Repolode
Submit
uber

uber/ADR

Enterprise security system that discovers, observes, benchmarks and detects risky behavior from AI coding agents and customer-facing support agents.

View on GitHubWebsite
Stars
2,108
Forks
225
Open issues
51
Last commit
6 days ago

What is it?

ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents. It targets employee-facing agents such as Cursor, Claude Code, Codex and GitHub Copilot CLI, as well as customer-facing AI support agents. The project is deployed in production at Uber.

The open-source release covers four parts: Discovery, which inventories AI apps, CLI agents, IDE extensions, local model runtimes and MCP servers on an endpoint and flags unknown ones; Sensor, which collects and normalizes agent telemetry from tools including Claude Code, Cursor, Codex and Gemini CLI; ADR-Bench, a benchmark of 300+ tasks with 134 MCP servers covering 17 agent attack techniques; and Detection, a two-tier detector that pairs high-recall triage with deeper agentic reasoning on suspicious sessions. A prevention component and the offline red-teaming engine are not part of this release.

The repository is Python-based and uses uv for setup. The Detection module supports Anthropic and OpenAI keys, and a keyless LlamaFirewall mode for smoke tests. Its benchmark fixtures are synthetic and intended for defensive security research.

Key features

  • 01Discovers AI tools, agent CLIs, IDE extensions and MCP servers on employee endpoints.
  • 02Collects and normalizes telemetry from Claude Code, Cursor, Codex, Gemini CLI and other agents.
  • 03Provides ADR-Bench with 300+ tasks, 134 MCP servers and 17 attack techniques.
  • 04Runs a two-tier detector combining high-recall triage with agentic reasoning.
  • 05Supports macOS, Linux and Windows for telemetry capture.

Use cases

  • Inventorying unsanctioned AI coding tools and MCP servers across an engineering organization.
  • Auditing what coding agents do, including tool calls and execution traces.
  • Benchmarking agent defenses against prompt injection and MCP-related attacks.
  • Researching detection methods for risky agent behavior.

Quick start

  1. 1

    Clone the repository

    git clone https://github.com/uber/ADR
  2. 2

    Enter the Detection directory

    cd ADR/Detection
  3. 3

    Install dependencies with uv

    uv sync
  4. 4

    Set your API keys (Anthropic and OpenAI)

    export ANTHROPIC_API_KEY="..." OPENAI_API_KEY="..."

Things to know

  • Default detector requires paid Anthropic and OpenAI API keys; a keyless option exists only for smoke tests.
  • The prevention component is not included in the open-source release.
  • The offline ADR Explorer engine is not included in this repository.

In collections

Claude Code tools, skills & pluginsOpen-source AI agent frameworks & appsMCP serversOpenTelemetry & observability platforms

Topics

#agent-security#ai-agents#threat-detection#prompt-injection#mcp#benchmark#observability#ai-security#claude#claude-code

FAQ

What is ADR?
Enterprise security system that discovers, observes, benchmarks and detects risky behavior from AI coding agents and customer-facing support agents. ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents. It targets employee-facing agents such as Cursor, Claude Code, Codex and GitHub Copilot CLI, as well as customer-facing AI support agents. The project is deployed in production at Uber.
Is ADR free to use? What license does it have?
ADR is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is ADR still maintained?
Actively maintained. The last commit to ADR was on Oct 31, 2026.
What can I use ADR for?
Inventorying unsanctioned AI coding tools and MCP servers across an engineering organization. Auditing what coding agents do, including tool calls and execution traces. Benchmarking agent defenses against prompt injection and MCP-related attacks. Researching detection methods for risky agent behavior.
How do I install ADR?
Clone the repository: git clone https://github.com/uber/ADR Enter the Detection directory: cd ADR/Detection Install dependencies with uv: uv sync Set your API keys (Anthropic and OpenAI): export ANTHROPIC_API_KEY="..." OPENAI_API_KEY="..."
Where can I get ADR?
The source code and installation instructions are on GitHub: https://github.com/uber/ADR

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects