Guardrails vs numbat
NVIDIA's programmable guardrails for LLM apps: input, output, dialog and retrieval rails defined in Colang, wrapping any model or LangChain runnable. — versus — Perplexity's endpoint sensor for AI agents: hooks, OTLP logs and on-disk session artifacts normalized into one CEL-matched event model, with opt-in pre-action blocking and offline forensics.
Two places to put the control. NeMo Guardrails runs inside the app as programmable input, output, dialog and retrieval rails you author per application; numbat runs outside it on the host, so it also sees the agents nobody wired guardrails into.
| Guardrails | numbat | |
|---|---|---|
| Stars | 7.0k | 960 |
| Forks | 812 | 101 |
| Language | Python | Go |
| License | NOASSERTION | Apache-2.0 |
| Last activity | 3 days ago | 7 days ago |
| Topics | security | security, agents |
| Curated connections | 7 | 4 |
Guardrails — the curator's take
For when policy needs to be programmable, not a blocklist: topic bans, jailbreak checks, tool-use constraints and dialog flows written in Colang, enforced as input/output/dialog/retrieval rails around any LLM — RunnableRails drops it straight into a LangChain pipeline. NOT free at runtime: every rail is extra LLM calls and latency, Colang is its own language to learn, and rails mitigate rather than guarantee — you still red-team the result (that's garak's job).
numbat — the curator's take
Think EDR, not guardrails: it sits on the endpoint and watches what the agents on that machine actually did — desktop, CLI, IDE and gateway surfaces alike. Two features earn it the slot. Forensic reconstruction reads session artifacts the agents already wrote, so you can investigate a laptop that never had numbat installed. And enforcement is deliberately awkward to enable: every shipped rule is monitor-only, and blocking requires copying the YAML into your own policy directory, keeping the id, adding `enforce: true` and bumping the version. NOT a prompt-injection classifier and NOT a gateway — it observes and optionally vetoes at supported synchronous pre-action hooks, so check the coverage matrix before assuming your agent has live capture.