Is numbat free?
Yes. numbat launched on July 29, 2026 under the Apache 2.0 licence and is free to use, with contributions to the NVIDIA-backed Open Secure AI Alliance.
Beam vs PERPLEXITY
Beam vs numbat
numbat is the closest comparison to Beam: free, Apache-2.0, backed by NVIDIA and the Open Secure AI Alliance, with opt-in pre-action blocking and forensic replay. Beam also blocks — workspace owners and admins set observe, advisory, or enforce policy, with native denies on Claude Code and Codex PreToolUse and Sentinel pause/block on supported browser AI chats. Beam differs by scanning skill files and MCP configurations before you run them, keeping a workspace console, and importing numbat's records so they interoperate.
Beam vs numbat, side by side
Details below are drawn from a September 2026 review of the AI agent security market. Some figures are vendor-sourced or analyst estimates, and this is a fast-moving space — check with each vendor before you buy. Composio details come from its own pricing and documentation pages as of October 2026.
| Beam | numbat (Perplexity) | |
|---|---|---|
| What it is | Local-first activity monitor, policy enforcement, and pre-run scanner for AI coding agents, with a Sentinel browser extension for AI chats. | Open-source local monitor for coding agents, with forensic session replay. |
| Monitoring | Shell commands, file changes, tool calls, network endpoints and browser actions from harnesses such as Claude Code, Codex and Cursor, plus Beam Sentinel checks on supported AI chat sites before send. Normalised into local NDJSON with risk flags and evidence attached. | Shell, file, network, MCP and tool events from Claude Code, Codex, Cursor, OpenClaw, OpenCode and Pi, collected via local hooks, OTLP/HTTP logs and on-disk session artifacts. Reconstructs past sessions forensically. |
| Skill / MCP scanning | Yes. SKILL.md files and MCP configurations are scanned before you run them, using 11 heuristic patterns plus an MCP version-pin check. Workspace admins can also block an MCP server for the org or one user. | Not a dedicated pre-run skill scanner. MCP and tool activity is captured as events and matched against 52 detection rules covering categories such as secret access and data exfiltration. |
| Blocking / enforcement | Yes. Workspace owners and admins set observe, advisory, or enforce policy. Enforce denies matching tool calls on Claude Code and Codex PreToolUse hooks. The Sentinel Chrome extension pauses or blocks high-risk browser sends and can hold a send after redacting live secrets. | Yes, opt-in. Monitor-only is the default. |
| Individual use | Free for up to 3 people, and Pro for one person at $8/month. Team workspaces add owner/admin roles, org baselines, stricter member overrides and a control plane. | Free and self-hosted for anyone, with no paid tier to reach. |
| Deployment | Local collector plus a workspace dashboard. Apple and Windows MDM. Sentinel Chrome extension for browser AI chats. Licensed self-hosted control plane for teams that need it on their own infrastructure. | A single Go binary. Also deployed to fleets through MDM. |
| Source / licence | AGPL-3.0 for the local CLI and collector; the multi-user control plane is proprietary. | Apache 2.0, contributed to the Open Secure AI Alliance. |
| Pricing | Free for up to 3 people. Pro $8/month for one person. Team $20 per developer and $5 per browser seat a month, billed yearly. | Free. |
numbat in numbers
As reported in our source research. Some figures are estimates.
- Launched
- July 29, 2026
- Licence
- Apache 2.0
- Detection rules
- 52 rules across 11 behaviour categories, written as Common Expression Language expressions
- Backing
- NVIDIA and the Open Secure AI Alliance
- Traction
- About 961 GitHub stars in its first six weeks; star counts move quickly
Where numbat does more
- It is free and open source under Apache 2.0, with backing from NVIDIA and the Open Secure AI Alliance. Beam's local CLI is AGPL-3.0; it is not Apache-licensed and not similarly backed.
- Opt-in pre-action blocking from a single Go binary, with monitor-only as the default. Beam's deny is workspace policy on Claude Code and Codex hooks, plus Sentinel for browser AI chats.
- Broad harness coverage plus forensic replay of past sessions.
Where Beam differs
- Beam scans a SKILL.md or mcp.json before you run it, as its own step, rather than only classifying events after an agent acts.
- Beam stores everything locally, redacts known credential formats before writing, and sends no cloud telemetry by default.
- Beam imports numbat's normalised event and finding records, so the two can run together rather than instead of each other.
Beam’s current gaps
- Enforce is hook-based: a native deny is wired for Claude Code and Codex PreToolUse. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block.
- Missing, unreadable or expired cached policy allows the action. Beam is not a fail-closed kernel sandbox or an in-silicon watchdog.
- Scanning is heuristic pattern matching. It produces false positives, misses novel phrasing, and is not a guarantee of safety.
- There is no SOC 2 report and no default SIEM forwarder. Kernel isolation like OpenShell remains a different layer.
Which one fits
If you want a free, self-hosted monitor today and are happy to run and maintain it, numbat is a genuinely strong choice and we would not argue otherwise. Beam is worth a look if pre-run skill and MCP scanning is the part you care about, or if you want Beam's timeline alongside numbat's records.
FAQ
Can numbat and Beam both block a dangerous command?
Yes, at different layers. numbat offers opt-in pre-action blocking and runs monitor-only by default. Beam workspace owners and admins can set enforce policy: Claude Code and Codex PreToolUse denials, plus Sentinel pause/block on high-risk browser sends. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block.
Can I run Beam and numbat together?
Yes. Beam imports numbat's normalised event and finding records, so numbat can do the collection while Beam adds its skill and MCP scan reports.
See how Beam works
Beam is an early, local-first prototype. Read what it actually does today before comparing it further.