uber/adr

Purpose and Entry Points

ADR is an enterprise security system for AI agents. This open-source repository provides telemetry collection (Sensor), a benchmark of adversarial agent tasks/MCP servers, and detector implementations; prevention and the offline Explorer are excluded. Primary executable surfaces are Sensor/adr_sensor/cli.py, Detection/main_detector.py, and Detection/main_benchmark.py.

Sensor: Endpoint Telemetry Normalization

The Sensor is a Python CLI/runtime that observes local agent activity across coding-agent products and emits a unified event model. Product-specific parsers isolate each tool’s native logs/configuration while the observer coordinates collection:

• Sensor/adr_sensor/observer.py

• Sensor/adr_sensor/parsers/base_parser.py

• Sensor/adr_sensor/schemas/agent_event_schema.py

Platform-specific discovery is bounded in Sensor/adr_sensor/utils/platform_paths.py; parsers include Codex, Claude, Cursor, Cline, opencode, Warp, and Claude Desktop.

Detection Pipeline

Detection is a separate Python project configured by detector and benchmark YAML. main_detector.py selects and runs detectors over session/task inputs, while main_benchmark.py drives evaluation. The core detector abstraction enables interchangeable implementations:

• Detection/main_detector.py

• Detection/guardrail/base_detector.py

• Detection/config_detector.yaml

The included ADR baseline is the primary dual-agent detector; LlamaFirewall is an alternative baseline:

• Detection/guardrail/adr_agent/adr_baseline.py

• Detection/guardrail/llamafirewall_agent/llamafirewall_baseline.py

Context and Agentic Reasoning Boundary

The ADR detector is supported by local context-provider services that expose policy, threat intelligence, and source-code analysis. These form an explicit boundary between detection reasoning and security knowledge/tool-code retrieval:

• Detection/context_providers/policy_store_server.py

• Detection/context_providers/threat_intelligence_server.py

• Detection/context_providers/source_code_analyzer_server.py

Their datasets and registries map policies, threats, and simulated MCP implementations:

• Detection/context_providers/data/policy_store.yaml

• Detection/context_providers/data/threat_repository.yaml

• Detection/context_providers_registry.json

ADR-Bench Execution Model

ADR-Bench packages attack scenarios, task suites, agents, policy configurations, and results. benchmark_pack.py handles benchmark packaging; the vendored AgentDojo framework composes an agent pipeline, planner, prompt-injection detector, and tool execution:

• Detection/benchmark/benchmark_pack.py

• Detection/benchmark/agentdojo/benchmarks/agentdojo/benchmark.py

• Detection/benchmark/agentdojo/benchmarks/agentdojo/agent_pipeline/agent_pipeline.py

Task suites span banking, Slack, travel, and workspace, combining benign user tasks with injection tasks:

• Detection/benchmark/agentdojo/benchmarks/agentdojo/default_suites/v1/banking/task_suite.py

• Detection/benchmark/agentdojo/benchmarks/agentdojo/default_suites/v1/slack/task_suite.py

• Detection/benchmark/agentdojo/benchmarks/agentdojo/task_suite/load_suites.py

MCP Simulation and Threat Corpus

The benchmark’s large MCP-server corpus simulates enterprise tools and malicious or risky services. Server registries select available implementations; server code and fixture environments remain local/synthetic rather than production integrations:

• Detection/mcp_servers_registry.json

• Detection/context_providers/source_codes/mcp_servers_0/

• Detection/context_providers/source_codes/mcp_servers_2/openai_server.py

Runtimes and External Dependencies

Both major subsystems are Python projects managed with uv (Sensor/pyproject.toml, Detection/pyproject.toml). Detection uses external Anthropic and OpenAI APIs when running the ADR workflow, with LLM adapters in the vendored benchmark:

• Detection/openai_config.py

• Detection/benchmark/agentdojo/benchmarks/agentdojo/agent_pipeline/llms/openai_llm.py

• Detection/benchmark/agentdojo/benchmarks/agentdojo/agent_pipeline/llms/google_llm.py

CI and Sensor release automation run through GitHub Actions:

• .github/workflows/ci.yml

• .github/workflows/release-sensor.yml