Adrian plugin
A Claude Code plugin that classifies each tool call and the agent's reasoning, then blocks risky ones or asks you first.
- 591 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Tool input and output, messages and the agent's reasoning go to a backend, even if personal data is removed first.
- The plugin can deny a tool call before it runs, and with the backend down it lets everything through.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/adrianDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Tool input and output, messages and the agent's reasoning go to a backend, even if personal data is removed first.
- The plugin can deny a tool call before it runs, and with the backend down it lets everything through.
This is third-party code. Review the repository files before installing.
What it does
Adrian is an open-source runtime security engine for AI agents. The `adrian-cc` plugin for Claude Code intercepts every tool call, sends it to the Adrian backend and receives a verdict: allow, ask the user or deny before it runs. The backend judges the agent's actions and reasoning against what the agent is meant to do. That catches prompt injection, tool poisoning, secret leakage and privilege escalation. A server-side policy sets the mode: ALERT only logs, BLOCK denies risky calls, HITL asks the user right in the terminal.
Who it is for. People who give Claude Code access to working repositories and services and want to see and stop out-of-remit actions.
Good fit when
- The agent reads third-party pages and email, so prompt injection is a risk.
- A team needs a log of tool calls and a dashboard of verdicts.
- A person should approve risky actions right in the terminal.
- Monitoring is deployed on your own infrastructure with the backend from the repository.
Not a fit when
- Session data cannot leave the machine and there is no self-hosted backend.
- Protection must not depend on the network: the plugin needs access to a backend.
- The agent is not Claude Code: this plugin works only there.
Example request
Check with `/adrian-status` whether the Adrian backend is connected and the API key is found.Limitations
Python 3.12 or newer, an Adrian backend (cloud or self-hosted) and an API key are required; Windows also needs Git for Windows. Events reach the backend after personal data is removed (email, phone, card, AWS key and other types), but the calls and the agent's reasoning still leave the machine. A server-side policy sets the blocking mode, not the plugin, so behavior depends on backend settings. With the backend unavailable the plugin lets calls through.
How to disable. Disable or remove the `adrian-cc` plugin from the `/plugin` menu in Claude Code and delete the API key from `~/.adrian/.env`. Stop a self-hosted backend separately.
FAQ
How do I install the plugin?
In Claude Code run `/plugin marketplace add secureagentics/Adrian`, then `/plugin install adrian-cc@adrian` and `/adrian-init`. The wizard picks a backend, creates `~/.adrian/.env` and verifies the connection.
Where does the API key go?
Into `~/.adrian/.env`. It is never pasted into the chat: `/adrian-init` asks you to put it in the file.
What happens if the backend is unavailable?
The plugin lets calls through. It runs fail-open, so protection is off for that time.
What data goes to the server?
Call events: tool input and output, messages and the agent's reasoning. Before sending, the plugin strips email, phone, card number, AWS key and other personal data, and this cannot be turned off.
How do I update the plugin?
With `/plugin marketplace update adrian` in Claude Code.
Discussion
No questions or reviews yet.
Related
PluginsA Claude Code plugin that screens prompts, tool calls and documents for injection and leaks, returning BLOCK, CHALLENGE or ALLOW
Agent Governance Toolkit
Agent Governance Toolkit (Claude Code plugin)
A Microsoft plugin for Claude Code whose hooks inspect prompts and tool calls against a policy and block dangerous commands.
Security hook for coding agents: scores each tool call with session context and flags injections in results and skills
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
Claude Hooks (Prompt Injection Defender)
Claude Hooks
A Claude Code hook that scans file, web page and command output for hidden instructions and warns the agent
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Adrian (this card) | no | 591 | |
| HOL Guard | yes | 1,094 | checks commands and calls on the machine itself; Adrian judges calls and agent reasoning on a backend |
| Destructive Command Guard | no | 6,349 | a rule-based hook against dangerous commands; Adrian classifies any tool call and can ask for approval |
README in short
Claude Code has a ready plugin, and the repository holds SDKs for other setups. The Go backend lives in the same repository, so it can be self-hosted.