agentgateway vs numbat
Both are catalogued under Guardrails & Security. The figures come from the GitHub API; the assessments are ours.
agentgatewayProxy that puts auth, policy and tracing in front of MCP, A2A and LLM trafficOfficialApache-2.0
numbatEndpoint capture of AI agent activity into NDJSON, matched against local CEL rules, with opt-in blockingOfficialApache-2.0At a glance
| At a glance | agentgateway | numbat |
|---|---|---|
| License | Apache-2.0 | Apache-2.0 |
| Languages | Rust, Go | Go |
| Deployment | Self-hosted / Runs locally | Runs locally / Self-hosted |
| Maturity | Growing | Experimental |
| Stars | 4.4k | 924 |
| Star growth over the last 7 days | — | — |
| Forks | 730 | 97 |
| Open issues | 343 | 6 |
| Last commit | 14 Aug 2026 | 14 Aug 2026 |
| Activity | Active | Active |
What each one does
agentgateway
A Rust data plane that sits between agents and everything they call — model providers, MCP servers, other agents — so authentication, RBAC, rate limits and OpenTelemetry export are configured once instead of reimplemented in every agent. Solo.io donated it to the Linux Foundation in August 2025 and it moved under the Agentic AI Foundation in June 2026, alongside MCP and goose. It is young for something that sits in the request path: per-user identity onto downstream MCP servers is still an open issue, so confirm the authentication model you need before putting it in front of production traffic.
Full entry →numbat
numbat is a single binary that watches supported desktop, CLI, IDE and gateway agents through hooks, plugins and OTLP/HTTP log exporters, normalizes their activity into one event model, and evaluates it with a local CEL rule engine that writes versioned NDJSON events, findings and enforcement decisions. It also reconstructs past sessions from on-disk artifacts via `numbat scan`, so you can investigate an agent that was never instrumented. Blocking is deliberately conservative: enforce mode is off by default and every shipped rule is monitor-only, so denying an action means copying the rule YAML into your own `--rules-dir`, keeping its id, adding `enforce: true` and bumping the version. It is a poor fit if you expect coverage of arbitrary agents or a definitive account of what ran — the coverage matrix decides what is observable per host and surface, at-rest reconstruction cannot recover activity an agent never persisted, and findings are rule matches rather than proof that an action completed.
Full entry →What you can do
agentgateway
- Put several MCP servers behind one port — One
mcpbackend takes a list of named targets — the repository's multiplex example launchesmcp-server-timewithuvxandserver-everythingwithnpx— and exposes them together on a single bind. stdio, SSE and streamable HTTP all terminate at the gateway, so the client sees one endpoint. - Authorise individual tool calls with CEL —
mcpAuthorizationrules are CEL expressions over the verified JWT and the call itself:mcp.tool.name == "echo"leaves one tool open to anyone whilejwt.sub == "test-user" && mcp.tool.name == "get-sum"restricts another to a single subject. Tool-level policy is what the MCP specification explicitly declines to enforce itself. - Route by cost rather than by model name — A virtual model dispatches to real backends through conditional rules — the cost-routing example sends requests whose
max_tokensis 1024 or less togpt-4o-miniand larger ones up the tiers — with the last target acting as the required fallback. Budget and spend controls, prompt enrichment and failover sit on the same OpenAI-compatible surface. - Run it standalone or as a Gateway API controller — A single binary reading flat YAML covers local and non-Kubernetes deployments; the built-in controller implements Gateway API plus the Inference Gateway extensions, routing to self-hosted models on GPU utilisation, KV cache state, LoRA adapters and queue depth. Guardrails hook into regex filters, OpenAI moderation, Bedrock Guardrails, Model Armor or a custom webhook.
- Check the identity story before committing — Enterprise SSO with per-user credentials to downstream MCP services, OAuth Identity Assertion for cross-app access and custom OAuth scopes are all still open issues, and another reports that the current versioning scheme breaks automated patch updates. The proxy is production-shaped; the delegated-identity half of it is not finished.
numbat
- Survey an endpoint before instrumenting it —
numbat agentslists discovered agents andnumbat scan --agent codexparses their on-disk session artifacts; both are read-only and install no hooks or agent config changes. - Stream live activity to a local record file —
numbat hook install --agent codex --emit allappends events, findings, indicators and applicable enforcement decisions to~/.numbat/records.ndjson, whilenumbat hook statusverifies configuration only — not execution or delivery. - Write detections in CEL and test them first — Custom YAML rules run through
numbat rules check --rules-dir ./numbat-policyandnumbat rules test; a rules directory replaces an embedded rule when it reuses the same id, and--no-builtin-rulesgives an operator-only catalog. - Promote a monitor rule into a deny — Copy the shipped YAML from
rules/, keep the id, addenforce: true, bump the version, thennumbat hook install --agent codex --rules-dir ./numbat-policy --enforce; blocking applies only to agents with a supported synchronous pre-action hook. - Hand an investigation to someone else —
numbat timelinebuilds a per-session view andnumbat case build/numbat case verifyproduce and check bundles with SHA-256 manifests — which establish internal consistency, not source authenticity; complete raw transcripts stay out of normal records unless you opt into adding evidence files.