agentsight vs numbat
System-level observability for AI agents via eBPF and TLS tracing: correlates prompts and model calls with the processes, files and network the agent actually touched — no SDK, no proxy. — versus — Perplexity's endpoint sensor for AI agents: hooks, OTLP logs and on-disk session artifacts normalized into one CEL-matched event model, with opt-in pre-action blocking and offline forensics.
Both sensors for what a coding agent did on the box. Numbat cooperates with the harness — hooks, OTLP logs, session artifacts; AgentSight is harness-agnostic, tracing eBPF and TLS so it works on any binary, including ones with no hooks.
| agentsight | numbat | |
|---|---|---|
| Stars | 671 | 983 |
| Forks | 101 | 102 |
| Language | C | Go |
| License | MIT | Apache-2.0 |
| Last activity | today | 3 days ago |
| Topics | security, coding, local | security, agents |
| Curated connections | 5 | 7 |
agentsight — the curator's take
Use it when the agent is a closed CLI (Claude Code, Codex, Gemini CLI, OpenClaw) and its own logs don't explain a failure: AgentSight watches at the kernel boundary, so it sees the model traffic *and* every exec, file write and outbound connection, and ties them together. That's the layer LangSmith-class tools can't reach without owning the app code. NOT for prompt/eval-level tracing of an app you wrote (use an OTLP tracer), and it's Linux-with-eBPF: on macOS you're out of luck. Not an enforcement tool — it observes and advises, it doesn't block.
numbat — the curator's take
Think EDR, not guardrails: it sits on the endpoint and watches what the agents on that machine actually did — desktop, CLI, IDE and gateway surfaces alike. Two features earn it the slot. Forensic reconstruction reads session artifacts the agents already wrote, so you can investigate a laptop that never had numbat installed. And enforcement is deliberately awkward to enable: every shipped rule is monitor-only, and blocking requires copying the YAML into your own policy directory, keeping the id, adding `enforce: true` and bumping the version. NOT a prompt-injection classifier and NOT a gateway — it observes and optionally vetoes at supported synchronous pre-action hooks, so check the coverage matrix before assuming your agent has live capture.