ADR MCP server
Commit Oct 31, 2026Secures enterprise AI agents through observability, security benchmarking, and threat detection of agentic behavior.
Also known as uber/ADR
- Stars
- 2,130
- Tools
- —
- Downloads, 30 days
- —
- Latest version
- —
- Last commit
- Oct 31, 2026
- License
- Apache-2.0
What is ADR MCP?
ADR secures enterprise AI agents through observability, security benchmarking, and threat detection of agentic behavior.
Summary generated from the project's README
About ADR MCP server
Securing enterprise AI agents through observability and threat detection is the primary function of ADR. This system helps organizations protect employee-facing tools like Cursor, Claude Code, and GitHub Copilot CLI, as well as customer-facing support agents. It works by discovering unsanctioned AI tools on endpoints, observing agent intent and execution traces, and evaluating defenses through specialized benchmarking.
Developers can use the open-source components including ADR Discovery, ADR Sensor, ADR-Bench, and ADR Detector. The system supports macOS, Linux, and Windows environments. To run the detection component, users need to set up an environment with ANTHROPIC_API_KEY or OPENAI_API_KEY. The ADR-Bench feature provides a testing ground with over 300 tasks and 134 MCP servers to cover 17 different agent attack techniques.
While the current release includes discovery, observability, benchmarking, and detection, the prevention component for stopping unsafe actions is not yet included in the open-source version. The detection architecture utilizes a two-tier approach that combines high-recall triage with deep agentic reasoning to identify suspicious sessions.
What you can do with it
- 1Inventory AI tools on endpointsIdentify all installed AI applications, CLI agents, and MCP servers across employee devices.
- 2Monitor agent telemetry and intentCapture and normalize execution traces and tool use from various coding assistants.
- 3Benchmark agent security defensesTest how well an agent handles realistic enterprise attack techniques using a large set of tasks.
- 4Detect suspicious agent behaviorUse a dual-agent detector to triage and reason through potentially risky AI sessions.
Written from the project's README. Every use case is checked against a quote from it.
Configuration
ANTHROPIC_API_KEY
| Name | Description | |
|---|---|---|
| ANTHROPIC_API_KEY | — |
Automated checks
Ran Nov 13, 2026Full report →Not verified yet. A server needs a score of 80, no serious finding, and enough data for us to check. How checks work
- Source repository linked and reachablePass
- Open source license (OSI)Pass
- Commit or release in the last yearPass
- Package name not close to a popular packageNot checked
- Remote endpoint uses HTTPSNot checked
- Destructive tools are labelledNot checked
- No hidden instructions to the modelPass
- No critical advisory in the package or its dependenciesNot checked
README
View on GitHubADR: Agentic AI Detection and Response
ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents. It helps organizations secure employee-facing agents such as Cursor, Claude Code, Codex, GitHub Copilot CLI, and DeepSeek Harness, as well as customer-facing agents such as AI support agents.
ADR is deployed in production at Uber, and the accompanying paper was accepted to MLSys 2026: Paper PDF · Slides PDF
How ADR secures enterprise AI agents
ADR secures enterprise AI agents through five complementary capabilities: discovering unsanctioned AI tools, observing agent activity, evaluating defenses, detecting threats, and preventing unsafe actions.
- ADR Discovery: Find the AI tools present on employee endpoints. Inventories installed AI applications, CLI agents, IDE extensions, local model runtimes, and MCP servers, and flags unknown surfaces for review.
- ADR Observability: Understand what AI agents are doing and why. In production, ADR captures agent intent, tool use, and execution traces across 7+ AI coding tools on macOS, Linux, and Windows, as well as internal automation and customer-facing support agents.
- ADR Benchmark: Test agent security under realistic enterprise conditions. ADR-Bench includes 300+ tasks, 134 MCP servers, and coverage of all 17 agent attack techniques.
- ADR Detection: Detect risky agent behavior efficiently. Its two-tier architecture combines high-recall triage with deeper agentic reasoning for suspicious sessions.
- ADR Prevention: Stop unsafe actions before they cause harm. This component is not included in the current open-source release. Stay tuned.
Repository layout
This repository contains the open-source ADR Discovery, ADR Sensor, ADR-Bench, and ADR Detector described in the paper. The offline ADR Explorer engine, which hardens ADR Detection through pre-deployment red teaming, is not included here.
| Path | ADR component | Description |
|---|---|---|
| Discovery/ | ADR Discovery | Inventory the AI apps, CLI agents, IDE extensions, model runtimes, and MCP servers on an endpoint, and flag unknown surfaces for review |
| Sensor/ | ADR Observability | Collect and normalize agent telemetry from Claude Code, Cursor, Codex, GitHub Copilot CLI, DeepSeek Harness, opencode, Claude Desktop, and others |
| Detection/ | ADR Benchmark + Detection | Dual-agent detector, 134 MCP servers, 304 benchmark tasks, baselines, figure scripts |
| docs/REPRODUCIBILITY.md | Evaluation | Step-by-step workflow to reproduce benchmark detection and paper figures |
Quick start: ADR Detection
git clone https://github.com/uber/ADR
cd ADR/Detection
uv sync
export ANTHROPIC_API_KEY="..." OPENAI_API_KEY="..."
Default detector is adr (ADR dual-agent). For keyless smoke tests, use --detector llamafirewall (see Detection/README.md).
See docs/REPRODUCIBILITY.md for the full evaluation workflow (inflate packed benchmark → run detectors → plot figures).
Component documentation:
ADR Sensor also captures Gemini CLI session journals on macOS, Linux, and Windows, including tool results and nested subagent sessions.
- Discovery/README.md: endpoint inventory, probes, and the fingerprint catalog
- Sensor/README.md: telemetry collection and unified schema
- Detection/README.md: ADR-Bench, detector baselines, MCP infrastructure
Citation
@inproceedings{li2026adr,
title={ADR: An Agentic Detection System for Enterprise Agentic AI Security},
author={Li, Chenning and Hu, Pan and Xu, Justin and Ozbas, Baris and Liu, Olivia and Van, Caroline and Li, Manxue and Zhou, Wei and Alizadeh, Mohammad and Zhang, Pengyu and Sriramadhesikan, KK and Zhang, Ming},
booktitle={Proceedings of the Ninth Conference on Machine Learning and Systems},
year={2026}
}
Or use CITATION.cff.
Star History
License
Apache License 2.0. See LICENSE. Detection/benchmark/agentdojo/ is vendored third-party code under its own LICENSE (MIT).
Data notice
Detection/ includes synthetic benchmark fixtures (fake credentials, emulated environments, prompt-injection scenarios) for defensive security research only. Details: docs/OPEN_SOURCE_REVIEW.md.
ADR MCP questions
What does ADR Discovery do?
It inventories installed AI applications, CLI agents, IDE extensions, local model runtimes, and MCP servers to flag unknown surfaces for review.
Does ADR include prevention capabilities in the open-source version?
No, the prevention component is not included in the current open-source release.
Which operating systems are supported by the ADR Sensor?
The sensor captures agent telemetry across macOS, Linux, and Windows.
What is included in the ADR-Bench?
ADR-Bench includes over 300 tasks, 134 MCP servers, and coverage for all 17 agent attack techniques.