StackMap
Subscribe
Explore / ADR
uber

ADR

Uber's Agentic AI Detection and Response: inventory AI tools on endpoints, capture Claude Code/Cursor/Codex telemetry, and flag risky sessions with a two-tier detector; ships ADR-Bench (300+ tasks).

2,113 227 Python Apache-2.0updated 6 days ago
securityevals
View on GitHubDispute this mapping →
Curator's take

An enterprise SOC's starting kit for coding agents, with production credibility (deployed at Uber, MLSys 2026). Take the pieces you need: Discovery for shadow-AI inventory, Sensor for a unified telemetry schema across 7+ harnesses, Detector for cheap triage plus agentic deep review, ADR-Bench (134 MCP servers, 17 attack techniques) to score any detector you are considering. Do NOT expect blocking — Prevention is unreleased, so it tells you what happened, not stops it; pair with a runtime guard. Also skip if you are one developer: the default detector needs Anthropic and OpenAI keys and the value shows at fleet scale.

Mapped by ShipWithAI editors · links verified

Continue your stack

What teams reach for next — and why each earns a place beside ADR. Ranked by curator confidence.

pairs wellalternativealternativeAdriannumbatgeigerADR
pairs wellalternativebuilt withpick a node for the why · open it from the panel
Weekly digest
README.md2 min read

ADR: Agentic AI Detection and Response

uber/ADR | Trendshift

ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents. It helps organizations secure employee-facing agents such as Cursor, Claude Code, Codex, GitHub Copilot CLI, and DeepSeek Harness, as well as customer-facing agents such as AI support agents.

ADR is deployed in production at Uber, and the accompanying paper was accepted to MLSys 2026: Paper PDF · Slides PDF

How ADR secures enterprise AI agents

ADR secures enterprise AI agents through five complementary capabilities: discovering unsanctioned AI tools, observing agent activity, evaluating defenses, detecting threats, and preventing unsafe actions.

  1. ADR Discovery: Find the AI tools present on employee endpoints. Inventories installed AI applications, CLI agents, IDE extensions, local model runtimes, and MCP servers, and flags unknown surfaces for review.
  2. ADR Observability: Understand what AI agents are doing and why. In production, ADR captures agent intent, tool use, and execution traces across 7+ AI coding tools on macOS, Linux, and Windows, as well as internal automation and customer-facing support agents.
  3. ADR Benchmark: Test agent security under realistic enterprise conditions. ADR-Bench includes 300+ tasks, 134 MCP servers, and coverage of all 17 agent attack techniques.
  4. ADR Detection: Detect risky agent behavior efficiently. Its two-tier architecture combines high-recall triage with deeper agentic reasoning for suspicious sessions.
  5. ADR Prevention: Stop unsafe actions before they cause harm. This component is not included in the current open-source release. Stay tuned.

Repository layout

This repository contains the open-source ADR Discovery, ADR Sensor, ADR-Bench, and ADR Detector described in the paper. The offline ADR Explorer engine, which hardens ADR Detection through pre-deployment red teaming, is not included here.

Path ADR component Description
Discovery/ ADR Discovery Inventory the AI apps, CLI agents, IDE extensions, model runtimes, and MCP servers on an endpoint, and flag unknown surfaces for review
Sensor/ ADR Observability Collect and normalize agent telemetry from Claude Code, Cursor, Codex, GitHub Copilot CLI, DeepSeek Harness, opencode, Claude Desktop, and others
Detection/ ADR Benchmark + Detection Dual-agent detector, 134 MCP servers, 304 benchmark tasks, baselines, figure scripts
docs/REPRODUCIBILITY.md Evaluation Step-by-step workflow to reproduce benchmark detection and paper figures

Quick start: ADR Detection

git clone https://github.com/uber/ADR
cd ADR/Detection
uv sync
export ANTHROPIC_API_KEY="..." OPENAI_API_KEY="..."

Default detector is adr (ADR dual-agent). For keyless smoke tests, use --detector llamafirewall (see Detection/README.md).

See docs/REPRODUCIBILITY.md for the full evaluation workflow (inflate packed benchmark → run detectors → plot figures).

Component documentation:

ADR Sensor also captures Gemini CLI session journals on macOS, Linux, and Windows, including tool results and nested s