ADR: Agentic AI Detection and Response (GitHub Repository)

ADR (Agentic AI Detection and Response) is an enterprise security system that protects employee-facing AI agents such as Cursor, Claude Code, and Codex, as well as customer support agents. It has been deployed in Uber's production environment, and the related paper was accepted to MLSys 2026.

ADR enhances agent security through the following four capabilities:

• Observability: Collects intent, tool usage, and execution traces from over seven AI coding tools and internal automation/customer support agents on macOS, Linux, and Windows.
• Benchmark: Evaluates over 300 tasks, 133 MCP servers, and 17 agent attack techniques via ADR-Bench.
• Detection: Uses a two-stage detection architecture combining high false-positive rate triage with deep agent reasoning for suspicious sessions.
• Prevention: Blocks dangerous tasks before execution; this feature is not included in the current open-source release.

The public repository includes ADR Sensor and ADR-Bench & Detector. The Sensor collects and normalizes telemetry from Claude Code, Cursor, Codex, and others, while the Detection directory provides a dual-agent detector, 133 MCP servers, 303 benchmark tasks, baselines, and graph scripts for the paper. The offline ADR Explorer engine used for pre-deployment red teaming has not been released.

Users can clone the repository, install dependencies with uv sync, and configure Anthropic and OpenAI API keys to run the detector. The default detector is adr, and the --detector llamafirewall option can be used to run smoke tests without API keys. The project is distributed under the Apache License 2.0, while some vendored AgentDojo code follows a separate MIT license.