Primary question: Do your AI coding agents already touch production systems, repositories, or customer data — and do you need a detection layer that understands agent tool-use traces rather than just prompt text?
RepoDaily adoption score
RepoDaily rates this as 91/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
5 source(s) across 4 source category/categories, plus a RepoDaily-specific evidence module when available.
5 workflow step(s), 6 next-action step(s), and 5 command/install signal(s) were detected.
Trending momentum is +321 stars, with maintenance/release/issue signals counted when present.
Risk is marked medium, with 5 security note(s) and 4 explicit skip condition(s).
3 opportunity lens item(s), 4 alternative(s), and 3 type-specific section(s) support differentiation.
License source or license wording is present.
9 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
ADR (Agentic AI Detection and Response) is an enterprise security system from Uber that targets a problem most organizations are only beginning to confront: AI agents that autonomously call tools, execute code, and move data across enterprise environments with minimal human oversight. The repository, published alongside an MLSys 2026 paper, ships three of ADR's four components as open source: the Sensor for telemetry collection, ADR-Bench for security evaluation, and the Detector for identifying risky agent sessions. The fourth component, Prevention, is described in the paper but explicitly withheld from this release.
What separates ADR from conventional prompt-injection scanners is its two-tier detection architecture. A high-recall triage layer first screens sessions for suspicious patterns, then a deeper agentic-reasoning pass investigates flagged sessions in detail. This design aims to keep false positives manageable without missing novel attack vectors — a tradeoff the ADR-Bench benchmark (303 tasks, 133 MCP servers, 17 agent attack techniques) is designed to measure rigorously.
The Sensor component normalizes telemetry from more than seven AI coding tools running on macOS, Linux, and Windows, capturing agent intent, tool invocations, and execution traces in a unified schema. This gives security teams a consistent view of what an agent attempted, which tools it called, and why — across heterogeneous coding assistants rather than per-tool silos. Uber states that ADR is deployed in production internally for both employee-facing coding agents and customer-facing support agents.
Why it is trending now
- Accepted at MLSys 2026 with a full paper and slides, lending academic credibility to a problem space dominated by vendor marketing.
- Production-deployed at Uber across employee-facing coding agents (Cursor, Claude Code, Codex) and customer-facing support agents.
- ADR-Bench is the largest open agent-security benchmark in the release: 303 tasks, 133 MCP servers, and coverage of all 17 known agent attack techniques.
- The Sensor unifies telemetry from 7+ AI coding tools on three operating systems into a single normalized schema — a capability most teams currently build ad hoc.
- Apache 2.0 license with clear component boundaries makes adoption and downstream tooling straightforward for enterprise security teams.
Problem it solves
- AI coding agents autonomously invoke tools — shells, file systems, MCP servers, web APIs — with broad permissions and minimal per-action review, creating a new attack surface that traditional DLP and endpoint tools do not model.
- Agent sessions are opaque: without normalized telemetry, security teams cannot reconstruct what an agent intended, which tools it called, or what data it accessed after a suspicious event.
- No widely adopted benchmark exists for evaluating agent-specific attack techniques (prompt injection, tool poisoning, privilege escalation via MCP), making it hard to compare detectors apples-to-apples.
- False-positive volume is a known barrier: naive keyword or pattern matching on agent traces produces noise that overwhelms security analysts, so a two-tier triage-plus-reasoning pipeline is needed.
How it works
- The Sensor hooks into AI coding tools (Claude Code, Cursor, Codex, and others) on macOS, Linux, and Windows, capturing agent intent, tool-use calls, and execution traces in a unified schema stored under Sensor/.
- The triage layer of the Detector performs high-recall screening on incoming sessions to flag any that merit deeper investigation.
- The agentic-reasoning layer of the Detector takes flagged sessions and performs deeper analysis — reading the full tool-use chain, MCP server interactions, and execution context to classify the behavior.
