Adrian vs numbat
Runtime security for AI agents: watches actions AND reasoning traces to catch prompt injection, tool poisoning and out-of-remit behavior — blocking before the action lands. SDKs + Claude Code plugin. — versus — Perplexity's endpoint sensor for AI agents: hooks, OTLP logs and on-disk session artifacts normalized into one CEL-matched event model, with opt-in pre-action blocking and offline forensics.
Both do runtime security for agents, with opposite epistemologies. Adrian reads the reasoning trace to catch injection semantically; numbat is deterministic — CEL rules over a normalized endpoint event model, emitting versioned NDJSON and case bundles built for an incident responder.
| Adrian | numbat | |
|---|---|---|
| Stars | 548 | 960 |
| Forks | 91 | 101 |
| Language | Python | Go |
| License | Apache-2.0 | Apache-2.0 |
| Last activity | 4 days ago | 7 days ago |
| Topics | security, agents | security, agents |
| Curated connections | 5 | 4 |
Adrian — the curator's take
The interesting bet is judging reasoning traces, not just tool calls, against a working model of the agent's remit — the OpenAI/DeepMind-cited combo that catches what injection-trained classifiers miss. Know the deployment shape: the quickstart routes your agent's actions AND thoughts through their managed dashboard; self-hosting exists but is the longer path. Young (★460) and a startup's wedge product — run audit mode first and measure false positives on your own traffic before trusting block mode in production.
numbat — the curator's take
Think EDR, not guardrails: it sits on the endpoint and watches what the agents on that machine actually did — desktop, CLI, IDE and gateway surfaces alike. Two features earn it the slot. Forensic reconstruction reads session artifacts the agents already wrote, so you can investigate a laptop that never had numbat installed. And enforcement is deliberately awkward to enable: every shipped rule is monitor-only, and blocking requires copying the YAML into your own policy directory, keeping the id, adding `enforce: true` and bumping the version. NOT a prompt-injection classifier and NOT a gateway — it observes and optionally vetoes at supported synchronous pre-action hooks, so check the coverage matrix before assuming your agent has live capture.