adrian-cc

Agent attacks slip past static analysis and network monitoring.

Adrian catches them at runtime, by watching what the agent actually does (its actions and its reasoning) and stepping in before it acts. Open source, free forever.

+35% detection accuracy · 4x more nuanced attacks caught vs behaviour-only monitoring (OpenAI & DeepMind research)

⭐ If you think agents need a runtime security layer, star the repo. It is how new people find Adrian, and how we know to keep building it in the open.

---

Adrian is an open-source, AARM-aligned runtime security monitoring and control engine for AI agents. It analyses both agent activity logs (tool calls, actions, outputs) and reasoning traces to detect malicious, misaligned, or out-of-remit behaviour, and optionally intervene in-flight. SDKs are available for Python (LangChain) and TypeScript (sdk/typescript/README.md), plus a native Claude Code plugin that secures every tool call from your terminal.

🆕 Claude Code plugin - now live. Drop Adrian into Claude Code and every tool call is classified in real time, with risky actions blocked or held for your approval right in the terminal. No code changes: install with /plugin marketplace add secureagentics/Adrian then /adrian-init. Full guide: integrations/claude-code/README.md.

Documentation  •  Dashboard  •  Discord  •  LinkedIn

▶️ See it in action: Adrian catches an agent going out-of-remit in real time and steps in before the action lands.

https://github.com/user-attachments/assets/ba50e6e4-fe3e-47b2-aa69-2902e1ef2924

^{New to Adrian? Check out the Launch Video.}

Why Adrian is different

Most agent monitoring stops at activity logs: APIs, MCP, DB interactions, tool calls, etc. Adrian enhances this by also analysing the agent's reasoning: understanding why it took an action, under what context, and what it is planning on doing next. Combining behaviour and reasoning analysis like this is exactly what the OpenAI and DeepMind research found catches far more, and Adrian is the first tool to put it into a deployable security control, free forever.

What it catches:

• Prompt injection and jailbreaks, direct and indirect
• Tool poisoning and unsafe or off-policy tool calls
• Data exfiltration and secret / credential leakage
• Privilege escalation and out-of-remit actions

Classifiers trained on prompt-injection datasets only catch what they have seen before. Adrian works differently: it holds a working understanding of what your agent is meant to do and judges each new action against that, correlated across the whole session. So when your e-commerce agent starts resetting user passwords, something no training set would flag, Adrian catches it.

Quickstart