ADR: Agentic AI Detection and Response — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow changes to MCP-server benchmark coverage and telemetry-based detection so tracking accurately reflects released capabilities, without attributing the unreleased prevention component.

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Enterprise AI-agent security research, telemetry and detector evaluation.

What we know

Uber's open-source research system for discovering AI tools, collecting agent telemetry and evaluating risky behavior.

Maintenance / activity evidence

Observed Oct 5, 2026 (UTC)chore(deps): bump urllib3 from 2.5.0 to 2.8.0 in /Detection ( 158)

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Endpoint inspection and telemetry collection at component level. Writes: Writes evaluation/report artifacts.
Model-provider auth
Sensitive access: Enterprise agent telemetry, Endpoint inventory

Agent telemetry and security-analysis data are sensitive; keep deployments controlled and treat detector outputs as research signals.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

1,848 repository stars

Stars observed Oct 6, 2026.

All limitations / Review context

Which MCP attack scenarios and endpoint inventory integrations are reproducible in the released detector, and has prevention actually been published?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Agent telemetry and security-analysis data are sensitive; keep deployments controlled and treat detector outputs as research signals.
Endpoint inspection and telemetry collection at component level.
Model-provider auth
Agent intent/tool traces and endpoint inventory may be collected.
Reviewed write actions: Writes evaluation/report artifacts
Sensitive access: Enterprise agent telemetry, Endpoint inventory
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
The prevention component is not included in the current open-source release; endpoint telemetry requires a separate privacy and deployment review before use.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Open-source release does not include prevention.
Detection docs warn about isolated/non-production use.
Model-backed detector workflows may require paid API keys.

Original activity observations

2026-10-05T08:28:40Z: chore(deps): bump urllib3 from 2.5.0 to 2.8.0 in /Detection ( 158)

Technical identity

github.com/uber/adr

Exact implementation source: https://github.com/uber/adr ↗
Reviewed resource type: Testing / Debugging
Repository identity: uber/ADR

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
uber/adr
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Testing / Debugging setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Uber ADR is a research/detection repository; not an installable MCP server. Only show upstream research/prototype setup, not a client MCP registration.
publisher setup entry · Publisher instructions
git clone https://github.com/uber/ADR cd ADR/Detection uv sync
Configure / authenticate
MCP100 setup guide
Research/detection repository. Use source setup for the Detection subproject only; no standalone MCP endpoint or install command exists.
Check connection
Suggested check
Run the documented local detector example against non-sensitive test material; no MCP connection should be expected.
Remove / uninstall / revoke
Suggested check
Uber ADR is an enterprise AI security/detection system, not a standalone MCP server. Stop its collector/detector in the deployment environment and remove the research checkout/venv only after preserving needed evaluation artifacts. No `claude mcp remove ADR` registration is implied.
Client unregistration, program uninstall, persistent-data deletion, and credential revocation must be treated separately.

Official Documentation & Sources

What it does

Uber's open-source research system for discovering AI tools, collecting agent telemetry and evaluating risky behavior.

Capability: Security & Testing
Resource type: Testing / Debugging
Industry: Cybersecurity
Best fit: Enterprise AI-agent security research, telemetry and detector evaluation.

Representative uses

Inventory AI applications/agents/MCP servers
Capture agent tool-use telemetry
Run security benchmarks
Evaluate suspicious sessions

Limitations

Open-source release does not include prevention.
Detection docs warn about isolated/non-production use.
Model-backed detector workflows may require paid API keys.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Model-provider auth
Permissions: Endpoint inspection and telemetry collection at component level.
Data handling: Agent intent/tool traces and endpoint inventory may be collected.
Cost: usage_based
Risk and cautions: Agent telemetry and security-analysis data are sensitive; keep deployments controlled and treat detector outputs as research signals.

Access scope and cautions

Write actions: Writes evaluation/report artifacts
Sensitive access: Enterprise agent telemetry Endpoint inventory
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Inventory AI applications/agents/MCP servers; Capture agent tool-use telemetry; Run security benchmarks; Evaluate suspicious sessions.

What authentication is documented?

Model-provider API keys for detector workflows.

Can it modify data or perform write operations?

Documented write actions include: Writes evaluation/report artifacts. Recorded permission boundary: Endpoint inspection and telemetry collection at component level.

What data-handling boundary should I consider?

Agent intent/tool traces and endpoint inventory may be collected. Recorded sensitive-access context: Enterprise agent telemetry; Endpoint inventory.

What limitations and risks should I check before use?

Agent telemetry and security-analysis data are sensitive; keep deployments controlled and treat detector outputs as research signals. Open-source release does not include prevention. Detection docs warn about isolated/non-production use. Model-backed detector workflows may require paid API keys. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices. The prevention component is not included in the current open-source release; endpoint telemetry requires a separate privacy and deployment review before use.

What cost model is recorded?

The reviewed cost model is usage based. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.

Is this an official MCP?

Uber is listed as First-party MCP in MCP100’s current evidence.