Track internal AI agent activity and identify threats
You can see at a glance what instructions coding tools or customer service bots are receiving and what actions they are taking. ADR is a system that tracks the intent and tool usage logs of AI agents to prevent dangerous actions before they happen. This project, currently in production at Uber, was recently accepted as a paper at MLSys 2026, recognizing its reliability.
Five pillars of AI agent security
ADR consists of five functions: discovery, observation, benchmarking, detection, and prevention. It first creates a list of AI tools and MCP servers installed on endpoints to find unauthorized tools. It then collects execution logs to see what intent an agent has when calling a tool. Based on this data, it tests security using more than 300 tasks and 134 MCP servers. Suspicious sessions undergo two stages of analysis to identify threats, although the current open-source version does not yet include the prevention function.
Open-sourced components
This repository includes ADR Discovery, ADR Sensor, ADR-Bench, and ADR Detector. Discovery inventories AI apps, CLI agents, and IDE extensions on endpoints. Sensor collects telemetry generated by more than seven coding tools, such as Claude Code, Cursor, and Codex, as well as internal automation agents. The Detection folder contains a dual-agent detector, 304 benchmark tasks, and infrastructure for 134 MCP servers. ADR Explorer, an offline engine for pre-deployment red team testing, is not included in this repository.
How to run the detection function
To run the detection function, clone the repository and move to the Detection folder. Install dependencies with the uv sync command and set the API keys for Anthropic and OpenAI as environment variables. The default detector is adr, and if you want a simple test without an API key, you can use the --detector llamafirewall option. The full evaluation workflow is explained step by step in the docs/REPRODUCIBILITY.md file.
Things to check before use
This project is distributed under the Apache License 2.0, and the Detection/benchmark/agentdojo/ folder contains third-party code under the MIT license. The data consists of synthetic benchmark fixtures for defensive security research, including fake credentials and prompt injection scenarios. Since the current open-source release lacks the prevention function that blocks dangerous actions, environments that need to automatically block detected threats should consider this limitation. Additionally, while you can observe agent activity on macOS, Linux, and Windows, compatibility with specific internal automation agents requires individual verification.
