpha rather than a Numb
08-23 04:25alert_silentThe new artifact strengthens the broader design pattern but does not test Numbat or establish independent reliability, so it can wait for routine briefing and product-specific evidence.
08-23 04:25alert_routeThe new artifact strengthens the broader design pattern but does not test Numbat or establish independent reliability, so it can wait for routine briefing and product-specific evidence.
08-23 04:24alert_silentAgentmetry is a substantive but self-reported public alpha that independently explores hook-coverage attestation, hash-chained local trails, and MCP schema-change detection. It is relevant to Scott’s
08-23 04:24surface_candidateAgentmetry is a substantive but self-reported public alpha that independently explores hook-coverage attestation, hash-chained local trails, and MCP schema-change detection. It is relevant to Scott’s
08-23 04:24alert_routeAgentmetry is a substantive but self-reported public alpha that independently explores hook-coverage attestation, hash-chained local trails, and MCP schema-change detection. It is relevant to Scott’s
08-23 04:23attachThis usable local artifact materially contextualizes agent observability by attesting hook coverage and detecting MCP schema changes.
08-23 04:22propose_attachThis usable local artifact materially contextualizes agent observability by attesting hook coverage and detecting MCP schema changes.
08-21 03:34repriceRepeated reobservation still finds no independent Numbat deployment, benchmark, or operational report; the adjacent agent-security activity does not advance the product-specific reliability question.
08-21 03:34alert_silentThe only delta is elapsed time without validating evidence, which neither changes Numbat’s established release status nor warrants interrupting Scott before routine review.
08-21 03:34alert_routeThe only delta is elapsed time without validating evidence, which neither changes Numbat’s established release status nor warrants interrupting Scott before routine review.
08-19 02:59repriceAnother reobservation produced only negligible engagement and no independent deployment, benchmark, or operational report. Adjacent interest in agent observability is rising, but Numbat’s endpoint cov
08-19 02:59alert_silentThere is no consequential new delta beyond repetitive low-level amplification, so Scott gains nothing from an interruption before routine review.
08-19 02:59alert_routeThere is no consequential new delta beyond repetitive low-level amplification, so Scott gains nothing from an interruption before routine review.
08-17 02:32repriceRungraph adds an adjacent implementation of coding-agent activity visualization, reinforcing demand for execution auditing but not validating Numbat’s endpoint coverage, blocking reliability, or opera
08-17 02:32alert_silentThe new artifact concerns harness-level run visualization and provides no independent Numbat deployment result or consequential capability evidence, so it can wait for routine review.
08-17 02:32alert_routeThe new artifact concerns harness-level run visualization and provides no independent Numbat deployment result or consequential capability evidence, so it can wait for routine review.
08-17 02:23alert_silentRungraph appears to be a new graph-visualization tool for coding-agent runs, but the supplied evidence shows neither endpoint-level instrumentation nor independent deployment results that materially a
08-17 02:23alert_routeRungraph appears to be a new graph-visualization tool for coding-agent runs, but the supplied evidence shows neither endpoint-level instrumentation nor independent deployment results that materially a
08-17 02:22attachA first-party coding-agent run-graph artifact provides relevant evidence about practical visibility and auditing of agent activity.
08-17 02:22propose_attachA first-party coding-agent run-graph artifact provides relevant evidence about practical visibility and auditing of agent activity.
08-15 08:29repriceThe case remains an unvalidated first-party release: two days of reobservation produced no independent deployment, benchmark, or operational evidence. The slight engagement increase is repetitive ampl
08-15 08:29alert_silentNo consequential new delta occurred; engagement moved marginally without comments or independent validation, so this can wait for routine review.
08-15 08:29alert_routeNo consequential new delta occurred; engagement moved marginally without comments or independent validation, so this can wait for routine review.
08-13 07:36repriceIndependent technical context strengthens the need for runtime visibility beyond sandbox isolation, making Numbat worth watching, but it does not validate Numbat’s actual coverage or reliability. The
08-13 07:36alert_silentThe new evidence corroborates the broader problem rather than establishing any new Numbat capability, deployment, or performance result, so it can wait for the normal briefing.
08-13 07:36alert_routeThe new evidence corroborates the broader problem rather than establishing any new Numbat capability, deployment, or performance result, so it can wait for the normal briefing.
08-13 07:24alert_silentThe Rye post appears to reinforce the known need for runtime visibility beyond sandbox containment, but the supplied evidence shows no independent Numbat deployment, benchmark, implementation artifact
08-13 07:24alert_routeThe Rye post appears to reinforce the known need for runtime visibility beyond sandbox containment, but the supplied evidence shows no independent Numbat deployment, benchmark, implementation artifact