Adrian is a runtime security monitoring and control engine for AI agents, aligned to the AARM specification. It reads both the agent's activity — tool calls, actions, outputs — and its reasoning traces, classifies each step, and can intervene in flight: alert, hold for human review, or block the action before it lands. The stated targets are prompt injection and jailbreaks (direct and indirect), tool poisoning and off-policy tool calls, data exfiltration and credential leakage, and privilege escalation or out-of-remit actions.
The distinguishing mechanism is that Adrian holds a working model of what a given agent is supposed to do and judges each new action against that remit, correlated across the whole session, rather than matching against a classifier trained on known prompt-injection examples. The project cites OpenAI and DeepMind research (arXiv 2503.11926) for the combination of behaviour and reasoning analysis, reporting +35% detection accuracy and 4x more nuanced attacks caught versus behaviour-only monitoring.
Instrumentation is through SDKs: Python for LangChain (which auto-instruments both LangChain and LangGraph, covering createagent and createreact_agent) and Anthropic, plus TypeScript. Two calls, adrian.init and adrian.shutdown, bracket existing agent code. A Claude Code plugin adds terminal coverage with no code changes, classifying each tool call in real time and blocking or holding risky ones. Supported frameworks are LangChain, the OpenAI Agents SDK, Claude Code, and the Anthropic SDK, with CrewAI and OpenClaw listed as roadmap items.
You can run against a managed dashboard with an API key, or self-host the whole stack offline. The self-hosted deployment is a Docker Compose bring-up of a Go backend (WebSocket, dashboard API, and analysis engine), a Next.js dashboard, the Python SDK, and a llama.cpp container serving a local Gemma model as the classifier; a bootstrap step creates the database, applies migrations, generates an admin password, and offers to download Gemma 4 E4B (about 5 GB) or E2B (about 3 GB). It is tested on NVIDIA GPUs with the CUDA container toolkit, and CPU-only operation is described as slow at those model sizes.
Configuration covers the agent's remit, audit versus block mode, alerting channels, and which behaviours are accepted or treated as known risks. Alerting ships for Discord and Slack, with WhatsApp, Microsoft Teams, and PagerDuty on the roadmap.
Features
- Reasoning plus behaviour analysis: classifies the agent's chain of thought alongside its tool calls, actions, and outputs
- In-flight intervention: audit or block mode, with alert, human-review, and block verdicts routed back to the agent runtime
- Remit-based judgement: each action is judged against a working understanding of the agent's purpose and correlated across the session
- Threat coverage: prompt injection and jailbreaks, tool poisoning, unsafe tool calls, data and credential exfiltration, and privilege escalation
- SDKs: Python for LangChain and Anthropic, plus TypeScript, wrapping existing agent code in two calls
- Claude Code plugin: installs from a plugin marketplace and classifies every terminal tool call without code changes
- Self-hosting: an offline Docker Compose stack with a Go backend, Next.js dashboard, and a bundled llama.cpp classifier running Gemma 4 E2B or E4B locally
- Managed dashboard: a hosted option where events appear classified by severity within seconds of a run
- Alerting: Discord and Slack channels, with Teams, WhatsApp, and PagerDuty on the roadmap
- Policy configuration: per-agent remit, accepted behaviours, and known risks set from the dashboard
