Anomaly Alert
Identify anomalous sessions using Agent Monitor data, cost outliers from the pricing...
Install
npx skills add hoangsonww/Claude-Code-Agent-Monitor --skill anomaly-alert -g -a claude-code -y- Repository
- hoangsonww/Claude-Code-Agent-Monitor1.1k
- Category
- AI and agents
- Updated
- 5d ago
- License
- MIT
- Context cost
- Lightabout 618 tokens
- Runs scripts
- No, instructions only
What it does
Identify anomalous sessions using Agent Monitor data, cost outliers from the pricing engine, token anomalies (cache miss spikes, compaction baseline surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError clusters), behavioral deviations from workflow intelligence (complexity score outliers, error propagation anomalies), and sessions with abnormal metadata (extreme turn_count, high thinking_blocks, zero turn_duration).
Anomaly Alert
Detect anomalous sessions in Claude Code Agent Monitor data.
Input
The user provides: $ARGUMENTS
This may be:
- "all" or empty (default: check all anomaly types)
- "cost" for cost anomalies only
- "duration" for duration anomalies only
- "errors" for error rate anomalies only
- A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ)
Procedure
-
Fetch baseline data from
http://localhost:4820:GET /api/sessions?limit=500, historical sessions for baselineGET /api/analytics, aggregated metricsGET /api/pricing/cost, cost data per session
-
Compute baselines for each metric:
- Mean, median, standard deviation
- P25, P75, P90, P95, P99 percentiles
- Interquartile range (IQR) for robust outlier detection
-
Detect anomalies using statistical thresholds:
Cost Anomalies
- Sessions costing >2σ above mean
- Single sessions exceeding daily average
- Sudden cost spikes (session-over-session increase >200%)
Duration Anomalies
- Sessions lasting >2σ above mean duration
- Extremely short sessions (<1 minute) that still incur cost
- Sessions with unusual active-vs-idle ratios
Error Rate Anomalies
- Sessions with error rates >2σ above baseline
- New error types not seen in previous sessions
- Sessions with >3 consecutive tool failures
Behavioral Anomalies
- Unusual tool combinations not seen before
- Sessions with abnormally high compaction counts
- Model switches mid-session (if unexpected)
- Sessions with no tool usage (pure conversation)
Token Anomalies
- Input/output token ratio far from historical norm
- Cache miss rate significantly higher than average
- Token usage growing faster than session count
