IV. Implement

Integrations matrix

Which ATR component each public adoption uses, and the layer it runs in. The classification reads only that entry's own sentence in ADOPTERS.md. If the sentence names no component, the table says so rather than guess.

NeutralEvery adopter is listed by the same rules. No ranking, no recommendation. A merged pull request shows an integration happened. It does not prove the integration is still in use. To correct an entry, edit ADOPTERS.md.

By component

Python engine (pyatr)2

Evaluates rules in process from Python.

python/

Rule YAML5

Rules imported or packaged as they are.

rules/

Converted or ported rules4

Rules translated to another format: YARA, YARA-L, a native scoring engine.

src/converters/

Detection logic, rewritten2

Patterns or templates derived from ATR rules in the adopter's own form.

Test cases as a dataset2

True-positive payloads used as adversarial test data.

rules/

Test scenarios1

Regression scenarios written from ATR rules.

Rule-ID taxonomy1

ATR identifiers and categories used as a threat-intel vocabulary.

Framework mapping4

ATR categories or rules mapped onto a control catalog.

docs/

Event attributes1

Detection fields carried on agent telemetry.

spec/

Directory listing10

Listed as a tool or format; no code consumed.

Not stated in ADOPTERS.md4

The entry does not name the component it uses.

Python engine (pyatr)

python/

Project	Layer	Integration (from ADOPTERS.md)	Evidence
AG2 (AutoGen) tier 2	Runtime guardrail	`ATRGuardrail` contrib capability that scans tool output and LLM input against the ATR ruleset via the `pyatr` engine; contributed to the ag2-classic framework by the ATR maintainer, who agreed to maintain it, and reviewed, amended and merged by AG2 maintainer marklysze
Cisco AI BOM tier 2	Component inventory	`security_enrichment.py` uses pyatr to tag detected skill, prompt, agent and MCP components with MITRE ATLAS technique IDs

Rule YAML

rules/

Project	Layer	Integration (from ADOPTERS.md)
Cisco AI Defense tier 1	Scanner	ATR rule pack merged into the open-source cisco-ai-defense/skill-scanner repository. This describes that repository, not any Cisco product
BerriAI LiteLLM tier 2 · in review	LLM proxy	ATR guardrail integration as a LiteLLM proxy callback; scans LLM input + output against the rule corpus at the proxy layer
Promptfoo tier 2 · in review	Red team and evaluation	MCP red-team output scanning consumes ATR rules to flag adversarial responses in evaluation runs
NVIDIA NeMo Guardrails tier 2 · in review	Runtime guardrail	Agent Threat Rules detection rail for the NeMo Guardrails library
Tencent AI-Infra-Guard tier 2	Runtime guardrail	MCP threat-detection prompt templates covering ATR attack classes, contributed by the ATR maintainer and merged by an AI-Infra-Guard maintainer into the scanner's `data/mcp/` ruleset in its own `prompt_template` schema, with `ATR (Agent Threat Rules)` as the author of each added file

Converted or ported rules

src/converters/

Project	Layer	Integration (from ADOPTERS.md)
Cisco mcp-scanner tier 2 · in review	Scanner	ATR-derived tool_shadowing YARA rule contributed to the Cisco mcp-scanner detection set
rulezet (CIRCL) tier 2	Threat intelligence	`atr_format.py` importer/converter mirroring the existing `sigma_format` module (24 unit tests) — ATR rules are manageable as a first-class format in rulezet
atr-to-yaral tier 2	SIEM / detection content	Converts ATR YAML rules into YARA-L 2.0 rules for Google SecOps (Chronicle), including a real RE2 compile-check gate, Unicode-escape translation, and canary testing against each rule's own test cases
prompt-protection tier 2	Scanner	`prompt-protection/atr` compiles ATR rule packs into the library's own scoring engine and emits the spec ScanResult shape, honouring scan-target, agent-source, status and maturity-lane filtering; conditions it cannot express faithfully are skipped with a reason rather than approximated

Detection logic, rewritten

Project	Layer	Integration (from ADOPTERS.md)	Evidence
Gen Digital Sage tier 1	Other	ATR-derived agent-layer threat patterns contributed to the Sage agentic-AI risk-scoring layer
Splunk security_content tier 2 · in review	SIEM / detection content	Three ATR-derived MCP detections contributed to the Splunk Suspicious MCP Activity analytic story

Test cases as a dataset

rules/

Project	Layer	Integration (from ADOPTERS.md)	Evidence
Microsoft PyRIT tier 2	Red team and evaluation	ATR adversarial-payload dataset loader merged into PyRIT (PR #1715, merged 2026-05-27 by maintainer Roman Lutz). A follow-up AgentThreatRulesScorer (PR #1893) was merged 2026-08-17 and reverted 2026-08-18 by PR #2410; only the dataset loader ships today
OWASP Agentic Skills Top 10 tier 3	Scanner	ATR-to-AST crosswalk and the wild-scan dataset accepted as external references; both PRs merged by project lead kenhuangus

