The library already ships detection rails from a range of providers (ActiveFence, Cisco AI Defense, CrowdStrike AIDR, Trend Micro, Prompt Security, and others). I would like to contribute one for Agent Threat Rules (ATR).
ATR is an open, MIT-licensed detection standard for AI-agent attacks: prompt injection, jailbreak, tool poisoning, MCP attacks, and skill compromise. It is already shipped in Cisco AI Defense and in Microsoft's agent-governance-toolkit. The rule set is distributed as the pyatr PyPI package and runs locally, with no API key or network call.
Proposal: a library/atr/ rail mirroring injection_detection. An @action evaluates the user message against the bundled ATR rules via pyatr and flags matches at or above a configurable severity (default critical/high), with flows.co + flows.v1.co and a test. pyatr would be lazy-imported with a "pip install pyatr" hint, the same optional-dependency pattern as yara for injection_detection, so no hard dependency is added to the package.
The implementation is ready (rail + test + docs + CHANGELOG) and I will open a PR referencing this issue.
The library already ships detection rails from a range of providers (ActiveFence, Cisco AI Defense, CrowdStrike AIDR, Trend Micro, Prompt Security, and others). I would like to contribute one for Agent Threat Rules (ATR).
ATR is an open, MIT-licensed detection standard for AI-agent attacks: prompt injection, jailbreak, tool poisoning, MCP attacks, and skill compromise. It is already shipped in Cisco AI Defense and in Microsoft's agent-governance-toolkit. The rule set is distributed as the pyatr PyPI package and runs locally, with no API key or network call.
Proposal: a library/atr/ rail mirroring injection_detection. An @action evaluates the user message against the bundled ATR rules via pyatr and flags matches at or above a configurable severity (default critical/high), with flows.co + flows.v1.co and a test. pyatr would be lazy-imported with a "pip install pyatr" hint, the same optional-dependency pattern as yara for injection_detection, so no hard dependency is added to the package.
The implementation is ready (rail + test + docs + CHANGELOG) and I will open a PR referencing this issue.