Adrian
Open-source runtime security engine for AI agents: it watches actions and reasoning in real time and intercepts malicious tool use, prompt injection and policy drift before the agent acts.
Per-dimension scores and reasoning
Evidence shows a policy-driven verdict mapping (per-MAD-code policy flags in unit tests), a HITL approval mode, and configurable timeout handling - good. Deductions: the Claude Code hook defaults to fail-open on verdict timeout/error (FAIL_OPEN true by default), which weakens a security control; the backend and SDK source are absent from the evidence, so least-privilege implementation, sensitive-data flow (reasoning traces and transcripts sent to a managed cloud), and rollback can only be assessed from README claims.
CI for SDK lint and release is complete (tag/version match check, twine check, OIDC trusted publishing), LangChain compatibility is pinned with a verification date, and timeout/error/unknown-verdict branches have tests. Deduction: static review only - actual failure-message quality is unverified, and several tests skip without a backend.
README states target scenarios, self-hosting hardware limits (NVIDIA GPU; CPU slow), supported frameworks and roadmap; trigger precision is supported by granular policy unit tests. Deduction: capability boundaries rest on documentation claims; cross-platform environment fit is not addressed.
Full Apache-2.0 text and SPDX headers present; layered install instructions (managed, self-hosted, plugin) with version verification dates; SECURITY.md with response targets and scope. Deduction: no CHANGELOG in evidence, and SDK source and CONTRIBUTING body are referenced but not provided for verification.
Two-line SDK integration and zero-code Claude Code plugin lower adoption cost; dual behaviour+reasoning analysis is a differentiated runtime control. Deduction: detection effectiveness rests entirely on a cited third-party paper, with no in-repo benchmarks.
Verdict-action mapping is traceable to unit tests; facts and inferences are mostly separated (verification dates, external citations). Deduction: headline claims (+35%, 4x) come from an external paper, not this repo's experiments; managed-cloud and backend implementations cannot be cross-verified from the provided files.
- The Claude Code plugin defaults to fail-open on verdict timeout/error; for a security control, evaluate enabling fail_closed_on_classifier_error and verify it.
- In managed mode, agent behaviour and reasoning traces are uploaded to the cloud; prefer the self-hosted offline deployment for sensitive environments and audit the actual data flow.
- Headline detection-effectiveness claims derive from third-party research; no in-repo benchmark of this product is provided, so actual detection rates should not be inferred.
- This is a static review: the Go backend, the SDK body, and self-hosting container configs were not in the evidence, so their actual security is unverified.
What does this agent do, and when should you use it?
Adrian is an open-source, AARM-aligned runtime security monitoring and control engine for AI agents by Secure Agentics. Unlike monitoring that stops at activity logs (APIs, MCP, tool calls), it also analyses the agent's reasoning traces, which OpenAI and DeepMind research cites as delivering +35% detection accuracy and 4x more nuanced attacks caught. It detects prompt injection and jailbreaks (direct and indirect), tool poisoning and off-policy tool calls, data exfiltration and credential leakage, plus privilege escalation and out-of-remit actions. The stack comprises a Go backend (WebSocket + dashboard API + AI engine), a Next.js dashboard, Python and TypeScript SDKs, and a local Llama.cpp container serving a Gemma model as the classifier. Deployment is either via the managed dashboard at app.adrian.secureagentics.ai or a fully offline, data-sovereign self-hosted stack driven by Docker Compose. SDKs integrate with two lines of code (adrian.init()/shutdown()) for LangChain/LangGraph, Anthropic and OpenAI Agents SDK, and a Claude Code plugin secures every tool call with no code changes.
