AI Defense Stack

Agent & MCP security

Uber ADR: open-source agent detection and response toolkit

Uber ADR is an open-source agent detection and response toolkit from Uber. It is released under the Apache-2.0 license and is offered as: CLI, Library, Self-hosted.

  • Last reviewed
Visit Uber ADR (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 8: Monitoring and response

Best for

Security teams that want an open-source way to inventory coding agents and MCP servers on endpoints and collect agent telemetry for their own detection pipeline

Consider instead if

  • You need runtime enforcement that blocks risky agent actions, which the open-source release does not include. See Zenity or Straiker.
  • You mainly want to vet MCP servers before connecting an agent to them. See Cisco MCP Scanner.

What Uber ADR does

Uber ADR (Agentic AI Detection and Response) is an open-source security system for AI agents, published by Uber, which says it runs in production there. The Apache-2.0 repository has three parts. Discovery inventories AI apps, agents and MCP servers on a machine. Sensor is a Python package that turns the local logs of 11 listed coding agents into one event format and can export it over OpenTelemetry. Detection holds a two-tier detector and ADR-Bench, a benchmark of 304 tasks and 134 MCP servers. The README says the prevention component, which stops unsafe actions, is not in the open-source release. It is a monitoring and detection toolkit, not an inline blocker.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Uber Source, checked October 21, 2026: github.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
2,072 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 19, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
July 31, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
CLI, Library, Self-hosted Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Documentation
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Uber ADR fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Uber ADR covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L8 Monitoring Monitoring and response Primary Log, detect and respond to AI incidents with the evidence every layer produces. Its description names detection and response as its main job
L2 Discovery Discovery and posture Also covers Documents discovery of AI apps, agents and MCP servers on endpoints, flagging unknown surfaces for review. Discovery inventories AI apps, CLI agents, IDE extensions, local model runtimes and MCP servers on endpoints and flags unknown surfaces for review

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Uber ADR, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection The detector is evaluated on prompt injection scenarios, including the public AgentDojo benchmark, in recorded agent sessions. Sensor collects user and assistant text, tool calls with arguments and results, and session context from 11 listed coding agents; Two-tier detector: high-recall triage, then deeper agentic reasoning on suspicious sessions
LLM06 Excessive Agency Inventories agents and records their tool calls and permissions so over-broad or unsafe actions can be reviewed after the fact. Discovery inventories AI apps, CLI agents, IDE extensions, local model runtimes and MCP servers on endpoints and flags unknown surfaces for review; Sensor collects user and assistant text, tool calls with arguments and results, and session context from 11 listed coding agents; Two-tier detector: high-recall triage, then deeper agentic reasoning on suspicious sessions

Not mapped in our analysis: LLM02, LLM05, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Uber ADR FAQ

Does Uber ADR block unsafe agent actions?

Not in the open-source release. The README lists Prevention as a component and says it is not included in the current open-source release. The code here covers discovery, observation and detection.

Which agents does the Sensor read?

The Sensor README lists 11 agents, including Claude Code, Cursor, Cline, Codex CLI, GitHub Copilot CLI and Gemini CLI. Most run on macOS, Linux and Windows, and a few are limited to two of the three.

What does the OpenTelemetry export send?

The Sensor README says export is off by default and that the exporter applies no redaction, so prompts, responses, tool arguments and results can be transmitted. Route it through a collector you control.

Key facts you can cite

We have no commercial relationship with Uber.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.