ADR vs numbat
Uber's Agentic AI Detection and Response: inventory AI tools on endpoints, capture Claude Code/Cursor/Codex telemetry, and flag risky sessions with a two-tier detector; ships ADR-Bench (300+ tasks). — versus — Perplexity's endpoint sensor for AI agents: hooks, OTLP logs and on-disk session artifacts normalized into one CEL-matched event model, with opt-in pre-action blocking and offline forensics.
Both are endpoint sensors for AI agents that normalise hooks and on-disk session artifacts from Claude Code, Codex, Cursor and others into one event model. numbat is a single Go binary with deterministic CEL rules and opt-in blocking; ADR adds LLM-based dual-agent detection and a benchmark, but no blocking yet.
| ADR | numbat | |
|---|---|---|
| Stars | 2.1k | 1.2k |
| Forks | 227 | 124 |
| Language | Python | Go |
| License | Apache-2.0 | Apache-2.0 |
| Last activity | 6 days ago | 2 days ago |
| Topics | security, evals | security, agents |
| Curated connections | 3 | 9 |
ADR — the curator's take
An enterprise SOC's starting kit for coding agents, with production credibility (deployed at Uber, MLSys 2026). Take the pieces you need: Discovery for shadow-AI inventory, Sensor for a unified telemetry schema across 7+ harnesses, Detector for cheap triage plus agentic deep review, ADR-Bench (134 MCP servers, 17 attack techniques) to score any detector you are considering. Do NOT expect blocking — Prevention is unreleased, so it tells you what happened, not stops it; pair with a runtime guard. Also skip if you are one developer: the default detector needs Anthropic and OpenAI keys and the value shows at fleet scale.
numbat — the curator's take
Think EDR, not guardrails: it sits on the endpoint and watches what the agents on that machine actually did — desktop, CLI, IDE and gateway surfaces alike. Two features earn it the slot. Forensic reconstruction reads session artifacts the agents already wrote, so you can investigate a laptop that never had numbat installed. And enforcement is deliberately awkward to enable: every shipped rule is monitor-only, and blocking requires copying the YAML into your own policy directory, keeping the id, adding `enforce: true` and bumping the version. NOT a prompt-injection classifier and NOT a gateway — it observes and optionally vetoes at supported synchronous pre-action hooks, so check the coverage matrix before assuming your agent has live capture.