ADR: Secure and Monitor Enterprise AI Agents

Overview

ADR helps organizations understand which AI agents and related tools are present, observe their activity, and identify security risks such as prompt injection. Its open-source components cover endpoint discovery, telemetry collection, security benchmarks, and detection, addressing the challenge of securing agents used across varied tools and workflows.

The project is intended for enterprise security and engineering teams that need to assess agent behavior or reproduce security evaluations. The repository does not include ADR Prevention or the ADR Explorer red-teaming engine.

Key Features

• Discovers AI applications, command-line agents, IDE extensions, local model runtimes, and MCP servers on endpoints.
• Collects and normalizes agent telemetry, including intent, tool use, and execution traces.
• Supports telemetry from multiple coding agents and platforms, including Claude Code, Cursor, Codex, and Gemini CLI.
• Includes ADR-Bench with benchmark tasks and MCP servers for evaluating agent security.
• Provides a dual-agent detector with a high-recall triage stage and deeper reasoning for suspicious sessions.
• Includes a keyless smoke-test option using the llamafirewall detector.

Use Cases

• Security teams inventorying AI tools on employee devices and identifying unsanctioned applications or MCP servers.
• Platform teams investigating agent sessions by reviewing normalized activity and tool-use traces.
• AI security researchers comparing detection approaches against realistic benchmark tasks.
• Enterprise engineering teams reproducing the paper's benchmark evaluations and figures.

Getting Started

git clone https://github.com/uber/ADR
cd ADR/Detection
uv sync

The default detector requires API keys. See the Detection README for setup, and the reproducibility guide for the evaluation workflow. Component-specific instructions are in the Discovery, Sensor, and Detection directories.

Alternatives

• giskard-oss: Giskard focuses on repeatable vulnerability probes and safety tests for AI systems, while ADR also targets tool discovery and ongoing agent activity monitoring.

Considerations

• The default detector needs API keys for Anthropic and OpenAI. A keyless smoke test is available with --detector llamafirewall.
• Prevention and ADR Explorer are not included in the open-source repository.
• The benchmark fixtures are synthetic and intended for defensive security research.
• The repository contains vendored third-party AgentDojo code under its own MIT license; review its license alongside the project's Apache-2.0 license.