- ADR-Bench provides the evaluation harness: 303 benchmark tasks across 133 MCP servers, covering all 17 agent attack techniques, with baselines and figure scripts for reproducible comparison.
- The full reproduction workflow is documented in docs/REPRODUCIBILITY.md: inflate the packed benchmark, run detectors, and plot paper figures.
Repository layout and component boundaries
The repository is organized into two primary code directories plus documentation. Sensor/ contains the observability layer — the parsers and schema normalizers that ingest telemetry from Claude Code, Cursor, Codex, and other supported tools. Detection/ contains the benchmark infrastructure (ADR-Bench tasks, 133 MCP servers, baseline detector implementations) and the dual-agent detector itself.
Notably absent from the open-source release are the ADR Prevention engine (which blocks unsafe actions in real time) and the ADR Explorer (an offline red-teaming tool that hardens detection through pre-deployment testing). Both are described in the MLSys 2026 paper but are withheld from this repository, with the README noting 'Stay tuned' for Prevention.
The Detection/ directory also vendors third-party code: Detection/benchmark/agentdojo/ is AgentDojo under its own MIT license, separate from the repository's Apache 2.0 terms. All benchmark fixtures in Detection/ are synthetic — fake credentials and emulated environments — so no real enterprise data is exposed.
Getting started: clone, sync, run
- Clone: `git clone https://github.com/uber/ADR` then `cd ADR/Detection`.
- Install dependencies: `uv sync` (the project uses uv as its Python package manager).
- Set API keys: `export ANTHROPIC_API_KEY="..." OPENAI_API_KEY="..."` — the default `adr` dual-agent detector requires both.
- Keyless smoke test: `--detector llamafirewall` runs without paid API keys for a baseline comparison.
- Full evaluation: follow docs/REPRODUCIBILITY.md to inflate the packed benchmark, run detectors, and generate paper figures.
- Component docs: Sensor/README.md covers the telemetry schema; Detection/README.md covers benchmark tasks, MCP infrastructure, and detector baselines.
How ADR compares to adjacent security tools
- Vs. LlamaFirewall: ADR includes LlamaFirewall as a built-in baseline detector (`--detector llamafirewall`). LlamaFirewall is a prompt-injection and content filter; ADR adds full tool-use trace analysis, a 303-task benchmark, and a two-tier triage-plus-reasoning pipeline.
- Vs. AgentDojo: AgentDojo is vendored inside ADR-Bench as a benchmark substrate. ADR extends beyond it with 133 MCP servers, the dual-agent detector, and enterprise telemetry from production coding tools.
- Vs. traditional DLP: DLP tools inspect data payloads; ADR models agent intent and tool-use chains — what the agent tried to do and why, not just what bytes it moved.
- Vs. prompt-injection-only scanners: ADR's detection spans all 17 agent attack techniques (including tool poisoning and privilege escalation via MCP), not just injection in prompt text.
Who should pay attention?
Good fit if
- Your engineering organization has adopted AI coding agents (Cursor, Claude Code, Codex) that execute code, access repositories, or call MCP servers against production or staging systems.
- You need a repeatable benchmark to evaluate and compare agent-security detectors before committing to a vendor or building in-house.
- You want normalized agent telemetry across multiple coding tools rather than per-tool logging that your analysts must manually correlate.
- You are a security researcher who needs the 133-MCP-server benchmark harness to study new agent attack techniques.
Skip for now if
- You have no AI agents in production and are only evaluating prompt-level input/output filtering for chatbot responses.
- You need real-time prevention or blocking — that component is not in the open-source release and has no committed timeline.
- Your environment cannot run Python with uv or cannot provision ANTHROPIC_API_KEY and OPENAI_API_KEY for the default dual-agent detector.
- You need an out-of-the-box SIEM or SOAR replacement — ADR is a detection and benchmarking toolkit, not a full incident-response platform.
