gfg-adr-detection

A packaged, importable build of ADR Detection from uber/ADR, maintained by Global Fashion Group for internal use and published so it can be installed with pip rather than cloned.

Not affiliated with or endorsed by Uber. This is a modified redistribution under the Apache License 2.0; the original copyright and LICENSE are retained. For the upstream project, its paper and its benchmark, go to github.com/uber/ADR.

⚠️ Not a general-purpose library

ADR Detection is a research artifact that parses hostile input and, in its high-precision tier, spawns a nested agent with permission checks off. Run it in a container, VM or dedicated host — not alongside your application.

Since 0.5.0 the default install is just the detector: four direct dependencies (mcp, openai, PyYAML, numpy) and a closure of roughly 38 packages. The research stack is opt-in, and the CVE-bearing pins upstream documents and accepts under an isolated threat model now live only in those extras:

If you install [benchmark] or [baseline], the old advice applies in full: the == pins will conflict with most other packages, so give it a dedicated virtualenv.

0.9.2

[benchmark]: langgraph 1.2.12 -> 1.2.18 (GHSA-3fx2-cqw9-xr3c, medium), held by a constraint-dependencies floor; langgraph-checkpoint 4.2.0 -> 4.3.1 follows. The wheel and its 38-package runtime closure are identical to 0.9.1. Dependabot reports no open alerts.

0.9.1

Clears every open Dependabot alert, plus five OSV advisories it had not raised.

• Runtime: certifi 2025.7.9 -> 2026.10.23 (PYSEC-2026-4320, not yet a Dependabot alert). Same four runtime dependencies, same 38-package closure.
• [benchmark]: aiohttp 3.14.3 -> 3.14.5 (eight advisories), pillow 12.3.0 -> 13.0.0 (also [corpus]; 41 advisories, five critical), dnspython 2.7.0 -> 2.9.1 and langgraph-sdk 0.4.5 -> 0.4.10 (OSV).
• [baseline]: fsspec 2025.7.0 -> 2026.9.0, setuptools 83.0.0 -> 84.2.1. filelock 3.32.7 -> 4.2.4 (also [benchmark], [dev]).
• [notebook]: nbconvert 7.17.1 -> 7.17.2, tornado 6.5.10 -> 6.6 (OSV).
• [dev]: virtualenv 21.11.0 -> 21.15.1 (15 advisories), black 26.5.1 -> 26.10.1.
• Each is held by a constraint-dependencies floor so a re-resolution cannot walk it back. pip-audit over the full lock, every extra included, reports nothing.

0.9.0

Clears every remaining Dependabot alert.

• Runtime: pyjwt 2.13.0 -> 2.15.1 (via mcp), fixing two high advisories: a BOM bypass and public JWK containers accepted as HMAC secrets. The openai cap widens from <2 to <3; the closure now carries openai 2.54.0. The detector only calls chat.completions.create, which openai 2.0 left unchanged. pydantic 2.11.7 -> 2.13.5 and typing-extensions 4.12.2 -> 4.16.0 follow. Same four runtime dependencies, same 38-package closure.
• [benchmark] moves to LangChain/LangGraph 1.x, where all nine remaining advisories are fixed: langgraph 0.2.60 -> 1.2.12, langgraph-checkpoint 2.1.2 -> 4.2.0, langgraph-sdk 0.1.74 -> 0.4.5, langchain-core 0.3.86 -> 1.6.6, langchain-openai 0.2.14 -> 1.6.7, langchain-anthropic 0.3.1 -> 1.7.5, langchain-google-genai 2.0.8 -> 4.4.0. The langchain meta-package and langchain-text-splitters are no longer dependencies. The vendored AgentDojo react and IsolateGPT agents were ported off the APIs 1.x removed. The typing_extensions==4.12.2 pin is relaxed to >=4.14.
• Also clears four OSV advisories Dependabot had not yet raised: jupyter-server 2.20.0 -> 2.21.1, jupyterlab 4.5.10 -> 4.6.4, notebook 7.5.7 -> 7.6.3 ([notebook]), and pdfminer-six 20250506 -> 20260107 (via markitdown, [corpus]). pip-audit over the full lock, every extra included, now reports nothing.

0.8.1

Clears the remaining non-LangChain Dependabot alerts in the extras and dev tooling: bleach 6.2.0 -> 6.4.0 (two URI-sanitisation advisories, via [notebook]), fonttools 4.58.5 -> 4.65.0 (via matplotlib, [benchmark]), marshmallow 3.26.1 -> 3.26.2 (via nemoguardrails, [benchmark]), mammoth 1.9.1 -> 1.12.2 (via markitdown, [corpus]), and in [dev] pytest 8.4.1 -> 9.1.1 and virtualenv 20.31.2 -> 21.11.0. The runtime closure is unchanged.