Test scenarios

Project	Layer	Integration (from ADOPTERS.md)	Evidence
OWASP Agent Security Regression Harness tier S	Red team and evaluation	Four ATR-derived regression scenarios contributed to the harness (goal hijack, MCP trust boundary, prompt injection, sensitive-data disclosure). The scenario files carry no ATR attribution upstream, so this is a contribution to the harness rather than a reference to ATR by it

Rule-ID taxonomy

Project	Layer	Integration (from ADOPTERS.md)	Evidence
MISP / CIRCL tier S	Threat intelligence	ATR rule-ID taxonomy + threat-intel galaxy merged into MISP's core distribution

Framework mapping

docs/

Project	Layer	Integration (from ADOPTERS.md)
FINOS Common Cloud Controls tier S	Control catalog	ATR guideline-mappings merged into the Common Cloud Controls catalogue (CN01/CN02/CN04/CN06) with Gemara MappingReference entries
Gemara tier S	Control catalog	ATR detection categories mapped onto Gemara capability-catalog format; the example directory under `examples/ai-agent/` is the project's only worked example. Contributed by ATR, merged by Gemara maintainer jpower432
killertcell428/aigis tier 3	Control catalog	Aigis↔ATR crosswalk — maps Aigis detection patterns to ATR rule IDs through the shared MITRE ATLAS technique axis, with a two-direction ATLAS coverage-gap analysis; merged into the Aigis repo
precize/Agentic-AI-Top10-Vulnerability tier 3	Control catalog	ATR detection mapping across the agentic-AI vulnerability categories in a third-party catalogue

Event attributes

spec/

Project	Layer	Integration (from ADOPTERS.md)	Evidence
OpenTelemetry — semantic-conventions-genai tier S · in review	Observability	Proposal for `agent.threat.detection.*` semantic-convention attributes (which ATR populates on agent spans) is in review

Directory listing

Project	Layer	Integration (from ADOPTERS.md)
IBM AI Atlas Nexus tier S	Other	IBM's AI risk knowledge graph lists Agent Threat Rules as an external reference and as a recommended action ("Use Agent Threat Rules as a supplementary shareable detection layer") in its OWASP Agentic Skills Top 10 linkages. Written and merged by IBM maintainer ingelise — ATR did not open this PR
NVIDIA NeMo Agent Toolkit tier 1	Other	NVIDIA's own README lists `NeMo-Agent-Toolkit-ATR` alongside the Tavily and Redis plugins under the Public Plugin API for Third-Party Tools. Written and merged by NVIDIA maintainer bbednarski9 — ATR did not open this PR
SigmaHQ tier 2	Directory	Cross-listing in the Sigma tools directory; agent-threat-rules listed as a sibling detection-rule format
ottosulin/awesome-ai-security tier 3	Directory	ATR listed in the MCP Security section
CryptoAILab/Awesome-LM-SSP tier 3	Directory	ATR listed in the LLM safety & security awesome-list
wearetyomsmnv/Awesome-LLM-agent-Security tier 3	Directory	ATR listed in the LLM-agent security tooling awesome-list
nibzard/awesome-agentic-patterns tier 3	Scanner	"Deterministic Threat Rule Scanning" pattern accepted, referencing ATR
xlabs-club/awesome-x-ops tier 3	Directory	ATR added to the English and Simplified-Chinese lists by maintainer l10178 — ATR did not open this PR
ProjectRecon/awesome-ai-agents-security tier 3	Directory	ATR listed in the Static Analysis & Linters section
raphabot/awesome-cybersecurity-agentic-ai tier 3	Directory	ATR listed in the Tools section

Not stated in ADOPTERS.md

Project	Layer	Integration (from ADOPTERS.md)
Microsoft Agent Framework tier 2	Runtime guardrail	Sample showing ATR as a deterministic action-boundary validator in the Microsoft Agent Framework
Microsoft Agent Governance Toolkit tier 2	Directory	Example directories in the AGT repository: examples/acs-atr-annotator (an ACS annotator adapter) and examples/atr-import (compiles ATR YAML into ACS manifests and Rego bundles). The rule-pack YAML that earlier example PRs added under examples/atr-community-rules was removed upstream on 2026-07-30, and that directory's weekly sync workflow is pinned to an old ATR release. Contributed by the ATR maintainer and merged by an AGT maintainer; AGT maintainers have since updated these examples in their own refactors (2026-07, 2026-09)
Google ADK tier 2	Runtime guardrail	ATR guardrail plugin documented in Google's official ADK integration catalogue, live at adk.dev/integrations/atr-guardrail/. Contributed by ATR, merged by Google maintainer koverholt
AMD GAIA tier 3	Runtime guardrail	Official GAIA integrations doc — guarding the Lemonade model endpoint with an offline ATR input/output guard (prompt-injection detection pattern)

Page generated 2026-11-10Something wrong or missing? Open an issue