Risks and cautions
The benchmark and detection components are fully open and documented, but Prevention and Explorer are withheld, the dual-agent detector requires paid API keys, and the project ships only Sensor and Detection with no deployment orchestration.
- The default `adr` detector requires both ANTHROPIC_API_KEY and OPENAI_API_KEY, creating an ongoing inference cost for production detection.
- ADR Prevention — the component that blocks unsafe actions — is not in this release, so teams get detection without automated enforcement.
- ADR Explorer, the offline red-teaming engine, is also withheld, limiting pre-deployment hardening for external adopters.
- No Docker images, Helm charts, or deployment manifests are included; teams must build their own production deployment path.
- The project is newly open-sourced from a single organization (Uber); long-term maintenance cadence and community governance are unproven.
- ADR-Bench covers all 17 known agent attack techniques across 303 tasks and 133 MCP servers, providing the most comprehensive open agent-security benchmark in the release.
- The two-tier detection pipeline (high-recall triage followed by agentic reasoning) is designed to suppress false positives that plague naive pattern-matching detectors.
- All benchmark fixtures in Detection/ use synthetic data — fake credentials and emulated environments — so no real secrets or enterprise data are shipped.
- The Sensor captures execution traces across macOS, Linux, and Windows for 7+ AI coding tools, giving incident responders post-hoc reconstruction of agent sessions.
- Vendored AgentDojo code in Detection/benchmark/agentdojo/ is MIT-licensed and disclosed separately from the Apache 2.0 main license.
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
LlamaFirewall | You need a lightweight, keyless prompt-injection baseline without the full two-tier agentic-reasoning pipeline. ADR already includes it as `--detector llamafirewall`. | Free / open-source |
AgentDojo | You want a standalone agent benchmark substrate. ADR-Bench vendors AgentDojo and extends it with 133 MCP servers and enterprise task coverage. | Free / open-source |
NeMo Guardrails | Your focus is conversational input/output guardrails for LLM chatbots rather than autonomous tool-use detection for coding agents. | Free / open-source |
Enterprise DLP platforms (e.g., Symantec, Forcepoint) | You need traditional data-loss prevention for file transfers and network exfiltration but not agent-intent modeling. | Commercial license |
What this trend reveals
MCP server red-teaming lab
ADR-Bench ships 133 MCP servers and 303 tasks covering 17 attack techniques. Security teams can extend the benchmark with custom MCP servers that mirror their internal tooling, creating a red-teaming lab tailored to their specific agent deployment.
Clone Detection/, follow Detection/README.md Part 3 on 'Enriching the benchmark' for adding custom MCP servers and malicious test servers.
Unified agent telemetry pipeline
The Sensor already normalizes telemetry from 7+ coding tools into a unified schema. Organizations running mixed agent fleets (Cursor on macOS, Claude Code on Linux, Codex on Windows) can use the Sensor as a single ingestion layer feeding their existing SIEM or data lake.
Review Sensor/README.md for the unified schema definition and parser conventions; follow Sensor/CONTRIBUTING.md for adding parsers for unsupported tools.
Academic collaboration on agent security
The MLSys 2026 paper, CITATION.cff, and the reproducibility workflow make ADR a credible foundation for security research. Researchers can reproduce paper figures and contribute new attack techniques or detector baselines back to ADR-Bench.
Follow docs/REPRODUCIBILITY.md end-to-end, cite using the provided BibTeX, and submit new tasks or MCP servers via the CONTRIBUTING.md workflow (CLA required).
RepoDaily verdict
ADR is the most substantive open-source release yet for enterprise AI agent security — a production-deployed detection system backed by an MLSys 2026 paper, with a 303-task benchmark spanning 133 MCP servers and 17 attack techniques. The withheld Prevention and Explorer components and the API-key cost of the default detector are real constraints, but for any team running Cursor, Claude Code, or Codex against real systems, ADR-Bench and the Sensor alone justify evaluation.