failproofai vs numbat
Observability plus policy enforcement for agent harnesses: records every run across 12 harnesses (Claude Code, Codex, Cursor, Hermes…) and blocks dangerous tool calls with 39 built-in policies. — versus — Perplexity's endpoint sensor for AI agents: hooks, OTLP logs and on-disk session artifacts normalized into one CEL-matched event model, with opt-in pre-action blocking and offline forensics.
Both normalise coding-agent hooks and session artifacts into one record. Numbat is Perplexity's sensor — observe and ship OTLP; Failproof AI observes and also blocks, with a policy engine and a local dashboard.
| failproofai | numbat | |
|---|---|---|
| Stars | 2.1k | 983 |
| Forks | 444 | 102 |
| Language | MDX | Go |
| License | NOASSERTION | Apache-2.0 |
| Last activity | yesterday | 3 days ago |
| Topics | security, coding | security, agents |
| Curated connections | 5 | 7 |
failproofai — the curator's take
The one to install the day an agent first runs `rm -rf` or force-pushes: hooks into ten coding CLIs plus the Hermes and OpenClaw gateways, records sessions to a local dashboard on :8020, and enforces policies *before* the tool call runs — sanitize API keys, block .env reads, sudo, terraform/kubectl, destructive SQL, direct pushes to main. Custom policies are a JS file in .failproofai/ that returns allow/deny/instruct; packs are versioned GitHub repos. NOT a tracing platform for agents you built from code (the Python SDK gives tracing but enforcement needs a hook in your runtime), and note the source-available licence and optional cloud — local works without an account.
numbat — the curator's take
Think EDR, not guardrails: it sits on the endpoint and watches what the agents on that machine actually did — desktop, CLI, IDE and gateway surfaces alike. Two features earn it the slot. Forensic reconstruction reads session artifacts the agents already wrote, so you can investigate a laptop that never had numbat installed. And enforcement is deliberately awkward to enable: every shipped rule is monitor-only, and blocking requires copying the YAML into your own policy directory, keeping the id, adding `enforce: true` and bumping the version. NOT a prompt-injection classifier and NOT a gateway — it observes and optionally vetoes at supported synchronous pre-action hooks, so check the coverage matrix before assuming your agent has live capture.