At runtime, the Adrian SDK intercepts your agent's event stream: it auto-instruments LangChain/LangGraph and streams activity logs (tool calls, actions, outputs) plus reasoning traces to the Adrian backend. A classifier model (Llama.cpp serving a local Gemma model when self-hosted, or the managed service in the cloud) judges each action against the agent's configured remit and full session context, producing verdicts of alert, human review or block; the control plane steps in before the action lands. Operators generate API keys in the dashboard or via Settings → Agents, and configure audit vs block mode, alerting channels and accepted behaviours. Integration is two lines of code: adrian.init(api_key=...) and adrian.shutdown(). The Claude Code plugin installs via /plugin marketplace add secureagentics/Adrian and /adrian-init, classifying every tool call in real time.
- Engineering teams running autonomous agents over sensitive data (e.g. investment research) who want data exfiltration and credential leakage blocked before actions execute.
- Teams building multi-step LangChain/LangGraph agents in production who need alerting or real-time blocking when prompt injection or jailbreaks occur.
- Developers using Claude Code in the terminal who want every tool call classified, with risky actions blocked or held for approval inline.
- Organisations with data-sovereignty or offline compliance needs that must run agent security monitoring on their own infrastructure with no telemetry leaving the box.
- Security teams tracking whether agents drift out of remit (e.g. an e-commerce agent resetting user passwords) rather than relying solely on dataset-trained classifiers.
What are this agent's strengths and limitations?
- Analyses behaviour and reasoning together; OpenAI/DeepMind research cited in the README reports +35% detection accuracy and 4x more nuanced attacks versus behaviour-only monitoring, a concrete differentiator.
- Supports fully offline, data-sovereign self-hosting including a local Gemma classifier, with no telemetry leaving the box.
- Intervenes before actions execute (alert / human review / block), not after the fact.
- Judges actions against a working model of the agent's remit across the session, catching out-of-remit behaviour no training set would flag.
- Self-hosting requires an NVIDIA GPU and a heavyweight local model (Gemma 4 E4B ~5GB); CPU-only is possible but officially acknowledged as slow on real workloads.
- Production support is tied to LangChain/LangGraph (>=1.0,<2.0), the OpenAI Agents SDK or Anthropic SDK; CrewAI and OpenClaw are roadmap-only.
- Alerting is currently limited to Discord and Slack; WhatsApp, Teams and PagerDuty are not yet available.
- Contributors must sign a CLA and follow style rules (British English, no em-dashes), adding friction for external contributions.
How do you install or deploy this agent?
Managed: 1) sign up at app.adrian.secureagentics.ai and generate an API key; 2) pip install adrian-sdk; 3) pip install langchain langchain-openai (or langchain-anthropic, etc.). Self-hosted: 1) git clone https://github.com/secureagentics/Adrian && cd Adrian; 2) docker compose --profile setup run --rm setup bootstrap (interactively downloads the Gemma 4 E4B ~5GB or E2B ~3GB classifier, or pass --gguf my-model.gguf); 3) docker compose --profile llm up -d; 4) browse http://localhost:3000 and sign in with admin@localhost and the bootstrap-printed password. Prerequisites: Docker + Docker Compose v2, an NVIDIA GPU with CUDA driver, NVIDIA Container Toolkit, ~10 GB disk. Claude Code plugin: /plugin marketplace add secureagentics/Adrian then /adrian-init.
How do you use this agent?
Minimal managed-mode usage: import adrian; adrian.init(api_key="adr_live_..."), then invoke your LangChain/LangGraph agent normally (the SDK auto-instruments it), and call adrian.shutdown() at the end. Events appear in the dashboard within seconds, classified by severity. Self-hosted, the SDK defaults to ws://localhost:8080/ws so only the API key is needed. Create an SDK key in Settings → Agents → New key, and configure the agent's remit, audit vs block mode and alerting channels. A full runnable example is at examples/python/quickstart.py in the repository.
How does this agent compare with similar options?
The README explicitly contrasts Adrian with activity-log-only monitoring and with classifiers trained only on prompt-injection datasets, which it says catch only previously seen patterns; Adrian instead judges behaviour against the agent's remit and session context. No named commercial competitors are listed.