NeMo-Agent-Toolkit-atr

August 4, 2026 · View on GitHub

Agent Threat Rules (ATR) threat detection as a third-party plugin for the NVIDIA NeMo Agent Toolkit.

It registers an atr function group whose atr__inspect function runs the open-source Agent Threat Rules catalog (via the pyatr engine) against tool input and returns a verdict.

What it does

atr__inspect(text, tool_name=None) evaluates text against ATR rules and returns:

{ "action": "allow | log | deny", "matched_rule_ids": ["..."], "max_severity": "critical | high | medium | low | null" }
  • deny — a match at or above a configured deny severity (default: critical, high)
  • log — a match below the deny threshold
  • allow — no match

Use it from a workflow or guardrail step that inspects tool arguments before a tool executes, and acts on the verdict.

Install

This package is not published to PyPI yet. Install it from source:

pip install "git+https://github.com/Agent-Threat-Rule/NeMo-Agent-Toolkit-atr"

It installs alongside nvidia-nat-core (1.8 or newer); the toolkit discovers the plugin through the nat.plugins entry point (nat_atr).

Configure

function_groups:
  atr:
    _type: atr
    deny_severities: ["critical", "high"]
    # rules_dir: /path/to/atr/rules   # optional; defaults to pyatr's bundled rules

This registers the atr__inspect tool.

Status

Verified against released nvidia-nat-core 1.8.0 with pyatr 0.2.7 (Python 3.12), 16 tests passing:

  • Unit tests for the detection core (nat.plugins.atr.detector) over the ATR engine (pyatr), using a fixture rule set.
  • Default-path tests (tests/test_default_rules.py) that build the detector the way a workflow does — no rules_dir — and assert a real rule set loads and that known attack payloads are denied.
  • End-to-end integration tests that load the plugin through NeMo's WorkflowBuilder, resolve the atr__inspect tool, and invoke it (deny on a prompt-injection input, allow on benign input). See tests/.

If rule loading yields nothing, the detector raises EmptyRuleSetError at construction rather than starting up and allowing every input.

The plugin currently exposes ATR as a callable inspection function (a function group). A nat_middleware-based variant that auto-inspects every tool call at the PreInvoke boundary is a planned follow-up (NVIDIA/NeMo-Agent-Toolkit#1959).

Relationship to ATR

ATR is an open detection standard (MIT-licensed). This plugin is a thin adapter: it does not vendor rules — it depends on the published pyatr package and the ATR rule catalog, which are maintained upstream in the agent-threat-rules repository.

License

MIT. See LICENSE.