How secureagentics/adrian works
Adrian is a runtime security monitor and control layer for AI agents. Its principal flow instruments agent activity and reasoning, sends captured events to a backend classifier, and returns verdicts that can notify, block, or pause execution for human review. The repository also includes a dashboard, persistent event and review data, alerting, Python and TypeScript SDKs, and a Claude Code integration. The README documents the overall stack and capabilities; sampled source confirms selected event, review, and SDK behaviors, while several subsystem links remain documented rather than source-verified.
Main entry points: handler.go WebSocket intake · routes.go Dashboard API · handler.py Python instrumentation · engine.go Runtime classifier
Components 19
Agent capture
- Python instrumentation
sdk/python/adrian/handler.py - Agent context
sdk/python/adrian/context.py - Paired events
sdk/python/adrian/format/types.py - Python transport
sdk/python/adrian/ws.py - TypeScript SDK
sdk/typescript/packages/core/src/handler.ts
Classification
- Runtime classifier
backend/internal/engine/engine.go
Backend services
- WebSocket intake
backend/internal/ws/handler.go - Dashboard API
backend/internal/api/routes.go - Persistent state
backend/internal/store/store.go - SQLite database
backend/internal/db/db.go - Human review queue
backend/internal/api/handlers_reviews.go - Alert dispatch
backend/internal/notifications/dispatcher.go
Dashboard
- Security dashboard
frontend/app/(dashboard)/page.tsx - Review controls
frontend/app/(dashboard)/reviews/page.tsx
SDK integrations
- Claude Code plugin
integrations/claude-code/adrian_cc/agent.py - PII redaction
sdk/python/adrian/pii/_engine.py
Other components
- AI agent
- Security operator
- LLM classifier service
Connections 21
- AI agent → Python instrumentation: emits activity
- Python instrumentation → Agent context: tracks context
sdk/python/adrian/handler.py - Python instrumentation → Paired events: pairs events
sdk/python/adrian/format/types.py - Paired events → Python transport: sends events
sdk/python/adrian/ws.py - AI agent → TypeScript SDK: captures behavior
- AI agent → Claude Code plugin: captures tool calls
- Python instrumentation → PII redaction: redacts sensitive data
- Python transport → WebSocket intake: streams events
- WebSocket intake → Runtime classifier: classifies activity
backend/internal/ws/handler.go - Runtime classifier → LLM classifier service: queries model
- WebSocket intake → Persistent state: records events
backend/internal/ws/handler.go - Persistent state → SQLite database: persists state
- Runtime classifier → WebSocket intake: returns verdicts
- WebSocket intake → Python transport: delivers verdicts
- Dashboard API → Persistent state: queries state
- Dashboard API → Human review queue: resolves reviews
backend/internal/api/handlers_reviews.go - Human review queue → WebSocket intake: publishes resolution
backend/internal/api/handlers_reviews.go - Dashboard API → Alert dispatch: dispatches alerts
- Security dashboard → Dashboard API: requests data
- Security operator → Review controls: reviews decisions
- Review controls → Dashboard API: submits decisions