The LangChain/LangGraph advisories remain: each is fixed only on the 1.x line, which the frozen AgentDojo harness in [benchmark] cannot run on.

0.8.0

Clears every high and critical advisory in the research extras.

• [baseline] now requires transformers >= 5.10.0 (was 4.57.6). Three advisories against transformers have no fix on the 4.x line. Verified: llamafirewall's scanners initialise on transformers 5.17.0 + torch 2.14.0.
• [benchmark] moves nemoguardrails 0.14.0 -> 0.24.1. Its old fastembed cap was holding pillow below 12 (13 advisories) and huggingface-hub below 1.0 (blocking the transformers fix). It also drops annoy, so no C++ toolchain is needed to install.
• [corpus] no longer depends on standalone fastmcp, which was stuck on 1.0 with five advisories including a critical. The corpus servers now import FastMCP from mcp.server.fastmcp -- the copy bundled with mcp, already a runtime dependency -- which is what 47 of them already did.
• google-cloud-aiplatform 1.71.1 -> 1.165.1.

The default install is unchanged in shape: same four runtime dependencies, same 38-package closure, and that closure now carries no known advisories at any severity.

0.7.0

Security bumps inside the research extras: langchain-core 0.3.28 -> 0.3.86 clears a critical serialization-injection advisory, plus aiohttp, tornado, langsmith, langchain, langchain-community, deepdiff and others. The default install is unchanged -- same four runtime dependencies, same closure.

Breaking in 0.6.0

The import package is guardrail again, not adr_guardrail. 0.4.0 and 0.5.0 shipped adr_guardrail; update imports:

from guardrail.adr_agent.adr_baseline import ADRBaseline   # 0.6.0+

Note that PyPI's unrelated guardrail distribution also ships a top-level guardrail package. Install this alongside it and one will shadow the other with no error, so give this package a dedicated virtualenv.

Breaking in 0.5.0

pip install gfg-adr-detection no longer installs torch, transformers, the LangChain stack, flask, spacy, nltk, opencv-python or ~90 other packages that nothing in the detector imports. Specifically:

• LlamaFirewallBaseline now needs gfg-adr-detection[baseline]. Without it, is_available() returns False and main_detector.py --detector llamafirewall exits with a message. Note that constructing the class directly only logs a warning, so check is_available().
• Reproducing the benchmark from a checkout needs uv sync --extra benchmark.
• Running the corpus MCP servers needs --extra corpus.

What this package changes

Upstream resolves its runtime data relative to __file__, three directories up — which is the source tree in a checkout, and site-packages once installed. The practical effect was that an installed copy discovered zero MCP context providers and silently degraded from two detection tiers to one, with no error. This build fixes that and the related path assumptions:

• context providers resolve from inside the package (ADR_CONTEXT_PROVIDERS_DIR overrides; the original layout is still honoured for source checkouts)
• the reasoning workspace is relocatable via ADR_WORKSPACE_ROOT, instead of being created inside site-packages
• MCP servers launch with sys.executable rather than uv run, which resolved an unrelated environment when installed as a wheel
• the dependency axios is dropped — it is a JavaScript library, and the PyPI project of that name is unrelated to it and to ADR
• the 16 MB benchmark corpus is not shipped, so the source-code context provider is disabled by default (enable_source_code: false)
• the dependency set is split: the detector's own runtime closure is the default install, and the benchmark harness, the LlamaFirewall baseline and the corpus fixtures are extras. Upstream declared all three as hard requirements, so installing the detector pulled ~199 packages to run code that imports four. About 35 of those declarations are imported nowhere in the tree at all.

Install

python -m venv .venv && .venv/bin/pip install gfg-adr-detection

Requires Python 3.10–3.12. For the research extras:

pip install "gfg-adr-detection[benchmark]"   # AgentDojo harness + paper figures
pip install "gfg-adr-detection[baseline]"    # LlamaFirewall comparison (torch)

Use

from guardrail.adr_agent.adr_baseline import ADRBaseline

detector = ADRBaseline(config_data=config, benchmark_type="adr_bench")
verdict = detector.analyze_conversation(messages).to_dict()

config is the parsed config_detector.yaml structure documented upstream. The high-precision tier shells out to the Claude CLI, which refuses to run as root — so give the container an unprivileged user.

Licence

Apache-2.0, as the original. See LICENSE.