Adrian is an open-source, Apache-2.0 runtime security tool for AI agents from Secure Agentics. Instead of static code scanning or watching only network and API traffic, it instruments a running agent's tool calls and, where exposed, its reasoning traces, and can intervene in-flight — alert, hold for human review, or block — before an action executes. The project describes itself as AARM-aligned, a runtime-security framework spec at aarm.dev, and frames its design around a specific finding it cites from an OpenAI/DeepMind paper (arXiv:2503.11926): combining behavior analysis with reasoning analysis catches more than behavior-only monitoring. The README's headline "+35% detection accuracy, 4x more nuanced attacks caught" figures are that paper's own reported findings, not an independently published benchmark of Adrian itself — worth separating the two.

What it looks for spans four categories: prompt injection and jailbreaks (direct and indirect), tool poisoning and unsafe or off-policy tool calls, data exfiltration and secret or credential leakage, and privilege escalation into out-of-remit actions. The pitch for the reasoning-trace component is that a classifier trained only on known injection patterns can't catch novel misuse — the example given is an e-commerce agent that starts resetting user passwords, a behavior no static training set would flag but that looks anomalous against a working definition of what the agent is supposed to be doing, correlated across the whole session.

Integration is split across a Python SDK (adrian-sdk on PyPI) with LangChain/LangGraph auto-instrumentation and a dedicated Anthropic-SDK integration, a TypeScript SDK, and a native Claude Code plugin — installed with /plugin marketplace add secureagentics/Adrian — that classifies every terminal tool call in real time and can hold risky actions for approval. Wrapping an existing LangChain/LangGraph agent is two calls, adrian.init() before and adrian.shutdown() after, around otherwise unmodified code.

Deployment offers two paths: a managed dashboard (app.adrian.secureagentics.ai) that needs only an API key, or a fully self-hosted stack brought up with Docker Compose — a Go backend handling the WebSocket connection, dashboard API and classification engine, a Next.js dashboard, and a bundled llama.cpp container serving a local Gemma 4 model (E2B at roughly 3GB or E4B at roughly 5GB) as the on-device classifier, so agent traces and their classification never have to leave the host. The README is explicit that the self-hosted path is tested on an NVIDIA GPU with the NVIDIA Container Toolkit, and that CPU-only inference is "technically possible but will be slow" at that model size.

On traction: the repository sits at 549 stars and 91 forks since being created on 2026-05-11 (roughly three and a half months), with 10 contributors visible in the commit history, an active Discord, a Product Hunt launch badge, and a maintained docs site — signs of more than a weekend project. GitHub's UI shows 6 open issues, but the real open-issue count via the search API is 3, the difference being open pull requests folded into the raw field.

The caveats are the ones any young security product carries. The self-hosted engine's actual detection quality rests on the bundled Gemma 4 classifier's judgment calls, and beyond the cited third-party research, the project doesn't publish an independently reproduced accuracy number for its own classifier against adversarial or targeted evasion attempts — the kind of stress-testing a mature WAF or intrusion-detection product would have behind it. The managed dashboard is also a separate, presumably monetized product sitting next to the free, self-hostable engine, so "free forever" describes the open-source core rather than the hosted service.

Adrian is aimed at teams shipping LangChain/LangGraph or Claude Code-based agents with real tool access — financial operations, infrastructure, anything where a locally-plausible-looking action can still be the wrong one — who want a runtime layer watching for exactly the failure mode static analysis and network monitoring don't see: an agent doing something harmful for reasons that make sense in isolation.