Agents-OSS
EN
Submit

codex-security vs numbat

Both are catalogued under Guardrails & Security. The figures come from the GitHub API; the assessments are ours.

codex-securityCLI and TypeScript SDK that scans a codebase to find, validate and fix security vulnerabilities.OfficialApache-2.0numbatEndpoint capture of AI agent activity into NDJSON, matched against local CEL rules, with opt-in blockingOfficialApache-2.0

At a glance

At a glancecodex-securitynumbat
LicenseApache-2.0Apache-2.0
LanguagesTypeScript, PythonGo
DeploymentRuns locally / Self-hostedRuns locally / Self-hosted
MaturityGrowingExperimental
Stars9.9k924
Star growth over the last 7 days——
Forks68997
Open issues1296
Last commit16 Aug 202614 Aug 2026
ActivityActiveActive

What each one does

codex-security

`npx @openai/codex-security scan .` walks a checkout and leaves JSON results on stdout, while `--mode deep` spreads discovery across workers and subagents until it stops turning up anything new. Across runs, `scans compare BEFORE_SCAN_ID AFTER_SCAN_ID` matches findings by root cause and labels them new, persisting, reopened, resolved or unknown, so a second scan reports movement instead of restating the whole report. It is a poor fit as a pre-commit gate: deep discovery runs until `--max-time-hours`, which defaults to 96. Access is also gated — the CLI needs access to Codex Security, and some cybersecurity requests and protected findings require Trusted Access for Cyber approval, so cloning the repo on its own scans nothing.

Full entry →

numbat

numbat is a single binary that watches supported desktop, CLI, IDE and gateway agents through hooks, plugins and OTLP/HTTP log exporters, normalizes their activity into one event model, and evaluates it with a local CEL rule engine that writes versioned NDJSON events, findings and enforcement decisions. It also reconstructs past sessions from on-disk artifacts via `numbat scan`, so you can investigate an agent that was never instrumented. Blocking is deliberately conservative: enforce mode is off by default and every shipped rule is monitor-only, so denying an action means copying the rule YAML into your own `--rules-dir`, keeping its id, adding `enforce: true` and bumping the version. It is a poor fit if you expect coverage of arbitrary agents or a definitive account of what ran — the coverage matrix decides what is observable per host and surface, at-rest reconstruction cannot recover activity an agent never persisted, and findings are rule matches rather than proof that an action completed.

Full entry →

What you can do

codex-security

  • One command, or one SDK call — npx @openai/codex-security scan . is the whole entry point; --model and --effort high tune the run. The TypeScript equivalent is new CodexSecurity() plus await security.run("."), which returns result.reportPath.
  • Deep scans with an explicit stop condition — --mode deep takes --workers and --subagents for parallelism and --stop-after-no-new 3, --max-discovery-runs 10 and --max-time-hours 1.5 as budgets. Discovery otherwise halts at 96 hours, and findings completed before the limit are still returned.
  • Findings tracked across scans — scans compare BEFORE_SCAN_ID AFTER_SCAN_ID reuses saved matches and matches the rest by root cause; findings stay unknown where coverage was incomplete or the original location was never reviewed. findings list [repository] surfaces open findings not confirmed by the latest scan.
  • Swap in another inference provider — --provider openrouter, --provider fireworks and --provider amazon-bedrock pair with a matching --model such as anthropic/claude-sonnet-4.5. Bedrock accepts AWS_BEARER_TOKEN_BEDROCK as well as standard access keys, profiles, web identity and the default AWS credential chain.
  • Containerized bulk scanning — The official image and its Docker Compose config run noninteractive, resumable scans of repositories pinned to immutable Git revisions. --knowledge-base PATH shares security documents with every repository, --scan-prompt-file PATH carries the scan instructions common to all of them, and a prompt CSV column holds the instructions for one repository.

numbat

  • Survey an endpoint before instrumenting it — numbat agents lists discovered agents and numbat scan --agent codex parses their on-disk session artifacts; both are read-only and install no hooks or agent config changes.
  • Stream live activity to a local record file — numbat hook install --agent codex --emit all appends events, findings, indicators and applicable enforcement decisions to ~/.numbat/records.ndjson, while numbat hook status verifies configuration only — not execution or delivery.
  • Write detections in CEL and test them first — Custom YAML rules run through numbat rules check --rules-dir ./numbat-policy and numbat rules test; a rules directory replaces an embedded rule when it reuses the same id, and --no-builtin-rules gives an operator-only catalog.
  • Promote a monitor rule into a deny — Copy the shipped YAML from rules/, keep the id, add enforce: true, bump the version, then numbat hook install --agent codex --rules-dir ./numbat-policy --enforce; blocking applies only to agents with a supported synchronous pre-action hook.
  • Hand an investigation to someone else — numbat timeline builds a per-session view and numbat case build / numbat case verify produce and check bundles with SHA-256 manifests — which establish internal consistency, not source authenticity; complete raw transcripts stay out of normal records unless you opt into adding evidence files.

Other comparisons