Overview
ADR (Agentic AI Detection and Response) is an enterprise security system developed and deployed at Uber to protect AI agents. It provides observability into agent behavior, a benchmark with 300+ tasks and 133 MCP servers, and a two-tier detection system for risky agent actions. Research published at MLSys 2026.
Features
- ✓Agent observability across multiple tools
- ✓300+ task security benchmark
- ✓133 MCP server coverage
- ✓17 agent attack technique coverage
- ✓Two-tier detection architecture
- ✓Cross-platform telemetry
Installation
git clone https://github.com/uber/ADR && cd ADR/Detection && uv syncPros
- +Deployed in production at Uber
- +Comprehensive benchmark coverage
- +Academic validation (MLSys 2026)
- +Open-source core components
- +Cross-platform support
Cons
- −Prevention component not open-sourced
- −Requires API keys for full functionality
- −Early-stage project with limited community
- −Enterprise-focused, overkill for individuals
Alternatives
Documentation
Uber ADR (Agentic AI Detection and Response)
Overview
ADR is an enterprise security system designed to protect AI agents. Developed and deployed in production at Uber, ADR helps organizations secure both employee-facing tools (Cursor, Claude Code, Codex) and customer-facing AI agents (AI support systems, automated assistants). Research on ADR was accepted to MLSys 2026.
ADR addresses a growing asymmetry: as AI agents gain access to more tools and data through MCP servers and native integrations, the surface area for accidental or malicious data exfiltration grows proportionally. ADR provides the observability and detection infrastructure needed to keep agent behavior within safe boundaries.
Features
ADR provides four complementary capabilities:
- Observability: understand what AI agents are doing and why — capturing agent intent, tool use, and execution traces across multiple AI coding tools on macOS, Linux, and Windows
- Benchmark: test agent security under realistic enterprise conditions with 300+ tasks, 133 MCP servers, and coverage of 17 agent attack techniques
- Detection: detect risky agent behavior efficiently using a two-tier architecture combining high-recall triage with deeper agentic reasoning
- Prevention: stop unsafe actions before they cause harm (note: the prevention component is not included in the current open-source release)
Repository Structure
| Directory | Purpose |
|---|---|
Sensor/ | ADR Observability — collecting and normalizing agent telemetry |
Detection/ | ADR Benchmark + Detection with dual-agent detector, MCP servers, and 303 benchmark tasks |
docs/ | Documentation including reproducibility guides |
Installation
git clone https://github.com/uber/ADR
cd ADR/Detection
uv sync
export ANTHROPIC_API_KEY="your-key" OPENAI_API_KEY="your-key"
The default detector is the adr dual-agent detector. For keyless testing, run with --detector llamafirewall.
Quick Start
# Run the benchmark with the default ADR dual-agent detector
python -m adr.detect
# Run a specific benchmark task
python -m adr.detect --task task_id
# Use the lightweight detector (no API keys needed)
python -m adr.detect --detector llamafirewall
Core Concepts
- Two-tier detection: a fast, high-recall triage stage filters out obvious benign actions; a deeper agentic reasoning stage analyzes suspicious behavior in detail
- MCP server coverage: the benchmark includes 133 real-world MCP servers to test agents against the tools they actually use
- Cross-platform telemetry: the Sensor component normalizes traces from Cursor, Claude Code, Codex, and other tools into a unified schema
- 17 attack techniques: coverage spans prompt injection, tool abuse, data exfiltration, credential theft, and more
Advanced Features
- Dual-agent detector: an agent-based detector that reasons about the safety of another agent's actions
- Llama Firewall detector: a lighter-weight alternative detector for environments without API keys
- Benchmark reproducibility: documented guides for reproducing ADR's security evaluation results
Examples
| Use Case | Description |
|---|---|
| Employee coding assistant monitoring | Track what Claude Code, Cursor, and Codex do across your team |
| Customer-facing agent security | Audit AI support agents for unsafe tool use |
| Security benchmarking | Run the 300+ task benchmark against your own agent configurations |
| MCP server audit | Test which MCP servers your agents can access and whether that access is safe |
Pros
- ✅ Deployed and validated in production at a major enterprise (Uber)
- ✅ Comprehensive benchmark coverage (300+ tasks, 133 MCP servers, 17 attack techniques)
- ✅ Open-source core components under Apache-2.0
- ✅ Academic validation via MLSys 2026 publication
- ✅ Cross-platform support (macOS, Linux, Windows)
- ✅ Normalized telemetry schema across multiple AI coding tools
Cons
- ❌ Prevention component not yet open-sourced
- ❌ Requires API keys (Anthropic, OpenAI) for full detector functionality
- ❌ Relatively early-stage project with limited community metrics (492 stars at time of writing)
- ❌ Designed for enterprise use — may be overkill for individual developers
When to Use
Use ADR when you operate AI agents at enterprise scale and need observability and security detection into agent behavior. If you are a team running multiple AI coding assistants or customer-facing agents, ADR's benchmark and detection infrastructure provides a structured way to understand your agent attack surface. Individual developers with a single local agent can rely on platform-level controls instead.