The open-source Numbat project shows that AI-agent hooks aren’t a security boundary and gives developers a monitoring-first framework to keep workspaces safe. By treating each agent as an observable endpoint that can be reconstructed and, if needed, stopped, Numbat forces teams to ask the right questions before they rely on a safety prompt alone.

Why AI-agent hooks need more than a safety prompt

Coding agents can read every file in a developer’s workspace, invoke local build tools, and fire off network requests. A prompt that says “are you sure?” won’t stop a malicious or buggy agent from exfiltrating data or corrupting a repository. Most teams treat the hook that connects the agent to the host as a wall that blocks bad behavior, but in practice that hook is just a point of contact, not a gatekeeper.

The three capabilities any protection strategy must cover

  • Observation – The host must surface what the agent is doing in real time. Without logs or hook outputs, a rogue action disappears into the background.
  • Reconstruction – After an incident, engineers need enough context to piece together the chain of events without exposing additional secrets. A transcript that records every request, file read and network call is essential.
  • Enforcement – The system must deny a dangerous action before it runs. This goes beyond merely recording the event; it requires a mechanism that can intervene, not just report.

Numbat builds a single model that aggregates data from local hooks, system logs and session files, then lets developers apply rules that span all three capabilities. The documentation makes it clear that monitoring is the default stance; enforcement is an opt-in that still leaves the host in control of the final decision.

Monitoring versus enforcement: the distinction that matters

Many developers conflate “protection” with “monitoring.” Numbat draws a line between the two. A monitoring-first approach gives teams visibility into every agent action without altering the agent’s behavior. If a rule later indicates a pattern of abuse, the team can flip on enforcement for that specific action. The enforcement path does not hijack the underlying tool; it simply asks the host to reject the request, preserving the host’s authority over its own resources while still offering a safety net.

A transcript generated by Numbat serves as an audit trail. It helps investigators understand what went wrong after the fact, but it does not prevent the problem from occurring. That is why the project recommends starting with observation, moving to reconstruction, and only then considering enforcement once the data and risk profile are clear.

The agent coverage matrix: a practical checklist

Numbat ships with a coverage matrix that lists every supported hook, the level of observation it provides, and where gaps exist. The matrix does not hide unsupported scenarios; it makes them visible so teams can plan accordingly. Using the matrix as a checklist can prevent surprise failures when a hook stops working or when an agent runs on a platform the matrix marks as “unsupported.”

Checklist for engineering teams

  • Inventory every agent host (IDE plugins, CLI wrappers, CI runners) your codebase touches.
  • Decide whether you need an audit trail only, or real-time prevention as well.
  • Test the system’s behavior when a hook fails – does it fall back to a safe default?
  • Keep operating-system permissions and network-level controls separate from the agent’s toolchain.

Following the list helps teams align their security posture with the actual capabilities of the hooks they rely on.

Limits of the approach

Numbat is not a replacement for traditional endpoint security solutions. A host hook can only report what the host chooses to expose; if the host’s operating system or network stack lacks granular logging, observation will be incomplete. Enforcement depends on the host’s willingness to deny actions, which may not be possible for all tools or environments. The project states that coverage depends on what the host provides, and that the tool’s value lies in making those dependencies visible.

Developers who assume a safety prompt is enough risk giving agents unchecked access to code, credentials and network resources. Numbat forces a shift from “trust the hook” to “verify what the hook does,” a move that aligns security practice with the reality of AI-driven development.

Takeaway: Treat AI-agent hooks as observation points, not walls; monitor first, enforce only after you understand the data and the risk.