ADR observes agent activity, but it does not block actions
ADR covers four open components. Discovery inventories agent applications, command-line tools, IDE extensions, local model runtimes, and MCP servers. Sensor parses local records from coding agents into one event schema. ADR-Bench supplies synthetic attack scenarios and emulated servers. Detection uses a fast triage stage followed by deeper reasoning for suspicious sessions. The repository README says Uber runs ADR in production, while the public code is also tied to an MLSys 2026 paper.
The missing piece is decisive for buyers: ADR Prevention is not in the open release. The offline Explorer used to harden detection before deployment is excluded too. Open ADR can tell a security program what agents exist, convert activity into records, and evaluate or analyze threats. It does not provide an open enforcement point that stops a tool call before the side effect. Pairing detection with endpoint, identity, network, or tool authorization controls remains the operator's job.
The Sensor reads 7 agent formats into one detailed record
ADR Sensor documents support for Claude Code, Cursor, Cline, Claude Desktop, Codex CLI, Warp, and opencode. It reads JSONL, SQLite, JSON task files, and platform-specific audit records, then emits JSON or JSONL. The normalized event can include chat history, tools, arguments, results, model, username, hostname, and project path. Claude Desktop records can also expose skills, plugins, MCP servers, permission mode, and dispatch status.
That detail makes detection possible and privacy work unavoidable. A developer conversation may contain source code, customer data, secrets, local paths, or failed tool output. The CLI defaults to recent history and offers an all-history option, but retention duration is only one control. Teams need endpoint notice, collection scope, access policy, encryption, deletion, incident use, and rules for exporting events to a SIEM or detector. Installing a parser does not settle employee monitoring obligations.
What happened when we ran it
Our sandbox worked inside Detection/, where the measured Python project lives. Installing 300 packages took 130 seconds and used 6,219 MB. The build succeeded in 8 seconds. Pytest ran for 30 seconds, reporting 61 passed and 0 failed, then exited with code 1 because collection raised an error for an asyncio marker missing from the configured marker list.
The log also recorded 25 warnings, including Pydantic class-config deprecations and a syntax warning in a LangChain community module. Pip-audit reported 100 known vulnerabilities. The Detection README explains that several dependencies are pinned to reproduce the paper and knowingly contain CVEs acceptable only in its isolated threat model. Our audit number reinforces that boundary; it does not identify the severity or exploitability of each finding from the supplied measurement block.
Detection needs model access or a narrower keyless path
The default dual-agent detector uses GPT-4o for triage and Claude Sonnet through Claude Code for reasoning. Its setup asks for OpenAI and Anthropic API keys, an installed Claude Code CLI, and an authenticated Claude session. A Hugging Face token is optional. The documentation offers LlamaFirewall for keyless smoke tests, which is useful for checking the pipeline without sending sessions to the default hosted model pair.
Full benchmark execution is larger than a unit-test run. The repository lists 303 tasks and 133 MCP servers, with synthetic credentials, prompt injection, vulnerable tools, and emulated enterprise systems. Its README orders users to run in a container, VM, or dedicated host, away from production data and networks. The reproduction guide also warns that API rate limits can distort the detector's triage behavior by escalating more work to the reasoning stage.
Open code does not reproduce every paper claim
The repository includes synthetic fixtures and step-by-step instructions for rebuilding benchmark results and paper figures. It does not include Uber's enterprise telemetry or production deployment results. Detection also says the ALRPHFS and GuardAgent baseline implementations were removed because of licensing, leaving their paper numbers in the documentation rather than runnable code. Readers should separate reproducible repository paths from results that require unavailable data or implementations.
Open issue 42 identifies a concrete detector gap: triage lacks a deterministic check for invisible Unicode tag characters and bidirectional overrides, even though a bidi payload appears in the benchmark. The report proposes a prefilter; the issue was still open when fetched. That is the right level of caution for a detection system. A paper result measures a threat set and configuration, not permanent coverage of every obfuscation technique.
August activity is current, while the public release is young
GitHub recorded 1,501 stars, 22 combined issues and pull requests, and a push on August 25, 2026. The latest tagged release was Sensor v1.0.0 on July 31. The Apache-2.0 repository also vendors AgentDojo benchmark code under MIT. Recent activity and a clear data notice are positive signals, though one sensor release is too little history to treat every source parser as settled.
ADR is most useful as a candid kit for an enterprise agent-security program. The Sensor handles a messy collection problem, and the benchmark gives detection engineers hostile sessions to study without touching live agents. The 6,219 MB environment, 100 audit findings, excluded prevention layer, hosted-model requirements, and sensitive event schema all demand experienced operators. Start in an isolated lab, decide what telemetry you are allowed to retain, and keep prevention in a separate control until an enforcement component is available.