Adrian is an open-source, self-hostable runtime security engine that watches both LangChain agent behavior and reasoning traces to detect prompt injection, tool misuse, and out-of-remit actions before they execute.
| Tool | secureagentics/Adrian — AARM-aligned runtime security monitoring and control engine for AI agents, with Python and TypeScript SDKs |
| Category | AI agent runtime security / behavioral observability |
| Primary Use | Instrumenting LangChain/LangGraph, OpenAI Agents, and Claude Code agents to detect and optionally block prompt injection, unsafe tool calls, data exfiltration, and out-of-remit behavior in authorized deployments |
| Safe Use | Defensive monitoring of agents you own or are authorized to assess; deployable in labs, enterprise AI deployments, and security research environments |
| Telemetry Note | Emits classified events (tool calls, actions, outputs, reasoning traces) to a dashboard over WebSocket; self-hosted deployments keep all telemetry local with no data leaving the host |
Adrian, published by secureagentics, positions itself as a runtime security layer for AI agents rather than another static scanner or network monitor. The core argument in the README is that agent attacks slip past perimeter tooling because the dangerous signal lives in what the agent decides to do and why — its tool calls, its reasoning, and the mismatch between the two. Adrian instruments the agent at runtime, analyzes both activity logs and reasoning traces, and can intervene before an action lands. With roughly 588 stars, an Apache-2.0 license, and a Python-first codebase, it is one of the more serious open-source entries in the emerging agentic security space.
The distinguishing design decision is reasoning analysis. Most agent monitoring stacks stop at activity logs — APIs, MCP interactions, database calls, tool invocations. Adrian additionally analyzes the agent's reasoning: why it took an action, under what context, and what it plans next. The README grounds this in research from OpenAI and DeepMind claiming a 35% detection accuracy improvement and 4x better coverage of nuanced attacks when behavior and reasoning are combined. For defenders, that is the difference between flagging an anomalous API call and understanding that the agent was steered there by an injected instruction.
The detection model is described as remit-based rather than purely classifier-driven. Prompt-injection classifiers trained on datasets only catch patterns they have seen before; Adrian instead holds a working model of what your specific agent is supposed to do and judges each action against it, correlated across the whole session. The README's canonical example is an e-commerce agent that suddenly starts resetting user passwords — behavior no injection training set would flag, but a clear out-of-remit violation. This matters because it shifts detection from signature matching to policy deviation, which generalizes to novel attacks.
The published threat coverage is concrete: direct and indirect prompt injection and jailbreaks, tool poisoning and unsafe or off-policy tool calls, data exfiltration and secret or credential leakage, and privilege escalation or out-of-remit actions. Each of these maps cleanly onto the failure modes security teams worry about when giving agents tool access, MCP servers, and credentials. The topic list (prompt-injection, mcp-security, runtime-security, threat-detection, ai-governance) confirms the intended scope is agent governance as much as detection.
Integration is where Adrian gets practical. The SDK auto-instruments LangChain and LangGraph — including both create_agent and create_react_agent — with supported version ranges of langchain/langgraph >=1.0,<2.0 and langchain-core >=1.2.19,<2.0. There are SDKs for Python (LangChain, Anthropic) and TypeScript, plus a native Claude Code plugin. The plugin is notable: install with /plugin marketplace add secureagentics/Adrian followed by /adrian-init, and every tool call from the terminal is classified in real time, with risky actions blocked or held for human approval — no code changes required.
The instrumented workflow is minimal by design. Two lines bracket your existing agent code: adrian.init(api_key=...) before the agent runs and adrian.shutdown() after. The SDK defaults to ws://localhost:8080/ws for self-hosted setups, and events appear in the dashboard within seconds, classified by severity. Configuration includes the agent's remit, audit versus block mode, alerting channels, and accepted-behavior versus known-risk lists — the knobs a security engineer expects from a control plane rather than a passive logger.
The self-hosting story is unusually complete. The repository ships everything needed to run the full stack on a single host: a Go backend (WebSocket plus dashboard API plus AI engine), a Next.js dashboard, the Python SDK, and a llama.cpp container serving a local Gemma model for classification. The bootstrap process creates data/adrian.db, applies migrations, generates a random admin password, writes .env, and offers to download the on-device classifier (Gemma 4 E4B at roughly 5 GB, or E2B at roughly 3 GB) into ./models/; an existing GGUF can be passed with --gguf. The explicit claim — no managed cloud, no telemetry leaving the box — makes this viable for data-sovereign enterprise deployments.
Hardware requirements are honest about cost: an NVIDIA GPU with recent CUDA drivers and the NVIDIA Container Toolkit is expected, with about 10 GB of disk for the model; CPU-only operation is described as technically possible but slow on real workloads. The stack comes up with docker compose --profile llm up -d and the dashboard listens on http://localhost:3000. SDK keys are minted from Settings → Agents → New key, and the bundled make sdk-install target sets up a uv-managed .venv from the in-tree sdk/ directory.
Architecturally, the README's flow diagram tells the whole story: agent runtime to Adrian SDK to backend to classifier model to a verdict node feeding a control plane, which can respond with alert, human review, or block back to the agent. That verdict-to-control path is what separates Adrian from observability products — it is a policy enforcement point embedded in the agent loop, not a post-hoc log analyzer. The audit versus block mode distinction lets teams phase adoption: observe first, enforce once tuning is trusted.
Framework coverage currently spans LangChain, LangGraph, the OpenAI Agents SDK, Claude Code, and the Anthropic SDK, with CrewAI on the roadmap. The AARM alignment (aarm.dev) signals the project is betting on standardized agent runtime observability semantics, which is worth tracking if you are evaluating long-term interoperability. A managed dashboard at app.adrian.secureagentics.ai exists for teams that prefer not to self-host, but the fully offline path means the open-source core is genuinely usable without it.
For authorized security teams, Adrian fills a real gap: it is a defensive control you wrap around your own agents in development, staging, or production, giving you session-correlated detection of injection, leakage, and privilege drift with an enforcement hook. Even in pure audit mode it functions as a high-fidelity observability layer for agent behavior, producing severity-classified event streams that feed incident response. The fact that it runs entirely on-host with a local model makes it practical for organizations whose agents touch sensitive data they cannot ship to a third-party SaaS.
Caveats worth noting before adoption: classification quality depends on the local Gemma model sizing and on how accurately you define each agent's remit, and block mode in front of production agents introduces a new failure surface that deserves its own testing. But as an Apache-licensed, self-hostable runtime control plane for agentic systems, Adrian is a tool anyone deploying LangChain or Claude Code agents with real tool access should be evaluating — the reasoning-plus-behavior analysis approach is a meaningful step beyond log-only monitoring.
secureagentics/Adrian.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.