Recently, more people are using local development agents like Claude Code or OpenHands. While it’s incredibly convenient to grant them terminal access to write and execute code on their own, it’s always a bit nerve-wracking wondering if they might suddenly run a dangerous shell command or wipe out local files.

Perplexity has just open-sourced an interesting security layer called Numbat to address these concerns. Released under the Apache 2.0 license, Numbat is a lightweight, single-binary security sidecar written in Go that monitors terminal session transcripts and telemetry data from agents running on your local machine in real-time.

The core of this tool is its use of Common Expression Language (CEL) to define and detect risky agent behaviors. It comes with 52 built-in rules across 11 categories, allowing it to quickly identify malicious file writes or abnormal shell execution patterns.

While it defaults to a monitoring mode, you can configure it to switch to an 'Enforce' mode. For example, by adjusting your rule settings as shown below, you can safely block risky actions right before they are executed.

# Numbat CEL 규칙 설정 예시
id: block-destructive-command
category: shell_execution
cel: "command.contains('rm -rf')"
enforce: true

As agents are given more write permissions in local development environments, this lightweight sidecar guardrail pattern is likely to become essential. It’s definitely more peace of mind to run a security filter locally that provides a sandboxing effect rather than relying solely on the agent's own judgment. If you're interested in agent workflow security, it’s worth checking out.